We can see high NFS usage for a client that we want to kick off, but not affecting the other NFS clients. How can we do this? Only with using firewall?
-
Is there an explicit access list, or is it wide open?– Jeff Schaller ♦Nov 18, 2016 at 14:32
-
if you don't have an explicit access list, then yes, I think you're down to a firewall or explicitly listing every client except that one, unexporting and re-exporting.– Jeff Schaller ♦Nov 21, 2016 at 15:44
2 Answers
You will need bos.net.ipsec.rte to be able to use an iptables like solution.
check your current installation with:
michael@x071:[/home/michael]lslpp -L bos.net.ipsec.rte
Fileset Level State Type Description (Uninstaller)
----------------------------------------------------------------------------
bos.net.ipsec.rte 6.1.9.45 C F IP Security
If it is already installed, you can check if it is active, or inactive using:
Active:
michael@x071:[/home/michael]lsdev -C | grep ipsec
ipsec_v4 Available IP Version 4 Security Extension
ipsec_v6 Available IP Version 6 Security Extension
Inactive:
root@x064:[/]lsdev -C | grep ipsec
That is no output, meaning it has never been activated, or
root@x072:[/]lsdev -C | grep ipsec
ipsec_v4 Defined IP Version 4 Security Extension
ipsec_v6 Defined IP Version 6 Security Extension
some output meaning there maybe some configuration, but it has been deactivated.
Here are some examples of how you can switch on/off ipsec for v4 and-or v6 ipsec.
root@x072:[/]lsdev -C | grep ipsec
ipsec_v4 Defined IP Version 4 Security Extension
ipsec_v6 Available IP Version 6 Security Extension
root@x072:[/]mkdev -l ipsec_v4
ipsec_v4 Available
root@x072:[/]rmdev -l ipsec_v6
ipsec_v6 Defined
root@x072:[/]lsdev -C | grep ipsec
ipsec_v4 Available IP Version 4 Security Extension
ipsec_v6 Defined IP Version 6 Security Extension
Now to stopping nfs per client (defined as an IP address)
Let's take the IP address 192.168.111.222 as the address of the client I want to stop. There are different actions that can be taken - permit and deny are the common ones - we can be a bit fancy though and use block-port that creates a new dynamic deny rule each time a port tries to connect - this way you can see how active the unique mount requests are:
We need to focus on port 2049
root@x072:[/]grep nfs /etc/services
nfsd-status 1110/tcp # Cluster status info
nfsd-keepalive 1110/udp # Client status info
picknfs 1598/tcp # picknfs
picknfs 1598/udp # picknfs
shiva_confsrvr 1651/tcp # shiva_confsrvr
shiva_confsrvr 1651/udp # shiva_confsrvr
#nfs 2049/tcp # Network File System - Sun Microsystems
#nfs 2049/udp # Network File System - Sun Microsystems
3d-nfsd 2323/tcp # 3d-nfsd
3d-nfsd 2323/udp # 3d-nfsd
mediacntrlnfsd 2363/tcp # Media Central NFSD
mediacntrlnfsd 2363/udp # Media Central NFSD
Note: to use smit(ty) use:
smitty ipsec4
and then use Advanced...->Add
Add an IP Security Filter Rule
Type or select values in entry fields.
Press Enter AFTER making all desired changes.
[Entry Fields]
* Rule Action [shun_port] +
* IP Source Address [192.168.111.222]
* IP Source Mask [255.255.255.255]
IP Destination Address [0.0.0.0]
IP Destination Mask [0.0.0.0]
* Apply to Source Routing? (PERMIT/inbound only) [yes] +
* Protocol [tcp] +
* Source Port / ICMP Type Operation [any] +
* Source Port Number / ICMP Type [0] #
* Destination Port / ICMP Code Operation [eq] +
* Destination Port Number / ICMP Type [2049] #
* Routing [local] +
* Direction [inbound] +
* Log Control [no] +
* Fragmentation Control [0] +
* Interface [all] +
Expiration Time (sec) [300] #
Pattern Type [none] +
Pattern / Pattern File []
Description <g port on NFS request]
Or from the command line:
/usr/sbin/genfilt -v 4 -a 'S' -s '192.168.111.222' -m '255.255.255.255' -d '0.0.0.0' -M '0.0.0.0' -g 'y' -c 'tcp' -o 'any' -p '0' -O 'eq' -P '2049' -r 'L' -w 'I' -l 'N' -t '0' -i 'all' -e '300' -D 'block incoming port on NFS request'
And either in smit, or from the command line - activate the rule
mkfilt -v4 -u
and to see the configured rules
lsfilt -v4 -O
and to see any (maybe) dynamic rules
lsfilt -v4 -a -O
** Comment I cannot yet add: in case you need a change right NOW - as this only affects future connections to the port you can use the commands:
nfs.clean; sleep 2; rc.nfs
to stop, then restart nfs services. Note that
stopsrc -g nfs; startsrc -g nfs
does not start the daemons in the proper sequence
-
-
I hope it does not look complex. I do not think so. But I think iptables are hard. Had I been using iptables rather than mkfilt since 1999 I might think this is hard ;) Nov 22, 2016 at 12:17
-
Ugh - press enter and the comment goes... What I wanted to add is that ipsec is used by AIX hardening (using aixpert) - so ipsec should be installed and ready to go by default. Nov 22, 2016 at 12:19
netstat -an
then use tcpkill
to send reset packets to both sides.
tcpkill uses same params as tcpdump
-
Wouldn't the client just reopen a new TCP connection immediately? This action doesn't make it unmount the resource. Nov 18, 2016 at 17:22
-
-
it sounds like their NFS server is running AIX, which I don't think provides iptables or tcpkill– Jeff Schaller ♦Nov 21, 2016 at 15:42