Setting up an NFS server

This page documents configuring Network File System (NFS) on both server and client side including autofs and Kerberos authentication.

Installation

Install the following package for both NFS client and NFS server service.

# apk add nfs-utils

Configuration

Setting up NFS service on Alpine Linux is no different from other Linux distributions.

NFS server

Setup export dirs in /etc/exports on your server with IP address 10.10.10.1. For example:

Contents of /etc/exports

/data 10.10.10.0/24(rw,nohide,no_subtree_check,no_root_squash)    

After editing /etc/exports, reload your setting:

# exportfs -afv

To make NFS server service to autostart on boot:

# rc-update add nfs

To start NFS server service now:

# rc-service nfs start

NFS client

To mount NFS shares automatically, an entry needs to made to /etc/fstab as follows:

Contents of /etc/fstab

10.10.10.1:/data /mount/point nfs4 rw,_netdev 0 0

To mount nfs share from /etc/fstab file at booting of the system:

# rc-update add nfsmount

To mount the nfs shares from /etc/fstab file now:

# rc-service nfsmount start

You can check your boot services:

# rc-status

Tip: netmount is a general service for all network-based filesystems, while nfsmount is specifically tailored for NFS.

To use netmount, here are the equivalent commands:

# rc-service netmount start # rc-update add netmount

Using autofs

Autofs is another alternative for mounting filesystems like NFS. Autofs aims to provide on-demand mounting and race free automatic unmounting of various other filesystems.

Ensure that autofs package is installed, if not installed already.

apk add autofs

Add an entry in the file /etc/auto.master that points to a map file to define the mount points for the /mnt/nfs directory.. For example:

Contents of /etc/auto.master

/mnt/nfs /etc/auto.nfs --timeout=60

Create the Map File /etc/auto.nfs that maps the NFS share 10.10.10.1:/data to /mnt/nfs/share as follows:

Contents of /etc/auto.nfs

share -rw 10.10.10.1:/data

Start and Enable autofs:

# rc-update add autofs # rc-service autofs start

Eventhough autofs is primarily a client-side tool it can also be used on servers for dynamic mounting if required. For an use case of using Autofs on servers, refer to Sharing a Disk page.

Kerberos authentication

By default, NFS security only validates the IP of the client. You can add user level authentication with a Kerberos authentication protocol. The choices are:

MIT KRB5 available in krb5 package
Heimdal available in heimdal package

Note: It is recommended to have the same Kerberos flavor across the network as both implementations are not completely mutually compatible.

The example given below uses MIT KRB5 syntax. So install the server package krb5-server on server and krb5 package for client machines.

Server configuration

Assuming you setup Kerberos in the in the network, create ticket to your NFS machine :

# kadmin: addprinc -randkey nfs/nfs1.example.com@EXAMPLE.COM

And add it to the machines krb5.keytab file:

# kadmin: ktadd nfs/nfs1.example.com@EXAMPLE.COM

Then, edit your /etc/exports, and add sec=krb5 (only authentication), sec=krb5i (also hmac signing) or sec=krb5p (also encryption). For example:

Contents of /etc/exports

/data 10.10.10.0/24(rw,nohide,no_subtree_check,sec=krb5p,no_root_squash)    

After editing /etc/exports, reload your setting

# exportfs -afv

User id mapping is managed by nfsidmap utility from nfs-utils package.

Client configuration

In order for the client to connect to NFS via kerberos, enable and start rpc.gssd service.

# rc-update add rpc.gssd

# rc-service rpc.gssd start