5

How can the NFS server on a Debian 8 system be limited to NFSv3?

By default, shares can be mounted with both vers=3 and vers=4.

/etc/default/nfs-kernel-server:

# To disable NFSv4 on the server, specify '--no-nfs-version 4' here
#RPCMOUNTDOPTS="--manage-gids"
RPCMOUNTDOPTS="--manage-gids --no-nfs-version 4"

This option does not seem to have any effect (rpcinfo still shows nfs accepting version 4).

6

Turns out modifying the RPCMOUNTDOPTS variable as described in /etc/default/nfs-kernel-server does not work and there's a bug report for that: #738063

This variable is used in the rpc.mountd call:

# systemctl status nfs-kernel-server
● nfs-kernel-server.service - LSB: Kernel NFS server support
   Loaded: loaded (/etc/init.d/nfs-kernel-server)
   Active: active (running) since Sun 2016-06-12 19:46:01 CEST; 6s ago
  Process: 15110 ExecStop=/etc/init.d/nfs-kernel-server stop (code=exited, status=0/SUCCESS)
  Process: 15119 ExecStart=/etc/init.d/nfs-kernel-server start (code=exited, status=0/SUCCESS)
   CGroup: /system.slice/nfs-kernel-server.service
           └─15167 /usr/sbin/rpc.mountd --manage-gids --port 2048 --no-nfs-version 4

However, clients are still able to mount using -o vers=4.

Instead, this option must be passed to rpc.nfsd. Looking at the init script /etc/init.d/nfs-kernel-server, it seems like the RPCNFSDCOUNT variable is the only variable that's passed to rpc.nfsd. It's not intended for that purpose, but it works and it seems to be the only option short of editing the init script.

Solution:

In /etc/default/nfs-kernel-server, add the --no-nfs-version 4 option to RPCNFSDCOUNT instead of RPCMOUNTDOPTS:

# Number of servers to start up
#RPCNFSDCOUNT=8
RPCNFSDCOUNT="8 --no-nfs-version 4"

Restart the NFS service:

# systemctl restart nfs-kernel-server

Test it:

# mount -t nfs -o vers=4 SERVER:/data/public /mnt
mount.nfs: Protocol not supported

Version 3 still works:

# mount -t nfs -o vers=3 SERVER:/data/public /mnt
2
  • Very good solution, clearly a bug! – mvorisek Jan 3 '18 at 16:26
  • a good solution but appeared not enough for the rootfs mounting from the linux kernel. it appeared NFSv4 is no longer working over UDP but is expecting TCP to be used, however kernel by default is trying to connect over UDP even for the NFSv4 so special parameter has to be added at the tail of the nfsroot. Example: nfsroot=192.79.143.131:/diskless/client01,tcp – Oleg Kokorin Mar 30 '18 at 11:18
0

looks like you want

RPCMOUNTDOPTS="--manage-gids -V 3"

It seems there are no compatibility problem with -V 3 and --manage-gids but I didn't test.

2
  • of course you need to restart the nfs server service. – Emmanuel May 26 '16 at 15:08
  • No, that option does not disable version 4 either. – basic6 Jun 12 '16 at 18:00
0

Related to the answer by @basic6, I had to figure out where the environments file is held on our CentOS 7 system.

TL;DR

We changed the RPCNFSDARGS variable in /etc/sysconfig/nfs.

Where is the config file?

Here is the systemd service:

sudo systemctl status nfs-server.service        
● nfs-server.service - NFS server and services
   Loaded: loaded (/usr/lib/systemd/system/nfs-server.service; enabled; vendor preset: disabled)
  Drop-In: /run/systemd/generator/nfs-server.service.d
           └─order-with-mounts.conf
   Active: active (exited) since Tue 2019-06-25 13:12:19 CEST; 7min ago
 Main PID: 44563 (code=exited, status=0/SUCCESS)
    Tasks: 0
   Memory: 0B
   CGroup: /system.slice/nfs-server.service

In /usr/lib/systemd/system/nfs-server.service we notice the ExecStart but also EnvironmentFile and the Wants/After service:

[Unit]
...
Wants=nfs-config.service
After=nfs-config.service

[Service]
EnvironmentFile=-/run/sysconfig/nfs-utils
...
ExecStart=/usr/sbin/rpc.nfsd $RPCNFSDARGS

So we may want to change the RPCNFSDARGS variable to include "--no-nfs-version 4". The EnvironmentFile is recreated by the nfs-config service. Let's look into /usr/lib/systemd/system/nfs-config.service:

[Service]
...
ExecStart=/usr/lib/systemd/scripts/nfs-utils_env.sh

That script creates the EnvironmentFile and gets it initial variables from /etc/sysconfig/nfs at the top of its script:

#!/bin/sh

#
# Extract configuration from /etc/sysconfig/nfs and write
# environment variables to /run/sysconfig/nfs-utils to be 
# used by the systemd nfs-config service
#

nfs_config=/etc/sysconfig/nfs
if test -r $nfs_config; then
    . $nfs_config
fi

@basic6 referred to /etc/default/nfs-kernel-server, in our case it is /etc/sysconfig/nfs.

Adding the --no-nfs-version option

Next to that, we choose to change the RPCNFSDARGS variable in /etc/sysconfig/nfs instead of RPCNFSDCOUNT as it seems more neat:

diff --git a/etc/sysconfig/nfs b/var/tmp/nfs.XXS8L74E
index 74104d3..82bc1b4 100644
--- a/etc/sysconfig/nfs
+++ b/var/tmp/nfs.XXS8L74E
@@ -11,7 +11,7 @@
 #LOCKD_UDPPORT=32769
 #
 # Optional arguments passed to rpc.nfsd. See rpc.nfsd(8)
-RPCNFSDARGS=
+RPCNFSDARGS="--no-nfs-version 4"
 # Number of nfs server processes to be started.
 # The default is 8. 
 RPCNFSDCOUNT=32
-1

After edit restart nfs-kernel-server On other linux distro i use another method, edit /etc/nfsmount.conf

# Protocol Version [2,3,4]
# This defines the default protocol version which will
# be used to start the negotiation with the server.
Defaultvers=3

Then restart nfs,this enable only nfs3

1
  • 1
    /etc/nfsmount.conf does not exist (by default, Debian) and "negotiation with the server" indicates that this is a client setting. – basic6 May 25 '15 at 11:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.