1. Overview

This document deals with the administration of NFS (version 3) and NFS Version 4 on GNU/Linux.
It aims to simplify the installation and the administration of NFSv4.

The goals of this project are:

• to sum up the existing commands and tools needed to administrate NFSv4 clients and servers on Linux;
• to present a list of administrative tasks and managed objects with their attributes;
• to create, or participate to the creation of a CIM schema for NFSv4;
• to propose a GUI and its implementation in existing Linux graphical tools (including WebMin, Nagios and WBEM).

The work is based on the kernel 2.6.
It does not target a specific Linux distribution: the init scripts are standard ones, and will have to be modified for each distribution.


When designing an administration command, the following rules must be observed:

• the command must have options to see the status;
• the output format may have different formats:
  • a raw format, used by other commands. This output must not be language dependant;
  • a stanza format, which is more human readable.
• all of this needs to be specified in the documentation, at least in the man pages.

2. Existing and missing commands

The GNU/Linux commands are in the following packages:

• nfs-utils (v1.0.6)
  The package nfs-utils is maintained by <nfs@lists.sourceforge.net>: http://sourceforge.net/projects/nfs/
  
• utils-linux (v2.11z)
  The package util-linux is maintained by <util-linux@math.uio.no>
• autofs (v3.1.7)
  autofs is implemented in the kernel-space.
  The package autofs is maintained by <autofs@linux.kernel.org>
  

(N.B.: on RedHat, mount is not in the util-linux package but in its own package)

2.1 Existing commands

2.1.1 Server commands

2.1.1.1 exportfs

exportfs is used to maintain the list of the NFS exported filesystems.
This list is kept in the file:
/var/lib/nfs/xtab
exportfs can export, unexport or reexport filesystems, according to either the file /etc/exports or to the arguments.

The notation is:
client:/path
where client can be a hostname (abbreviated name or fqdn), a NIS netgroup, an IP address (IPv4 or IPv6), an IP subnetwork, or even nothing, which means every hosts.

Usefull options:

• secure
• rw/ro
• async/sync
• no_wdelay
• root_squash/no_root_squash, all_squash
• anonuid, anonguid
• fsid

2.1.2 Client commands

2.1.2.1 mount

mount mounts a filesystem.
The type of the filesystem is specified with the option -t (for example, nfs or nfs4).

Usefull options:

• async/sync
• exec/noexec
• suid/nosuid
• user/nouser
• ro/rw
• bg/fg
• rsize, wsize
• timeo
• retrans
• retry
• acremin, acremax, acdirmin, acdirmax, actimeo /noac
• hard/soft
• lock/nolock
• tcp/udp
• intr

Specific NFSv4 option:

• -sec : the security flavor (sys, krb5, krb5i, lkey, spkm, ...)

2.1.2.2 umount

umount unmounts filesystems.

Usefull options:

• '-f': force unmount

2.1.2.3 automount

automount configures the mount points for autofs, the automounter.
It uses the file:
/etc/auto.master

2.1.3 Kerberos5 configuration

For both the client and the server, credentials need to be created.
There is currently no command nor script to fill in the file:
/etc/krb5.keytab

The structure of this file willl be discussed later.

2.1.4 Reports commands

2.1.4.1 rpcinfo

rpcinfo -p shows if the nfs daemon is running, which version are supported (2, 3, 4), and with which protocol (udp, tcp).

2.1.4.2 nfsstat

nfsstat displays statistics about both NFS client and server activity.
It uses the files /proc/net/rpc/nfsd (for the server statistics) and /proc/net/rpc/nfs (for the client).

2.1.4.3 showmount

showmount -a lists the clients hostname and the mounted filesystems on a server.
showmount -e lists the filesystems exported by a server.

2.1.4.4 exportfs

exportfs lists the exported file system for NFS.
It uses the following files:
/var/lib/nfs/etab to show what filesystems should be exported to whom at the moment
/var/lib/nfs/rmtab lists which filesystems are actually mounted by certain clients at the moment
/proc/fs/nfs/exports (it is the same file as /var/lib/nfs/xtab, which is unused, unless /proc doesn't exist) contains informations about what filesystems are exported to actual client

2.1.4.5 mount

On the client, mount shows which filesystems are currently mounted.
It can also be accessible by /proc/mounts.

2.1.5 Init scripts

Prior to the use of NFSv4, daemons need to be started, via their corresponding init scripts.

For the server:

• rpc.statd
• rpc.mountd
• rpc.idmapd
• rpc.svcgssd
• rpc.nfsd

For the client:

• rpc.gssd -m
• rpc.idmapd

idmapd needs to be configured with the file:
/etc/idmapd.conf

2.2 Missing commands and options

Here are the currently commands and scripts that need to be done, in order of priority:

• Is there a way for a client to get the security flavor of the server?
• The scripts to start the daemons and to create the default config files have not been updated : /etc/rc.d/init.d/nfs
• For nfsv4, the old showmount command will no more be used, because '/' can always be mounted.
  But since in all the GUI showmount is used to list the exported directories, a new command which will mount '/', list the directories and then unmount '/' can be useful to list the exported directories.
• nfsstat has not been modified, it doesn't show anything really reliable about nfsv4.
  A "nfs zero stats patch" has been made by Steve Dickson which prints only non-zero stats which are really needed for the v4. This patch can also be used to display a realtime interface (top like) to monitor NFS traffic.
• There is no config file for rpc.svcgssd and rpc.gssd, to, for example, precise the path of the rpc_pipefs filesystem.
• It could be usefull to enable various levels of debug more easily than by echoing data in /proc files like: echo 8 > /proc/sys/sunrpc/nfs_debug
• The commands for the NFSv4 features (migration, replication, load balancing, ...) are still in developpement, so their API is not yet precised.
• Since Kerberos and also the ACLs are domains today badly managed and closely connected to NFSv4, they will be administrate (but firstly, only what is required by NFSv4)

Other missing commands or options?

2.3 The CIM schema for NFS and NFSv4

CIM standards are made by the DMTF: http://www.dmtf.org/standards/cim/
The current CIM schema, version 2.8.1, deals only with NFSv3 (16 attributes).

A IBM opensource project, SBLIM (Gareth S. Bestor, IBM LTC Beaverton), has delivered recently (begining of April) a package providing only exports for NFSv3 and NFSv4 : http://oss.software.ibm.com/developerworks/projects/sblim/

• Do we wait for a new NFSv4 standard schema? (it could take months)
• Do we take part in the DMTF/SNIA standardisation process?
• Do we participate to the SBLIM project?

3. Objects and tasks

The tasks about NFSv4 can be divided in three parts:

• on the server side, there are the daemons that need to be configured, started or stopped, and monitored.
  The server maintains a list of the exported filesystems, to whom, with their properties.
• on the client side, there are also a few daemons (due to the authentification).
  The client maintains a list of the mounted filesystems with their properties.
• on both server and client, management of third-party utils: Kerberos and ACLs

3.1 Server side

3.1.1 Tasks

• Start/stop NFS
  
  • specify the number of NFS server threads
  • specify the port of the NFS daemon
  • Run, stop and show the status of the daemons nfsd, mountd, statd (v3), lockd (v3)
  ==> rpc.nfsd, rpc.mountd
• Show stats
  ==> nfsstat, ...?
• show errors and logs
  ==> rpcinfo, /var/log/messages (grep nfsd and knfsd), results of the commands, ...?
• Enable/disable security
  • Run, stop and show the status of the daemons svcgssd
    
  ==> rpc.svcgssd, rpc_pipefs filesystem
• Migration management (v4)
  Parameters: directories to migrate, to which machine names
  ==> To be defined
• Replication management (v4)
  Parameters: directories to replicate, to which machine names
  ==> To be defined
• Load balancing management (v4)
  Parameters: directories to replicate, to which machine names, according to thresholds (CPU, net, diskIO)
  ==> To be defined
• ID mapping management (v4 only?)
  
  • Start/stop idmapd
  • Parameters: the NFS domain, the pipefs directory, the nobody user, the nobody group
  ==> rpc.idmapd, /etc/idmapd.conf

3.1.2 Managed objects: exported directories

• See the list of the exported filesystems
  ==> /var/lib/nfs/etab, /var/lib/nfs/rmtab
• See and change the properties of each exported filesystem
• Export a filesystem
  For NFSv4, the best way to do is to export /export and to mount in this directory all the other directories which need to be exported, with a mount --bind
==> exportfs, mount --bind
• Unexport a filesystem
  ==> exportfs, umount

The properties are:

• path name of directory to export
• export:
  • now / at boot / both
  ==> /etc/exports
• permissions:
  • read-only / read-write
  • access list:
    • hostname (or IP)
    • ro / rw
  • map root to:
    • root / anonymous
  • map users to anonymous (public filesystem)
  • Allow suid
  ==> /etc/idmapd.conf
• authentification:
  • none
  • sys
  • krb5, krb5i, krb5p
  • lipkey, lipkey-i, lipkey-p
  • spkm3, spkm3i, spkm3p
  Maybe it could be interesting to separate in a GUI the two functions integrity and privacy from the authentification protocol?

3.2 Client side

3.2.1 Tasks

• Enable/disable security
  • Run, stop and show the status of the daemon gssd
  ==> rpc.gssd, rpc_pipefs filesystem
• Start/stop automount
  • Run, stop and check the status of the daemon automount
  • Use of the daemon supermount? (which seems to be specific to some distributions)
  ==> automount, /etc/auto.master
==> supermount (enable/disable)
• ID mapping management (v4 only?)
  
  • Start/stop idmapd
  • Parameters: the NFS domain (must be the same of the one of the server), the pipefs directory, the nobody user, the nobody group
  ==> rpc.idmapd, /etc/idmapd.conf

3.2.2 Managed objects: mounted filesystems

• See the list of the mounted filesystems
  For nfsv3, showmount shows the directories exported by a server.
  For nfsv4, since a server exports a pseudofilesystem and no more a list of directories, showmount can't be used (or new version of shwomount)
  ==> showmount (v3), mount (v4)
• See and change the properties of each mounted filesystem
• Mount a filesystem
  ==> mount
• Unmount a filesystem
  ==> umount

The properties are:

• mount point
• remote host (hostname, IPv4, IPv6)
• remote port (with a default one)
• remote directory (selected from a list)
• NFS version:
  • NFSv3
  • NFSv4
  The choice of the NFS version will enable or disable some options below.
• permissions:
  • read-only / read-write
• mount in:
  • sync / async
  • background / foreground
  • soft / hard (v3)
    • allow interrupts on hard mounts
    • number of retransmission for soft mounts
• allow suid
• transfert size:
  • read size (with a default value)
  • write size (with a default value)
• transfert protocol (v3):
  • tcp
  • udp
• transport protocol (v4):
  Infiniband, MPI, ... ?
• Authentification:
  • none
  • sys
  • krb5, krb5i, krb5p
  • lipkey, lipkey-i, lipkey-p
  • spkm3, spkm3i, spkm3p
  Security flavor will be autonegociated. But it could be interesting to display the available security flavors offered by the server.
• Attributes caching (v3):
  • min and max times for files and directories

3.3 Other tools

• Kerberos5 configuration
  ==> /etc/krb5.keytab, ...?
• ACL management
  show / modifiy

4. GUI implementation

4.1 GUI

On linux, there is no usual GUI to administrate NFS (there is actually no usual GUI to administrate Linux...)
The most commonly used administration tool is WebMin. It provides many usefull features, including the management of the filesystems.
Two other tools can be added to WebMin: Nagios, which provides the monitoring features, and MRTG, which provides the reports features.

Creation from scratch of a new GUI (in GTK for example) or WebMin+Nagios will be enough?

4.2 WebMin

http://www.webmin.com/

WebMin is a web-based interface for system administration.
It has several modules, and two of them need to be modified to support NFSv4:

• 'NFS exports': for the server, it deals with the exported filesystems
• 'Disk and Network Filesystems': used on the client to mount or unmount filesystems

Both modules are standard modules, made by the creator of WebMin, Jamie Cameron.

Requirements for the new modules: maybe supermount?

It could be useful to administrate several hosts at the same time...

4.2.1 Missing functionalities of 'NFS exports' module

4.2.2 Missing functionalities of 'Disk and Network Filesystems' module

4.3 Nagios

http://www.nagios.org/

Nagios is a host and network monitoring daemon.
It runs intermittent checks on hosts and services. It has currently no NFS specific plugin.

4.3.1 Missing functionalities of Nagios

4.4 MRTG

http://people.ee.ethz.ch/~oetiker/webtools/mrtg/

MRTG plots graphs to monitor the traffic load on a network.

4.4.1 Missing functionalities of MRTG

4.5 Distribution specific tools

The distribution specific tools and init scripts are under the responsability of each distribution maintainers. They won't be discussed here.

• RedHat: redhat-config-nfs
• Debian: dkpg-reconfigure?
• SuSE: yast?
• Mandrake: drakconf?

4.6 desktop specific tools

There is no tool, neither on KDE nor on Gnome, to configure a NFS client or server.
The following tools can be used to monitor partitions usage:

• for KDE: ksysguard
• for Gnome: gnome-system-monitor

4.7 WBEM

4.7.1 The implementation in OpenPegasus