Mercurial > hg > Blog
comparison content/Linux/nfs.md @ 63:9693693301f2
add blog post on NFS server
| author | Dirk Olmes <dirk@xanthippe.ping.de> |
|---|---|
| date | Thu, 30 Jul 2015 07:32:04 +0200 |
| parents | |
| children | 1d9382b0329b |
comparison
equal
deleted
inserted
replaced
| 62:3fd13e528c93 | 63:9693693301f2 |
|---|---|
| 1 Title: NFS setup | |
| 2 Date: 2015-07-30 | |
| 3 Lang: en | |
| 4 | |
| 5 I'm planning to put my [Raspberry Pi](https://www.raspberrypi.org/) back to use. I have always disliked its dependency on SD memory cards so I'm planning to put the Pi's root filesystem on NFS. The Pi side will be a topic for another blog post later, first I'll have to setup an NFS server on my main [Gentoo](https://www.gentoo.org) machine. | |
| 6 | |
| 7 The main NFS setup is described [on the Gentoo wiki](https://wiki.gentoo.org/wiki/NFS) in sufficient detail. I had a bit of a headache getting NFS through my [Shorewall](http://www.shorewall.net/) based firefall, though. There is a good section on NFS security in the [NFS-HOWTO](http://tldp.org/HOWTO/NFS-HOWTO/security.html) which describes all the necessary bits. And the Gentoo config files have all the required settings in their comments, too. It turns out that all you have to do is to put some configuration into place and the NFS server will play nicely with the firewall: | |
| 8 | |
| 9 In `/etc/sysctl.conf` these settings: | |
| 10 | |
| 11 fs.nfs.nlm_tcpport = 4001 | |
| 12 fs.nfs.nlm_udpport = 4001 | |
| 13 | |
| 14 In `/etc/conf.d/nfs` enable these settings: | |
| 15 | |
| 16 OPTS_RPC_MOUNTD="-p 32767" | |
| 17 OPTS_RPC_STATD="-p 32765 -o 32766" | |
| 18 | |
| 19 Now all NFS daemons should be locked down to specific ports so you can add appropriate shorewall rules: | |
| 20 | |
| 21 ACCEPT loc fw tcp 111 # portmapper | |
| 22 ACCEPT loc fw udp 111 | |
| 23 ACCEPT loc fw tcp 2049 # rpc.nfsd | |
| 24 ACCEPT loc fw udp 2049 | |
| 25 ACCEPT loc fw tcp 4001 # kernel lockd | |
| 26 ACCEPT loc fw udp 4001 | |
| 27 ACCEPT loc fw tcp 32765:32767 | |
| 28 ACCEPT loc fw udp 32765:32767 | |
| 29 | |
| 30 Restart the nfs service and the firewall. Now clients on the local network should be able to mount shares over NFS. |