Tema: nfs
-
Hardening NFS exports: network scope, squash options and sec=krb5 instead of AUTH_SYS
The default NFS authentication (AUTH_SYS) trusts whatever UID a client claims. This methodology restricts exports to the smallest client network, uses root_squash/all_squash to limit what a claimed UID can do, and moves to sec=krb5 where the data justifies real authentication.
-
Montar recursos compartidos NFS de forma robusta: hard frente a soft, timeo, y qué ocurre cuando el servidor desaparece
La opción de montaje predeterminada hard hace que un cliente NFS reintente indefinidamente y bloquee el proceso llamante cuando el servidor no está accesible —normalmente la elección correcta, pero significa que un servidor que no responde deja colgados comandos como df o ls hasta que vuelve. x-systemd.automount o nofail evitan que un servidor inaccesible deje colgado el arranque.
-
Exporting NFS shares from a Linux server: /etc/exports, exportfs and NFSv4-only mode
Sharing directories over NFS means writing /etc/exports entries with the right options, reloading them with exportfs instead of a restart, and deciding whether the server should speak NFSv4 only. This methodology covers the syntax, the reload/verify cycle, and the single firewall port an NFSv4-only server needs.
Legible por máquina: JSON