This topic describes the basic features of NFS export options, and how to control client access to your file system.
NFS export options enable you to create more granular access control than is possible using just security list rules to limit VCN access. You can use NFS export options to specify access levels for IP addresses or CIDR blocks connecting to file systems through exports in a mount target. Access can be restricted so that each client’s file system is inaccessible and invisible to the other, providing better security controls in multi-tenant environments.
Using NFS export option access controls, you can limit clients' ability to connect to the file system and view or write data. For example, if you want to allow clients to consume but not update resources in your file system, you can set access to Read Only. You can also reduce client root access to your file systems and map specified User IDs (UIDs) and Group IDs (GIDs) to an anonymous UID/GID of your choice. For more information about how NFS export options work with other security layers, see About Security.
Watch a video about working with NFS export options in File Storage.
Required IAM Policy
To use Oracle Cloud Infrastructure, you must be given the required type of access in a policy written by an administrator, whether you're using the Console or the REST API with an SDK, CLI, or other tool. If you try to perform an action and get a message that you don’t have permission or are unauthorized, confirm with your administrator the type of access you've been granted and which compartment you should work in.
Exports control how NFS clients access file systems when they connect to a mount target. File systems are exported (made available) through mount targets. Each mount target maintains an export set which contains one or many exports. A file system may be exported through one or more mount targets. A file system must have at least one export in one mount target in order for instances to mount the file system. The information used by an export includes the file system OCID, mount target OCID, export set OCID, export path, and client export options. Typically, an export is created in a mount target when the file system is created. Thereafter, you can create additional exports for a file system in any mount target that resides in the same availability domain as the file system.
NFS export options are a set of parameters within the export that specify the level of access granted to NFS clients when they connect to a mount target. An NFS export options entry within an export defines access for a single IP address or CIDR block range.
Each separate client IP address or CIDR block you want to define access for needs a separate export options entry in the export. For example, if you want to set options for NFS client IP addresses 10.0.0.6, 10.0.08, and 10.0.0.10, you need to create three separate entries, one for each IP address.
File Storage service considers the listed order of each export options entry for the export. During an NFS request by a client, File Storage service applies the first set of options that matches the client Source IP address. Only the first set is applied; the rest are ignored.
For example, consider the following two export options entries specifying access for an export:
Entry 1: Source: 10.0.0.0/16, Access: Read Only
Entry 2: Source: 10.0.0.8, Access: Read/Write
In this case, clients who connect to the export from IP address 10.0.0.8 have Read Only access. The request Source IP address is contained in the CIDR block specified in the first entry, and File Storage Service applies the options in the first match.
File systems can be associated with one or more exports, contained within one or more mount targets. If the client source IP address does not match any entry on the list for a single export, then that export is not visible to the client. However, the file system could be accessed through other exports on the same or other mount targets. To completely deny client access to a file system, be sure that the client source IP address or CIDR block is not included in any export for any mount target associated with the file system.
The following options can be set to control export access:
Source: The IP address or CIDR block of a connecting NFS client.
Require Privileged Source Port (true/false): This setting determines whether the NFS clients specified in source are required to connect from a privileged source port. Privileged ports are any port including 1-1023. On Unix-like systems, only the root user can open privileged ports. Setting this value to true disallows requests from unprivileged ports. The default for this setting is different depending on how the export is created. Creating an export without an explicit ClientOption array sets the requirePrivilegedSourcePort attribute of the client option to false. When you create a ClientOption array explicitly , requirePrivilegedSourcePort defaults to true.
For example, creating an export in the Console using the default selections sets requirePrivilegedSourcePort to false. Creating an export in the API along with a ClientOption array sets requirePrivilegedSourcePort to true.
When Require Privileged Source Port is set to true, you also have to follow these additional configuration steps:
When mounting the file system from a Unix-like system, include the resvport option in your mount command when mounting. For example:
sudo mount -o resvport 10.x.x.x:/fs-export-path /mnt/yourmountpoint
Access (Read_Only, Read_Write): This setting specifies the source NFS client access. If unspecified, defaults to Read_Write.
Identity Squash: (All, Root, None): This setting determines whether the source clients accessing the file system have their User ID (UID) and Group ID (GID) remapped to anonymousUid and anonymousGid. If you choose All, all users and groups are remapped. If Root, only the root user UID/GID combination 0/0 is remapped. If None, no users are remapped. If unspecified, defaults to None.
anonymousUid: This setting is used along with the Identity Squash option. When remapping users, you can use this setting to change the default anonymousUid of 65534 to any user ID of your choice.
anonymousGid: This setting is used along with the Identity Squash option. When remapping groups, you can use this setting to change the default anonymousGid of 65534 to any group ID of your choice.
Typical Access Control Scenarios
When you create file system and export, the NFS export options for that file system are set to the following defaults, which allow full access for all NFS client source connections. These defaults must be changed if you want to restrict access:
Source: 0.0.0.0/0 (All)
Require Privileged Source Port: False
Identity Squash: None
Scenario A: Control Host Based Access
Provide a managed hosted environment for two clients. The clients share a mount target, but each has their own file system, and cannot access each other's data. For example:
Client A, who is assigned to CIDR block 10.0.0.0/24, requires Read/Write access to file system A, but not file system B.
Client B, who is assigned to CIDR block 10.1.1.0/24, requires Read/Write access to file system B, but not file system A.
Client C, who is assigned to CIDR block 10.2.2.0/24, has no access of any kind to file system A or file system B.
Both file systems A and B are associated to a single mount target, MT1. Each file system has an export contained in the export set of MT1.
Since Client A and Client B access the mount target from different CIDR blocks, you can set the client options for both file system exports to allow access to only a single CIDR block. Client C is denied access by not including its IP address or CIDR block in the NFS export options for any export of either file system.
Set the export options for file system A to allow Read/Write access only to Client A, who is assigned to CIDR block 10.0.0.0/24. Client B and Client C are not included in this CIDR block, and cannot access the file system.
Set the export options for file system B to allow Read/Write access only to Client B, who is assigned to CIDR block 10.1.1.0/24. Client A and Client C are not included in this CIDR block, and cannot access the file system.
Set the export options for file system A to allow Read_Write access only to Client A, who is assigned to CIDR block 10.0.0.0/24. Client B and Client C are not included in this CIDR block, and cannot access the file system.
Set the export options for file system B to allow Read_Write access only to Client B, who is assigned to CIDR block 10.1.1.0/24. Client A and Client C are not included in this CIDR block, and cannot access the file system.
Set the export options for file system A to allow READ_WRITE access only to Client A, who is assigned to CIDR block 10.0.0.0/24. Client B and Client C are not included in this CIDR block, and cannot access the file system.
Set the export options for file system B to allow READ_WRITE access only to Client B, who is assigned to CIDR block 10.1.1.0/24. Client A and Client C are not included in this CIDR block, and cannot access the file system.
To increase security, you'd like to limit the root user's privileges when connecting to File System A. Use Identity Squash to remap root users to UID/GID 65534. In Unix-like systems, this UID/GID combination is reserved for 'nobody', a user with no system privileges.
Open the navigation menu. Under Core Infrastructure, click File Storage and then click File Systems.
In the List Scope section, select a compartment. All of the file systems in the selected compartment are displayed.
Find the file system you want to set export options for, click the the Actions icon (three dots), and then click View File System Details.
In the Exports list, find the export you want to set export options in, click the the Actions icon (three dots), and then click View Export Details. If there is no export listed for the file system, you can create one. See To create an export for a file system for more information.
To be sure you be sure that you select export, check the following:
The path must start with a slash (/) followed by a sequence of zero or more slash-separated elements. For any two export resources associated with the same export set, the path sequence for the first export resource can’t contain the complete path element sequence of the second export sequence. Paths can't end in a slash. No path element can be a period (.) or two periods in sequence (..). Lastly, no path can exceed 255 bytes.