NFS can't mount with client alias in server's /etc/exports

[Thomas Lee_1]

Hi,

Here the situation.

On Client(192.168.3.2):
/etc/hosts
127.0.0.1 localhost
192.168.3.1 dummy_server server_name
192.168.3.2 client_name
...

On Server(192.168.3.1):
/etc/hosts
...
192.168.3.2 dummy_client client_name
...

/etc/exports
/share -access=client_name

Problem:
When I try to mount from client:
mount server_name:/share /share or
mount dummy_server:/share /share
both give me "Permission denied"

But work when change the /etc/exports
to :
/share -access=dummy_client,client_name

So, why is that?

Regards,
Thomas

[G. Vrijhoeven · Accepted solution]

Hi Thomas,

Your /etc/nsswitch.conf states the priority of resolving hostnames to ip-adresses. If it states dns first the entry in /etc/hosts will not matter. Also mind that you provide the full domain name.

HTH,

Gideon

[Eric Antunes]

Hi Thomas,

It may be because you are using aliases at the /etc/hosts files. Do you need those aliases? If not, try it after removing the aliases...

Best Regards,

Eric Antunes

[Thomas Lee_1]

Gideon,

As we have no DNS setup for internal use,
only "files" specified in /etc/nsswitch.conf,
so plain "client_name" already the FQDN.

Eric,

There are some special need to use alias
in our previous setup, so can you explain
why I will encounter this problem?


Regards,
Thomas

[Eric Antunes]

No, I can't explain why. But did it worked without the aliases (you must identify the issue before solving it...)?

[Elmar P. Kolkman]

It's quite simple: the client tries to do the nfs mount, arrives with an IP address, which is resolved, using the first hostname found.... which is dummy_client, not client_name. It will then see if that name is allowed mounting, which it is not.

If you want this to work, there are multiple solutions:
1) switch dummy_client and client_name in /etc/hosts.
2) add dummy_client to the list of clients you allow mounting, like you tested yourself
3) replace the hostname with the IP address in /etc/exports, so it becomes
/share -access=192.168.3.2

[Andrew Cowan]

The exact same problem occurs if you setup Kerberos and then try to use alias names. It only uses the first name listed in "/etc/hosts" or the exact name resolved by DNS.

When you think about this it is very secure behaviour since somebody could simply add a name as an alias name for another system and then use this to mount an attack.

[KapilRaj]

On the server ,

host
host

should return the same names for NFS to verify he is the right one .. else it will fail.

Regds,

Kaps

[Thomas Lee_1]

Thx for all your help