CentOS6.3 经由SSH Tunnel 挂载 NFS

最近在项目开发过程中遇到一个问题，通过Web读取NFS服务器的文件时，如何保证网络传输的安全性？由于不想增加开发的复杂性，便采取了使用SSH通道的方式进行挂载。下面大致说明一下配置过程。

环境说明

NFS Server：192.168.86.228  OS：CentOS6.3

NFS Client：192.168.86.66      OS：CentOS6.3

NFS服务器端配置如下

前提条件

NFS服务已经安装完毕（这里不再说明安装过程）

/etc/sysconfig/nfs配置如下

#
# Define which protocol versions mountd
# will advertise. The values are "no" or "yes"
# with yes being the default
#MOUNTD_NFS_V2="no"
#MOUNTD_NFS_V3="no"
MOUNTD_NFS_V2="no"
MOUNTD_NFS_V3="no"
#
#
# Path to remote quota server. See rquotad(8)
#RQUOTAD="/usr/sbin/rpc.rquotad"
RQUOTAD=no
# Port rquotad should listen on.
#RQUOTAD_PORT=875
# Optinal options passed to rquotad
#RPCRQUOTADOPTS=""
#
#
# Optional arguments passed to in-kernel lockd
#LOCKDARG=
# TCP port rpc.lockd should listen on.
#LOCKD_TCPPORT=32803
LOCKD_TCPPORT=32803
# UDP port rpc.lockd should listen on.
#LOCKD_UDPPORT=32769
LOCKD_UDPPORT=32769
#
#
# Optional arguments passed to rpc.nfsd. See rpc.nfsd(8)
# Turn off v2 and v3 protocol support
#RPCNFSDARGS="-N 2 -N 3"
RPCNFSDARGS="-N 2 -N 3 -U"
# Turn off v4 protocol support
#RPCNFSDARGS="-N 4"
# Number of nfs server processes to be started.
# The default is 8.
#RPCNFSDCOUNT=8
# Stop the nfsd module from being pre-loaded
#NFSD_MODULE="noload"
# Set V4 grace period in seconds
#NFSD_V4_GRACE=90
#
#
#
# Optional arguments passed to rpc.mountd. See rpc.mountd(8)
#RPCMOUNTDOPTS=""
# Port rpc.mountd should listen on.
#MOUNTD_PORT=892
#
#
# Optional arguments passed to rpc.statd. See rpc.statd(8)
#STATDARG=""
# Port rpc.statd should listen on.
#STATD_PORT=662
# Outgoing port statd should used. The default is port
# is random
#STATD_OUTGOING_PORT=2020
# Specify callout program
#STATD_HA_CALLOUT="/usr/local/bin/foo"
#
#
# Optional arguments passed to rpc.idmapd. See rpc.idmapd(8)
#RPCIDMAPDARGS=""
#
# Set to turn on Secure NFS mounts.
#SECURE_NFS="yes"
# Optional arguments passed to rpc.gssd. See rpc.gssd(8)
#RPCGSSDARGS=""
# Optional arguments passed to rpc.svcgssd. See rpc.svcgssd(8)
#RPCSVCGSSDARGS=""
#
# To enable RDMA support on the server by setting this to
# the port the server should listen on
#RDMA_PORT=20049

/etc/exports配置如下

/home/cmatc 192.168.86.66/24(insecure,rw)

启动NFS服务

service rpcbind restart
service nfs restart

/etc/ssh/sshd_config配置如下

AllowTcpForwarding yes

NFS客户端配置如下

ssh -fN -L 3049:192.168.86.53:2049 root@192.168.86.53  #通过客户端的3049端口与NFS通信（NFS的默认端口是2049）
mount -t nfs4 -o port=3049 localhost:/home/cmatc /tmp/nfs #注意这里一定要写成localhost