Using NFS for ESX/ESXi

Last week I attended a VMware training course and this week I was trying to set up a nfs datastore but I was making no headway, it always failed to mount from vSphere:

Create NFSTest datastore 172.10.121.213
Error during the configuration of the host : NFS Error: Unable to Mount filesystem: Unable to connect to
NFS server

I then remembered the training course. ESX only supports NFS 3, so I mounted the NFS share from a linux box using nfs 3:

mount <host>:/shareddir /localdir -o nfsvers=3

This worked fine from linux but not from ESX.

Network connectivity existed, i.e. I could ping and telnet on port 2049 to the NFS server, yet ESX stubbornly refused to mount the NFS share.

After doing a little bit of reading, I learnt that I was using the wrong ping command, I should have used vmkping instead, which dutifully failed to reach the NFS server.

It turns out that VMKernel needs to be able to connect to the NFS server and due to network segmentation (VLANs) the ESX hosts could not reach the NFS server from the existing VMKernel connections. So I added another VMKernel connection and I was able to mount the share with this following command:

esxcfg-nas -a nfstest -o nfsserver -s /shareddir

Although this was on a ESX 4 host, this command exists on ESXi 5.0 too.

NFS -- Provide network shares suitable for group collaboration

At first, I thought that this was in essence the same objective as Create and configure set-GID directories for collaboration, where the folder that you set up is also shared and writeable to everybody, ie chmod 4777, but I'm not sure that this is actually the case, as you are depending on the user's umask to set the right permissions for the files created, in other words you need to make the files world writeable.

An alternative is to set the uid and gid of the anonymous user so that they match the owner of the share, but this is also the same as making it world writable, just a little bit more elegantly and you still need to set up the directory for collaboration in the NFS server, if that is indeed required. In a similar vein, you can change the shared directory's ownership to nfsnobody.

It is worth bearing in mind that NFS works using uid and gids, so that if you set the gid (or the uid) to 514 and the client does not have a group with gid 514 it won't know who to match, so you will get permissions errors. More intriguingly, if you set  an (either anonuid or anongid) on the share (e.g. home/col *(rw,sync,anongid=514)) and create a file with a user that has uid =gid=501 and has 514 as a secondary group, the file will belong to user with uid=501 in the server, which may or may not be the same user as in the client. In other words, this needs some sort of directory service to work properly, which to me sounds more complicated than the average objective, even for the RHCE exam.

Thus, in essence, in other for this to work properly you need to have both server and client being member of a domain, then set up group collaboration on a share where the group owner is a domain group and finally simply export the share, which al seems way beyond the average objective as I said above.

Since I've meaning for a while to write a post about setting openLDAP up, so once this is done, I will update this post.

NFS -- Provide network shares to specific clients

The crux of this objective lies with the /etc/exports file, which is where all the available nfs shares are configured.

In the exam you might have to install nfs, which you can do with:

yum install nfs-utils -y

You will need to open the firewall for port 2049 (don't forget to save it):

iptables -I INPUT -p tcp --dport nfs -j ACCEPT
iptables -I INPUT -p udp --dport nfs -j ACCEPT

Make sure that nfs starts with the system (Make sure the rpcbind is also set to start with the system):

chkconfig nfs on
chkconfig nfslock on

There are a few SELinux settings related to nfs (default settings):

allow_ftpd_use_nfs --> off
allow_nfsd_anon_write --> off
git_system_use_nfs --> off
httpd_use_nfs --> off
nfs_export_all_ro --> on
nfs_export_all_rw --> on
qemu_use_nfs --> on
samba_share_nfs --> off
use_nfs_home_dirs --> on
virt_use_nfs --> off
xen_use_nfs --> off

You can now start nfs with:

service nfs start

Let's get back to the objective, say you want to share directory /distro to all clients in your network, you'll need to edit /etc/exports like this (assuming that your network is 10.168.20.0):

/distro  10.168.20.0/24(ro)

Note that there is no space between the address/mask and the export options. Similarly, if you just want to share to a single client you can specify it by ip address or hostname or even fqdn, like this:

/distro 10.168.20.225(ro,sync)
/distro rhel6test.dev.com(ro,sync)
/distro 10.168.20.225(ro,sync) rhel6test.dev.com(ro,sync)
/distro 10.168.20.0/24(ro,sync) rhel6(ro,sync)

Note that the third line is the same as the first two lines combined and the fourth is just another example of how options can be combined.
You can now export the filesystems and restart nfs with:

exportfs -av; service nfs restart