0

We can see high NFS usage for a client that we want to kick off, but not affecting the other NFS clients. How can we do this? Only with using firewall?

  • Is there an explicit access list, or is it wide open? – Jeff Schaller Nov 18 '16 at 14:32
  • if you don't have an explicit access list, then yes, I think you're down to a firewall or explicitly listing every client except that one, unexporting and re-exporting. – Jeff Schaller Nov 21 '16 at 15:44
1

You will need bos.net.ipsec.rte to be able to use an iptables like solution.

check your current installation with:

michael@x071:[/home/michael]lslpp -L bos.net.ipsec.rte
  Fileset                      Level  State  Type  Description (Uninstaller)
  ----------------------------------------------------------------------------
  bos.net.ipsec.rte         6.1.9.45    C     F    IP Security

If it is already installed, you can check if it is active, or inactive using:

Active:

michael@x071:[/home/michael]lsdev -C | grep ipsec
ipsec_v4    Available       IP Version 4 Security Extension
ipsec_v6    Available       IP Version 6 Security Extension

Inactive:

root@x064:[/]lsdev -C | grep ipsec

That is no output, meaning it has never been activated, or

root@x072:[/]lsdev -C | grep ipsec
ipsec_v4   Defined         IP Version 4 Security Extension
ipsec_v6   Defined         IP Version 6 Security Extension

some output meaning there maybe some configuration, but it has been deactivated.

Here are some examples of how you can switch on/off ipsec for v4 and-or v6 ipsec.

root@x072:[/]lsdev -C | grep ipsec
ipsec_v4   Defined         IP Version 4 Security Extension
ipsec_v6   Available       IP Version 6 Security Extension
root@x072:[/]mkdev -l ipsec_v4
ipsec_v4 Available
root@x072:[/]rmdev -l ipsec_v6
ipsec_v6 Defined
root@x072:[/]lsdev -C | grep ipsec
ipsec_v4   Available       IP Version 4 Security Extension
ipsec_v6   Defined         IP Version 6 Security Extension

Now to stopping nfs per client (defined as an IP address)

Let's take the IP address 192.168.111.222 as the address of the client I want to stop. There are different actions that can be taken - permit and deny are the common ones - we can be a bit fancy though and use block-port that creates a new dynamic deny rule each time a port tries to connect - this way you can see how active the unique mount requests are:

We need to focus on port 2049

root@x072:[/]grep nfs /etc/services
nfsd-status      1110/tcp               # Cluster status info
nfsd-keepalive  1110/udp                # Client status info
picknfs          1598/tcp               # picknfs
picknfs          1598/udp               # picknfs
shiva_confsrvr  1651/tcp                # shiva_confsrvr
shiva_confsrvr  1651/udp                # shiva_confsrvr
#nfs                    2049/tcp                # Network File System - Sun Microsystems
#nfs                    2049/udp                # Network File System - Sun Microsystems
3d-nfsd          2323/tcp               # 3d-nfsd
3d-nfsd          2323/udp               # 3d-nfsd
mediacntrlnfsd  2363/tcp                # Media Central NFSD 
mediacntrlnfsd  2363/udp                # Media Central NFSD 

Note: to use smit(ty) use:

smitty ipsec4

and then use Advanced...->Add

                         Add an IP Security Filter Rule

Type or select values in entry fields.
Press Enter AFTER making all desired changes.

                                                        [Entry Fields]
* Rule Action                                        [shun_port]             +
* IP Source Address                                  [192.168.111.222]
* IP Source Mask                                     [255.255.255.255]
  IP Destination Address                             [0.0.0.0]
  IP Destination Mask                                [0.0.0.0]
* Apply to Source Routing? (PERMIT/inbound only)     [yes]                   +
* Protocol                                           [tcp]                   +
* Source Port / ICMP Type Operation                  [any]                   +
* Source Port Number / ICMP Type                     [0]                      #
* Destination Port / ICMP Code Operation             [eq]                    +
* Destination Port Number / ICMP Type                [2049]                   #
* Routing                                            [local]                 +
* Direction                                          [inbound]               +
* Log Control                                        [no]                    +
* Fragmentation Control                              [0]                     +
* Interface                                          [all]                   +
  Expiration Time  (sec)                             [300]                    #
  Pattern Type                                       [none]                  +
  Pattern / Pattern File                             []
  Description                                        <g port on NFS request]

Or from the command line:

/usr/sbin/genfilt -v 4  -a 'S' -s '192.168.111.222' -m '255.255.255.255' -d '0.0.0.0' -M '0.0.0.0' -g 'y' -c 'tcp' -o 'any' -p '0' -O 'eq' -P '2049' -r 'L' -w 'I' -l 'N' -t '0' -i 'all' -e '300' -D 'block incoming port on NFS request'

And either in smit, or from the command line - activate the rule

mkfilt -v4 -u

and to see the configured rules

lsfilt -v4 -O

and to see any (maybe) dynamic rules

lsfilt -v4 -a -O

** Comment I cannot yet add: in case you need a change right NOW - as this only affects future connections to the port you can use the commands:

nfs.clean; sleep 2; rc.nfs

to stop, then restart nfs services. Note that

stopsrc -g nfs; startsrc -g nfs

does not start the daemons in the proper sequence

  • if there is no other solution, this looks OK! :) – pepite Nov 22 '16 at 11:15
  • I hope it does not look complex. I do not think so. But I think iptables are hard. Had I been using iptables rather than mkfilt since 1999 I might think this is hard ;) – Michael Felt Nov 22 '16 at 12:17
  • Ugh - press enter and the comment goes... What I wanted to add is that ipsec is used by AIX hardening (using aixpert) - so ipsec should be installed and ready to go by default. – Michael Felt Nov 22 '16 at 12:19
0
netstat -an

then use tcpkill to send reset packets to both sides.

tcpkill uses same params as tcpdump

  • Wouldn't the client just reopen a new TCP connection immediately? This action doesn't make it unmount the resource. – BowlOfRed Nov 18 '16 at 17:22
  • update exports / iptables for new connections – mikejonesey Nov 18 '16 at 18:16
  • it sounds like their NFS server is running AIX, which I don't think provides iptables or tcpkill – Jeff Schaller Nov 21 '16 at 15:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.