SDS@hd/Access/NFS - Revision history

S Siebler at 07:55, 8 August 2025

2025-08-08T07:55:09Z

← Older revision		Revision as of 09:55, 8 August 2025
Line 82:		Line 82:
	<pre>		<pre>
	$ cat /etc/auto.sds-hd		$ cat /etc/auto.sds-hd
	sds-hd -fstype=nfs4,rw,sec=krb5,vers=4.1,nosuid,nodev lsdf02.urz.uni-heidelberg.de:/gpfs/lsdf02		sds-hd -fstype=nfs4,rw,sec=krb5,vers=4,nosuid,nodev lsdf02.urz.uni-heidelberg.de:/gpfs/lsdf02
	....		....
	</pre>		</pre>
Line 193:		Line 193:
	<pre>		<pre>
	mount.nfs4: mount(2): Permission denied		mount.nfs4: mount(2): Permission denied
	mount.nfs4: trying text-based options 'sec=krb5,vers=4.1,addr=x.x.x.x,clientaddr=a.b.c.d'		mount.nfs4: trying text-based options 'sec=krb5,vers=4,addr=x.x.x.x,clientaddr=a.b.c.d'
	mount.nfs4: mount(2): Permission denied		mount.nfs4: mount(2): Permission denied
	mount.nfs4: access denied by server while mounting lsdf02.urz.uni-heidelberg.de:/gpfs/lsdf02		mount.nfs4: access denied by server while mounting lsdf02.urz.uni-heidelberg.de:/gpfs/lsdf02

S Siebler: /* Mount a nfs share */

2025-08-08T07:54:33Z

Mount a nfs share

← Older revision		Revision as of 09:54, 8 August 2025
Line 53:		Line 53:
	<pre>		<pre>
	> mkdir <mountpoint>		> mkdir <mountpoint>
	> mount -t nfs4 -o sec=krb5,vers=4.1 lsdf02.urz.uni-heidelberg.de:/gpfs/lsdf02/ <mountpoint>		> mount -t nfs4 -o sec=krb5,vers=4 lsdf02.urz.uni-heidelberg.de:/gpfs/lsdf02/ <mountpoint>
	</pre>		</pre>

	To enable the mounting after a restart, you have to add the following line to the file "/etc/fstab"		To enable the mounting after a restart, you have to add the following line to the file "/etc/fstab"
	<pre>		<pre>
	lsdf02.urz.uni-heidelberg.de:/gpfs/lsdf02/ <mountpoint> nfs4 sec=krb5,vers=4.1 0 0		lsdf02.urz.uni-heidelberg.de:/gpfs/lsdf02/ <mountpoint> nfs4 sec=krb5,vers=4 0 0
	</pre>		</pre>

H Schumacher: Added introductorysentence, changed prerequisites, adjusted formatting

2024-11-28T23:53:05Z

Added introductorysentence, changed prerequisites, adjusted formatting

← Older revision		Revision as of 01:53, 29 November 2024
Line 1:		Line 1:
			NFS is a Network File System only for Linux.
⚫	= ~~<b>~~ Prerequisites ~~</b>~~ =

		⚫	== Prerequisites ==
	* '''Attention:''' To access data served by SDS@hd, you need a '''''Service Password'''''. See details [[SDS@hd/Registration]].

		⚫	* The access via nfs protocol is machine-based, which means new nfs-Clients have to be registered on SDS@hd. During this registration each machine receives a keytab file from the SDS@hd team, which allows mounting SDS@hd. In order the keytab file to be created, please send an email to SDS@hd team for Clientregistration with the following information:
	* Additionally the access to SDS@hd is currently only available inside the [https://www.belwue.de/netz/netz0.html belwue-Network]. This means you have to use the VPN Service of your HomeOrganization, if you want to access SDS@hd from outside the bwHPC-Clusters (e.g. via [https://www.eduroam.org/where/ eduroam] or from your personal Laptop)

⚫	* The access via nfs protocol is machine-based, which means ~~'''~~new nfs-Clients have to be registered~~'''~~ on SDS@hd. During this registration each machine receives a keytab file from the SDS@hd team, which allows mounting SDS@hd. In order the keytab file to be created, please ~~[mailto:sds-hd-support@urz.uni-heidelberg.de?subject=SDS@hd%20nfs-Client%20Registration~~ send an email] to SDS@hd team for Clientregistration with the following information:
	** hostname of the new nfs-Client		** hostname of the new nfs-Client
	** IP address		** IP address
Line 12:		Line 10:
	** acronym of the Speichervorhaben which should be available on this machine		** acronym of the Speichervorhaben which should be available on this machine

	= ~~<b>~~ Using NFSv4 for UNIX client ~~</b>~~ =		== Using NFSv4 for UNIX client ==

	The authentication for data access via NFSv4 is performed using Kerberostickets. This requires a functioning Kerberos environment on the client!		The authentication for data access via NFSv4 is performed using Kerberostickets. This requires a functioning Kerberos environment on the client!
Line 29:		Line 27:
	</pre>		</pre>

	''Example ~~debian~~/~~ubuntu~~''		''Example Debian/Ubuntu''
	<pre>		<pre>
	> apt install nfs-common nfs4-acl-tools nfs-server		> apt install nfs-common nfs4-acl-tools nfs-server
Line 49:		Line 47:
	</pre>		</pre>

	== ~~mount~~ a nfs share ==		=== Mount a nfs share ===
	The usual restrictions for mounting drives under Linux apply. Usually this can only be done by the superuser "root". For detailed information, please contact the system administrator of your system.		The usual restrictions for mounting drives under Linux apply. Usually this can only be done by the superuser "root". For detailed information, please contact the system administrator of your system.

Line 63:		Line 61:
	</pre>		</pre>

	=== AutoFS Setup ===		==== AutoFS Setup ====

	Instead of the fstab-entry you can also use the automounter "autofs".		Instead of the fstab-entry you can also use the automounter "autofs".
Line 74:		Line 72:
	</pre>		</pre>

	* ~~debian~~/~~ubuntu~~:		* Debian/Ubuntu:
	<pre>		<pre>
	$ apt install autofs		$ apt install autofs
Line 113:		Line 111:
	Of course you can adopt all other autofs options, like timeouts, etc. to the specific needs of your environment or use any other method for dynamically mounting the shares.		Of course you can adopt all other autofs options, like timeouts, etc. to the specific needs of your environment or use any other method for dynamically mounting the shares.

	== ~~access~~ your data ==		=== Access your data ===
	'''Attention!''' The access can not be done as root user, because root uses the Kerberosticket of the machine, which does not have data access!		'''Attention!''' The access can not be done as root user, because root uses the Kerberosticket of the machine, which does not have data access!

Line 138:		Line 136:
	</pre>		</pre>

	== ~~renew~~ a kerberos ticket ==		=== Renew a kerberos ticket ===
	Because a kerberos ticket has a limited lifetime (default: 10 hours, maximum 24 hours) for security reasons, you have to renew your ticket before it expires to prevent access loss.		Because a kerberos ticket has a limited lifetime (default: 10 hours, maximum 24 hours) for security reasons, you have to renew your ticket before it expires to prevent access loss.
	<pre>		<pre>
Line 146:		Line 144:
	This renewal could only be done for maximum time of 10 Days and as long as the current kerberos ticket is still valid. For renewal of an expired ticket, you have to use again your Servicepassword.		This renewal could only be done for maximum time of 10 Days and as long as the current kerberos ticket is still valid. For renewal of an expired ticket, you have to use again your Servicepassword.

	== ~~destroy~~ kerberos ticket ==		=== Destroy kerberos ticket ===
	Even if kerberos tickets are only valid for a limited period of time, a ticket should be destroyed as soon as access is no longer needed to prevent misuse on multi-user systems:		Even if kerberos tickets are only valid for a limited period of time, a ticket should be destroyed as soon as access is no longer needed to prevent misuse on multi-user systems:
	<pre>kdestroy</pre>		<pre>kdestroy</pre>

	== ~~automated~~ kerberos tickets ==		=== Automated kerberos tickets ===
	<span style="color:red"><strong>'''Attention!''' Keep this generated Keytab safe and use it only in trusted environments!</strong></span>		<span style="color:red"><strong>'''Attention!''' Keep this generated Keytab safe and use it only in trusted environments!</strong></span>

	If your workflow needs a permanent access to SDS@hd for longer than 10 Days, you can use '''ktutil''' to encrypt your Service Password into a keytab file:		If your workflow needs a permanent access to SDS@hd for longer than 10 Days, you can use '''ktutil''' to encrypt your Service Password into a keytab file:

	''~~interactive~~ way:''		''Interactive way:''
	<pre>		<pre>
	ktutil		ktutil
Line 166:		Line 164:
	</pre>		</pre>

	''~~non~~-interactive way:''		''Non-interactive way:''
	<pre>		<pre>
	echo -e "addent -password -p hd_xy123@BWSERVICES.UNI-HEIDELBERG.DE -k 1 -e rc4-hmac\n<your_servicepasword>\n		echo -e "addent -password -p hd_xy123@BWSERVICES.UNI-HEIDELBERG.DE -k 1 -e rc4-hmac\n<your_servicepasword>\n
Line 178:		Line 176:
	<br>		<br>

	= ~~<b>~~ Troubleshooting ~~</b>~~ =		== Troubleshooting ==

	== ~~incorrect~~ mount option ==		=== Incorrect mount option ===

	When you try to mount SDS@hd you get the following error message:		When you try to mount SDS@hd you get the following error message:
Line 190:		Line 188:
	This means the service rpc-gssd.service is not yet running. Please try to start the service via <pre>systemctl restart rpc-gssd.service</pre>		This means the service rpc-gssd.service is not yet running. Please try to start the service via <pre>systemctl restart rpc-gssd.service</pre>

	== ~~permission~~ denied while mounting when SELinux is enabled ==		=== Permission denied while mounting when SELinux is enabled ===

	When trying to mount, you get the following error message:		When trying to mount, you get the following error message:

S Siebler at 11:31, 7 August 2024

2024-08-07T11:31:15Z

← Older revision		Revision as of 13:31, 7 August 2024
Line 202:		Line 202:
	You should check your systemlogs for entries like:		You should check your systemlogs for entries like:
	<pre>		<pre>
	Aug 07 13:09:53 ~~nc-docker-aio-don~~ setroubleshoot[510523]: SELinux is preventing /usr/sbin/rpc.gssd from open access on the file /etc/krb5.keytab. For complete SELinux messages run: sealert -l XXXXXX		Aug 07 13:09:53 systemname setroubleshoot[510523]: SELinux is preventing /usr/sbin/rpc.gssd from open access on the file /etc/krb5.keytab. For complete SELinux messages run: sealert -l XXXXXX
	</pre>		</pre>

S Siebler at 11:28, 7 August 2024

2024-08-07T11:28:18Z

← Older revision		Revision as of 13:28, 7 August 2024
Line 177:		Line 177:
	</pre>		</pre>
	<br>		<br>

			= <b> Troubleshooting </b> =

			== incorrect mount option ==

			When you try to mount SDS@hd you get the following error message:
			<pre>
			mount.nfs4: mount(2): Invalid argument
			mount.nfs4: an incorrect mount option was specified
			</pre>

			This means the service rpc-gssd.service is not yet running. Please try to start the service via <pre>systemctl restart rpc-gssd.service</pre>

			== permission denied while mounting when SELinux is enabled ==

			When trying to mount, you get the following error message:
			<pre>
			mount.nfs4: mount(2): Permission denied
			mount.nfs4: trying text-based options 'sec=krb5,vers=4.1,addr=x.x.x.x,clientaddr=a.b.c.d'
			mount.nfs4: mount(2): Permission denied
			mount.nfs4: access denied by server while mounting lsdf02.urz.uni-heidelberg.de:/gpfs/lsdf02
			</pre>

			You should check your systemlogs for entries like:
			<pre>
			Aug 07 13:09:53 nc-docker-aio-don setroubleshoot[510523]: SELinux is preventing /usr/sbin/rpc.gssd from open access on the file /etc/krb5.keytab. For complete SELinux messages run: sealert -l XXXXXX
			</pre>

			or similar. To solve the issue you have to add a SELinux rule to allow access to /etc/krb5.keytab (or disable SElinux completely).

S Siebler: /* Prerequisites */

2024-01-10T10:56:50Z

Prerequisites

← Older revision		Revision as of 12:56, 10 January 2024
Line 5:		Line 5:
	* Additionally the access to SDS@hd is currently only available inside the [https://www.belwue.de/netz/netz0.html belwue-Network]. This means you have to use the VPN Service of your HomeOrganization, if you want to access SDS@hd from outside the bwHPC-Clusters (e.g. via [https://www.eduroam.org/where/ eduroam] or from your personal Laptop)		* Additionally the access to SDS@hd is currently only available inside the [https://www.belwue.de/netz/netz0.html belwue-Network]. This means you have to use the VPN Service of your HomeOrganization, if you want to access SDS@hd from outside the bwHPC-Clusters (e.g. via [https://www.eduroam.org/where/ eduroam] or from your personal Laptop)

	* The access via nfs protocol is machine-based, which means '''new nfs-Clients have to be registered''' on SDS@hd. During this registration each machine ~~gets~~ a keytab file, which allows mounting SDS@hd.		* The access via nfs protocol is machine-based, which means '''new nfs-Clients have to be registered''' on SDS@hd. During this registration each machine receives a keytab file from the SDS@hd team, which allows mounting SDS@hd. In order the keytab file to be created, please [mailto:sds-hd-support@urz.uni-heidelberg.de?subject=SDS@hd%20nfs-Client%20Registration send an email] to SDS@hd team for Clientregistration with the following information:

	* Currently you have to [mailto:sds-hd-support@urz.uni-heidelberg.de?subject=SDS@hd%20nfs-Client%20Registration send an email] for Clientregistration to SDS@hd Team with the following information:
	** hostname of the new nfs-Client		** hostname of the new nfs-Client
	** IP address		** IP address

S Richling: /* Prerequisites */

2023-11-23T14:22:25Z

Prerequisites

← Older revision		Revision as of 16:22, 23 November 2023
Line 1:		Line 1:
	= <b> Prerequisites </b> =		= <b> Prerequisites </b> =

	* '''Attention:''' To access data served by SDS@hd, ~~You~~ need a '''''Service Password'''''. See details [[SDS@hd/Registration]].		* '''Attention:''' To access data served by SDS@hd, you need a '''''Service Password'''''. See details [[SDS@hd/Registration]].

	* Additionally the access to SDS@hd is currently only available inside the [https://www.belwue.de/netz/netz0.html belwue-Network]. This means you have to use the VPN Service of your HomeOrganization, if you want to access SDS@hd from outside the bwHPC-Clusters (e.g. via [https://www.eduroam.org/where/ eduroam] or from your personal Laptop)		* Additionally the access to SDS@hd is currently only available inside the [https://www.belwue.de/netz/netz0.html belwue-Network]. This means you have to use the VPN Service of your HomeOrganization, if you want to access SDS@hd from outside the bwHPC-Clusters (e.g. via [https://www.eduroam.org/where/ eduroam] or from your personal Laptop)

S Siebler: /* mount a nfs share */

2023-11-15T08:59:01Z

mount a nfs share

← Older revision		Revision as of 10:59, 15 November 2023
Line 57:		Line 57:
	<pre>		<pre>
	> mkdir <mountpoint>		> mkdir <mountpoint>
	> mount -t nfs4 -o sec=krb5,vers=4.0 lsdf02.urz.uni-heidelberg.de:/gpfs/lsdf02/ <mountpoint>		> mount -t nfs4 -o sec=krb5,vers=4.1 lsdf02.urz.uni-heidelberg.de:/gpfs/lsdf02/ <mountpoint>
	</pre>		</pre>

	To enable the mounting after a restart, you have to add the following line to the file "/etc/fstab"		To enable the mounting after a restart, you have to add the following line to the file "/etc/fstab"
	<pre>		<pre>
	lsdf02.urz.uni-heidelberg.de:/gpfs/lsdf02/ <mountpoint> nfs4 sec=krb5,vers=4.0 0 0		lsdf02.urz.uni-heidelberg.de:/gpfs/lsdf02/ <mountpoint> nfs4 sec=krb5,vers=4.1 0 0
	</pre>		</pre>

Line 86:		Line 86:
	<pre>		<pre>
	$ cat /etc/auto.sds-hd		$ cat /etc/auto.sds-hd
	sds-hd -fstype=nfs4,rw,sec=krb5,vers=4.0,nosuid,nodev lsdf02.urz.uni-heidelberg.de:/gpfs/lsdf02		sds-hd -fstype=nfs4,rw,sec=krb5,vers=4.1,nosuid,nodev lsdf02.urz.uni-heidelberg.de:/gpfs/lsdf02
	....		....
	</pre>		</pre>

S Richling at 15:13, 19 August 2022

2022-08-19T15:13:50Z

← Older revision		Revision as of 17:13, 19 August 2022
Line 41:		Line 41:
	On ubuntu server: nfs-kernel-server		On ubuntu server: nfs-kernel-server

			{{:SDS@hd/Access/ID-Mapping}}
	{{:Sds-hd_idmapping}}

	To enable the ID-Mapping for NFSv4 mounts change the file ''/etc/idmapd.conf'' with the following lines:		To enable the ID-Mapping for NFSv4 mounts change the file ''/etc/idmapd.conf'' with the following lines:

S Richling: /* Using NFSv4 for UNIX client */

2022-08-19T15:11:45Z

Using NFSv4 for UNIX client

← Older revision		Revision as of 17:11, 19 August 2022
Line 18:		Line 18:
	The authentication for data access via NFSv4 is performed using Kerberostickets. This requires a functioning Kerberos environment on the client!		The authentication for data access via NFSv4 is performed using Kerberostickets. This requires a functioning Kerberos environment on the client!

			{{:SDS@hd/Access/Kerberos}}
	{{:Sds-hd_kerberos}}

	After configuring kerberos, you have to install nfs packages in your system, and enable kerberized NFSv4. The exact names of the packages depending on you linux distribution (see examples below).		After configuring kerberos, you have to install nfs packages in your system, and enable kerberized NFSv4. The exact names of the packages depending on you linux distribution (see examples below).