Re: FC8 and NFS service

Robin Laing wrote:
Bill Davidsen wrote:
Terry Polzin wrote:
On Wednesday 20 February 2008 14:32, Bill Davidsen wrote:
I am trying to replace a bunch of NFS servers with new machines running
FC8. The NFS server is doing some kind of evil security check which was
not present in FC1, causing connection rejects like "invalid port
XXXXXX" messages. Since the port works against the FC1 server, and there
are 120-140 clients per server, running various operating systems, the
solution lies in telling the NFS service to stop doing the unwanted
security check and treat anything coming through iptables as valid.

Has someone a thought on this? Changing clients isn't going to happen,
and it seems the Solaris NFS server works (or the upgrade from FC1 might
be dropped).

--
Bill Davidsen <davidsen@xxxxxxx>
"We have more to fear from the bungling of the incompetent than from
the machinations of the wicked." - from Slashdot
Can we see your /etc/exports file? You may need to add insecure to your exports to use some ports in newer NFS instances.
I'm not that far along, I have just been exporting with exportfs at the moment, and I have turned secure mounts off. If that gets all clients working I'll change to using insecure.

Newer instances is right, I'm building a FC9alpha1 test box as I type, I'll test both client and server on FC[6789] and client on everything.

More later, thanks.



After having fought with NFS for a weekend I found that you have to define the ports in the NFS configuration files and then open them up in the firewall.

/etc/sysconfig/nfs

When I get an answer like this I know either I didn't explain the problem well or I don't follow at all what you are trying to do. The firewall is open now, and has been, all tcp/udp/icmp is accepted from the trusted subnet. I'm attaching my nfs file in case it tells you something it doesn't tell me.

The ports are random now.

Exactly, but even with secure NFS off I still get stuff like:
Feb 21 21:50:33 posidon mountd[26030]: refused mount request from 192.168.2.17 for /common (/common
): illegal port 60080

I can attach that if the folding is an issue. But no matter what I set in any server file, I can't change the behavior of the clients, so I need to accept what the clients have been using all along against servers on FC1 and Solaris.

At home I have now moved to sshfs instead of nfs, more secure and easier to setup.

The logistics of changing clients in any way are unacceptable. Too many clients, too many old O/S types and versions. The server has to use any port that fits in 16 bits and stop trying to do the firewall's job.

--
Bill Davidsen <davidsen@xxxxxxx>
"We have more to fear from the bungling of the incompetent than from
the machinations of the wicked." - from Slashdot

--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list

Relevant Pages

  • RE: Printing from Win9x clients stops
    ... > and make sure this software does not interfere with SBS Server. ... > clients, please disable it and try again. ... Create a local printer and redirect the port to the network server. ...
    (microsoft.public.windows.server.sbs)
  • V210 BGE0@1000FDX (Adam Tomkinson)
    ... sunmanagers Digest, Vol 31, Issue 28 ... When connecting a server to a Gig interface you need to enable autoneg ... Blocked port after process kill ... NFS oddity ...
    (SunManagers)
  • V210 BGE0@1000FDX
    ... When connecting a server to a Gig interface you need to enable autoneg ... Blocked port after process kill ... NFS oddity ... where hostname is the name of the NFS client which will automount the ...
    (SunManagers)
  • Re: Filesystem monitoring question
    ... server as a directory. ... A number of SMB and NFS clients, around 30, will need to write to this ... Writing to the directory is 24/7 since some clients VPN into the network ...
    (freebsd-hackers)
  • NFS UDP fast server slow client problems
    ... Fast NFS server causing SLOW NFS reads on Tru64 clients ...
    (Tru64-UNIX-Managers)