Discussion:
Restricting NFS-Ganesha to use NFSv4.0 only
(too old to reply)
Nico van Royen
2018-11-23 18:42:19 UTC
Permalink
Hi All,

In a bugzilla ( [ https://bugzilla.redhat.com/show_bug.cgi?id=1546713 | https://bugzilla.redhat.com/show_bug.cgi?id=1546713 ] ) I was reading it showed that it should be possible to restrict the NFSv4 usage to only use 4.0 (since 4.1/4.2 is not supported).
To try that, I modified an existing share so it reads :

EXPORT{
Export_Id = 2;
Path = "/DATA";
FSAL {
name = GLUSTER;
hostname="localhost";
volume="DATA";
}
Access_type = RW;
Disable_ACL = true;
Squash="No_root_squash";
Pseudo="/DATA";
Protocols = "4" ;
Transports = "UDP","TCP";
SecType = "sys";
NFSv4 {
minor_versions = 0;
}
}

And restarted the nfs- ganesha service. Seemed to start fine and mounted the share from a client and specifying the mount option "-o vers=4.1" and indeed it mounted it with NFSv4.1 (I was expecting/hoping it would refuse to mount).

What is (or should be) the way to only allow NFSv4.0 exports (if possible at all) ?

Running GlusterFS 3.12 / RHGS 3.4 with packages :
bash-4.2# rpm -qa | grep ganesha
glusterfs- ganesha -3.12.2-18.el7rhgs.x86_64
nfs- ganesha -2.5.5-10.el7rhgs.x86_64
nfs- ganesha -gluster-2.5.5-10.el7rhgs.x86_64

bash-4.2# rpm -qa | grep ^glusterfs
glusterfs-libs-3.12.2-18.el7rhgs.x86_64
glusterfs- ganesha -3.12.2-18.el7rhgs.x86_64
glusterfs-client-xlators-3.12.2-18.el7rhgs.x86_64
glusterfs-fuse-3.12.2-18.el7rhgs.x86_64
glusterfs-cli-3.12.2-18.el7rhgs.x86_64
glusterfs-api-3.12.2-18.el7rhgs.x86_64
glusterfs-server-3.12.2-18.el7rhgs.x86_64
glusterfs-3.12.2-18.el7rhgs.x86_64

Thanks in advance,
Nico van Roijen
Kaleb S. KEITHLEY
2018-11-23 23:20:14 UTC
Permalink
Post by Nico van Royen
Hi All,
In a bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=1546713) I
was reading it showed that it should be possible to restrict the NFSv4
usage to only use 4.0 (since 4.1/4.2 is not supported).
Who is telling you that 4.1 and 4.2 aren't supported?

Because NFS-Ganesha does, in fact, support NFSv4.1, NFSv4.2, and pNFS.

(Maybe you're thinking of the nfs-ganesha server in Red Hat's RHGS (Red
Hat Gluster Storage) or RHCS (Red Hat Ceph Storage), where 4.1 and 4.2
are not supported.)
Post by Nico van Royen
EXPORT{
      Export_Id = 2;
      Path = "/DATA";
      FSAL {
           name = GLUSTER;
           hostname="localhost";
           volume="DATA";
           }
      Access_type = RW;
      Disable_ACL = true;
      Squash="No_root_squash";
      Pseudo="/DATA";
      Protocols = "4" ;
      Transports = "UDP","TCP";
      SecType = "sys";
      NFSv4 {
            minor_versions = 0;
      }
     }
And restarted the nfs-ganesha service.   Seemed to start fine and
mounted the share from a client and specifying the mount option "-o
vers=4.1" and indeed it mounted it with NFSv4.1  (I was expecting/hoping
it would refuse to mount).
What is (or should be) the way to only allow NFSv4.0 exports (if possible at all) ?
bash-4.2# rpm -qa | grep ganesha
glusterfs-ganesha-3.12.2-18.el7rhgs.x86_64
nfs-ganesha-2.5.5-10.el7rhgs.x86_64
nfs-ganesha-gluster-2.5.5-10.el7rhgs.x86_64
bash-4.2# rpm -qa | grep ^glusterfs
glusterfs-libs-3.12.2-18.el7rhgs.x86_64
glusterfs-ganesha-3.12.2-18.el7rhgs.x86_64
glusterfs-client-xlators-3.12.2-18.el7rhgs.x86_64
glusterfs-fuse-3.12.2-18.el7rhgs.x86_64
glusterfs-cli-3.12.2-18.el7rhgs.x86_64
glusterfs-api-3.12.2-18.el7rhgs.x86_64
glusterfs-server-3.12.2-18.el7rhgs.x86_64
glusterfs-3.12.2-18.el7rhgs.x86_64
Thanks in advance,
Nico van Roijen
_______________________________________________
Gluster-users mailing list
https://lists.gluster.org/mailman/listinfo/gluster-users
Nico van Royen
2018-11-26 20:09:37 UTC
Permalink
Hi Kaleb,

It indeed concerns the RHGS 3.4 version (not the opensource version).
When mounting an NFS share from a random client, and the client does not specify vers=4.0 (or vers=4,minorversion=0 for RH6) it will still make a NFSv4.1 connection.
This is why we want to restrict it server-side to prevent issues (we even have a RH case about this since Nov 2017, still open since it will also be discussed with a RH solution architect soon, I was hoping someone from the community would have a solution ready to restrict the NFS version server-side).

Regards,
Nico van Roijen (ING)



----- Oorspronkelijk bericht -----
Van: "Kaleb S. KEITHLEY" <***@redhat.com>
Aan: "gluster-users" <gluster-***@gluster.org>
Verzonden: Zaterdag 24 november 2018 00:20:14
Onderwerp: Re: [Gluster-users] Restricting NFS-Ganesha to use NFSv4.0 only
Post by Nico van Royen
Hi All,
In a bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=1546713) I
was reading it showed that it should be possible to restrict the NFSv4
usage to only use 4.0 (since 4.1/4.2 is not supported).
Who is telling you that 4.1 and 4.2 aren't supported?

Because NFS-Ganesha does, in fact, support NFSv4.1, NFSv4.2, and pNFS.

(Maybe you're thinking of the nfs-ganesha server in Red Hat's RHGS (Red
Hat Gluster Storage) or RHCS (Red Hat Ceph Storage), where 4.1 and 4.2
are not supported.)
Post by Nico van Royen
EXPORT{
      Export_Id = 2;
      Path = "/DATA";
      FSAL {
           name = GLUSTER;
           hostname="localhost";
           volume="DATA";
           }
      Access_type = RW;
      Disable_ACL = true;
      Squash="No_root_squash";
      Pseudo="/DATA";
      Protocols = "4" ;
      Transports = "UDP","TCP";
      SecType = "sys";
      NFSv4 {
            minor_versions = 0;
      }
     }
And restarted the nfs-ganesha service.   Seemed to start fine and
mounted the share from a client and specifying the mount option "-o
vers=4.1" and indeed it mounted it with NFSv4.1  (I was expecting/hoping
it would refuse to mount).
What is (or should be) the way to only allow NFSv4.0 exports (if possible at all) ?
bash-4.2# rpm -qa | grep ganesha
glusterfs-ganesha-3.12.2-18.el7rhgs.x86_64
nfs-ganesha-2.5.5-10.el7rhgs.x86_64
nfs-ganesha-gluster-2.5.5-10.el7rhgs.x86_64
bash-4.2# rpm -qa | grep ^glusterfs
glusterfs-libs-3.12.2-18.el7rhgs.x86_64
glusterfs-ganesha-3.12.2-18.el7rhgs.x86_64
glusterfs-client-xlators-3.12.2-18.el7rhgs.x86_64
glusterfs-fuse-3.12.2-18.el7rhgs.x86_64
glusterfs-cli-3.12.2-18.el7rhgs.x86_64
glusterfs-api-3.12.2-18.el7rhgs.x86_64
glusterfs-server-3.12.2-18.el7rhgs.x86_64
glusterfs-3.12.2-18.el7rhgs.x86_64
Thanks in advance,
Nico van Roijen
_______________________________________________
Gluster-users mailing list
https://lists.gluster.org/mailman/listinfo/gluster-users
_______________________________________________
Gluster-users mailing list
Gluster-***@gluster.org
https://lists.gluster.org/mailman/listinfo/gluster-users

Jiffin Thottan
2018-11-26 04:50:34 UTC
Permalink
Hi Nico,

The option is ganesha-server specific option(not per export). U need to mention it in ganesha.conf in the following block
NFSv4 {
minor_versions = 1;
}

Not inside the block of block of volume configuration file



----- Original Message -----
From: "Nico van Royen" <***@van-royen.nl>
To: "gluster-users" <gluster-***@gluster.org>
Sent: Saturday, November 24, 2018 12:12:19 AM
Subject: [Gluster-users] Restricting NFS-Ganesha to use NFSv4.0 only

Hi All,

In a bugzilla ( https://bugzilla.redhat.com/show_bug.cgi?id=1546713 ) I was reading it showed that it should be possible to restrict the NFSv4 usage to only use 4.0 (since 4.1/4.2 is not supported).
To try that, I modified an existing share so it reads :

EXPORT{
Export_Id = 2;
Path = "/DATA";
FSAL {
name = GLUSTER;
hostname="localhost";
volume="DATA";
}
Access_type = RW;
Disable_ACL = true;
Squash="No_root_squash";
Pseudo="/DATA";
Protocols = "4" ;
Transports = "UDP","TCP";
SecType = "sys";
NFSv4 {
minor_versions = 0;
}
}

And restarted the nfs- ganesha service. Seemed to start fine and mounted the share from a client and specifying the mount option "-o vers=4.1" and indeed it mounted it with NFSv4.1 (I was expecting/hoping it would refuse to mount).

What is (or should be) the way to only allow NFSv4.0 exports (if possible at all) ?

Running GlusterFS 3.12 / RHGS 3.4 with packages :
bash-4.2# rpm -qa | grep ganesha
glusterfs- ganesha -3.12.2-18.el7rhgs.x86_64
nfs- ganesha -2.5.5-10.el7rhgs.x86_64
nfs- ganesha -gluster-2.5.5-10.el7rhgs.x86_64

bash-4.2# rpm -qa | grep ^glusterfs
glusterfs-libs-3.12.2-18.el7rhgs.x86_64
glusterfs- ganesha -3.12.2-18.el7rhgs.x86_64
glusterfs-client-xlators-3.12.2-18.el7rhgs.x86_64
glusterfs-fuse-3.12.2-18.el7rhgs.x86_64
glusterfs-cli-3.12.2-18.el7rhgs.x86_64
glusterfs-api-3.12.2-18.el7rhgs.x86_64
glusterfs-server-3.12.2-18.el7rhgs.x86_64
glusterfs-3.12.2-18.el7rhgs.x86_64

Thanks in advance,
Nico van Roijen
Nico van Royen
2018-11-26 20:12:22 UTC
Permalink
Hi Jiffin ,

Will try that first thing tomorrow!
If that indeed works on the RHGS version a long overdue story on our backlog solved :)

Regards,
Nico van Roijen

----- Oorspronkelijk bericht -----
Van: "Jiffin Thottan" <***@redhat.com>
Aan: "Nico van Royen" <***@van-royen.nl>
Cc: "gluster-users" <gluster-***@gluster.org>
Verzonden: Maandag 26 november 2018 05:50:34
Onderwerp: Re: [Gluster-users] Restricting NFS-Ganesha to use NFSv4.0 only

Hi Nico,

The option is ganesha-server specific option(not per export). U need to mention it in ganesha.conf in the following block
NFSv4 {
minor_versions = 1;
}

Not inside the block of block of volume configuration file



----- Original Message -----
From: "Nico van Royen" <***@van-royen.nl>
To: "gluster-users" <gluster-***@gluster.org>
Sent: Saturday, November 24, 2018 12:12:19 AM
Subject: [Gluster-users] Restricting NFS-Ganesha to use NFSv4.0 only

Hi All,

In a bugzilla ( https://bugzilla.redhat.com/show_bug.cgi?id=1546713 ) I was reading it showed that it should be possible to restrict the NFSv4 usage to only use 4.0 (since 4.1/4.2 is not supported).
To try that, I modified an existing share so it reads :

EXPORT{
Export_Id = 2;
Path = "/DATA";
FSAL {
name = GLUSTER;
hostname="localhost";
volume="DATA";
}
Access_type = RW;
Disable_ACL = true;
Squash="No_root_squash";
Pseudo="/DATA";
Protocols = "4" ;
Transports = "UDP","TCP";
SecType = "sys";
NFSv4 {
minor_versions = 0;
}
}

And restarted the nfs- ganesha service. Seemed to start fine and mounted the share from a client and specifying the mount option "-o vers=4.1" and indeed it mounted it with NFSv4.1 (I was expecting/hoping it would refuse to mount).

What is (or should be) the way to only allow NFSv4.0 exports (if possible at all) ?

Running GlusterFS 3.12 / RHGS 3.4 with packages :
bash-4.2# rpm -qa | grep ganesha
glusterfs- ganesha -3.12.2-18.el7rhgs.x86_64
nfs- ganesha -2.5.5-10.el7rhgs.x86_64
nfs- ganesha -gluster-2.5.5-10.el7rhgs.x86_64

bash-4.2# rpm -qa | grep ^glusterfs
glusterfs-libs-3.12.2-18.el7rhgs.x86_64
glusterfs- ganesha -3.12.2-18.el7rhgs.x86_64
glusterfs-client-xlators-3.12.2-18.el7rhgs.x86_64
glusterfs-fuse-3.12.2-18.el7rhgs.x86_64
glusterfs-cli-3.12.2-18.el7rhgs.x86_64
glusterfs-api-3.12.2-18.el7rhgs.x86_64
glusterfs-server-3.12.2-18.el7rhgs.x86_64
glusterfs-3.12.2-18.el7rhgs.x86_64

Thanks in advance,
Nico van Roijen
Kaleb S. KEITHLEY
2018-11-26 20:26:16 UTC
Permalink
Post by Nico van Royen
Hi Jiffin ,
Will try that first thing tomorrow!
If that indeed works on the RHGS version a long overdue story on our backlog solved >
Regards,
Nico van Roijen
----- Oorspronkelijk bericht -----
Verzonden: Maandag 26 november 2018 05:50:34
Onderwerp: Re: [Gluster-users] Restricting NFS-Ganesha to use NFSv4.0 only
Hi Nico,
The option is ganesha-server specific option(not per export). U need to mention it in ganesha.conf in the following block
NFSv4 {
minor_versions = 1;
}
Not inside the block of volume configuration file
Minor_Versions is in nfs-ganesha-2.5.5, which is the version of
NFS-Ganesha that's in RHGS-3.4.
Post by Nico van Royen
----- Original Message -----
Sent: Saturday, November 24, 2018 12:12:19 AM
Subject: [Gluster-users] Restricting NFS-Ganesha to use NFSv4.0 only
Hi All,
In a bugzilla ( https://bugzilla.redhat.com/show_bug.cgi?id=1546713 ) I was reading it showed that it should be possible to restrict the NFSv4 usage to only use 4.0 (since 4.1/4.2 is not supported).
EXPORT{
Export_Id = 2;
Path = "/DATA";
FSAL {
name = GLUSTER;
hostname="localhost";
volume="DATA";
}
Access_type = RW;
Disable_ACL = true;
Squash="No_root_squash";
Pseudo="/DATA";
Protocols = "4" ;
Transports = "UDP","TCP";
SecType = "sys";
NFSv4 {
minor_versions = 0;
}
}
And restarted the nfs- ganesha service. Seemed to start fine and mounted the share from a client and specifying the mount option "-o vers=4.1" and indeed it mounted it with NFSv4.1 (I was expecting/hoping it would refuse to mount).
What is (or should be) the way to only allow NFSv4.0 exports (if possible at all) ?
bash-4.2# rpm -qa | grep ganesha
glusterfs- ganesha -3.12.2-18.el7rhgs.x86_64
nfs- ganesha -2.5.5-10.el7rhgs.x86_64
nfs- ganesha -gluster-2.5.5-10.el7rhgs.x86_64
bash-4.2# rpm -qa | grep ^glusterfs
glusterfs-libs-3.12.2-18.el7rhgs.x86_64
glusterfs- ganesha -3.12.2-18.el7rhgs.x86_64
glusterfs-client-xlators-3.12.2-18.el7rhgs.x86_64
glusterfs-fuse-3.12.2-18.el7rhgs.x86_64
glusterfs-cli-3.12.2-18.el7rhgs.x86_64
glusterfs-api-3.12.2-18.el7rhgs.x86_64
glusterfs-server-3.12.2-18.el7rhgs.x86_64
glusterfs-3.12.2-18.el7rhgs.x86_64
Thanks in advance,
Nico van Roijen
_______________________________________________
Gluster-users mailing list
https://lists.gluster.org/mailman/listinfo/gluster-users
_______________________________________________
Gluster-users mailing list
https://lists.gluster.org/mailman/listinfo/gluster-users
--
Kaleb
Continue reading on narkive:
Loading...