NFS is structured very differently from SMB, so your requests won't make sense in terms of NFS.
- NFS mounts are done per-system, not per-user.
showmount -d may tell you which systems have a NFS share mounted from a particular server, if the server is willing to disclose that information. On Linux, if
rpc_pipefs virtual filesystem is mounted, it also has information on active NFS connections. Typical
rpc_pipefs mount point is
/run/rpc_pipefs on Debian 9 and related distributions. You can find NFSv4 client information on NFSv4 server's
<rpc_pipefs mount point>/nfsd4_cb/clnt*/info, one client directory for each client host.
- For the client IP addresses, see the previous answer. Individual users are not "connected" per se; there is only one connection per mounted filesystem, even if there are multiple users. As a result, "when connected" only tells you about when the system was last booted, or when the sysadmin mounted the NFS share on the client, whichever is later.
- Change the permissions or ACLs on the shared filesystem to block the user's access, or connect to the client, become root, use
lsof -N to identify the user's processes with open NFS file handles, and kill them. Or unexport the NFS share to "kill" all NFS users at once.
- The audit subsystem on the NFS server can do the job, assuming that you can be certain that the UID/GID numbers on the server and the clients match each other (NFSv2 or v3) or that the usernames have been properly mapped (NFSv4).
With NFSv2 or v3, the NFS server used to be essentially trusting the NFS client to perform appropriate user identification and access control on behalf of the server. That's why the standard advice is to use NFS to share filesystems between trusted hosts only.
Kerberos-based user authentication (and optionally data encryption) was a later add-on: it can be used with NFSv2 and NFSv3 if both the client and the server support the option, but the "sideband protocols" (
statd) won't use the authentication information. Only in NFSv4 was the authentication fully integrated to cover all aspects of the protocol; however, it is still optional.