# NFS problem: Permission denied

## jabster

Hi.

I'm having a bit of a problem getting NFS setup on my new gentoo server.

here's my network:

1. Gentoo desktop (working just fine): 2.6.10-r6

2. Mandrake10 server (being migrated over to #3)

3. Gentoo server: 2.6.11-r4

I'm trying to get NFS running on the gentoo server, and keep getting this error from the desktop box:

```
bash-2.05b$ mount /mnt/music/

mount: 192.168.100.10:/music failed, reason given by server: Permission denied
```

Here's my fstab lines:

```
mailbox:/files0 /mnt/mailbox-temp       nfs     user,rsize=8192,wsize=8192,soft,nosuid  0 0

192.168.100.10:/music   /mnt/music      nfs     user,rsize=8192,wsize=8192,soft,nosuid  0 0
```

The mailbox line worlks, the 100.10 line does not.

UID/GIDs match on both gentoo boxes, GIDs match between gentoo desktop and Mdk box.

Now, I can mount the export on the gentoo server locally (mount 192.168.100.10:/music /mnt/temp) However, this does not work: mount localhost:/music /mnt/temp

I have identical /etc/hosts.allow and hosts.deny on both servers, and "order hosts,bind" in /etc/hosts.conf in both.

Per another thread here, I have removed NFS4 from my kernel, rebooted, and still no proper NFS exporting. I still get "Permission denied" when trying to mount from the desktop box.

Here's my /etc/exports:

1. Gentoo box:

/music  192.168.100.*(rw,sync,root_squash) (I've tried root_squash, no_root_squash, and nothing on the end there)

/home/johnj     192.168.100.*(rw,sync)

2. Mandrake box:

/files1/jakoozi/music           192.168.100.*(rw,sync)

/files1/jakoozi/pictures        192.168.100.*(rw,sync)

/files0                               192.168.100.*(rw,sync)

What am I missing?

thanks,

john

spam@jabster.net

----------

## yaneurabeya

Maybe try adding anongid and anonuid, as well as root_squash to the args. What I'm thinking is that the directory perms are specific so that the user 'nobody' cannot just login and look at what's inside the directory.

----------

## jabster

 *yaneurabeya wrote:*   

> Maybe try adding anongid and anonuid, as well as root_squash to the args. What I'm thinking is that the directory perms are specific so that the user 'nobody' cannot just login and look at what's inside the directory.

 

Thanks for the reply.

Tried that. Still no luck. But I should be able to mount just fine since I'm trying to mount as the same user as is on the gentoo server (name and GID/UID are identical on both gentoo boxes).

I tried something else last night: On the Mandrake box, I can mount the shares from the gentoo server. Did it as root, and therefore had only read-only access, but the point is that the gentoo server actually let me in. With no_root_squash I even get write access.

So I am now thinking I'm missing something on my gentoo desktop box? But I can still NFS mount from the mandrake box.

It's just this stinkin gentoo-gentoo connection that is causing me problems.

I don't understand why I cannot mount between the gentoo boxes.

Gentoo-server/Mdk-server:

I have the exact same hosts.allow-deny

I have the same UID-username/GID-groupname between boxes

I have the exact same /etc/exports.

I have the same permissions/ownership on the exported directories

I can mount back and forth between the two servers.

I can ssh into the gentoo server from the gentoo desktop.

Aarrgghh.

Would there be some difference between what the servers require on the clients? I don't have hosts.allow/deny on my desktop box.

-john

----------

## jabster

Hold on. May have found something.

Will report back when test is done......

-john

----------

## jabster

 *jabster wrote:*   

> Hold on. May have found something.
> 
> Will report back when test is done......
> 
> 

 

Well, that wasn't it.

Compiled "Provide NFSv3 server support" in my kernel on the desktop box. Same "Permission denied" error.

-john

----------

## jabster

Anybody got an idea on this one?

On why I can't NFS between two gentoo boxes? But can go Mandrake<-->Gentoo?

I am nearing Wit's End here.

i 'd think it'd be easier between gentoo boxes since everything should be the same version, etc.

thx,

john

----------

## yaneurabeya

I doubt that compiling in the NFS stuff in the module would have done that. I believe the issue is a fundamental one dealing with /etc/exports or the directory permissions. Could you show me the full permissions for the directory you're exporting please?

----------

## jabster

Well, this is sorta funky.

It's working. 

All of a sudden. Just like that.

Near as I can tell, apparently there was some sort of conflict with bind on the gentoo server. I had installed and started (but not yet configured) bind. Well, as soon as I got bind working, I was suddenly able to mount the NFS share from the gentoo server on the gentoo desktop.

New problem now tho: I started copying a DVD's worth of stuff over to the NFS share last night. Woke up this morning, and the mount directory is gone. I had it mounted at /mnt/music. And now there is no /mnt/music, and trying to mkdir it tells me "mkdir: cannot create directory `/mnt/music': File exists". And it's still listed in /etc/mtab. But I obviously can't unmount it.

An ls -l of /mnt gives this:

```

bash-2.05b# ls -l /mnt

ls: /mnt/music: Stale NFS file handle

total 26

drwxr-xr-x  2 root root       4096 Feb 26 16:28 FinePix602z

drwxr-xr-x  2 root root       4096 Mar  6 09:46 MP3

drwx------  2 root root       4096 Oct 27 16:38 cdrom

dr-xr-xr-x  6 root root       2048 Jan 23 14:08 cdrom1

drwx------  2 root root       4096 Oct 27 16:38 floppy

drwxr-xr-x  2 root root       4096 Feb 15 01:33 iriver

drwxrwxrwx  6  501 musicgroup 4096 Mar 17 21:03 mailbox-temp
```

So now I gonna reboot the desktop box and try again, and see if the mount lasts.

thanks for your help.

-john

----------

## yaneurabeya

Hmmmm... that's strange. I would see the bind issue though trickling down to your NFS problems though if you used the hostname as opposed to the IP address in exporting the share...

----------

## jabster

 *yaneurabeya wrote:*   

> Hmmmm... that's strange. I would see the bind issue though trickling down to your NFS problems though if you used the hostname as opposed to the IP address in exporting the share...

 

Kinda my thoughts. I have KDE configured to show un/mounted NFS shares on the desktop, so I have two icons there, and I hit the wrong one (the gentoo server one), and was quite shocked to see the konqueror window pop up showing contents of the remote share. Threw me for a bit of a loop there.

But anyway, since I rebooted this morning, the connections been rock solid. Copied over 5 DVDs worth of music over to the gentoo server, and amarok is playing it all just fine right now.  :Smile: 

Anywho, thanks for all the help.

-john

"How's your dic-

-tation machine?"

----------

## yaneurabeya

Lol. Cool. Nice sig btw  :Smile: .

----------

## stockman

I'm encountering the same issue on two gentoo boxes, one an amd64, the other an hp notebook.

The symptoms are identical on both.

http://nfs.sourceforge.net/nfs-howto/troubleshooting.html#SYMPTOM3 suggests "check /proc/fs/nfs/exports  or /var/lib/nfs/xtab on the server and make sure the option is listed"

I tried 

cat /proc/fs/nfs/exports shows only:

    desp3 ~ # cat  /proc/fs/nfs/exports

    # Version 1.1

    # Path Client(Flags) # IPs

   desp3 ~ #                       

like there are no shares out there

cat /var/lib/nfs/xtab shows nothing at all

but both exportfs -ra and /etc/init.d/nfs restart appear to run with no errors

trying both of the above cat commands on an old mandrake install with working shares, yeilds tons of info on its available shares.

Both of these machines were working fine before last weekend when I did an emerge --update --deep --newuse world on them.  I did preview it and don't recall anything to do with nfs being updated,  I am fairly certain that no non-default conf files having anything to do with nfs were changed, I'm pretty paranoid about backing up conf files before I allow etc-update to replace anything unless its a default file that I haven't had to touch.  I do know that my exports file is unchanged.

server logs show this:

Apr 23 09:12:14 box3 rpc.mountd: export request from 111.222.333.444

Apr 23 09:12:14 box3 rpc.mountd: authenticated mount request from box.domain.com:994 for /archive (/archive)

Apr 23 09:13:06 box3 rpc.mountd: Caught signal 15, un-registering and exiting.

I mangled the ip, machine and domain names, but you get the idea. The above is from the amd64 system log but the other gentoo box shows basically the same entries when attempting to mount a share on it.

I did try re-emerging nfs-utils, didn't help...

I'd certainly appreciate any ideas someone else might have for what to try now.

Stock

----------

## stockman

As usual, it turned out to be the result of my having done something stupid or overlooked something obvious  :Smile: 

The key was the message

rpc.idmapd: Skipping configuration file "/etc/idmapd.conf": No such file or directory   

when running /etc/init.d/nfs restart

I'd been ignoring it, since the file had never existed before  and  the idmapd man page seemed to imply that everything it configured had defaults, it seems thats not the case. I created the file, just using the defaults given in the man page and everythings working again now.  Apparently, something I scooped up in last weeks updates now requires the idmapd.conf file to exist.

Stock

----------

## plate

Well, this didn't fix it for me, I'm afraid. I'm still getting "Permission denied". Could you post the idmapd.conf you made for yourself? 

It's definitely a Gentoo-only problem that must have come from a contagious config file (or absence thereof), since every other NFS connection (as in: mounting shares on other servers) is operational, the only one not working is a Gentoo NFS server.

----------

## stockman

Well it seems I may have been a bit premature and the mystery has deepened.

for what its worth, here is the idmapd.conf file I created

# begin idmapd.conf

[General]

Verbosity = 0

Pipefs-Directory = /var/lib/nfs/rpc_pipefs

Domain = localdomain

[Mapping]

Nobody-User = nobody

Nobody-Group = nobody

# endidmapd.conf

however I am no longer sure that was the real cause of the problem.  Everything worked for a day or so after adding it but then the problem reoccurred.  

Now here is where it gets curious...

The server has two shares, was getting the problem on both.  A week or so ago, I'd grown tired of the startup scripts warning about a mode not being specified and the default having been changed in export fs so I had added the async option to both shares.

/work	111.222.333.0/255.255.255.0(async,insecure,no_root_squash,rw)

/archive 111.222.333.0/255.255.255.0(sync,insecure,no_root_squash,rw)

In the course of messing around with this problem, I tried changing the 2nd share to sync.  As soon as I did that and restarted the process again

I was suddenly able to mount both, and it seemed to work fine for a couple of days.  This morning it was broken again.  I changed both shares to sync, restarted everything, and now its working.  I haven't yet checked to see if it will still work after a reboot though.  Will try it after finishing this mornings other project and post the result.

Stock

----------

## stockman

hmmmmm...

reboot...  its broken again

restart nfs..

still broken

edit exports (change 2nd share back to the way it was)

restart nfs

works again

reboot

broken again

restart nfs

still broken

edit nfs  change network/netmask share from aaa.bbb.ccc.0/255.255.255.0 format to aaa.bbb.ccc.0/24  format just to try something differnt

restart nfs

fixed

doesn't appear to matter what you change just so you edit /etc/exports before restarting nfs

seems like it only reads /etc/exports if it sees its changed and then caches the info somewhere.... incorrectly

aughhhhhhh

hope this sorry little saga may give someone more knowledgable than I a clue as to how this can be fixed

Stock

----------

