nfs

来源：互联网发布：淘宝联盟是返利最多的编辑：程序博客网时间：2024/06/05 02:23

#########nfs##########

1.启用服务

yum install nfs-utils

systemctl enable nfs-server.service
systemctl start nfs-server

systemctl start firewalld.service

firewall-cmd --permanent --add-service=nfs
firewall-cmd --permanent --add-service=rpc-bind

firewall-cmd --permanent --add-service=mountd

测试：
showmount -e 172.25.254.124

Export list for 172.25.254.124:

2.共享目录
mkdir /public

chmod 777 /public/

vim /etc/exports ##man 5 exports来查看动作

exportfs rv ##刷新服务，让更改立即生效

要共享的系统目录共享方式

/public *(sync) ##public共享给所有人并且数据同步

测试：

/public 172.25.0.0/24(rw,sync) ##public共享给172.25.0.0/24网段

测试：18网段主机可以访问

254主机不可以访问

/public *.example.com(sync) ##public共享给example.com域的所有主机

/public 172.25.18.11(ro,sync) 172.25.18.10(rw,sync) ##public共享给11是只读，共享给10是写

测试：

11主机只可读：

10主机可读写：

/public *(rw,sync,no_root_squash) ##public共享给所有人，当客户端使用root挂载不转换用户身份

测试：

/public *(rw,sync,anonuid=1001,anongid=1000) ##public共享给所有人以1001为uid,1000为gid

测试：

3.利用kerberos保护nfs输出
在server上
yum install sssd krb5-workstation.x86_64 authconfig-gtk -y
开启kerberos认证，得到ldap用户

wget http://172.25.254.254/pub/keytabs/server24.keytab -O /etc/krb5.keytab
ktutil
ktutil: rkt /etc/krb5.keytab
ktutil: list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
   1    2    host/server24.example.com@EXAMPLE.COM
   2    2    host/server24.example.com@EXAMPLE.COM
   3    2    host/server24.example.com@EXAMPLE.COM
   4    2    host/server24.example.com@EXAMPLE.COM
   5    2    host/server24.example.com@EXAMPLE.COM
   6    2    host/server24.example.com@EXAMPLE.COM
   7    2    host/server24.example.com@EXAMPLE.COM
   8    2    host/server24.example.com@EXAMPLE.COM
   9    2     nfs/server24.example.com@EXAMPLE.COM
10    2     nfs/server24.example.com@EXAMPLE.COM
11    2     nfs/server24.example.com@EXAMPLE.COM
12    2     nfs/server24.example.com@EXAMPLE.COM
13    2     nfs/server24.example.com@EXAMPLE.COM
14    2     nfs/server24.example.com@EXAMPLE.COM
15    2     nfs/server24.example.com@EXAMPLE.COM
16    2     nfs/server24.example.com@EXAMPLE.COM
ktutil: quit

systemctl start nfs-secure-server
systemctl enable nfs-secure-server

vim /etc/exports
/public   *(rw,sec=krb5p)
exportfs -rv

在desktop上
yum install sssd krb5-workstation.x86_64 authconfig-gtk -y
开启kerberos认证，得到ldap用户
vim /etc/hosts
172.25.254.224 server24.example.com

wget http://172.25.254.254/pub/keytabs/desktop24.keytab -O /etc/krb5.keytab
[root@desktop ~]# ktutil
ktutil: rkt /etc/krb5.keytab
ktutil: list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
   1    2   host/desktop24.example.com@EXAMPLE.COM
   2    2   host/desktop24.example.com@EXAMPLE.COM
   3    2   host/desktop24.example.com@EXAMPLE.COM
   4    2   host/desktop24.example.com@EXAMPLE.COM
   5    2   host/desktop24.example.com@EXAMPLE.COM
   6    2   host/desktop24.example.com@EXAMPLE.COM
   7    2   host/desktop24.example.com@EXAMPLE.COM
   8    2   host/desktop24.example.com@EXAMPLE.COM
   9    2    nfs/desktop24.example.com@EXAMPLE.COM
10    2    nfs/desktop24.example.com@EXAMPLE.COM
11    2    nfs/desktop24.example.com@EXAMPLE.COM
12    2    nfs/desktop24.example.com@EXAMPLE.COM
13    2    nfs/desktop24.example.com@EXAMPLE.COM
14    2    nfs/desktop24.example.com@EXAMPLE.COM
15    2    nfs/desktop24.example.com@EXAMPLE.COM
16    2    nfs/desktop24.example.com@EXAMPLE.COM
ktutil: quit

systemctl start nfs-secure
systemctl enable nfs-secure

mount 172.25.254.224:/public /mnt -o sec=krb5p
su - student
cd /mnt
su - ladpuser1
klist
Ticket cache: KEYRING:persistent:1701:krb_ccache_0MQODsG
Default principal: ldapuser1@EXAMPLE.COM

Valid starting       Expires              Service principal
06/03/2017 23:47:36 06/04/2017 23:47:35 krbtgt/EXAMPLE.COM@EXAMPLE.COM
   renew until 06/03/2017 23:47:36
-bash-4.2$ ls /mnt

阅读全文

0 0