OpenBSD Blog #16: Hosting NFS on OpenBSD
Draft! |
This page is a draft and may be incomplete, incorrect, or just a
stub or outline. I've decided to allow myself to put draft pages on
my website as an experiment. I'm hoping they will:
|
Serving as NFS host
TODO: move this detail to a separate openbsd/ page!!!!!
$ man 5 exports
$ doas vim /etc/exports
$ cat /etc/exports
/files/ebooks -network 10.0.0.0 -mask 255.255.255.0
$ doas rcctl enable portmap mountd nfsd
$ phobos2:/files$ doas rcctl start portmap
$ phobos2:/files$ doas rcctl start mountd
$ phobos2:/files$ doas rcctl start nfsd
After a lot of uncertainty about whether or not to enable file locking (did I really need it?), I decided I’d go for it and turn it off if it was somehow a performance problem.
But I was surprised to run into:
$ doas rcctl enable rpc.lockd rpc.statd rcctl: service rpc.lockd does not exist
Indeed, rcctl ls all did not list anything named rpc.*. What on earth?
Well, you know what I did eventually see in the list? lockd and statd
without the rpc. prefix in the name.
Which is apparently correct. But the wild thing is that the man pages for each of these are still for the old name:
$ man lockd man: No entry for lockd in the manual. $ man rpc.lockd [shows man page for rpc.lockd(8)]
Furthermore, the internet is full of instructions invoking rpc.lockd and
rpc.statd with the prefix.
Anyway, here’s the answer:
doas rcctl enable lockd statd doas rcctl start lockd doas rcctl start statd
And note that the connecting client machine will probably also need to run a statd service of some sort to make file locking work from both ends. See the client section below for more.
If you need to make a change to /etc/exports, you can tell mountd to
reload by sending it a hangup signal (HUP) like so:
phobos2:~$ doas vim /etc/exports phobos2:~$ doas kill -HUP $(cat /var/run/mountd.pid)
Connecting as clients
I have a mixture of Linux and BSD clients on the home network.
The showmount utility seems to be common to all of them and is
very handy for displaying available NFS mounts on a given host.
(The -e option stands for "exports".)
$ showmount -e phobos2.home.arpa Export list for phobos2.home.arpa: /files/ebooks 10.0.0.0 /files/topsecret 10.0.0.85
The above listing shows that /files/ebooks is available for the whole
10.0.0.0 network while /files/topsecret is only available for a client
at IP address 10.0.0.85.
Notice that the NFS server shows all exports, even ones that are not allowed for the current client! Good to know to avoid any nasty surprises.
To see the available NFS mount options on an OpenBSD client, see man
mount_nfs. Good luck figuring that out before you’ve already done it. Finding
the right man page for stuff is a terrible chicken-and-egg problem.
You can do a mount manually at any time with mount.
# mount -t nfs <server>:/<dir> /<local-dir>
I’ve decided on a local file structure that is descriptive of where the
mount came from. So for the ebooks example, I’m making this directory
on a Linux client prior to mounting:
$ sudo mkdir -p /mnt/phobos2/ebooks $ sudo chmod 755 /mnt/phobos2/ebooks
And mounting with:
$ sudo mount -t nfs phobos2.home.arpa:/files/ebooks /mnt/phobos2/ebooks
I really like how fast the NFS connection happens. It’s basically instantaneous. SSHFS always had a pause while the SSH connection happened.
If you try to mount an export from a machine that isn’t on the allowed list, you’ll get a permission error as expected. OpenBSD client example:
$ doas mount -t nfs phobos2.home.arpa:/files/topsecret /mnt/phobos2/topsecret mount_nfs: can't access /files/topsecret: Permission denied
Locking
If you enabled file locking (see above), then the client will also need
to have file locking services running. (Or specifically disable it with the
nolock option!)
For example, I got this on my Slackware machine (after a considerable pause):
dave@callisto~$ sudo mount -t nfs 10.0.0.144:/files/ebooks /mnt/phobos2/ebooks mount.nfs: rpc.statd is not running but is required for remote locking. mount.nfs: Either use '-o nolock' to keep locks local, or start statd.
In that case, I enabled it thus:
sudo chmod a+x /etc/rc.d/rc.rpc $ sudo /etc/rc.d/rc.rpc start Starting RPC portmapper: /sbin/rpcbind -l -w Starting RPC NSM (Network Status Monitor): /sbin/rpc.statd
Now the mount connected immediately and, indeed, appears to be very fast.
It looks like man 5 fstab is pretty consistent across systems.
So here’s my line in /etc/fstab. Crossing fingers….
10.0.0.144:/files/ebooks /mnt/phobos2/ebooks nfs rw,bg,soft 0 0
Note the soft option. The idea here is to not have my computer
hang if the NFS export isn’t available for some reason.
It works. But I’ve got a Linux machine that doesn’t connect to the network immediately (I’ve never bothered chasing this down.) And, indeed, the ebooks mount wasn’t available after a fresh reboot.
Also note that the bg option is probably the only part I really need
here because I do want it to keep re-trying in the background.
I’m curious to see what happens if I remove soft on this computer…