ZFS and NFS exports

[James Craig]

I am currently running a 10.2-RELEASE-p7 that is sharing zfs datasets over NFS.

Before this, my file server was running Solaris, so I am coming from a Solaris-centric way of thinking, so I have some preconceptions I am working on getting over.

Things are *mostly* fine. the command I used to share filesystems is this:

zfs sharenfs="maproot=pseudoadmin alldirs lab1 lab2, maproot=root alldirs adminmachines" mypool/home1

the idea was that for any machine in the lab1 and lab2 netgroup that mounts the filesystem, will be given the uid of pseudoadmin (and not really root) when crossing the NFS boundary. Any machine in the adminmachines group will still be mapped to uid 0 when crossing over.

however I have discovered that root on the lab1 machines can create and modify files on the NFS share as though they are root, not pseudoadmin.

when I look at /etc/zfs/exports I see:

/mypool/home1  -maproot=pseudoadmin -alldirs lab1 lab2 -maproot=root -alldirs adminmachines

My thought is -- is the second -maproot= overriding the first, leaving all machines to allow root to remain root when passing over NFS?


I was reading that zfs sharenfs should be kept to simple things if used, so if this doesn't work,
should I instead be using /etc/exports? and if so; would it need to be multi-line and look like this:

/mypool/home1  -maproot=pseudoadmin -alldirs lab1 lab2
/mypool/home1  -maproot=root -alldirs adminmachines

thank you!

 

[big_girl]

I can't speak to your other questions, but it is best to run-


zfs unshare -a


..and use /etc/exports to share ZFS folders.

There have been threads here on /etc/exports but in my experience, NFS on FreeBSD is tricky. Firewall rules and ACLs can be very helpful.

 

[James Craig]

I was just getting something together to report back here.

I created another zfs share, and instead of using zfs to share it, I was able to share it via /etc/exports and get the behavior I was looking for. When I finish making sure I got it right I will make a full followup post. It does look what I wrote above will be the way to go.

 

[gkontos]

In my experience, using traditional NFS exports is far less complicated.

 

[SirDice]

I was reading that zfs sharenfs should be kept to simple things if used, so if this doesn't work,
should I instead be using /etc/exports?

Yes, the sharenfs option works a little different on FreeBSD. On Solaris it directly talks to the kernel to set the NFS options. On FreeBSD the sharenfs function is more or less hacked in as it cannot talk to the kernel to control NFS. So it creates a /etc/zfs/exports and the NFS daemon reads this. The translation however is pretty basic so for complex sharing options it'll be better to just 'hardcode' them into /etc/exports.