NetworkFileSystem:Install:Server

lastmod 2026-02-09created 2026-02-092 edits

NFS server configuration (with security applied)

Linux security configuration

NFSv4 Only installation

Using only NFSv4 fixes the port to a single 2049/tcp, which simplifies firewall management and is better for security. v2/v3 use rpcbind and several dynamic ports, so always disable them.

sudo apt install -y nfs-kernel-server

# NFSv4만 허용 (v2, v3 차단) / Enable NFSv4 only
sudo tee /etc/default/nfs-kernel-server << 'EOF'
RPCNFSDCOUNT=8
RPCNFSDPRIORITY=0
RPCMOUNTDOPTS="--manage-gids --no-nfs-version 2 --no-nfs-version 3"
RPCSVCGSSDOPTS=""
RPCNFSDOPTS="-N 2 -N 3"
NEED_SVCGSSD=""
EOF

# rpcbind 비활성화 (NFSv4는 불필요) / Disable rpcbind
sudo systemctl disable --now rpcbind.service rpcbind.socket

NFS version	Required ports	Security assessment
NFSv2/v3	111 (rpcbind), 2049, many dynamic ports	Vulnerable — requires opening many ports
NFSv4	2049/tcp only	Recommended — single port, easy firewall management

Create the NFS shared directory

NFSv4 works on top of a pseudo filesystem, so create a separate root directory and use bind mounts.

# NFSv4 루트 (pseudo filesystem) / Create NFSv4 root
sudo mkdir -p /srv/nfs4
sudo mkdir -p /srv/nfs4/shared
sudo mkdir -p /srv/nfs4/homes

# 실제 데이터 디렉토리를 bind mount / Bind mount data directory
sudo mkdir -p /data/shared
sudo mount --bind /data/shared /srv/nfs4/shared

# fstab에 영구 등록 / Persist in fstab
echo "/data/shared /srv/nfs4/shared none bind 0 0" | sudo tee -a /etc/fstab

/etc/exports configuration (least privilege)

Kerberos environment (highest security)

sudo tee /etc/exports << 'EOF'
# NFSv4 pseudo root
/srv/nfs4        192.168.1.0/24(ro,fsid=0,no_subtree_check,crossmnt,sec=krb5p)

# 공유 디렉토리 - 특정 IP만 허용, root squash 적용
/srv/nfs4/shared 192.168.1.100(rw,sync,no_subtree_check,root_squash,sec=krb5p,anonuid=65534,anongid=65534)
/srv/nfs4/shared 192.168.1.101(ro,sync,no_subtree_check,root_squash,sec=krb5p)
EOF

sec=krb5p is the most secure, but it requires a separate Kerberos infrastructure (KDC). In home and small environments, the sec=sys + firewall IP restriction combination below is the practical choice.

=== Maximizing practical security without Kerberos (based on sec=sys) ===

sudo tee /etc/exports << 'EOF'
/srv/nfs4        192.168.1.0/24(ro,fsid=0,no_subtree_check,crossmnt,sec=sys)

# all_squash로 모든 원격 사용자를 특정 UID로 제한
# Map all remote users to specific UID with all_squash
/srv/nfs4/shared 192.168.1.100(rw,sync,no_subtree_check,all_squash,anonuid=1100,anongid=1100,sec=sys)
EOF

# 전용 NFS 사용자 생성 / Create dedicated NFS user
sudo groupadd -g 1100 nfsuser
sudo useradd -u 1100 -g 1100 -s /usr/sbin/nologin -d /nonexistent nfsuser

# 디렉토리 권한 설정 / Set directory permissions
sudo chown -R nfsuser:nfsuser /data/shared
sudo chmod 770 /data/shared

sudo exportfs -ra

exports security options in detail

Option	Description	Security level
root_squash	Maps the client's root to nobody (default)	Basic security
all_squash	Maps all remote users to nobody (or a specified UID)	Hardened
sync	Responds after writes complete (guarantees data integrity)	Data safety
no_subtree_check	Improves performance and stability (subtree_check has race condition issues)	Recommended
sec=krb5p	Kerberos authentication + data encryption	Highest
sec=krb5i	Kerberos authentication + integrity checking	High
sec=krb5	Kerberos authentication only	Medium
sec=sys	System UID/GID-based authentication	Basic
anonuid / anongid	Specifies the UID/GID of squashed users	Control

Add NFS rules to the firewall

Allow only per client IP, and never open it to the entire network.

# NFSv4는 2049/tcp만 필요 / NFSv4 requires only 2049/tcp
sudo ufw allow from 192.168.1.100 to any port 2049 proto tcp comment 'NFS-client1'
sudo ufw allow from 192.168.1.101 to any port 2049 proto tcp comment 'NFS-client2'

# 규칙 확인 / Verify rules
sudo ufw status numbered

Start and verify the NFS server

sudo systemctl enable --now nfs-server

# 내보내기 확인 / Verify exports
sudo exportfs -v

# 포트 확인 / Verify port
sudo ss -tlnp | grep 2049