2 - Raspberry PI Community Projects

options lockd nlm_udpport=2045 nlm_tcpport=2045
Example 11.25
The /etc/modprobe.d/lockd file
Once these parameters are set, it becomes easier to control access to the NFS service from the
firewall in a fine-grained way by filtering access to ports 111 and 2045 through 2049 (both UDP
and TCP).
11.4.2. NFS Server
The NFS server is part of the Linux kernel; in kernels provided by Debian it is built as a kernel
module. If the NFS server is to be run automatically on boot, the nfs-kernel-server package should
be installed; it contains the relevant start-up scripts.
ALTERNATIVE
The nfs-user-server server
nfs-user-server is an NFS server running as a traditional server, with a userspace
program and not a kernel module. This version of NFS is mostly obsolete
since the kernel-based NFS server is now mature and reliable.
The NFS server configuration file, /etc/exports, lists the directories that are made available
over the network (exported). For each NFS share, only the given list of machines is granted
access. More fine-grained access control can be obtained with a few options. The syntax for
this file is quite simple:
/directory/to/share machine1(option1,option2,...) machine2(...) ...
Each machine can be identified either by its DNS name or its IP address. Whole sets of machines
can also be specified using either a syntax such as *.falcot.com or an IP address range such as
192.168.0.0/255.255.255.0 or 192.168.0.0/24.
Directories are made available as read-only by default (or with the ro option). The rw option
allows read-write access. NFS clients typically connect from a port restricted to root (in other
words, below 1024); this restriction can be lifted by the insecure option (the secure option is
implicit, but it can be made explicit if needed for clarity).
By default, the server only answers an NFS query when the current disk operation is complete
(sync option); this can be disabled with the async option. Asynchronous writes increase performance
a bit, but they decrease reliability since there's a data loss risk in case of the server
crashing between the acknowledgment of the write and the actual write on disk. Since the default
value changed recently (as compared to the historical value of NFS), an explicit setting is
recommended.
In order to not give root access to the filesystem to any NFS client, all queries appearing to come
from a root user are considered by the server as coming from the anonymous user. This behavior
corresponds to the root_squash option, and is enabled by default. The no_root_squash
278 The Debian Administrator's Handbook