11

I am working in a lab with three Ubuntu systems, and I would like to cross-mount some filesystems via NFS. However, while the systems have some of the same usernames, the UIDs and GIDs don't match, because the three systems were set up separately. When I mount an NFS filesystem from one system to another, the ownership shows up wrong. For example, if UID 1000 is alice on server1 and the same UID, 1000, is bob on server2, then when server1 mounts server2's exported filesystem, bob's files appear to be owned by alice.

So Is there any way to make NFS (v4) convert UID's between servers via their associated user names? Googling for this, I've seen lots of references to Kerberos, LDAP, or NIS, which seems like massive overkill for such a simple task, and might not be possible since these systems are not centrally-managed. This link seems to indicate that what I ask is impossible. Is it correct?

Edit: I've tried every configuration for /etc/idmapd.conf that I can think of or find on the internet, and while the idmapd process is clearly running, so far I have not seen any evidence that NFS is making any attempt to use it at all, and it has never had any effect whatsoever on the user ID's reported on NFS mounts.

  • 1
    I believe that the easiest thing for you is to bring all your stuff in order. You may stay with your current auth scheme as you have only three boxes, but you need to sync all users UIDs/GIDs across your boxes. this is not a difficult task actually. – Serge Sep 22 '12 at 17:57
  • Yes, that is what I finally ended up doing. – Ryan Thompson Sep 24 '12 at 23:28
5

With no centralized user administration, the "best" way I see is for you to force all servers to use the same GID and UID for each user. Now ... I'm only talking about files and/or directories.

What I would do in this case is:

  • Register each UID and GID currently in use.
  • Edit /etc/passwd and /etc/group and match the groups on all servers. Preferably to new UIDs and GIDs so the next step will be faster
  • Run this (it will take some time):

    find / -group <OLD_GID> -exec chgrp <NEW_GID> '{}' \+
    find / -user  <OLD_UID> -exec chown <NEW_UID> '{}' \+
    
  • Ummm, the "find" statement is starting from the root directory. The command is changing the ownership of every directory on the system. The suggested changes to these commands will include every file on the system. I suggest you limit which directories this command runs against or you will have a very bad day. – user57226 Jan 20 '14 at 20:05
  • 2
    From find man: -group gname True if the file belongs to the group gname. If gname is numeric and does not appear in the group(4) database, it is taken as a group ID. – BitsOfNix Jan 21 '14 at 9:41
1

NFSv4 supports id mapping. When enabled, NFS will transmit user names instead of numeric ids. Hosts having different numeric uid for the same user is not a problem, as user names are mapped to uids on the host.

Id mapping is always used with Kerberos security modes (sec=krb5).

Id mapping can also be used in AUTH_UNIX (the default sec=sys) mode. I have explained configuration details in answer to: How to get NFSv4 idmap working with sec=sys.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.