Exporting an NFS share
You can export an NFS share with the specified NFS options that can then be accessed by one or more client systems.
If you add a directory that has already been exported with a different NFS option (rw, ro, async, or secure, for example), Access Appliance provides a warning message saying that the directory has already been exported. Access Appliance updates (overwrite) the old NFS options with the new NFS options.
Directory options appear in parentheses.
If a client was not specified when the NFS> share add command was used, then * is displayed as the system to be exported to, indicating that all clients can access the directory.
Directories that have been exported to multiple clients appear as separate entries. Directories that are exported to <world> and other specific clients also appear as separate entries.
For example:
Consider the following set of exported directories where only the client (1.1.1.1) has access to directory (fs2), while all other clients have access only.
share1 /vx/fs2 * (ro)
share2 /vx/fs2 1.1.1.1 (rw)
When sharing a directory, Access Appliance does not check whether the client exists or not. If you add a share for an unknown client, then an entry appears in the NFS> show command output.
The NFS> show fs command displays the list of exportable file systems. If a directory does not exist, the directory is automatically created and exported when you try to export it.
Valid NFS options include the following:
| Grants read and write permission to the directory (including all files under the directory that reside on the exported directory's file system). Hosts mounting this directory will be able to make changes to the directory. |
| Grants read-only permission to the directory. Hosts mounting this directory will not be able to change it. |
| Grants synchronous write access to the directory. Forces the server to perform a disk write before the request is considered complete. |
| Grants asynchronous write access to the directory. Allows the server to write data to the disk when appropriate. |
| Grants secure access to the directory. Requires that clients originate from a secure port. A secure port is between 1-1024. |
| Grants insecure access to the directory. Permits client requests to originate from unprivileged ports (those above 1024). |
| Requires authorization of all locking requests. |
| Some NFS clients do not send credentials with lock requests, and therefore work incorrectly with secure_locks, in which case you can only lock world-readable files. If you have such clients, either replace them with better ones, or use the insecure_locks option. |
| Prevents the root user on an NFS client from having root privileges on an NFS mount. This effectively "squashes" the power of the remote root user to the lowest local user, preventing remote root users from acting as though they were the root user on the local system. |
| Disables the root_squash option. Allows root users on the NFS client to have root privileges on the NFS server. |
| Causes the NFS server to delay writing to the disk if another write request is imminent. This can improve performance by reducing the number of times the disk must be accessed by separate write commands, reducing write overhead. Note: The wdelay option is deprecated, and is supported for backward-compatibility only. |
| Disables the wdelay option. The no_wdelay option has no effect if the async option is also set. Note: The no_wdelay option is deprecated, and is supported for backward-compatibility only. Using the no_wdelay option is always effective. |
| Verifies that the requested file is in an exported subdirectory. If this option is turned off, the only verification is that the file is in an exported file system. |
| Sometimes subtree checking can produce problems when a requested file is renamed while the client has the file open. If many such situations are anticipated, it might be better to set no_subtree_check. One such situation might be the export of the home directory. Most other situations are best handled with subtree_check. |
| Allows the Access Appliance administrator to associate a specific number as fsid with the share. |
| Allows you to disable a readdirplus remote procedure call (RPC). |
| Specifies the Kerberos security options for exporting an NFS share. The value can be krb5, krb5i , krb5p, or sys. The sys option does not provide Kerberos authentication. The other options use Kerberos V5 to authenticate users to the NFS server. |
Note:
With root_squash, the root user can access the share, but with 'nobody' permissions.
To export a directory/file system
- To see your exportable online file systems and snapshots, enter the following:
NFS> show fs
- To see your NFS shares and their options, enter the following:
NFS> share show
- To export a directory, enter the following command:
NFS> share add nfsoptions export_dir [share_name] [client]
nfsoptions
Comma-separated list of export options from the set.
export_dir
Specifies the name of the directory you want to export.
The directory name should start with
/vx, and only a-zA-Z0-9_/@+=.:- characters are allowed for export_dir.share_name
Specifies the share name. If the share name is not specified, then the default value is vxdefault.
client
Clients may be specified in the following ways:
Single host - specify a host either by an abbreviated name that is recognized by the resolver (DNS is the resolver), the fully qualified domain name, or an IP address.
Netgroups - specify netgroups as @group. Only the host part of each netgroup member is considered for checking membership.
IP networks - specify an IP address and netmask pair (address/netmask) to simultaneously export directories to all hosts on an IP sub-network. Specify the netmask as a contiguous mask length. You can specify either an IPv4 address or an IPv6 address.
If the client is not given, then the specified directory can be mounted or accessed by any client. To re-export new options to an existing share, the new options will be updated after the command is run.