Oracle Cloud Infrastructure Documentation

Working with NFS Export Options

This topic describes the basic features of NFS export options, and how to control client access to your file system.

Overview

NFS export options enable you to create more granular access control than is possible using just security list rules to limit VCN access. You can use NFS export options to specify access levels for IP addresses or CIDR blocks connecting to file systems through exports in a mount target. Access can be restricted so that each client’s file system is inaccessible and invisible to the other, providing better security controls in multi-tenant environments.

Using NFS export option access controls, you can limit clients' ability to connect to the file system and view or write data. For example, if you want to allow clients to consume but not update resources in your file system, you can set access to Read Only. You can also reduce client root access to your file systems and map specified User IDs (UIDs) and Group IDs (GIDs) to an anonymous UID/GID of your choice. For more information about how NFS export options work with other security layers, see About Security.

Tip

Watch a video about working with NFS export options in File Storage.

Required IAM Policy

To use Oracle Cloud Infrastructure, you must be given the required type of access in a An IAM document that specifies who has what type of access to your resources. It is used in different ways: to mean an individual statement written in the policy language; to mean a collection of statements in a single, named "policy" document (which has an Oracle Cloud ID (OCID) assigned to it); and to mean the overall body of policies your organization uses to control access to resources. written by an administrator, whether you're using the Console or the REST API with an SDK, CLI, or other tool. If you try to perform an action and get a message that you don’t have permission or are unauthorized, confirm with your administrator the type of access you've been granted and which A collection of related resources that can be accessed only by certain groups that have been given permission by an administrator in your organization. you should work in.

For administrators: The policy in Let users create, manage, and delete file systems allows users to manage NFS export options.

If you're new to policies, see Getting Started with Policies and Common Policies.

Exports

Exports control how NFS clients access file systems when they connect to a mount target. File systems are exported (made available) through mount targets. Each mount target maintains an export set which contains one or many exports. A file system may be exported through one or more mount targets. A file system must have at least one export in one mount target in order for instances to mount the file system. The information used by an export includes the file system OCID, mount target OCID, export set OCID, export path, and client export options. Typically, an export is created in a mount target when the file system is created. Thereafter, you can create additional exports for a file system in any mount target that resides in the same availability domain as the file system.

See To create an export for a file system for more information.

NFS Export Options

NFS export options are a set of parameters within the export that specify the level of access granted to NFS clients when they connect to a mount target. An NFS export options entry within an export defines access for a single IP address or CIDR block range.

Each separate client IP address or CIDR block you want to define access for needs a separate export options entry in the export. For example, if you want to set options for NFS client IP addresses 10.0.0.6, 10.0.08, and 10.0.0.10, you need to create three separate entries, one for each IP address.

File Storage service considers the listed order of each export options entry for the export. During an NFS request by a client, File Storage service applies the first set of options that matches the client Source IP address. Only the first set is applied; the rest are ignored.

For example, consider the following two export options entries specifying access for an export:

Entry 1: Source: 10.0.0.0/16, Access: Read Only

Entry 2: Source: 10.0.0.8, Access: Read/Write

In this case, clients who connect to the export from IP address 10.0.0.8 have Read Only access. The request Source IP address is contained in the CIDR block specified in the first entry, and File Storage Service applies the options in the first match.

Important

File systems can be associated with one or more exports, contained within one or more mount targets. If the client source IP address does not match any entry on the list for a single export, then that export is not visible to the client. However, the file system could be accessed through other exports on the same or other mount targets. To completely deny client access to a file system, be sure that the client source IP address or CIDR block is not included in any export for any mount target associated with the file system.

The following options can be set to control export access:

  • Source: The IP address or CIDR block of a connecting NFS client.
  • Require Privileged Source Port (true/false): This setting determines whether the NFS clients specified in source are required to connect from a privileged source port. Privileged ports are any port including 1-1023. On Unix-like systems, only the root user can open privileged ports. Setting this value to true disallows requests from unprivileged ports. The default for this setting is different depending on how the export is created. Creating an export without an explicit ClientOption array sets the requirePrivilegedSourcePort attribute of the client option to false. When you create a ClientOption array explicitly , requirePrivilegedSourcePort defaults to true.

    For example, creating an export in the Console using the default selections sets requirePrivilegedSourcePort to false. Creating an export in the API along with a ClientOption array sets requirePrivilegedSourcePort to true.

Important

When Require Privileged Source Port is set to true, you also have to follow these additional configuration steps: 

  1. When mounting the file system from a Unix-like system, include the resvport option in your mount command when mounting. For example: 

    sudo mount -o resvport 10.x.x.x:/fs-export-path /mnt/yourmountpoint

    For more information, see Mounting File Systems From Unix-Style Instances.

  2. When mounting the file system from a Windows system, be sure the UseReserverdPorts registry key value is set to 1.

    For more information, see Mounting File Systems From Windows Instances.

  • Access (Read_Only, Read_Write): This setting specifies the source NFS client access. If unspecified, defaults to Read_Write.
  • Identity Squash: (All, Root, None): This setting determines whether the source clients accessing the file system have their User ID (UID) and Group ID (GID) remapped to anonymousUid and anonymousGid. If you choose All, all users and groups are remapped. If Root, only the root user UID/GID combination 0/0 is remapped. If None, no users are remapped. If unspecified, defaults to None.
  • anonymousUid: This setting is used along with the Identity Squash option. When remapping users, you can use this setting to change the default anonymousUid of 65534 to any user ID of your choice.
  • anonymousGid: This setting is used along with the Identity Squash option. When remapping groups, you can use this setting to change the default anonymousGid of 65534 to any group ID of your choice.

Typical Access Control Scenarios

When you create file system and export, the NFS export options for that file system are set to the following defaults, which allow full access for all NFS client source connections. These defaults must be changed if you want to restrict access:

  • Source: 0.0.0.0/0 (All)
  • Require Privileged Source Port: False
  • Access: Read_Write
  • Identity Squash: None

Scenario A: Control Host Based Access

Provide a managed hosted environment for two clients. The clients share a mount target, but each has their own file system, and cannot access each other's data. For example:

  • Client A, who is assigned to CIDR block 10.0.0.0/24, requires Read/Write access to file system A, but not file system B.
  • Client B, who is assigned to CIDR block 10.1.1.0/24, requires Read/Write access to file system B, but not file system A.
  • Client C, who is assigned to CIDR block 10.2.2.0/24, has no access of any kind to file system A or file system B.
  • Both file systems A and B are associated to a single mount target, MT1. Each file system has an export contained in the export set of MT1.

Since Client A and Client B access the mount target from different CIDR blocks, you can set the client options for both file system exports to allow access to only a single CIDR block. Client C is denied access by not including its IP address or CIDR block in the NFS export options for any export of either file system.

Console Example
CLI Example
API Example

Scenario B: Limit the Ability to Write Data

Provide data to customers for consumption, but don't allow them to update the data.

For example, you'd like to publish a set of resources in file system A for an application to consume, but not change. The application connects from IP address 10.0.0.8.

Console Example
CLI Example
API Example

Scenario C: Improve File System Security

To increase security, you'd like to limit the root user's privileges when connecting to File System A. Use Identity Squash to remap root users to UID/GID 65534. In Unix-like systems, this UID/GID combination is reserved for 'nobody', a user with no system privileges.

CLI Example
API Example

 

Tip

If you don't want a file system to be visible to any clients, you can set all of the properties in the exportOptions array to empty values. For example,

{
   "exportOptions": [
     {
      "source":"",
      "requirePrivilegedSourcePort":"",
      "access": "",
      "identitySquash":""}        
] 

Using the Console

To set export options for a file system

Using the CLI

For information about using the CLI, see Command Line Interface (CLI).

To create an export
To update export options
To list exports
To delete an export

Using the API