NFS

NFS exports and mounts, autofs automounting, and Kerberos-secured NFS with krb5 authentication.

Server Configuration

Define NFS exports — /etc/exports syntax

# /etc/exports
/srv/nfs/shared    10.50.1.0/24(rw,sync,no_subtree_check,no_root_squash)
/srv/nfs/readonly  10.50.1.0/24(ro,sync,no_subtree_check)
/srv/nfs/homes     10.50.1.0/24(rw,sync,no_subtree_check,root_squash)

No space between hostname and options. 10.50.1.0/24 (rw) exports to the world read-only and to the subnet read-write — a common misconfig.

Apply export changes without restarting NFS — re-reads /etc/exports

sudo exportfs -ra

Show current active exports with options — verify what is actually shared

sudo exportfs -v

Enable and start NFS server on systemd

sudo systemctl enable --now nfs-server.service

Client Operations

Show what a server exports — probe before mounting

showmount -e 10.50.1.10

Mount an NFS share manually — NFSv4 (default)

sudo mount -t nfs 10.50.1.10:/srv/nfs/shared /mnt/shared

Mount with explicit NFSv3 — when server requires it or NFSv4 fails

sudo mount -t nfs -o vers=3 10.50.1.10:/srv/nfs/shared /mnt/shared

Persistent NFS mount via fstab — survives reboot

10.50.1.10:/srv/nfs/shared  /mnt/shared  nfs  defaults,_netdev  0  0

_netdev delays mount until network is up. Without it, boot hangs if NFS server is unreachable.

Mount with soft timeout — returns error instead of hanging indefinitely

sudo mount -t nfs -o soft,timeo=30,retrans=3 10.50.1.10:/srv/nfs/shared /mnt/shared

NFSv4 vs NFSv3

Check which NFS version is in use on a mounted share

nfsstat -m

NFSv4 uses a single port (2049) — simpler firewall rules

sudo firewall-cmd --permanent --add-service=nfs
sudo firewall-cmd --reload

NFSv3 requires multiple ports — rpcbind, mountd, statd, lockd

sudo firewall-cmd --permanent --add-service={nfs,rpc-bind,mountd}
sudo firewall-cmd --reload

Autofs

Install autofs — auto-mount NFS on access, unmount on idle

sudo pacman -S autofs

Configure auto.master — define mount point and map file

# /etc/auto.master
/mnt/auto  /etc/auto.nfs  --timeout=300

Configure the map file — key = subdirectory, value = NFS source

# /etc/auto.nfs
shared  -rw,soft  10.50.1.10:/srv/nfs/shared
homes   -rw,soft  10.50.1.10:/srv/nfs/homes

Enable autofs — directories appear under /mnt/auto/ on first access

sudo systemctl enable --now autofs.service

Wildcard autofs map — auto-mount any user’s home from NFS

# /etc/auto.home
*  -rw,soft  10.50.1.10:/srv/nfs/homes/&

Kerberos-Secured NFS

Export with Kerberos security — krb5p provides encryption + integrity

# /etc/exports
/srv/nfs/secure  *(rw,sync,sec=krb5p,no_subtree_check)

Mount with Kerberos security flavor

sudo mount -t nfs -o sec=krb5p 10.50.1.10:/srv/nfs/secure /mnt/secure

Requires working Kerberos infrastructure — keytab on both client and server, time synchronization via NTP.

Troubleshooting

Check RPC services — verify NFS daemons are registered and listening

rpcinfo -p 10.50.1.10

NFS statistics — client and server operation counts, errors, retransmissions

nfsstat -c

Server-side NFS stats — which operations are called most

nfsstat -s

Debug mount failures — verbose mount output

sudo mount -v -t nfs 10.50.1.10:/srv/nfs/shared /mnt/shared

Check if NFS ports are reachable — 2049 for NFSv4, 111 for rpcbind

ss -tlnp | awk '/2049|111/'

Stale NFS handle — force unmount a hung NFS mount

sudo umount -f /mnt/shared

Lazy unmount — detach immediately, clean up when not busy

sudo umount -l /mnt/shared

RHCSA Patterns

Full server setup — create share, export, open firewall, start service

sudo mkdir -p /srv/nfs/exam
sudo chown nobody:nobody /srv/nfs/exam
echo '/srv/nfs/exam 10.50.1.0/24(rw,sync,no_root_squash)' | sudo tee -a /etc/exports
sudo exportfs -ra
sudo firewall-cmd --permanent --add-service=nfs
sudo firewall-cmd --reload
sudo systemctl enable --now nfs-server.service

Full client setup — mount, verify, persist

sudo mkdir -p /mnt/exam
sudo mount -t nfs 10.50.1.10:/srv/nfs/exam /mnt/exam
df -h /mnt/exam
echo '10.50.1.10:/srv/nfs/exam /mnt/exam nfs defaults,_netdev 0 0' | sudo tee -a /etc/fstab