Limiting Access to NFS mounts

[Andrew Kaplan]

Hi there --

I have set up the exporting of filesystems on a particular server. What I want to do now is limit the access to the filesystems to one system. The exports file that I have in place has the following syntax:

/home/nohadani (sync,rw,root_squash)
/media/disk/nohadani (sync,rw,root_squash)

The problem that I am having is I am able to mount the directories in question from a remote host other than the one specified in the exports file. What other configuration steps do I need in order to limit access to the NFS mounts exclusively to the host listed in exports? Thanks.

[Stuart Browne · Accepted solution]

You need to re-export the exports file:

exportfs -ra

[Dave Olker]

Hi Andrew,

Another thing to check is to make sure there is no space between the hostname and the open parenthesis. In other words, some Linux variants treat this string:

/media/disk/nohadani (sync,rw,root_squash)

differently from:

/media/disk/nohadani (sync,rw,root_squash)

Note the blank space between and '('. Once you have the /etc/exports syntax correct, be sure to issue the "exportfs -av" command as previously suggested.

Regards,

Dave

[Andrew Kaplan]

Hi there --

Thanks for the help. When I ran the exportfs -rav command, the output indicated the hostname was not recognized. Most likely this is due to some DNS error.

To expedite matters, I replaced the hostname with the ip address of the system in question, and reran the exportfs -rav command again. There were no errors in the output, and a subsequent test on a remote system other than the one in question resulted in a permission denied message, which is what was supposed to happen.

Thanks again for the help.

[Ivan Ferreira]

Remember that NFS uses tcpwrappers, and you can also use hosts.allow, hosts.deny files to limit access to NFS services.

[Andrew Kaplan]

Hi there --

I need to edit the original message. Is there a way I can do so? Thanks.

[Dennis Handly]

>I need to edit the original message. Is there a way I can do so?

No. If there is a security/privacy issue because you have that in your text, you could ask the moderators to remove it. But not for some simple typos. You can just correct it in a reply.

For moderator requests, there is a monthly thread in: Your questions regarding ITRC Forums > general: March/April 2009 Issues Requiring Moderator Intervention
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1318758