NFSv4 in Action

This is under OpenSolaris:

[tdh@kanigix 1]> nfsstat -m /net/ultralord/f/1
/net/ultralord/f/1 from ultralord:/f/1
 Flags:         vers=4,proto=tcp,sec=sys,hard,intr,link,symlink,acl,rsize=1048576,wsize=1048576,retrans=5,timeo=600
 Attr cache:    acregmin=3,acregmax=60,acdirmin=30,acdirmax=60

Sorry, the added comments were not being emailed to me. I fixed that and also touched up Q6 to have the AIX entry.

Q: How do I change the ID domain (without rebooting)?

A:

• Data ONTAP:

  simcity> options nfs.v4.id.domain
  internal.excfb.com
  simcity> options nfs.v4.id.domain excfb.com
  simcity>
  

• Linux:

  Edit /etc/idmapd.conf and then:

  [tdh@adept ~]> sudo chkconfig rpcidmapd reset
  [tdh@adept ~]> 
  

• Solaris:

  Edit /etc/default/nfs and then:

  ultralord # cat /var/run/nfs4_domain
  internal.excfb.com
  ultralord # svcadm restart svc:/network/nfs/mapid
  ultralord # cat /var/run/nfs4_domain
  excfb.com
  

• AIX 5.3:

  # chnfsdmn internal.excfb.com
  # startsrc -s nfsrgyd
  # chnfsdmn
  internal.excfb.com
  

Q: How do you determine the ID domain a machine thinks it belongs to?

A:

• Data ONTAP:

  simcity> options nfs.v4.id.domain
  internal.excfb.com
  simcity> 
  

• Linux:

  [tdh@adept log]> sudo cat /proc/net/rpc/nfs4.idtoname/content
  #domain type id [name]
  

• Solaris:

  ultralord # cat /var/run/nfs4_domain
  excfb.com
  ultralord #
  

Q: How come I can't mount a Filer (i.e., running Data ONTAP) via NFSv4?

A: Out of the box, Data ONTAP comes configured with NFSv4 disabled. To enable it, toggle the option nfsv.v4.enable on:

simcity> options nfs.v4.enable on
simcity> 

Q: Why doesn't my keytab work with Triple-DES?

A: Not all Kerberos implementations support Triple-DES. Solaris does, but neither of Linux nor Data ONTAP do.

If Kerberized access is not working, and non-Kerberized access is, then check out your keytab to see if Single-DES is supported. I know of 3 ways to help fix this problem:

• Regenerate your keytab with DES support.
  • Either remove Triple-DES,
  • Or make sure DES is first. Some implementations will not work correctly if Triple-DES is first.
• The TGS ticket enc types can be restricted on the client by changing the krb5.conf file to set the option default_tgs_enctypes to something like: des-cbc-crc.
• Recreate the server's nfs principal to only include the single des enctype.

Q: Why do I still get nobody as an user for Data ONTAP?

A: Because by default, Data ONTAP does not have an /etc/passwd file. You either need to enable NIS, LDAP, or create a /etc/passwd with correct content.

Q: Why do I get nobody as an user?

A: Because your idmap domains are out of whack.

[root@mrx ~]# ls -la /nfs4/will/loghyr
total 63
drwxr-xr-x  10 nobody nobody   512 Nov 10 11:02 .
drwxr-xr-x   3 root   root    4096 Nov  9 21:53 ..
drwxr-xr-x   3 nobody nobody   512 Nov  9 16:37 fedora
drwxr-xr-x  11 nobody nobody   512 Apr  4  2005 home

You can fix this in the following ways, each dependent on your OS:

• Solaris edit /etc/default/nfs and make NFSMAPID_DOMAIN match your other box.
• Linux edit /etc/idmapd.conf and make Domain match your other box.
• Data ONTAP change the option nfs.v4.id.domain and make it match your other box.

I don't know how to do this for other OS variants. Please send me the details and I will add them.

I've got FAQ type questions here and there at different sites. I ran into another one while at Connectathon 2006. I wanted an easy way to collect things and be able to dump them all in from anywhere I happened to be. I don't think my blog fits the bill, I write about many diverse things at Kool Aid Served Daily. I might also gripe about different vendors there.

No, I want a neutral place which is easy to search. So, I'm going to populate the FAQ here.