Installation guide

248 Chapter 17. Network File System (NFS)
permitted or prevented access to the NFS server. For more information on configuring access
controls with TCP wrappers, see Chapter 8.
After the client is allowed past TCP wrappers, the NFS server refers to its configuration file,
/etc/exports, to determine whether the client has enough privileges to mount any of the exported
file systems. After granting access, any file and directory operations are sent to the server using
remote procedure calls.
Warning
NFS mount privileges are granted specifically to a client, not a user. If you grant a client machine
access to an exported file system, any users of that machine will have access to the data.
When configuring the /etc/exports file, be extremely careful about granting read-write permissions
(rw) to a remote host.
17.1.1. NFS and portmap
NFS relies upon remote procedure calls (RPC) to function. portmap is required to map RPC requests
to the correct services. RPC processes notify portmap when they start, revealing the port number they
are monitoring and the RPC program numbers they expect to serve. The client system then contacts
portmap on the server with a particular RPC program number. portmap then redirects the client to
the proper port number to communicate with its intended service.
Because RPC-based services rely on portmap to make all connections with incoming client requests,
portmap must be available before any of these services start. If, for some reason, the portmap service
unexpectedly quits, restart portmap and any services running when it was started.
The portmap service can be used with the host access files (/etc/hosts.allow and
/etc/hosts.deny) to control which remote systems are permitted to use RPC-based services on
your machine. See Chapter 8 for more information. Access control rules for portmap will affect all
RPC-based services. Alternatively, you can specify each of the NFS RPC daemons to be affected
by a particular access control rule. The man pages for rpc.mountd and rpc.statd contain
information regarding the precise syntax of these rules.
17.1.1.1. portmap Status
As portmap provides the coordination between RPC services and the port numbers used to commu-
nicate with them, it is useful to be able to get a picture of the current RPC services using portmap
when troubleshooting. The rpcinfo command shows each RPC-based service with its port number,
RPC program number, version, and IP protocol type (TCP or UDP).
To make sure the proper NFS RPC-based services are enabled for portmap, rpcinfo -p can be
useful:
program vers proto port
100000 2 tcp 111 portmapper
100000 2 udp 111 portmapper
100024 1 udp 1024 status
100024 1 tcp 1024 status
100011 1 udp 819 rquotad
100011 2 udp 819 rquotad
100005 1 udp 1027 mountd
100005 1 tcp 1106 mountd
100005 2 udp 1027 mountd
100005 2 tcp 1106 mountd
100005 3 udp 1027 mountd