Disable NFSv4 (server) on Debian, allow NFSv3

Question

How can the NFS server on a Debian 8 system be limited to NFSv3?

By default, shares can be mounted with both vers=3 and vers=4.

/etc/default/nfs-kernel-server:

# To disable NFSv4 on the server, specify '--no-nfs-version 4' here
#RPCMOUNTDOPTS="--manage-gids"
RPCMOUNTDOPTS="--manage-gids --no-nfs-version 4"

This option does not seem to have any effect (rpcinfo still shows nfs accepting version 4).

Answer 1

Turns out modifying the RPCMOUNTDOPTS variable as described in /etc/default/nfs-kernel-server does not work and there's a bug report for that: #738063

This variable is used in the rpc.mountd call:

# systemctl status nfs-kernel-server
● nfs-kernel-server.service - LSB: Kernel NFS server support
   Loaded: loaded (/etc/init.d/nfs-kernel-server)
   Active: active (running) since Sun 2016-06-12 19:46:01 CEST; 6s ago
  Process: 15110 ExecStop=/etc/init.d/nfs-kernel-server stop (code=exited, status=0/SUCCESS)
  Process: 15119 ExecStart=/etc/init.d/nfs-kernel-server start (code=exited, status=0/SUCCESS)
   CGroup: /system.slice/nfs-kernel-server.service
           └─15167 /usr/sbin/rpc.mountd --manage-gids --port 2048 --no-nfs-version 4

However, clients are still able to mount using -o vers=4.

Instead, this option must be passed to rpc.nfsd. Looking at the init script /etc/init.d/nfs-kernel-server, it seems like the RPCNFSDCOUNT variable is the only variable that's passed to rpc.nfsd. It's not intended for that purpose, but it works and it seems to be the only option short of editing the init script.

Solution:

In /etc/default/nfs-kernel-server, add the --no-nfs-version 4 option to RPCNFSDCOUNT instead of RPCMOUNTDOPTS:

# Number of servers to start up
#RPCNFSDCOUNT=8
RPCNFSDCOUNT="8 --no-nfs-version 4"

Restart the NFS service:

# systemctl restart nfs-kernel-server

Test it:

# mount -t nfs -o vers=4 SERVER:/data/public /mnt
mount.nfs: Protocol not supported

Version 3 still works:

# mount -t nfs -o vers=3 SERVER:/data/public /mnt

Answer 2

Related to the answer by @basic6, I had to figure out where the environments file is held on our CentOS 7 system.

TL;DR

We changed the RPCNFSDARGS variable in /etc/sysconfig/nfs.

Where is the config file?

Here is the systemd service:

sudo systemctl status nfs-server.service        
● nfs-server.service - NFS server and services
   Loaded: loaded (/usr/lib/systemd/system/nfs-server.service; enabled; vendor preset: disabled)
  Drop-In: /run/systemd/generator/nfs-server.service.d
           └─order-with-mounts.conf
   Active: active (exited) since Tue 2019-06-25 13:12:19 CEST; 7min ago
 Main PID: 44563 (code=exited, status=0/SUCCESS)
    Tasks: 0
   Memory: 0B
   CGroup: /system.slice/nfs-server.service

In /usr/lib/systemd/system/nfs-server.service we notice the ExecStart but also EnvironmentFile and the Wants/After service:

[Unit]
...
Wants=nfs-config.service
After=nfs-config.service

[Service]
EnvironmentFile=-/run/sysconfig/nfs-utils
...
ExecStart=/usr/sbin/rpc.nfsd $RPCNFSDARGS

So we may want to change the RPCNFSDARGS variable to include "--no-nfs-version 4". The EnvironmentFile is recreated by the nfs-config service. Let's look into /usr/lib/systemd/system/nfs-config.service:

[Service]
...
ExecStart=/usr/lib/systemd/scripts/nfs-utils_env.sh

That script creates the EnvironmentFile and gets it initial variables from /etc/sysconfig/nfs at the top of its script:

#!/bin/sh

#
# Extract configuration from /etc/sysconfig/nfs and write
# environment variables to /run/sysconfig/nfs-utils to be 
# used by the systemd nfs-config service
#

nfs_config=/etc/sysconfig/nfs
if test -r $nfs_config; then
    . $nfs_config
fi

@basic6 referred to /etc/default/nfs-kernel-server, in our case it is /etc/sysconfig/nfs.

Adding the --no-nfs-version option

Next to that, we choose to change the RPCNFSDARGS variable in /etc/sysconfig/nfs instead of RPCNFSDCOUNT as it seems more neat:

diff --git a/etc/sysconfig/nfs b/var/tmp/nfs.XXS8L74E
index 74104d3..82bc1b4 100644
--- a/etc/sysconfig/nfs
+++ b/var/tmp/nfs.XXS8L74E
@@ -11,7 +11,7 @@
 #LOCKD_UDPPORT=32769
 #
 # Optional arguments passed to rpc.nfsd. See rpc.nfsd(8)
-RPCNFSDARGS=
+RPCNFSDARGS="--no-nfs-version 4"
 # Number of nfs server processes to be started.
 # The default is 8. 
 RPCNFSDCOUNT=32

Answer 3

looks like you want

RPCMOUNTDOPTS="--manage-gids -V 3"

It seems there are no compatibility problem with -V 3 and --manage-gids but I didn't test.

Answer 4

After edit restart nfs-kernel-server On other linux distro i use another method, edit /etc/nfsmount.conf

# Protocol Version [2,3,4]
# This defines the default protocol version which will
# be used to start the negotiation with the server.
Defaultvers=3

Then restart nfs,this enable only nfs3