day10-storage-nas

rhce认证考试笔记

day10 NAS =============================================================== Chapter 8. Providing File-based Storage NFS基本输出 一、Configuring an NFS export （Server） [root@server0 ~]# yum -y install nfs-utils [root@server0 ~]# systemctl enable nfs-server.service [root@server0 ~]# systemctl restart nfs-server.service [root@server0 ~]# firewall-cmd --permanent --add-service=nfs [root@server0 ~]# firewall-cmd --reload 1. 以只读方式输出 [root@server0 ~]# mkdir /nfs1 [root@server0 ~]# cp /etc/hosts /nfs1/ [root@server0 ~]# vim /etc/exports /nfs1 172.25.0.10 [root@server0 ~]# exportfs -rv 2. 以读写的方式 [root@server0 ~]# mkdir /nfs2 [root@server0 ~]# mkdir /nfs3 [root@server0 ~]# vim /etc/exports /nfs1 172.25.0.10 /nfs2 172.25.0.0/24(rw,sync) /nfs3 172.25.0.0/24(rw,sync,no_root_squash) [root@server0 ~]# exportfs -r [root@server0 ~]# exportfs -v /nfs1 172.25.0.10(ro,wdelay,root_squash,no_subtree_check,sec=sys,ro,secure,root_squash,no_all_squash) /nfs2 172.25.0.0/24(rw,wdelay,root_squash,no_subtree_check,sec=sys,rw,secure,root_squash,no_all_squash) /nfs3 172.25.0.0/24(rw,wdelay,no_root_squash,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) 二、客户端mount 1. 查看目标主机的export [root@desktop0 ~]# mkdir /mnt/nfs1 [root@desktop0 ~]# mount -t nfs 172.25.0.11:/nfs1 /mnt/nfs1/ [root@desktop0 ~]# df 172.25.0.11:/nfs1 10473984 3935488 6538496 38% /mnt/nfs1 [root@desktop0 ~]# ls /mnt/nfs1/ hosts [root@desktop0 ~]# touch /mnt/nfs1/file1 touch: cannot touch ‘/mnt/nfs1/file1’: Read-only file system [root@desktop0 ~]# mkdir /mnt/nfs2 [root@desktop0 ~]# mkdir /mnt/nfs3 [root@desktop0 ~]# mount 172.25.0.11:/nfs2 /mnt/nfs2 [root@desktop0 ~]# mount 172.25.0.11:/nfs3 /mnt/nfs3 [root@desktop0 ~]# [root@desktop0 ~]# touch /mnt/nfs2/file1 touch: cannot touch ‘/mnt/nfs2/file1’: Permission denied [root@desktop0 ~]# touch /mnt/nfs3/file1 共享选项： root_squash 压制root (如果客户端以root用户挂载，权限将为被映射为nfsnobody) no_root_squash 不压制root Kerberos-enabled NFS exports 8.4. Practice: Protecting NFS Exports 一、Configuring an NFS export （Server） 1. 准备kerberos认证环境 （考试时，默认已经准备好） [student@serverX ~]$ lab nfskrb5 setup [root@server0 ~]# id ldapuser5 uid=1705(ldapuser5) gid=1705(ldapuser5) groups=1705(ldapuser5) 2. 配置安全共享 [root@server0 ~]# wget -O /etc/krb5.keytab http://wendang.chazidian.com/pub/keytabs/server0.keytab [root@server0 ~]# vim /etc/sysconfig/nfs RPCNFSDARGS="-V 4.2" [root@server0 ~]# systemctl start nfs-secure-server [root@server0 ~]# systemctl enable nfs-secure-server [root@server0 ~]# firewall-cmd --permanent --add-service=nfs [root@server0 ~]# firewall-cmd --reload [root@server0 ~]# mkdir /securenfs [root@server0 ~]# vim /etc/exports /securenfs 172.25.0.0/24(rw,sec=krb5p) [root@server0 ~]# exportfs -r [root@server0 ~]# systemctl restart nfs

rhce认证考试笔记

-server.service [root@server0 ~]# systemctl restart nfs-secure-server.service 二、客户端mount 1. 准备kerberos认证环境 [student@desktopX ~]$ lab nfskrb5 setup [root@desktop0 ~]# id ldapuser5 uid=1705(ldapuser5) gid=1705(ldapuser5) groups=1705(ldapuser5) [root@desktop0 ~]# wget -O /etc/krb5.keytab http://wendang.chazidian.com/pub/keytabs/desktop0.keytab [root@desktop0 ~]# systemctl start nfs-secure [root@desktop0 ~]# systemctl enable nfs-secure [root@desktop0 ~]# mkdir /mnt/secureshare [root@desktop0 ~]# vim /etc/fstab server0:/securenfs /mnt/secureshare nfs defaults,v4.2,sec=krb5p 0 0 [root@desktop0 ~]# systemctl restart nfs-secure