NetworkFileSystem:Install:Client

lastmod 2026-02-09created 2026-02-093 edits

NFS client connection (secure mount)

Install the NFS client

sudo apt install -y nfs-common

Create and test the mount directory

# 마운트 포인트 생성 / Create mount point
sudo mkdir -p /mnt/nfs

# 마운트 테스트 (보안 옵션 포함) / Test mount with security options
sudo mount -t nfs4 -o sec=sys,noexec,nosuid,nodev 192.168.1.50:/ /mnt/nfs

# 마운트 확인 / Verify mount
df -hT /mnt/nfs
mount | grep nfs4

Persist in fstab

echo "192.168.1.50:/shared /mnt/nfs nfs4 sec=sys,noexec,nosuid,nodev,hard,intr,timeo=600 0 0" | sudo tee -a /etc/fstab

# fstab 문법 검증 / Verify fstab syntax
sudo mount -a

Client mount security options

Option	Description	Reason
noexec	Blocks running executables on the NFS mount	Prevents remote execution of malicious binaries
nosuid	Ignores SUID/SGID bits	Blocks privilege escalation attacks
nodev	Blocks interpretation of device files	Prevents attacks via fake device files
hard	Retries indefinitely when the server does not respond	Prevents data loss (soft risks data corruption)
intr	Allows interrupts in hard mode	Can abort with Ctrl+C when the server fails
timeo=600	60-second timeout (unit: 1/10 second)	Leaves headroom for network latency
sec=sys	Uses system UID/GID authentication	Must match the server settings (change when using krb5p)

Automount (autofs) alternative

A way to mount only when needed, reducing unnecessary always-on connections:

# autofs 설치 / Install autofs
sudo apt install -y autofs

# 마스터 맵 설정 / Configure master map
echo "/mnt/nfs /etc/auto.nfs --timeout=300" | sudo tee -a /etc/auto.master

# NFS 맵 설정 / Configure NFS map
echo "shared -fstype=nfs4,sec=sys,noexec,nosuid,nodev,hard,intr 192.168.1.50:/shared" | sudo tee /etc/auto.nfs

sudo systemctl enable --now autofs

Method	Pros	Cons
fstab (persistent mount)	Mounts automatically at boot, simple setup	Can delay boot when the server is down
autofs (automount)	Mounts only when used, saves resources	Slight delay on first access

Client-side firewall

To restrict outbound traffic to the minimum on the client as well:

# NFS 서버로의 아웃바운드만 허용 (선택적) / Optional outbound restriction
sudo ufw allow out to 192.168.1.50 port 2049 proto tcp comment 'NFS-server'