2

I have a NFS directory that is used by multiple users, and hosted on a NFS server that I do not control.

I would like to back up the contents of the NFS directory from my client machine. My first attempt was to log in as root on my client machine, and then try to tar up all the files. However, this fails with permission error, as the NFS server maps root to an anonymous user (the root_squash options on the server), so some files are not readable.

So, how can I back up all the files on that NFS directory? In other words, how can I arrange to be able to read all of the files on that shared NFS directory? I don't control the NFS server and cannot configure it to use no_root_squash.

Now, I know that this security restriction can be bypassed. If I wanted to create a new user on my client machine with the right uid, I could su to that user and then read those files. Since I have root on my client machine, I could easily do this -- the NFS server is trusting my client machine. This would be annoying and a kludge, since I'd have to create several fake userids on my client machine and su back and forth between them, but it proves that it's possible in principle for root to read every file on the NFS directory.

My question is: is there a cleaner, easier way to arrange so that I can back up everything in this NFS directory, given that I do have root on my client machine but I don't have any control over the NFS server or its configuration?


Restrictions: I can't switch to a different NFS server. I don't control the configuration of the current NFS server. Any solution that would require all the users to make configuration changes or require extra effort from all the other users is impractical. I'm looking for a solution that doesn't require too much effort on my part (having to write up a bunch of complex scripts to find all the relevant users, create fake uids, su-ing to each one, creating a bunch of tarballs, and somehow merging the tarballs sounds painful).

  • Which version of the NFS protocol does the server implement? (I don't know how to find out.) Do you know what OS is running on the server? IIRC NFSv4 has better ways of remapping user IDs, which might give you a better chance at finding a convenient solution. – Gilles Feb 19 '15 at 23:44
  • @Gilles, thank you for the brainstorming! I don't know what OS or NFS protocol version and I'm not sure how to find out (so I asked a separate question about the version part of that). It looks like it might be NFSv3; trying to mount using NFSv4 failed with the error "mount.nfs: Protocol not supported", whatever that means. I don't know the OS of the NFS server (possibly NetApp?). – D.W. Feb 20 '15 at 0:03
1

You could require that all your users set default permissions to others=read (files) and others=read+execute (directories), so that your "root" account could read them.

You could change NFS server providers to somewhere that permits no_root_squash.

You could create the set of "fake" userids on your client machine, and then iterate across them, running something like find /mnt/NFS -user "$FAKE_USERID" ... | tar --no-recursion --files-from=- for each account. This would generate several tarballs but you'd avoid overlapping backups (the find partitions the files by owner, so each file would appear only in the tarball for the user who owned that file).

  • Thank you! Your answer exposes that I wasn't thorough enough in stating the requirements in my questions, I will edit my question. About your 1st paragraph: Unfortunately, it's not feasible to get all the users to follow this consistently. I'd like to do a backup without requiring extra effort / cooperation from the other users, and without requiring changes to the server. As I outline in the question, that goal is clearly possible in principle, but how can I do in a reasonable and non-kludgy way? About your 2nd paragraph: I don't control the NFS server, and can't use a different one. – D.W. Feb 19 '15 at 23:30
  • @D.W. The find ... -user ... limits the selection to files owned by the specified user. – roaima Feb 19 '15 at 23:37
  • Ahh, quite right! I read too quickly. Thank you for your explanation. The solution mentioned in the 3rd paragraph of your answer is still kludgy and requires a bit more work to write the scripts than I'd hoped for, but the method in your 3rd paragraph is a bit better than the best I had come up with on my own. I'll leave the question open in case someone else knows an even better/cleaner solution. Thank you! – D.W. Feb 19 '15 at 23:39
  • @D.W. I don't know of any way without resorting to homegrown code to talk to the NFS server directly at the Network API level. Having played with SunRPC years (and years) ago it's not something I would relish. Good luck! – roaima Feb 19 '15 at 23:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.