Lustre 1.6 Operations Manual

26.2 Root Squash Functionality
Lustre 1.6 introduces root squash functionality, a security feature which prevents
users from mounting Lustre, running it as the root user, and deleting all files in the
filesystem. The root squash feature works by re-mapping the user ID (UID) and
group ID (GID) of the root user to a UID and GID specified by the Lustre
administrator via proc entries on the Lustre MDS. This functionality also enables the
Lustre administrator to specify a client (or set of clients) for which the re-mapping
does not apply.
26.2.1 Root Squash Configuration Parameters
Root squash functionality is maintained by two configuration parameters,
root_squash and nosquash_lnets.
■ The root_squash parameter specifies the UID and GID with which the root user
accesses the Lustre filesystem.
■ The nosquash_lnets parameter specifies a set of clients for which root squash does
not apply. The LNET NID range syntax is used for this parameter. For example:
nosquash_lnets=172.16.245.[0-255/2]@tcp
In this example, root squash does not apply to all TCP clients with an even
number as the last component of their IP address.
26.2.2 Enabling, Disabling and Tuning Root Squash
By default, the root squash UID and GID are set to 0 and 0, respectively, which
means that no root squashing is performed. The nosquash NID is set to 0@, so
root squashing is performed for all clients.
The root squash UID and GID can be changed, on the fly, via the rootsquash proc
directory entry on the MDS. For example:
echo "500:500" > /proc/fs/lustre/mds/lustre-MDT0000/rootsquash
The NID of a not-squashed client can be changed, on the fly, via the nosquash_nid
proc directory entry on the MDS. For example:
echo "192.168.83.129@tcp" > /proc/fs/lustre/mds/lustre-MDT0000/nosquash_nid
26-4 Lustre 1.6 Operations Manual • September 2008