历经一天有余，终于完成了centos nfs学习系统的任务，一个字，累，还有一个字，累..在学习与译文过程之中，自己还是学到不少东西。对于译文的心得，我会另写一篇文章，吹一吹，描一描。
       在此集中贴出本系列的学习笔记链接，供大家参考，如有实效，不甚荣光.
centos nfs学习前七节笔记
   
    最后一回，自然是文精语简。可谓刀笔剑文，哈哈.总体上来讲，这一节，涉及的文字是最多的，同学们看得时间，希望多花点时间，有点耐心。花了我很多精力，喝了一大桶水，可谓劳苦功高。
    正文如下：
    本节集中论述exportfs命令的相关信息


The exportfs Command
  exportfs命令




Every file system being exported to remote users via NFS, as well as the access level for those
file systems, are listed in the /etc/exports file. When the nfs service starts, the
/usr/sbin/exportfs command launches and reads this file, passes control to rpc.mountd (if
NFSv2 or NFSv3) for the actual mounting process, then to rpc.nfsd where the file systems are
then available to remote users.
   对于每个通过nfs导出的文件系统，以及对这些文件系统的访问级别信息，可以在/etc/exports在找到。
当nfs 服务开启时，exportfs命令开始读取/etc/exports文件中的信息，然后把控制权交给rpc.mountd进程（如果你使用的
是nfsv2或v3版本）,于是这些导出的文件系统，远程用户（nfs client的用户）通过rpc.nfsd进程就可以访问它了


When issued manually, the /usr/sbin/exportfs command allows the root user to selectively
export or unexport directories without restarting the NFS service. When given the proper
options, the /usr/sbin/exportfs command writes the exported file systems to
/var/lib/nfs/xtab. Since rpc.mountd refers to the xtab file when deciding access privileges
to a file system, changes to the list of exported file systems take effect immediately.
    当你手工运行exportfs命令时，充许root用户根据需要导出或取消导出这些目录（导出的），不用重启nfs服务.
当对于特定的合适的选项，exportfs命令把导出的文件系统写到/var/lib/nfs/xtab中.如果要确定对于某个导出文件系统的
访问权限，rpc.mountd会去查对xtab文件的信息.
  


The following is a list of commonly used options available for /usr/sbin/exportfs:
   下列是exportfs命令的一系列常用选项



• -r — Causes all directories listed in /etc/exports to be exported by constructing a new
export list in /etc/lib/nfs/xtab. This option effectively refreshes the export list with any
changes that have been made to /etc/exports.
        在/etc/lib/nfs/xtab中构建一个新的导出列表，根据这些信息导出/etc/exports中所有的目录信息.
如果对/etc/exports作了修改，这个选项会有效刷新导出的列表(译得有些别扭，文字功力差啊）


• -a — Causes all directories to be exported or unexported, depending on what other options
are passed to /usr/sbin/exportfs. If no other options are specified, /usr/sbin/exportfs
exports all file systems specified in /etc/exports.
           视提供给exportfs命令的其它选项，决定是否导出或取消导出所有的目录.默认会导出
/etc/exports所有的文件系统



• -o file-systems — Specifies directories to be exported that are not listed in /etc/exports.
Replace file-systems with additional file systems to be exported. These file systems must
be formatted in the same way they are specified in /etc/exports.
            指定或说明不在/etc/exports文件的导出目录.这些文件系统必须要和/etc/exports指定的格式一样


• -i — Ignores /etc/exports; only options given from the command line are used to define
exported file systems.
         忽略/etc/exports;如果在命令行使用这个选项，用于定义导出的文件系统



• -u — Unexports all shared directories. The command /usr/sbin/exportfs -ua suspends
NFS file sharing while keeping all NFS daemons up. To re-enable NFS sharing, type
exportfs -r.
         取消导出所有的共享目录，exportfs -ua暂时中断nfs文件的系统（虽然所有的nfs进程还在活动之中）.
重启nfs共享，输入exportfs -r



• -v — Verbose operation, where the file systems being exported or unexported are displayed
in greater detail when the exportfs command is executed.
If no options are passed to the /usr/sbin/exportfs command, it displays a list of currently
exported file systems.
For more information about the /usr/sbin/exportfs command, refer to the exportfs man
page.
         这个选项大家一定很熟悉，基本每个linux或unix基本皆有这个选项。以冗余形式显示导出或取消导出的文件系统信息.
如果没有指定选项，exportfs显示目前导出的文件系统列表
 



-----下列具体论述每一种nfs的版本


Using exportfs with NFSv4
   使用nfsv4的exportfs



The exportfs command is used in maintaining the NFS table of exported file systems. When
typed in a terminal with no arguments, the exportfs command shows all the exported
directories.
    exportfs命令用于维护导出的文件系统的列表。不加参数，显示所有的导出目录



Since NFSv4 no longer utilizes the rpc.mountd protocol as was used in NFSv2 and NFSv3, the
mounting of file systems has changed.
An NFSv4 client now has the ability to see all of the exports served by the NFSv4 server as a
single file system, called the NFSv4 pseudo-file system. On Red Hat Enterprise Linux, the
pseudo-file system is identified as a single, real file system, identified at export with the fsid=0
option.
     nfsv4不再使用rpc.mountd协议（但nfsv2,v3仍在用），这样加载文件系统发生了改变.
一个nfsv4客户端现有具备查看所有的nfsv4服务器的导出共享目录信息，且以单一的文件系统呈现出来，这就是所谓的
nfsv4伪文件系统。在redhat中，伪文件系统被表示或识别为一个单一，实时或真正的文件系统，以fsid=0选项导出可以表示它们




For example, the following commands could be executed on an NFSv4 server:
  比如，下列命令可以在nfsv4服务器上执行




mkdir /exports mkdir /exports/opt mkdir /exports/etc mount --bind
/usr/local/opt /exports/opt mount --bind /usr/local/etc /exports/etc
exportfs -o fsid=0,insecure,no_subtree_check gss/krb5p:/exports exportfs -o
rw,nohide,insecure,no_subtree_check gss/krb5p:/exports/opt exportfs -o
rw,nohide,insecure,no_subtree_check gss/krb5p:/exports/etc



In this example, clients are provided with multiple file systems to mount, by using the --bind
option which creates unbreakeable links.
    在以上这个例子中，客户可以加载多个文件系统，通过使用--bind选项（它创建一个不间断的链路）



Because of the pseudo-file systems feature, NFS version 2, 3 and 4 export configurations are
not always compatible. For example, given the following directory tree:
   由于伪文件系统的特征，nfsv2,3,4导出配置有时可能互不兼容。比如，下面这个目录树结构:




/home /home/sam /home/john /home/joe and the export:
   一系列的目录结构（注意：根目录是一致）



/home *(rw,fsid=0,sync)
Using NFS version 2,3 and 4 the following would work:
mount server:/home /mnt/home ls /mnt/home/joe
   导出后，在nfs v2,3,4都可以正常运行



Using v4 the following would work:

mount -t nfs4 server:/ /mnt/home ls /mnt/home/joe
   在nfsv4下也可以正常运行


The difference being "server:/home" and "server:/". To make the exports configurations
compatible for all version, one needs to export (read only) the root filesystem with an fsid=0.
The fsid=0 signals the NFS server that this export is the root.
/ *(ro,fsid=0) /home *(rw,sync,nohide)
Now with these exports, both "mount server:/home /mnt/home" and "mount -t nfs
server:/home /mnt/home" will work as expected.
     但导出目录server:/home与server:/还有区别的。哈哈。为了兼容所有的导出配置信息，导出根文件系统必须要指定
fsid=0,这样fsid=o会给nfs server发一个特殊信号，别瞎玩，我是根目录，嘿嘿！！
     如果你指定这些选项，mount server:/home /mnt/home和mount -t nfs serer:/home /mnt/home将正常工作









 Securing NFS
   加固nfs的信息安全



NFS is well suited for sharing entire file systems with a large number of known hosts in a
transparent manner. However, with ease of use comes a variety of potential security problems.
The following points should be considered when exporting NFS file systems on a server or
mounting them on a client. Doing so minimizes NFS security risks and better protects data on
the server.
      nfs设计良好，可以完全满足大量主机使用的共享文件系统，并且以透明方式供外界使用。但是，正因为易于使用，
由此也引入了各种各类潜在的安全问题。当你导出服务器上的文件系统或在客户端加载它们时，必须要考虑几点，这样作可以减少
nfs安全风险，更好保护服务器上面的数据.





   Host Access
      主机访问控制



Depending on which version of NFS you plan to implement, depends on your existing network
environment, and your security concerns. The following sections explain the differences
between implementing security measures with NFSv2, NFSv3, and NFSv4. If at all possible,
use of NFSv4 is recommended over other versions of NFS.
    根据你使用的nfs版本及相应的网络环境，当然还有你注重的安全相关问题。下列着重讲解基于nfsv2,v3,v4的
实施信息安全的不同点。如果你采用了混合版本，建议优先选用nfsv4版本.



8.1.1. Using NFSv2 or NFSv3
          使用nfsv2或v3





NFS controls who can mount an exported file system based on the host making the mount
request, not the user that actually uses the file system. Hosts must be given explicit rights to
Securing NFS
     nfs它会根据需要加载文件系统客户端的请求，控制谁能加载被导出的文件系统，而不是访问文件系统的用户.
这些nfs client主机必须被授予经过加固nfs的权限



mount the exported file system. Access control is not possible for users, other than through file
and directory permissions. In other words, once a file system is exported via NFS, any user on
any remote host connected to the NFS server can access the shared data. To limit the potential
risks, administrators often allow read-only access or squash user permissions to a common
user and group ID. Unfortunately, these solutions prevent the NFS share from being used in the
way it was originally intended.
    加载了被导出的文件系统，acl对于用户不可用（或者讲用户不能使用acl功能），除非通常文件和目录显式授权。
换名话说，一旦一个文件系统通过nfs被导出。远程连接到nfs server的用户可以访问这些共享数据。为了限制潜在的风险,
管理员经常只开启只读权限或只开启通用用户的uid和gid。但不幸的是，这种解决方法违反了nfs的初衷.



Additionally, if an attacker gains control of the DNS server used by the system exporting the
NFS file system, the system associated with a particular hostname or fully qualified domain
name can be pointed to an unauthorized machine. At this point, the unauthorized machine is the
system permitted to mount the NFS share, since no username or password information is
exchanged to provide additional security for the NFS mount.
Wildcards should be used sparingly when exporting directories via NFS as it is possible for the
scope of the wildcard to encompass more systems than intended.
It is also possible to restrict access to the portmap service via TCP wrappers. Access to ports
used by portmap, rpc.mountd, and rpc.nfsd can also be limited by creating firewall rules with
iptables.
     另外，如果黑客有机会控制dns server（nfs主机会使用它），与这些dns主机相关的系统或主会指向一个未经授权的共享,
导致访问一些nfs加载的文件系统不用提供用户及密码，带来更多的安全问题




Using NFSv4
  使用nfsv4相关问题

The release of NFSv4 brought a revolution to authentication and security to NFS exports.
NFSv4 mandates the implementation of the RPCSEC_GSS kernel module, the Kerberos
version 5 GSS-API mechanism, SPKM-3, and LIPKEY. With NFSv4, the mandatory security
mechanisms are oriented towards authenticating individual users, and not client machines as
used in NFSv2 and NFSv3.
      nfsv4为与nfs exports相关的认证和安全问题,带来了革命性（根本性）的解决方案或福音.
nfsv4必须要实行rpcsec_gss内核模块，the Kerberos  version 5 GSS-API mechanism, SPKM-3, and LIPKEY.
nfsv4强制使用安全机制，主要目的认证单独的用户，而不像在nfsv2,v3服务于nfs client machine,更为丰富了
细粒度的安全




Note
  通告

It is assumed that a Kerberos ticket-granting server (KDC) is installed and
configured correctly, prior to configuring an NFSv4 server. Kerberos is a network
authentication system which allows clients and servers to authenticate to each
other through use of symmetric encryption and a trusted third party, the KDC.
NFSv4 includes ACL support based on the Microsoft Windows NT model, not the POSIX model,
because of its features and because it is widely deployed. NFSv2 and NFSv3 do not have
support for native ACL attributes.
     这个我不再细述了，很简单；本人不是sa,kerboras是一个大主题；有兴趣的同学，可以参考手册自行研究



Another important security feature of NFSv4 is its removal of the rpc.mountd daemon. The
rpc.mountd daemon presented possible security holes because of the way it dealt with
filehandlers.
For more information on the RPCSEC_GSS framework, including how rpc.svcgssd and
   nfsv4另一个重要的安全特征就是，不再需要rpc.mountd进程了。rpc.mountd进程会带来可能的安全漏洞,
原因就在于它以filehander方式进行工作


 Network File System (NFS)
 



8.2. File Permissions
    文件权限（或授权）


Once the NFS file system is mounted read/write by a remote host, the only protection each
shared file has is its permissions. If two users that share the same user ID value mount the
same NFS file system, they can modify each others files. Additionally, anyone logged in as root
on the client system can use the su - command to become a user who could access particular
files via the NFS share.
   一旦远程主机以读写方式加载了nfs文件系统，保护每一个共享文件途径就是它的权限。假如这里有两个用户,
共享同一个uid，并且同时加载了相同的nfs文件系统，这样它们可以相互修改文件。而且，nfs client上以root用户
登陆的用户，是具有su权利的，它也可以通过n访问nfs共享出来的特有文件



By default, access control lists (ACLs) are supported by NFS under Red Hat Enterprise Linux. It
is not recommended that this feature be disabled.
   默认情况下，在rhel下支持acl功能，不建议关闭这个功能


The default behavior. when exporting a file system via NFS is to use root squashing. This sets
the user ID of anyone accessing the NFS share as the root user on their local machine to a
value of the server's nfsnobody account. Never turn off root squashing.
     默认情况下，导出一个基于nfs的文件系统，使用root压制（译文不妥，请指正）.它会为任何一个访问nfs共享文件
的用户，设置一个特定的基于服务器nfsnobody帐户的uid.



 
If exporting an NFS share as read-only, consider using the all_squash option, which makes
every user accessing the exported file system take the user ID of the nfsnobody user.
    如果以只读方式导出nfs共享，可以考虑利用all_squash选项，会为每个访问共享文件系统的用户一个nfsnobody用户的uid



9. NFS and portmap
     nfs和portmap



Note
  通告

The following section only applies to NFSv2 or NFSv3 implementations that
require the portmap service for backward compatibility.
The portmapper maps RPC services to the ports they are listening on. RPC processes notify
portmap when they start, registering the ports they are listening on and the RPC program
numbers they expect to serve. The client system then contacts portmap on the server with a
particular RPC program number. The portmap service redirects the client to the proper port
number so it can communicate with the requested service.
  下面的小节（部分）仅适用于nfsv2,v3，这些版本为了向后兼容需要启动portmap服务.portmapper会在
rpc服务与rpc监听的端口之间构建一种映射关系。rpc进程在启动时，会通知portmap,注册它们（rpc程序或进程）
所监听的端口以及rpc程序对应的编号。这样一来，客户端（nfs client)然后会用一个特定的rpc程序编号，与
nfs server上面的portmap进行联系。portmap服务然后可以把这个来自客户端的连接重新导向给一个合适的端口,
这样它就可以与请求的服务进行正常通讯了（看到了吧，portmap服务是多么重要）





Because RP广告d services rely on portmap to make all connections with incoming client
requests, portmap must be available before any of these services start.
The portmap service uses TCP wrappers for access control, and access control rules for
portmap affect all RP广告d services. Alternatively, it is possible to specify access control
rules for each of the NFS RPC daemons. The man pages for rpc.mountd and rpc.statd
contain information regarding the precise syntax for these rules.
   因为基于rpc的服务全部依赖于portmap，通过它来接受来自nfs client的接入请求连接，因此rpc服务开启之
前，必须确保portmap服务是正常可用的.
   portmap服务使用tcp wrapper实现acl,基于portmap的规则会影响所有基于rpc的服务。当然你可以单独为每个
nfs rpc进程指定相应的acl.具体如何使用，请查阅man rpc.mountd和rpc.statd






9.1. Troubleshooting NFS and portmap
         处理nfs和portmap的疑难问题



 
Because portmap provides coordination between RPC services and the port numbers used to
communicate with them, it is useful to view the status of current RPC services using portmap
when troubleshooting. The rpcinfo command shows each RP广告d service with port
File Permissions
     因为portmap可以协调rpc服务和用于互相连接rcp服务的端口号之间的关系，所以使用portmap
查看当前rpc服务的工作状态是非常有用的。具体可以用rpcinfo命令显示每个基于rpc服务和端口文件的权限相关信息




numbers, an RPC program number, a version number, and an IP protocol type (TCP or UDP).
To make sure the proper NFS RP广告d services are enabled for portmap, issue the following
command as root:
rpcinfo -p
The following is sample output from this command:
program vers proto port 100000 2 tcp 111 portmapper 100000 2 udp 111
portmapper 100021 1 udp 32774 nlockmgr 100021 3 udp 32774 nlockmgr 100021 4
udp 32774 nlockmgr 100021 1 tcp 34437 nlockmgr 100021 3 tcp 34437 nlockmgr
100021 4 tcp 34437 nlockmgr 100011 1 udp 819 rquotad 100011 2 udp 819
rquotad 100011 1 tcp 822 rquotad 100011 2 tcp 822 rquotad 100003 2 udp 2049
nfs 100003 3 udp 2049 nfs 100003 2 tcp 2049 nfs 100003 3 tcp 2049 nfs 100005
1 udp 836 mountd 100005 1 tcp 839 mountd 100005 2 udp 836 mountd 100005 2
tcp 839 mountd 100005 3 udp 836 mountd 100005 3 tcp 839 mountd
    以上列举了rpcinfo的用法(细节不再讲解）



If one of the NFS services does not start up correctly, portmap is unable to map RPC requests
from clients for that service to the correct port. In many cases, if NFS is not present in rpcinfo
output, restarting NFS causes the service to correctly register with portmap and begin working.
    如果nfs服务状态不正常，portmap不能映射来自客户端对于某个基于rpc服务的请求到正确的端口。
在大多数情况下，如果rpcinfo结果中没有显示nfs,重启nfs会使服务正确注册到portmap之中，并正常开始工作
    


10. Using NFS over TCP
      基于tcp使用nfs
 
The default transport protocol for NFSv4 is TCP; however, the Red Hat Enterprise Linux 5
kernel includes support for NFS over UDP. To use NFS over UDP, include the -o udp option to
mount when mounting the NFS-exported file system on the client system.
    nfsv4默认的传输协议就是tcp; 但是rhel5内核支持基于udp的nfs。为了使用基于udp的nfs,
在加载时，请指定-o选项



The advantages of using TCP include the following:
   使用tcp的好处有如下几点：

• Improved connection durability, thus less NFS stale file handles messages.
        提升了连接的持续性；因此需要更少的nfs陈旧文件句柄信息


• Performance gain on heavily loaded networks because TCP acknowledges every packet,
unlike UDP which only acknowledges completion.
      由于tcp会去确认每个包，和udp不同，它仅在结束时进行一次确认；这样在超重负担的网络环境，会带来
很大的好处


• TCP has better congestion control than UDP. On a very congested network, UDP packets are
the first packets that are dropped. This means that if NFS is writing data (in 8K chunks) all of
that 8K must be retransmitted over UDP. Because of TCP's reliability, only parts of that 8K
data are transmitted at a time.
        tcp比udp具有更好的congestion控制（congestion不好译），udp包是被删除的第一个包。这意味着，
如果nfs以8k chunks为单位写入数据，但必须基于udp进行重传时。由于rcp的可靠性机制，每次只有8k部分的数据
被传递





• Error detection. When a TCP connection breaks (due to the server being unavailable) the
client stops sending data and restarts the connection process once the server becomes
available. With UDP, since it's connection-less, the client continues to pound the network with
data until the server reestablishes a connection.
The main disadvantage is that there is a very small performance hit due to the overhead
associated with the TCP protocol.
     错语检测。当一个tcp连接中断时（由于服务器不可用），此时客户端会停止发送数据，一旦服务恢复正常，它会重新开启连接进程.
但对于udp,因为它是一种少型连接的类型（connection-less),导致客户端会继续发送数据，直至服务重新建立这个出现问题的连接.
   使用tcp最大的不足就是，由于与tcp协议的一些附加成本，会产生很小量的对于性能的影响.