Network File System (NFS), File Permissions and ACLs

Network File System (NFS) in Red Hat Enterprise Linux (RHEL)

Introduction to NFS

Network File System (NFS) is a distributed file system protocol that allows a computer to access files over a network as if they were on its local disks. Developed by Sun Microsystems in 1984, NFS enables users to mount remote directories on their system and interact with them as though they are local.

Benefits of NFS

• Centralized Data Management: Simplifies the management of files by keeping them on a central server.
• Resource Sharing: Allows multiple clients to share data, eliminating the need for duplicate copies on each client machine.
• Scalability: Suitable for large-scale environments with numerous clients and servers.
• Flexibility: Supports various configurations and is compatible with different operating systems.

NFS Versions

• NFSv2: The original version, limited in features and performance.
• NFSv3: Introduced improvements such as support for large file sizes and asynchronous writes.
• NFSv4: Enhanced security features, improved performance, and stateful protocol capabilities.
• NFSv4.1: Added parallel NFS (pNFS) for better performance and scalability.

NFS Architecture

Components:

• NFS Server: The system that shares the directory.
• NFS Client: The system that mounts the shared directory.
• RPC (Remote Procedure Call): Used by NFS to communicate between the server and clients.
• Mount Protocol: Helps clients mount the NFS file systems.
• Portmap Service: Maps RPC program numbers to network port numbers.

Configuring NFS on RHEL

Prerequisites:

• Ensure that NFS packages are installed.
• Proper network setup between the server and clients.
• Properly configured firewalls and SELinux settings.

Installing NFS Packages:

sudo yum install nfs-utils

NFS Server Configuration:

1. Creating the Shared Directory:

sudo mkdir -p /srv/nfs/shared

sudo chown nfsnobody:nfsnobody /srv/nfs/shared

sudo chmod 755 /srv/nfs/shared

2. Configuring Exports:
   • Edit the /etc/exports file to define the shared directories and their permissions.

sudo vi /etc/exports

2. Add an entry for the shared directory:

/srv/nfs/shared 192.168.1.0/24(rw,sync,no_root_squash)

3. Starting and Enabling NFS Services:

sudo systemctl start nfs-server

sudo systemctl enable nfs-server

4. Exporting the Shared Directory:

sudo exportfs -rav

5. Opening Firewall Ports:

sudo firewall-cmd –permanent –add-service=nfs

sudo firewall-cmd –permanent –add-service=mountd

sudo firewall-cmd –permanent –add-service=rpc-bind

sudo firewall-cmd –reload

NFS Client Configuration:

1. Installing NFS Packages:

sudo yum install nfs-utils

2. Creating a Mount Point:

sh

Copy code

sudo mkdir -p /mnt/shared

3. Mounting the NFS Share:

sudo mount -t nfs 192.168.1.100:/srv/nfs/shared /mnt/shared

4. Automating Mounting at Boot:
   • Add an entry to /etc/fstab:

192.168.1.100:/srv/nfs/shared /mnt/shared nfs defaults 0 0

NFS Security Considerations

Firewall Configuration:

• Ensure necessary ports are open (NFS, RPC, mountd).

SELinux Configuration:

• Ensure SELinux policies are properly set to allow NFS.
• To label a directory for NFS sharing:

sudo semanage fcontext -a -t nfs_t “/srv/nfs/shared(/.*)?”

sudo restorecon -R /srv/nfs/shared

Access Control:

• Use /etc/exports to control which clients can access the NFS share and with what permissions.
• Example /etc/exports entry:

/srv/nfs/shared 192.168.1.0/24(rw,sync,no_root_squash)

Authentication and Encryption:

• Kerberos Authentication: Use Kerberos for secure authentication.
  • Ensure Kerberos is installed and configured on both server and client.
  • Edit /etc/exports for Kerberos authentication:

/srv/nfs/shared 192.168.1.0/24(rw,sync,sec=krb5p)

NFS Performance Tuning

Server-side Tuning:

• Asynchronous Writes: Enable asynchronous writes for better performance:

echo “options nfs nfs_max_async_write=64” >> /etc/modprobe.d/nfs.conf

• NFS Threads: Increase the number of NFS server threads to handle more client requests:

sudo vi /etc/sysconfig/nfs

# Set value of RPCNFSDCOUNT (e.g., RPCNFSDCOUNT=16)

Client-side Tuning:

• Mount Options:
  • Use options like rsize, wsize, timeo, and retrans for optimal performance.

sudo mount -t nfs -o rsize=8192,wsize=8192,timeo=14,retrans=3 192.168.1.100:/srv/nfs/shared /mnt/shared

Network Configuration:

• Ensure the network is optimized for NFS traffic, with adequate bandwidth and low latency.

Troubleshooting NFS

Common Issues:

• Permission Denied: Check /etc/exports and ensure the client IP is allowed. Verify permissions on the shared directory.
• Mount Failure: Ensure the NFS server is running, and the firewall and SELinux configurations allow NFS traffic.
• Performance Issues: Investigate network latency, NFS server load, and client mount options.

Log Files:

• Check relevant log files for errors:
  • Server logs: /var/log/messages or /var/log/syslog
  • Client logs: /var/log/messages or /var/log/syslog

NFS Commands for Troubleshooting:

• Show current NFS mounts:

showmount -e server_ip

• Check NFS status:

systemctl status nfs-server

Conclusion

NFS is a powerful and flexible solution for network file sharing in RHEL environments. Understanding its architecture, configuration, security, and performance tuning can help administrators effectively deploy and manage NFS in various scenarios. By centralizing data storage and enabling resource sharing, NFS enhances the efficiency and scalability of IT infrastructures.

File Permissions and ACLs in Linux

Introduction

File permissions and Access Control Lists (ACLs) are fundamental components of Linux security. They control how users and groups can interact with files and directories. Proper understanding and management of these permissions ensure data security and system integrity.

File Permissions

Basic File Permissions

Overview:

• Linux file permissions are divided into three categories: user (owner), group, and others.
• Each category has three types of permissions: read (r), write (w), and execute (x).

Permission Structure:

• Permissions are displayed in a 10-character string (e.g., -rwxr-xr–).
  • The first character indicates the type (- for a file, d for a directory, l for a link).
  • The next nine characters represent the permissions for user, group, and others in sets of three.

Viewing Permissions:

• Use ls -l to view file permissions.

ls -l filename

Changing Permissions:

• Use the chmod command to change file permissions.
  • Symbolic Mode:

chmod u+rwx,g+rx,o-r filename

• Numeric Mode:
  • Permissions can also be represented numerically (e.g., 755).

chmod 755 filename

Examples:

• Read and write for owner, read for group and others:

chmod 644 filename

• Full permissions for owner, none for group and others:

chmod 700 filename

Special Permissions

Set User ID (SUID):

• When set on an executable file, the file is executed with the privileges of the file owner.
• Represented by an s in the user execute position (e.g., -rwsr-xr-x).

chmod u+s filename

Set Group ID (SGID):

• When set on a directory, new files inherit the group of the directory.
• Represented by an s in the group execute position (e.g., -rwxr-sr-x).

chmod g+s directory

Sticky Bit:

• When set on a directory, only the file owner can delete or rename files within it.
• Represented by a t in the others execute position (e.g., drwxrwxrwt).

chmod +t directory

Changing Ownership

chown:

• Change the owner and group of a file.

chown user:group filename

• Change only the owner:

chown user filename

• Change only the group:

chown :group filename

chgrp:

• Change the group of a file.

chgrp group filename

Access Control Lists (ACLs)

Overview:

• ACLs provide a more flexible permission mechanism than the traditional user/group/others model.
• Allow permissions to be set for specific users and groups.

Enabling ACLs:

• Ensure the filesystem is mounted with ACL support. Most modern filesystems (ext4, xfs) support ACLs by default.
• To explicitly enable ACLs, you may need to modify /etc/fstab:

/dev/sda1 / ext4 defaults,acl 0 1

Viewing ACLs:

• Use the getfacl command to view ACLs.

getfacl filename

Setting ACLs:

• Use the setfacl command to set ACLs.

setfacl -m u:username:permissions filename

setfacl -m g:groupname:permissions filename

Examples:

• Grant read permission to user bob:

setfacl -m u:bob:r filename

• Grant read and write permissions to group sales:

setfacl -m g:sales:rw filename

• Remove an ACL entry:

setfacl -x u:bob filename

Default ACLs:

• Set default ACLs for directories, which are inherited by new files and subdirectories.

setfacl -m d:u:bob:rw /directory

Recursive ACLs:

• Apply ACLs recursively to all files and directories within a directory.

setfacl -R -m u:bob:rw /directory

Practical Examples and Use Cases

Scenario 1: Project Directory with Multiple Users

• Objective: Create a project directory where multiple users can collaborate. Ensure users can read, write, and execute files, but only the file owner can delete their files.

Step-by-Step:

1. Create the project directory:

mkdir /projects/myproject

2. Set group ownership to a project group:

chown :projectgroup /projects/myproject

3. Set the SGID bit so files inherit the group:

chmod g+s /projects/myproject

4. Set ACLs to allow group members to read, write, and execute:

setfacl -m g:projectgroup:rwx /projects/myproject

5. Set the sticky bit to prevent deletion by non-owners:

chmod +t /projects/myproject

Scenario 2: Temporary Shared Folder

• Objective: Create a shared directory for temporary files where all users can create, read, and delete files, but only the creator can modify or delete their files.

Step-by-Step:

1. Create the shared directory:

mkdir /shared/tmp

2. Set permissions to allow read, write, and execute for all users:

chmod 1777 /shared/tmp

Troubleshooting and Best Practices

Common Issues:

• Permission Denied: Verify file permissions and ACLs. Ensure the user has the required permissions.
• Incorrect Ownership: Use chown to set the correct ownership.
• ACLs Not Applied: Ensure the filesystem supports ACLs and is mounted with ACL support.

Best Practices:

• Least Privilege Principle: Grant only the necessary permissions to users and groups.
• Regular Audits: Periodically review permissions and ACLs to ensure they align with security policies.
• Backup ACLs: Use getfacl to back up ACLs before making significant changes.

getfacl -R /directory > acl_backup.txt

Conclusion

Understanding and managing file permissions and ACLs are crucial for maintaining security and efficiency in a Linux environment. Basic permissions provide a straightforward mechanism for access control, while ACLs offer granular control for more complex scenarios. Proper implementation and regular audits ensure that your system remains secure and accessible to the right users.