File Permissions over NFS

Hardware Hub Networking
, ,
1

Hi Everyone,

Having problems with file permissions between my desktop PC and my QNAP NAS.

It seems that file permissions/ownership don’t seem to mean anything over an NFS share. If I set a file to read only, I can still modify the file over NFS. I have made sure my UID matches on both my desktop and NAS. If I use Samba instead of NFS, then permissions work correctly. Not sure what I should be looking for to solve this problem.

Desktop PC is running Linux Mint 21.3.
QNAP is running QuTS Hero 6.0.1.3564 with a ZFS pool over NFS v4.1. (I have also tried NFS v3 also with no change.)

Thanks

2

NFSv4 supports permissions, but batteries are not included.

I have my /etc/exports configuration set to export my entire network share as read-only, so anything that mounts the share cannot create new files or directories, modify existing ones, or delete anything. This works for me because I use SCP and SFTP for privileged access simply because, imo, that’s easier than going through a whole kerberos setup.

1 Like
3

Thanks for the reply.

I have looked into setting up Kerberos but I am not having luck finding a good guide to follow.

Other forums had suggest a setup similar to yours…use separate read-only and writable shares. It’s just hard for me to wrap my brain around file permissions not working right out of the box for NFS. I cannot comprehend why NFS would just ignore permissions, at least until it is configured to do so.

Thanks.

4

It is because the nfsd service controls the access. Some of the local file system permisions will carry through but if you are using non-Unix like systems then things get murky. And depending on how you export your shares, that creates other issues. So your options Are to use kerberos or set explicit permisions on the expoets and ensure that you are connecting to the share with the appropriate user accounta passed in on the options line.

1 Like
5

I find Samba easier for this use case, personally. It’s cross-platform, too, so I can access it from my phone, tablet, MacBook, Linux desktops, and Windows. You can configure it such that one needs to enter credentials in order to access a share. That being said, my Samba server is treated like a low-trust public network share across my LAN because anyone on my network can access it, and afaik, the security features are rather basic unless you really take steps to lock it down (i.e with Active Directory and/or kerberos). I think the network-level authentication features are more than enough for me though.

1 Like
6

Yeah, if you have to go that route, then NFS or NFS over SSH is the better security setup and more worth your time than setting up a secure SMB share for all of the other stuff that you have to setup.