3 ms·

Isn't NFS also dead? It basically believes you are root if you say you are. And NFSv4 apparently requires Kerberos? WTF? Was it designed only for MIT use? Why

by dheera 5y ago

Isn't NFS also dead? It basically believes you are root if you say you are. And NFSv4 apparently requires Kerberos? WTF? Was it designed only for MIT use? Why can't they support simple things like SSH keys?

krylon 5y ago
The default for NFSv3 is to map client-side root to server-side nobody, unless you explicitly tell it not to. (Which I had to do once to run a diskless workstation with an NFS root filesystem.)
selfhoster11 5y ago
NFS is what you use if you want seamless file shares on Linux. Pretty much every other option has been junky or lost me data.
- adrian_b 5y ago
  It depends on what kind of data is important for you. In my Linux file systems (and also in my FreeBSD file systems), extended attributes are very important for me. The older NFS versions (v2, v3 and early v4, before Linux 5.9) do not support extended attributes, so I was always forced to use Samba shares, which for me worked OK, including with the sharing between Linux and FreeBSD.
  - selfhoster11 5y ago
    I'm just happy with the files themselves being intact, but IME even that was difficult to achieve with non-NFS solutions. SMB was notoriously difficult to set up, and things like WebDAV or SFTP would have severe write loss problems when I tried to use them like an interactive local filesystem. NFS is rock stable.
chasil 5y ago
NFSv4 uses idmapd with a defined "domain," unlike direct uid/gid mapping of earlier versions. When the idmapd daemons on either side cannot agree on the domain, all users will be "squashed" to the default NFS user. Root is always squashed, unless nosquash is specified in /etc/exports (which goes for earlier protocol versions as well). NFSv4 [cleartext] does not require kerberos. Kerberos can be used to encrypt the data stream between client and server, but this can also be accomplished with stunnel over TLS (google "nfs encryption" for details).
normaler 5y ago
A very clean approach to NFS authentication is using it in combination with wireguard. With NFS you can limit access to certain IPs or IP ranges. With wireguard you add authentication that these IPs are really the users/group of users. Also it adds encryption to the actual file transfer.

by dheera 5y ago

krylon 5y ago

The default for NFSv3 is to map client-side root to server-side nobody, unless you explicitly tell it not to. (Which I had to do once to run a diskless workstation with an NFS root filesystem.)

selfhoster11 5y ago

NFS is what you use if you want seamless file shares on Linux. Pretty much every other option has been junky or lost me data.

adrian_b 5y ago
It depends on what kind of data is important for you. In my Linux file systems (and also in my FreeBSD file systems), extended attributes are very important for me. The older NFS versions (v2, v3 and early v4, before Linux 5.9) do not support extended attributes, so I was always forced to use Samba shares, which for me worked OK, including with the sharing between Linux and FreeBSD.
- selfhoster11 5y ago
  I'm just happy with the files themselves being intact, but IME even that was difficult to achieve with non-NFS solutions. SMB was notoriously difficult to set up, and things like WebDAV or SFTP would have severe write loss problems when I tried to use them like an interactive local filesystem. NFS is rock stable.

chasil 5y ago

NFSv4 uses idmapd with a defined "domain," unlike direct uid/gid mapping of earlier versions. When the idmapd daemons on either side cannot agree on the domain, all users will be "squashed" to the default NFS user. Root is always squashed, unless nosquash is specified in /etc/exports (which goes for earlier protocol versions as well). NFSv4 [cleartext] does not require kerberos. Kerberos can be used to encrypt the data stream between client and server, but this can also be accomplished with stunnel over TLS (google "nfs encryption" for details).

normaler 5y ago

A very clean approach to NFS authentication is using it in combination with wireguard. With NFS you can limit access to certain IPs or IP ranges. With wireguard you add authentication that these IPs are really the users/group of users. Also it adds encryption to the actual file transfer.