4

In tutorials on NFSv4 it is common to see the recommendation to export a shared root directory to the entire subnet similar to this from the Arch wiki:

/etc/exports:

/srv/nfs        192.168.1.0/24(rw,sync,crossmnt,fsid=0,no_subtree_check)
/srv/nfs/music  192.168.1.0/24(rw,sync,no_subtree_check)
/srv/nfs/public 192.168.1.0/24(ro,all_squash,insecure,no_subtree_check) desktop(rw,sync,all_squash,anonuid=99,anongid=99,no_subtree_check)

Would it be more secure to not have the first line at all? (Throughout my question, when I mention "first line" I'm referring to the first export line in the snippet above.)

With NFSv4, fsid=0 is optional, and it seems to be mostly a convenience to shorten the path (by translating /srv/nfs to /). In my preliminary testing, the exports do work correctly without that first line as long you one uses /srv/nfs. What, if any, important functions does that first line provide?

I also want to consider the example when we know that there is at least one more bind mount such as this one:

/srv/nfs/projects

(Assume the contents of "projects" are sensitive unlike the music bind mount.)

The first export line, as it is written above, seems to give every client on the LAN access to the entire exported file system, especially with crossmnt and,no_subtree_check. I'm not suggesting that owner and group permissions are ignored, but I am thinking that the exports would work just as well without the first line and that the other bind mounts under /srv/nfs (such as /srv/nfs/projects) would not be unnecessarily opened up to the entire subnet, exposing any potential oversights around owner and group permissions.

Of course, one can add an export similar to this properly share "projects":

/etc/exports:

/srv/nfs/projects 192.168.1.123(rw,sync,root_squash,subtree_check)

Is this new line impacted in any way by the first line? I fail to see how the first export line has served any important purpose.

If having that line is helpful or recommended, would it be wise to do something like this?

/srv/nfs        192.168.1.0/24(ro,sync,fsid=0,subtree_check,all_squash)

Is it correct that the more specific exports that follow will override this one? For example, would the following line properly grant rw access to "music" even when the first line is changed to ro and made more restrictive as in the example below?

/srv/nfs        192.168.1.0/24(ro,sync,fsid=0,subtree_check,all_squash)
/srv/nfs/music  192.168.1.2(rw,sync,no_subtree_check)

Is order important in listing the exports? What determines precedence? Do more specific addresses (e.g., 192.168.1.2) override more general ones (192.168.1.0/24)?

NOTE: there is a single focused theme to this question, and it could probably use a better title to make that clear, but I'm not coming up with the right title for it so far. I welcome edits.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.