Unix - Network File System (NFS) Configuration and Administration in UNIX

1. Introduction to Network File System (NFS)

The Network File System (NFS) is a distributed file system protocol that allows users to access files and directories stored on another computer over a network. It enables a remote directory to appear as though it is part of the local file system, allowing users to work with remote files without manually transferring them between computers.

NFS is commonly used in UNIX and UNIX-like operating systems to share files between servers, workstations, and other network-connected systems. It follows a client-server architecture in which one computer provides access to selected directories while another computer connects to those directories and accesses their contents.

For example, consider an organization with ten employees who need access to the same collection of project documents. Instead of storing separate copies of the documents on every computer, the organization can store them on a central server and share the directory through NFS. Authorized employees can then access the shared files from their own workstations.

2. Architecture of NFS

NFS operates using two main components: the NFS server and the NFS client.

NFS Server

The NFS server is the computer that stores files and makes selected directories available to other computers on the network. The administrator determines which directories can be shared and which clients are permitted to access them. The server processes client requests and provides access according to the configured permissions.

NFS Client

The NFS client is the computer that connects to the server and accesses its shared directories. Once the remote directory is mounted, users can interact with the files through the normal directory structure. Depending on their permissions, they may be able to read, create, modify, or delete files.

Network Communication

The client and server communicate through network protocols. NFS commonly uses Remote Procedure Call (RPC) mechanisms to exchange requests and responses. NFS versions differ in their transport and service-discovery requirements. NFSv4 generally uses TCP port 2049 and does not require the same collection of auxiliary services as older NFS configurations.

The following example illustrates the relationship:

Server computer: stores files in /srv/shared.
Client computer: connects to the server over the network.
Shared directory: /srv/shared becomes accessible through a local mount point such as /mnt/shared.
Users: access the files through /mnt/shared, subject to permissions and server configuration.

3. How NFS Works

NFS allows a client to access remote files through its local directory hierarchy. The process generally involves the following steps.

Step 1: Directory Sharing

The administrator configures the NFS server to share a particular directory. The server defines which clients can access it and whether they receive read-only or read-write permissions.

Step 2: Client Connection

The client identifies the server by its hostname or IP address and requests access to the shared directory. The request must satisfy the server's access rules.

Step 3: Mounting the Remote Directory

The client mounts the remote directory at a local mount point. A mount point is an existing directory where the remote filesystem becomes accessible.

Step 4: File Access

When a user opens, reads, creates, or modifies a file in the mounted directory, the client communicates with the server as necessary to perform the requested operation.

Step 5: Server Processing

The server checks the request against applicable permissions and filesystem rules. If the operation is authorized, the server performs it and returns the result to the client.

Step 6: Unmounting

When the shared directory is no longer required, the client can unmount it. This removes the remote filesystem from that location in the client's directory hierarchy without deleting the original files stored on the server.

4. Configuring an NFS Server in UNIX

NFS configuration differs between UNIX variants and Linux distributions. The following commands demonstrate a common Linux-based implementation and may need adjustments for a particular operating system.

Step 1: Install the NFS Server Package

On Debian- or Ubuntu-based systems, the NFS server package can be installed using:

sudo apt update
sudo apt install nfs-kernel-server

On some Red Hat-based systems, the corresponding package is commonly installed with:

sudo dnf install nfs-utils

The package provides the components required to export directories and serve NFS requests.

Step 2: Create a Directory to Share

Create a directory that will contain the shared files:

sudo mkdir -p /srv/shared

The mkdir command creates the directory, while the -p option also creates missing parent directories when necessary.

The administrator must configure ownership and permissions appropriately. For example, a dedicated group can be created for authorized users, and access can be restricted to that group. Broad permissions such as allowing every user to write to the directory should be avoided unless there is a specific, justified requirement.

Step 3: Configure the Export File

The /etc/exports file defines the directories an NFS server makes available to clients.

Open the file:

sudo nano /etc/exports

An example entry is:

/srv/shared 192.168.1.20(ro,sync,root_squash)

This entry has several components:

/srv/shared identifies the directory being shared.
192.168.1.20 identifies the client allowed to access it.
ro specifies read-only access.
sync instructs the server to acknowledge changes after the relevant changes have been committed to stable storage, subject to the server's implementation.
root_squash maps remote root access to an unprivileged identity instead of granting the remote root user unrestricted root privileges on the server.

The IP address is an example and must be replaced with the actual authorized client address.

For a trusted client that genuinely requires write access, the export option may use rw instead of ro. Write access should be granted only when needed, and filesystem ownership and permissions must also allow the intended operations.

Step 4: Apply the Export Configuration

After saving the file, apply the configuration:

sudo exportfs -rav

The command reloads the export definitions and displays the directories being exported.

To list the active exports, use:

sudo exportfs -v

The output helps the administrator verify which directories are shared and which options apply to them.

Step 5: Start and Enable the NFS Service

On a system using systemd, the service can commonly be started and enabled with:

sudo systemctl enable --now nfs-kernel-server

On some distributions, the service is named nfs-server instead. The appropriate service name depends on the operating system.

The administrator should verify the service status and ensure that the firewall permits the required NFS traffic only from authorized network locations.

5. Configuring an NFS Client

After the server has been configured, the client must connect to the exported directory.

Step 1: Install the NFS Client Utilities

On Debian- or Ubuntu-based systems, install the client utilities with:

sudo apt install nfs-common

On many Red Hat-based systems, the relevant package is nfs-utils.

Step 2: Create a Mount Point

Create a local directory where the remote filesystem will be attached:

sudo mkdir -p /mnt/shared

The /mnt/shared directory acts as the local access point for the remote files.

Step 3: Mount the Shared Directory

Use the following command:

sudo mount -t nfs 192.168.1.10:/srv/shared /mnt/shared

In this example:

192.168.1.10 is the IP address of the NFS server.
/srv/shared is the directory exported by the server.
/mnt/shared is the mount point on the client.
-t nfs specifies the filesystem type.

Replace the example server address with the actual address of the NFS server.

If the mount succeeds, the client can access the shared files through /mnt/shared, subject to the configured access restrictions.

Step 4: Verify the Mount

The client can verify the mounted filesystem with:

findmnt /mnt/shared

Another useful command is:

df -hT

These commands help confirm that the remote filesystem is mounted and display information about the filesystem and its capacity.

6. Making an NFS Mount Persistent

A manually mounted NFS directory may not automatically be mounted after the client restarts. To make the mount persistent, the administrator can configure the /etc/fstab file.

An example entry is:

192.168.1.10:/srv/shared /mnt/shared nfs defaults,_netdev 0 0

The fields specify the server and remote directory, local mount point, filesystem type, mount options, and filesystem-check parameters.

The _netdev option indicates that the filesystem depends on network availability. Additional options, such as a suitable timeout or automount configuration, may be appropriate depending on the environment.

Before restarting the system, the administrator should test the entry with:

sudo mount -a

This command attempts to mount eligible entries in /etc/fstab that are not already mounted. Any reported errors should be resolved before relying on the configuration during startup.

7. NFS Permissions and Security

Security is an essential part of NFS administration because a shared directory can expose sensitive files to other computers.

Access Control

The server should export directories only to authorized clients. Where possible, access should be restricted to specific IP addresses or trusted network ranges instead of allowing all hosts to connect.

Read-Only and Read-Write Access

Read-only access is suitable when clients need to view files but must not change them. Read-write access should be provided only to clients that need to create or modify content.

Root Squashing

The root_squash option helps prevent a remote root user from automatically receiving root-level privileges on the server through NFS. It is commonly enabled by default, but administrators should verify the actual export configuration.

User and Group Permissions

Traditional NFS configurations often rely on numeric user and group IDs to determine file access. Inconsistent IDs between the client and server can cause unexpected permission problems. Centralized identity services or consistent user and group mappings can help avoid these issues.

Network Protection

NFS traffic should be limited to trusted networks, with suitable firewall rules. Where stronger authentication, integrity protection, or encryption is required, administrators should evaluate the security features supported by their NFS version and deployment, including Kerberos-based security where appropriate.

8. Common NFS Administration Commands

Command	Purpose
`exportfs -v`	Displays active exports and their options.
`exportfs -rav`	Reloads and applies export definitions.
`mount -t nfs`	Mounts a remote NFS filesystem.
`findmnt`	Displays mounted filesystems and their relationships.
`df -hT`	Displays filesystem capacity and type.
`umount /mnt/shared`	Unmounts the shared directory.
`systemctl status nfs-server`	Checks the NFS server service on systems using that service name and systemd.
`showmount -e server-address`	Queries exported directories where the server supports the relevant mount protocol services.

These commands assist administrators in configuring NFS, verifying mounts, checking exports, and diagnosing access problems. Exact command availability and service names vary by UNIX implementation.

9. Common NFS Problems and Troubleshooting

Mount Failure

A mount may fail because the server is unreachable, the remote directory is not exported, the client is not authorized, or the required network traffic is blocked. Administrators should verify the server address, export configuration, network connectivity, and firewall rules.

Permission Denied

A client may be able to mount a directory but still be unable to access or modify files. This can occur because of server-side permissions, read-only exports, user and group ID mismatches, or root squashing. The export options and file ownership should be examined together.

Slow File Access

Performance can be affected by network latency, congestion, server storage speed, or heavy concurrent usage. Monitoring server resources and network activity can help identify the cause. Mount options should be changed carefully because inappropriate settings may affect reliability or data consistency.

Server Unavailable

If the NFS server stops responding, clients may experience delays or errors while accessing remote files. Administrators should check the service status, server health, network connection, and relevant system logs.

Changes Not Appearing Immediately

File caching can affect when updates made by one client become visible to another. NFS has mechanisms for maintaining file consistency, but applications that rely on immediate visibility of every change must account for the caching and locking behavior of their particular NFS version and workload.

10. Advantages and Limitations of NFS

Advantages

Centralized Storage: Files can be stored and managed on a central server instead of duplicated across multiple computers.
Simplified Collaboration: Multiple authorized users can access common files through their local directory structures.
Reduced Duplication: Central storage reduces the need to maintain separate copies of the same documents.
Simplified Administration: Backups, storage allocation, and access policies can be managed centrally.
Scalability: Additional client computers can access shared resources as organizational needs grow, provided the server and network have sufficient capacity.

Limitations

Network Dependency: Clients generally need network access to use remote files.
Performance Variation: Access speed depends on the network, server capacity, and workload.
Configuration Complexity: Permissions, user identity mapping, firewall settings, and exports require careful administration.
Server Availability: A failure affecting the NFS server can interrupt access to shared files unless appropriate redundancy is available.
Security Considerations: Incorrect export rules or weak network protections can expose files to unauthorized users.

Conclusion

Network File System (NFS) is an important technology in UNIX administration because it allows multiple computers to share files through a common directory structure. By configuring an NFS server, defining exports, mounting remote directories on clients, and managing permissions, administrators can provide centralized file access across a network.

Effective NFS administration requires more than simply mounting a directory. Administrators must also consider security, user identity mapping, persistent mounts, system availability, performance, and troubleshooting. When configured correctly, NFS provides a practical solution for shared storage in development environments, educational institutions, research facilities, and enterprise networks.