2022年9月27日 星期二

CentOS 安裝 NFS Server

[環境]

三台 CentOS 7：
NFS Server (192.168.0.10)
Client (192.168.0.2)
Client (192.168.0.3)


[目的]

NFS Server (192.168.0.10) 建立兩個資料夾(/home/nfsA、/home/nfsB)，
開放給兩個 Client(192.168.0.2、192.168.0.3) 存取。


[步驟]

  • NFS Server
    1. 安裝 NFS
      $ yum install nfs-utils
    2. 建立要分享的資料夾
      $ mkdir /home/nfsA
$ mkdir /home/nfsB
    3. 編輯設定檔，加入兩個要分享的資料夾，並設定兩個 Client(192.168.0.2、192.168.0.3) 有存取權限。
      $ vi /etc/exports
      設定檔內容
      /home/nfsA 192.168.0.2(rw,sync,no_root_squash,no_all_squash,no_subtree_check) 192.168.0.3(rw,sync,no_root_squash,no_all_squash,no_subtree_check)
/home/nfsB 192.168.0.2(rw,sync,no_root_squash,no_all_squash,no_subtree_check) 192.168.0.3(rw,sync,no_root_squash,no_all_squash,no_subtree_check)
      注意：
      設定值 rw,sync,no_root_squash,no_all_squash,no_subtree_check，
      請依個人環境需求設定，可用的設定值、效果，可用 man exports 查看。 
      $ man exports
.....
rw     Allow both read and write requests on this NFS volume.
       The default is to disallow any request which changes the filesystem.
       This can also be made explicit by using the ro option.
.....
sync   Reply to requests only after the changes have been committed to stable storage (see async above).
       In  releases  of nfs-utils up to and including 1.0.0, the async option was the default.
       In all releases after 1.0.0, sync is the default, and async must be explicitly requested if needed.
       To help make system administrators aware of this change, exportfs will issue a warning if neither sync nor async is specified.
.....
no_subtree_check
       This option disables subtree checking, which has mild security implications, but can improve reliability in some circumstances.

       If a subdirectory of a filesystem is exported, but the whole filesystem isn't then whenever a NFS request arrives,
       the server must check not only that  the  accessed  file  is  in  the  appropriate filesystem (which is easy) but also that it is in the exported tree (which is harder).
       This check is called the subtree_check.

       In  order  to  perform  this  check, the server must include some information about the location of the file in the "filehandle" that is given to the client.
       This can cause problems with accessing files that are renamed while a client has them open (though in many simple cases it will still work).

       subtree checking is also used to make sure that files inside directories to which only root has access can only be accessed if the filesystem is exported with no_root_squash (see  below),  even  if
       the file itself allows more general access.

       As  a  general guide, a home directory filesystem, which is normally exported at the root and may see lots of file renames,
       should be exported with subtree checking disabled.  A filesystem which is mostly readonly,
       and at least doesn't see many file renames (e.g. /usr or /var) and for which subdirectories may be exported, should probably be exported with subtree checks enabled.

       The default of having subtree checks enabled, can be explicitly requested with subtree_check.

       From release 1.1.0 of nfs-utils onwards, the default will be no_subtree_check as subtree_checking tends to cause more problems than it is worth.
       If you  genuinely  require  subtree  checking,  you should explicitly put that option in the exports file.
       If you put neither option, exportfs will warn you that the change is pending.
.....
root_squash
       Map requests from uid/gid 0 to the anonymous uid/gid.
       Note that this does not apply to any other uids or gids that might be equally sensitive,
       such as user bin or group staff.
       (client 端使用 root 操作掛載的目錄時，NFS Server 會將 client 端的 root 對應成 NFS Server 上的匿名帳號)
no_root_squash
       Turn off root squashing. This option is mainly useful for diskless clients.

all_squash
       Map all uids and gids to the anonymous user.
       Useful for NFS-exported public FTP directories, news spool directories, etc.
       The opposite option is no_all_squash, which is the default setting.
    4. 啟動服務
      $ systemctl enable rpcbind
$ systemctl enable nfs-server
$ systemctl enable nfs-lock
$ systemctl enable nfs-idmap
$ systemctl start rpcbind
$ systemctl start nfs-server
$ systemctl start nfs-lock
$ systemctl start nfs-idmap
    5. 開放防火牆
      $ firewall-cmd --permanent --zone=public --add-service=nfs
$ firewall-cmd --permanent --zone=public --add-service=mountd
$ firewall-cmd --permanent --zone=public --add-service=rpc-bind
$ firewall-cmd --reload
$ firewall-cmd --list-all --zone=public
  • Client
    1. 安裝 nfs-utils、libnfsidmap，啟動 rpcbind
      $ yum install nfs-utils libnfsidmap
$ systemctl enable rpcbind
$ systemctl start rpcbind
    2. 掛載 NFS Server 資料夾
      • 方法1：手動掛載
        $ mkdir /mnt/nfsA
$ mkdir /mnt/nfsB
$ showmount -e 192.168.0.10
$ mount -t nfs 192.168.0.10:/home/nfsA /mnt/nfsA
$ mount -t nfs 192.168.0.10:/home/nfsB /mnt/nfsB
      • 方法2：使用 autofs 自動掛載
        [安裝 autofs]
        $ yum install autofs
$ systemctl enable autofs.service

        [建立新檔案 /etc/auto.mymnt-nfsA，裡面寫掛載 192.168.0.10:/home/nfsA/ 的語法]
        $ vi /etc/auto.mymnt-nfsA
        檔案內容
        * -rw,bg,soft,rsize=32768,wsize=32768 192.168.0.10:/home/nfsA/&

        [建立新檔案 /etc/auto.mymnt-nfsB，裡面寫掛載 192.168.0.10:/home/nfsB/ 的語法]
        $ vi /etc/auto.mymnt-nfsB
        檔案內容
        * -rw,bg,soft,rsize=32768,wsize=32768 192.168.0.10:/home/nfsB/&


        [建立新檔案 /etc/auto.master.d/mymnt.autofs，裡面寫上面兩個掛載語法，要掛載到哪個路徑]
        $ vi /etc/auto.master.d/mymnt.autofs
        檔案內容
        /mnt/nfsA /etc/auto.mymnt-nfsA
/mnt/nfsB /etc/auto.mymnt-nfsB


        [重啟 autofs]
        $ systemctl restart autofs

        [掛載語法說明(以 /etc/auto.mymnt-nfsA 內容為例)]
        * -rw,bg,soft,rsize=32768,wsize=32768 192.168.0.10:/home/nfsA/&
        最前面的「*」，表示 client 端 /mnt/nfsA 下的所有目錄
        最後面的「&」，表示 NFS Server 的 192.168.0.10:/home/nfsA 底下所有目錄
        「&」對應到「*」
        例如：192.168.0.10:/home/nfsA/abc 會掛載成 client 端的 /mnt/nfsA/abc




參考：

張貼者： 於
標籤：

沒有留言:

張貼留言

訂閱： 張貼留言 (Atom)