Hi,
I've been using NFS on SuSE/openSuSE Linux for 10 years now and know that
UID/GID must match the server to have the same permissions on the NFS
client box.
I've exported ~10 directories on the server. When the client box still ran
openSuSE 11.2, everything was ok.
Recently, I installed the client with Ubuntu 10.04 64 bit, and now NFS is
partly broken, without making any changes to the server:
* I'm running openLDAP to distribute user information, so UIDs and GIDs
are identical on both the client and the server.
* for certain groups, I get permission problems, for others everything is
fine:
* I have a openLDAP-provided group bbusers which all users belong to.
Home dir perms are <username>:bbusers with either 750 of even 700
permissions on most subdirectoies. No problems here.
* I have another groups provided by openLDAP called bbpcit_p and
bbpict_r and some directories that uses these groups on an NFS export
mounted on the client:
raimund@nfsclient:/nfs/p$ l -d Garten Scans
drwxr-x--- 3 root bbpict_p 36864 2009-09-13 18:46 Garten/
drwxr-x--- 9 root bbpict_r 4096 2008-12-04 21:36 Scans/
Numeric UIDs/GIDs here:
raimund@jupiter:/nfs/p$ l -dn Garten Scans
drwxr-x--- 3 0 1017 36864 2009-09-13 18:46 Garten/
drwxr-x--- 9 0 1007 4096 2008-12-04 21:36 Scans/
I can "cd Scans" without problems, but I can't "cd Garten", I get
"permission denied" If I try the latter. I am a member of both groups:
raimund@jupiter:/nfs/p$ id | tr "," "\n" |grep bbpict_
1007(bbpict_r)
1017(bbpict_p)
* I am sure this is an NFS problem, because when I create directories
with the same permissions/groups an a local filesystem, everything works
just fine. When I SSH into the server I can enter the directories just fine
as well.
* If I do a "sg bbict_p", my default group changes from bbusers
(GID=1000) to bbpict_p. After this procedure I can "cd Garten".
* Could it be that the NFS-client somehow ignores higher GIDs? Groups
with GIDs>=1012 seem to suffer from this problem more often, but I haven't
tested them all. Which config file might contain restrictions like this?
I am pretty much out of ideas on this problem. I would *greatly*
appreciate hints on how to solve it. Please, NFS-experts, enlighten me!
Cheers,
Raimund
On Thu, 2010-06-17 at 07:28 +0200, Raimund Eimann wrote:
> Hi,
>
> I've been using NFS on SuSE/openSuSE Linux for 10 years now and know that
> UID/GID must match the server to have the same permissions on the NFS
> client box.
>
> I've exported ~10 directories on the server. When the client box still ran
> openSuSE 11.2, everything was ok.
>
> Recently, I installed the client with Ubuntu 10.04 64 bit, and now NFS is
> partly broken, without making any changes to the server:
>
> * I'm running openLDAP to distribute user information, so UIDs and GIDs
> are identical on both the client and the server.
>
> * for certain groups, I get permission problems, for others everything is
> fine:
>
> * I have a openLDAP-provided group bbusers which all users belong to.
> Home dir perms are <username>:bbusers with either 750 of even 700
> permissions on most subdirectoies. No problems here.
>
> * I have another groups provided by openLDAP called bbpcit_p and
> bbpict_r and some directories that uses these groups on an NFS export
> mounted on the client:
>
> raimund@nfsclient:/nfs/p$ l -d Garten Scans
> drwxr-x--- 3 root bbpict_p 36864 2009-09-13 18:46 Garten/
> drwxr-x--- 9 root bbpict_r 4096 2008-12-04 21:36 Scans/
>
> Numeric UIDs/GIDs here:
>
> raimund@jupiter:/nfs/p$ l -dn Garten Scans
> drwxr-x--- 3 0 1017 36864 2009-09-13 18:46 Garten/
> drwxr-x--- 9 0 1007 4096 2008-12-04 21:36 Scans/
>
> I can "cd Scans" without problems, but I can't "cd Garten", I get
> "permission denied" If I try the latter. I am a member of both groups:
>
> raimund@jupiter:/nfs/p$ id | tr "," "\n" |grep bbpict_
> 1007(bbpict_r)
> 1017(bbpict_p)
>
> * I am sure this is an NFS problem, because when I create directories
> with the same permissions/groups an a local filesystem, everything works
> just fine. When I SSH into the server I can enter the directories just fine
> as well.
>
> * If I do a "sg bbict_p", my default group changes from bbusers
> (GID=1000) to bbpict_p. After this procedure I can "cd Garten".
>
> * Could it be that the NFS-client somehow ignores higher GIDs? Groups
> with GIDs>=1012 seem to suffer from this problem more often, but I haven't
> tested them all. Which config file might contain restrictions like this?
>
> I am pretty much out of ideas on this problem. I would *greatly*
> appreciate hints on how to solve it. Please, NFS-experts, enlighten me!
The Sun RPC protocol does not support sending more than 16 groups over
the wire, so if 'id -G' shows more than 16 entries, you are probably
going to have issues.
The Linux NFS server has a workaround: if you use the '-g' or
'--manage-gids' argument to mountd, then the server will fill in the
missing groups by looking up your uid in its copy of /etc/passwd.
Cheers
Trond