Re: NFS root only access -

["George N. White III" <gnwiii@xxxxxxxxx>]

On Tue, 10 Dec 2019 at 15:35, Bob Goodwin <bobgoodwin@xxxxxxxxxxx> wrote:

On 2019-12-10 11:17, Patrick O'Callaghan wrote:
>> *Dunno where to look?*
> $ grep bobg /etc/passwd
>
> poc

.

Client -

[root@Workstation-1 bobg]# grep bobg /etc/passwd
bobg:x:1000:1000:Bob Goodwin:/home/bobg:/bin/bash

[root@Workstation-1 bobg]# grep root /etc/passwd
root:x:0:0:root:/root:/bin/bash

server-

[root@NFS-Server bobg]# grep bobg /etc/passwd
bobg:x:1000:1000:Bob Goodwin:/home/bobg:/bin/bash

[root@NFS-Server bobg]# grep root /etc/passwd
root:x:0:0:root:/root:/bin/bash
operator:x:11:0:operator:/root:/sbin/nologin


If this is a problem, I really don't know what it should be? It appears
they are the same on the server as on the client

Confusion prevails here, that is for me ...

It isn't just you, colleagues at work often struggle with NFS configuration. 

I'm impressed by the patience and dedication shown by members
of this list for your NFS problems, but I'm also concerned
that the ensuing discussion rushed to solve the original problem, but
leaves you no further ahead when a similar issue crops up in the future.  

Give a person a configuration file and their system works for a while,
but show a person where to find the documentation and they have
configurations for life.

NFS has been around since 1984 (https://en.wikipedia.org/wiki/Network_File_System)

and is widely used on BSD, MacOS, and linux systems.  There are now many
alternative file-sharing mechanisms.   For a given use case it is not always
easy to know which sharing system is most appropriate.

Some keys things to understand about NFS are:

1) the server accepts the client systems validation of user credentials, based on

the UID and GID not the username used on the client.   As a side note, the "id"

command is an easy way to get UID and GID:

Example from a debian system:

$ id seadas
uid=1001(seadas) gid=1001(seadas) groups=1001(seadas),4(adm),27(sudo)

Example from a fedora system:

$ id seadas
uid=1001(seadas) gid=1001(seadas) groups=1001(seadas),4(adm),10(wheel),11(cdrom)

2)  it is clearly important that the server connect to the intended client (rather than some random IOT device that

has been configured by a hacker to use the hostname of your client).   DNS can't be trusted, so some systems

require the client to be configured in the hosts file. 

3)  file permissions and ACL's from the server's exported filesystem are honoured by clients.   Additional

controls can be applied in the /etc/exports file.

4)  NFS relies on a multiple services.   There are corresponding tools to query the status of various services.

Many linux distros have documentation on NFS configuration.   RHEL docs are often more complete than those

for fedora, so you might find the following helpful:

RHEL 8 Exporting NFS shares

If you can find time to review this while the steps you have taken are fresh in your mind, you should

find things less confusing, and have some idea of how to proceed next time you need to configure

NFS.

--

George N. White III

_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx