File Systems, NFS and AutofsLesson 2 of 4

Using NFS shares: mount manually and permanently

See what a server exports, mount it by hand, make the mount permanent, and set up a throwaway server on one machine to practise.

mount -t nfs
showmount
nfs-utils
exportfs
/etc/exports
nfsstat -m
findmnt -t nfs4
_netdev

45 min5 exercises

After this lesson you can

Explain what NFS is for and how a client addresses a share as server:/path.
List a server's exports, mount one, and make it permanent in /etc/fstab with suitable options.
Build a single-machine NFS server for practice and diagnose the common failures.

The idea

NFS (Network File System) lets a machine mount a directory that lives on another machine, so users see one tree. Many hosts can share home directories, software or data. The server exports a directory; the client mounts it. The address of a share is server:/exported/path, with the colon.

Parts and where they live:

Piece	Where	Notes
Package	`nfs-utils` (client and server)	Provides `mount.nfs`, `showmount`, the server
Server service	`nfs-server`	Reads `/etc/exports`
Export list	`/etc/exports`	`PATH CLIENT(options)`
Port	TCP 2049	NFSv4 needs only this one; firewall service name `nfs`
Default version	NFSv4.x	`vers=4.2` negotiated automatically

An export line decides who can mount and how:

/srv/share  192.168.122.0/24(rw,sync)

rw or ro; sync replies after data reaches disk (safe default); no_root_squash lets the client’s root act as root on the share (avoid it); by default root is squashed to the unprivileged user nobody. After editing, run exportfs -ra to re-read the file; exportfs -v shows what is active.

Permissions travel as numbers

With the default sec=sys, the server trusts the numeric UID and GID sent by the client. If alex is UID 1001 on the client but UID 1002 on the server, he acts as the wrong person. So home-directory and data sharing needs consistent UIDs across machines (central accounts, or matching useradd -u). When a share looks owned by a number such as 1001 or nobody, that mismatch is the cause.

The client side

Task	Command
See what a server exports	`showmount -e server`
Mount once	`mount -t nfs server:/path /mountpoint`
Show mounts and their options	`findmnt -t nfs4`, `nfsstat -m`
Mount at boot	fstab line below
Unmount	`umount /mountpoint`

server:/srv/share  /mnt/nfs  nfs  rw,_netdev,nofail  0  0

_netdev marks the mount as needing the network, so it is attempted after networking is up. nofail stops a missing server from blocking the boot. Network mounts do not use fsck, so the last field is 0.

Try it

sudo dnf install -y nfs-utils
sudo mkdir -p /srv/share && echo hi | sudo tee /srv/share/hello.txt
echo '/srv/share 192.168.122.0/24(rw,sync)' | sudo tee -a /etc/exports
sudo systemctl enable --now nfs-server
sudo exportfs -ra
sudo firewall-cmd --permanent --add-service=nfs
sudo firewall-cmd --reload
sudo exportfs -v

/srv/share    	192.168.122.0/24(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,root_squash,no_all_squash)

Note root_squash in the list: the default. On a host with SELinux enforcing, the standard NFS booleans already allow exporting; the client needs use_nfs_home_dirs only if home directories come from NFS.

showmount -e node1
sudo mkdir -p /mnt/nfs
sudo mount -t nfs node1:/srv/share /mnt/nfs
cat /mnt/nfs/hello.txt
findmnt -t nfs4

Export list for node1:
/srv/share 192.168.122.0/24
hi
TARGET   SOURCE            FSTYPE OPTIONS
/mnt/nfs node1:/srv/share  nfs4   rw,relatime,vers=4.2,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,clientaddr=192.168.122.12,local_lock=none,addr=192.168.122.11

Read the options: vers=4.2, hard (retry forever if the server disappears, so applications hang rather than lose data), sec=sys (UID trust), addr (the server).

Make it permanent

echo 'node1:/srv/share /mnt/nfs nfs rw,_netdev,nofail 0 0' | sudo tee -a /etc/fstab
sudo systemctl daemon-reload
sudo umount /mnt/nfs
sudo mount -a
findmnt /mnt/nfs

When it does not work

Symptom	Cause	Fix
`showmount` or `mount` hangs, then `Connection timed out`	Firewall on the server (port 2049 / rpc services)	`firewall-cmd --add-service=nfs --permanent` and reload
`access denied by server while mounting`	Path not exported, or client not in the allowed list	Check `exportfs -v`, then `exportfs -ra`
`Name or service not known`	Client cannot resolve the server	`getent hosts node1`, fix DNS or `/etc/hosts`
`Permission denied` writing	UID mismatch or server directory mode	`ls -ln` on both sides; fix ownership on the server
`Stale file handle`	The export was removed or recreated	`umount -f`, remount
Shell hangs after the server died	`hard` mount waiting for the server	Restore the server, or `umount -f -l`

Going further

mount -o vers=3 forces NFSv3 (needs rpcbind and extra firewall ports). sec=krb5p adds Kerberos authentication and encryption. The soft option returns an I/O error instead of waiting forever, at the risk of corrupting writes; keep hard for data you care about. x-systemd.automount or autofs (next lesson) avoids having every share mounted all the time. exportfs -u removes a single export, and nfsstat gives client and server counters. The server’s own SELinux booleans (nfs_export_all_rw, nfs_export_all_ro) control exports, while use_nfs_home_dirs is the client-side one for home directories.

Practice

0 of 5 done

Do these on your own system. They get harder. Check each result, then tick it off.

Warm-upDone
Build a practice NFS server
On node1, install nfs-utils, create /srv/share with a file hello.txt in it, export it read-write to your lab network (for example 192.168.122.0/24; use your own subnet), start the NFS server at boot, and open the firewall.
Check your result
sudo exportfs -v lists /srv/share. systemctl is-active nfs-server is active. firewall-cmd --list-services includes nfs.
Hint
/etc/exports line: /srv/share 192.168.122.0/24(rw,sync). Then exportfs -ra, systemctl enable --now nfs-server, firewall-cmd --permanent --add-service=nfs && firewall-cmd --reload.
Solution
```
sudo dnf install -y nfs-utils
sudo mkdir -p /srv/share && echo hi | sudo tee /srv/share/hello.txt
echo '/srv/share 192.168.122.0/24(rw,sync)' | sudo tee -a /etc/exports
sudo systemctl enable --now nfs-server
sudo exportfs -ra
sudo firewall-cmd --permanent --add-service=nfs
sudo firewall-cmd --reload
sudo exportfs -v
```
PracticeDone
Mount a share by hand
From node2 (or the same machine if you only have one), list what node1 exports, create /mnt/nfs, mount node1:/srv/share there, read the file, and unmount it.
Check your result
showmount -e node1 lists /srv/share. cat /mnt/nfs/hello.txt prints hi. findmnt -t nfs4 /mnt/nfs shows it while mounted and nothing after umount.
Hint
sudo mount -t nfs node1:/srv/share /mnt/nfs. Install nfs-utils on the client too.
Solution
```
sudo dnf install -y nfs-utils
showmount -e node1
sudo mkdir -p /mnt/nfs
sudo mount -t nfs node1:/srv/share /mnt/nfs
cat /mnt/nfs/hello.txt
findmnt -t nfs4 /mnt/nfs
sudo umount /mnt/nfs
```
PracticeDone
Mount it at every boot
Make the mount permanent via /etc/fstab so it is mounted at boot, and use the options rw,_netdev,nofail. Test with mount -a, then reboot and confirm it is mounted.
Check your result
grep nfs /etc/fstab shows node1:/srv/share /mnt/nfs nfs rw,_netdev,nofail 0 0. After the reboot findmnt /mnt/nfs lists it.
Hint
NFS entries are server:/export mountpoint nfs options 0 0. _netdev makes systemd wait for the network, nofail keeps boot going if the server is down.
Solution
```
echo 'node1:/srv/share /mnt/nfs nfs rw,_netdev,nofail 0 0' | sudo tee -a /etc/fstab
sudo systemctl daemon-reload
sudo mount -a
findmnt /mnt/nfs
sudo reboot
# after the reboot
findmnt /mnt/nfs
```
PracticeDone
Why can't I write to the share?
As a normal user on the client, try to create a file in /mnt/nfs. If it is refused, explain why using the owner of the directory on the server and the user IDs involved, and fix it on the server so the user alex can write.
Check your result
touch /mnt/nfs/a fails with Permission denied while the directory is owned by root:root mode 755 on the server. After chown alex /srv/share on the server (same UID on both hosts), the touch works.
Hint
NFS (with sec=sys) trusts the numeric UID from the client. The names must resolve to the same numbers on both machines. root is squashed to nobody by default.
Solution
```
# on the client, as alex
touch /mnt/nfs/a
id alex
# on the server
id alex
sudo chown alex /srv/share
# on the client again
touch /mnt/nfs/a && ls -ln /mnt/nfs
```
ChallengeDone
The mount hangs or fails: find out why
Break the setup three ways, one at a time, and write down the symptom and fix for each: stop the firewall service on the server (rule removed), un-export the path, and use a wrong server name. Use showmount -e, rpcinfo -p, ping, and journalctl on the client and server to locate each fault.
Check your result
Closed firewall: mount hangs and then Connection timed out. Not exported: access denied by server while mounting. Wrong name: Name or service not known.
Hint
Work outward: name resolves? host reachable? port 2049 open? path exported? permission on the export?
Solution
```
getent hosts node1
ping -c1 node1
showmount -e node1
sudo firewall-cmd --list-services       # on the server
sudo exportfs -v                         # on the server
sudo mount -t nfs node1:/srv/share /mnt/nfs; echo $?
```

The idea

Permissions travel as numbers

The client side

Try it

Make it permanent

When it does not work

Going further

Build a practice NFS server

Mount a share by hand

Mount it at every boot

Why can't I write to the share?

The mount hangs or fails: find out why