テーマ： nfs
-
Hardening NFS exports: network scope, squash options and sec=krb5 instead of AUTH_SYS
The default NFS authentication (AUTH_SYS) trusts whatever UID a client claims. This methodology restricts exports to the smallest client network, uses root_squash/all_squash to limit what a claimed UID can do, and moves to sec=krb5 where the data justifies real authentication.
-
Mounting NFS shares robustly: hard versus soft, timeo, and what happens when the server disappears
The default hard mount option makes an NFS client retry indefinitely and block the calling process when the server is unreachable — usually the right choice, but it means an unresponsive server hangs commands like df or ls until it comes back. x-systemd.automount or nofail keep an unreachable server from hanging the boot.
-
Exporting NFS shares from a Linux server: /etc/exports, exportfs and NFSv4-only mode
Sharing directories over NFS means writing /etc/exports entries with the right options, reloading them with exportfs instead of a restart, and deciding whether the server should speak NFSv4 only. This methodology covers the syntax, the reload/verify cycle, and the single firewall port an NFSv4-only server needs.
機械可読： JSON