0
  1. I want to get NFS user list (client list) like smbstatus
  2. I want to see which user & ip is using which share and when connected.
  3. I want to kill nfs user.
  4. I want to log what an user is doing like "Create, modify, delete".

I want to manage nfs users, but I can't find the information and tools for this problem.

1

NFS is structured very differently from SMB, so your requests won't make sense in terms of NFS.

  1. NFS mounts are done per-system, not per-user. showmount -d may tell you which systems have a NFS share mounted from a particular server, if the server is willing to disclose that information. On Linux, if rpc_pipefs virtual filesystem is mounted, it also has information on active NFS connections. Typical rpc_pipefs mount point is /var/lib/nfs/rpc_pipefs, or /run/rpc_pipefs on Debian 9 and related distributions. You can find NFSv4 client information on NFSv4 server's <rpc_pipefs mount point>/nfsd4_cb/clnt*/info, one client directory for each client host.
  2. For the client IP addresses, see the previous answer. Individual users are not "connected" per se; there is only one connection per mounted filesystem, even if there are multiple users. As a result, "when connected" only tells you about when the system was last booted, or when the sysadmin mounted the NFS share on the client, whichever is later.
  3. Change the permissions or ACLs on the shared filesystem to block the user's access, or connect to the client, become root, use lsof -N to identify the user's processes with open NFS file handles, and kill them. Or unexport the NFS share to "kill" all NFS users at once.
  4. The audit subsystem on the NFS server can do the job, assuming that you can be certain that the UID/GID numbers on the server and the clients match each other (NFSv2 or v3) or that the usernames have been properly mapped (NFSv4).

With NFSv2 or v3, the NFS server used to be essentially trusting the NFS client to perform appropriate user identification and access control on behalf of the server. That's why the standard advice is to use NFS to share filesystems between trusted hosts only.

Kerberos-based user authentication (and optionally data encryption) was a later add-on: it can be used with NFSv2 and NFSv3 if both the client and the server support the option, but the "sideband protocols" (lockd, mountd, rquotad and statd) won't use the authentication information. Only in NFSv4 was the authentication fully integrated to cover all aspects of the protocol; however, it is still optional.

|improve this answer|||||
  • For this reason I want help. We do not necessarily need to get this information from NFS. For example, maybe we will see which ip consumes the system by following the network usage. We can take out user for example by blocking an IP. NFS should have more skills but it is not. somehow we have to overcome it. because it is not manageable. – Morphinz Nov 22 '17 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.