Skip to content

Commit 3d7a3c5

Browse files
ehoughehough
committed
Merge branch 'develop'
2 parents 3919a98 + 5a4de87 commit 3d7a3c5

File tree

6 files changed

+308
-53
lines changed

6 files changed

+308
-53
lines changed

‎CHANGELOG.md

+14-2
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,19 @@ All notable changes to this project will be documented in this file.
44
The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
55
and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
66

7-
## [2.1.0] - 2019-10-31
7+
## [2.2.0] - 2019-03-08
8+
## Added
9+
* Enhanced debugging via environment variable: `NFS_LOG_LEVEL=DEBUG`. This also produces less cluttered log output
10+
during regular, non-debug operation.
11+
## Fixed
12+
* `idmapd` would not start when `NFS_VERSION=3`
13+
* allow Kerberos without `idmapd`. Most users will probably want to run them together, but
14+
it isn't required.
15+
* `NFS_VERSION` environment variable sanity check allowed invalid values
16+
* status code of `rpc.svcgssd` was not properly checked
17+
* `idmapd` debug output was invisible
18+
19+
## [2.1.0] - 2019-01-31
820
### Added
921
* Ability to automatically load kernel modules. ([#18](https://github.com/ehough/docker-nfs-server/issues/18)). Credit to [@andyneff](https://github.com/andyneff).
1022
### Fixed
@@ -48,4 +60,4 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
4860
* Fixed detection of built-in kernel modules ([#4](https://github.com/ehough/docker-nfs-server/pull/4))
4961

5062
## [1.0.0] - 2018-02-05
51-
Initial release.
63+
Initial release.

‎README.md

+3-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ This is the only containerized NFS server that offers **all** of the following f
1111
- clean teardown of services upon termination (no lingering `nfsd` processes on Docker host)
1212
- flexible construction of `/etc/exports`
1313
- extensive server configuration via environment variables
14-
- helpful, human-readable logging
14+
- human-readable logging (with a helpful [debug mode](doc/feature/logging.md))
1515
- *optional* bonus features
1616
- [Kerberos security](doc/feature/kerberos.md)
1717
- [NFSv4 user ID mapping](doc/feature/nfs4-user-id-mapping.md) via [`idmapd`](http://man7.org/linux/man-pages/man8/idmapd.8.html)
@@ -24,6 +24,7 @@ This is the only containerized NFS server that offers **all** of the following f
2424
* [Starting the server](#starting-the-server)
2525
* [Mounting filesystems from a client](#mounting-filesystems-from-a-client)
2626
* Optional features
27+
* [Debug logging](doc/feature/logging.md)
2728
* [Kerberos security](doc/feature/kerberos.md)
2829
* [NFSv4 user ID mapping](doc/feature/nfsv4-user-id-mapping.md)
2930
* [AppArmor integration](doc/feature/apparmor.md)
@@ -144,6 +145,7 @@ If you pay close attention to each of the items in this section, the server shou
144145

145146
## Optional Features
146147

148+
* [Debug logging](doc/feature/logging.md)
147149
* [Kerberos security](doc/feature/kerberos.md)
148150
* [NFSv4 user ID mapping](doc/feature/nfs4-user-id-mapping.md)
149151
* [AppArmor integration](doc/feature/apparmor.md)

‎doc/feature/kerberos.md

-4
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,6 @@ You can enable Kerberos security for your NFS server with the following steps.
66
1. set the server's hostname via the `--hostname` flag
77
1. provide `/etc/krb5.keytab` which contains a principal of the form `nfs/<hostname>`, where `<hostname>` is the hostname you supplied in the previous step.
88
1. provide [`/etc/krb5.conf`](https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html)
9-
1. provide [`/etc/idmapd.conf`](https://linux.die.net/man/5/idmapd.conf)
10-
1. provide `/etc/passwd` containing your NFS client users
119

1210
Here's an example:
1311

@@ -18,8 +16,6 @@ Here's an example:
1816
--hostname my-nfs-server.com \
1917
-v /host/path/to/server.keytab:/etc/krb5.keytab:ro \
2018
-v /host/path/to/server.krb5conf:/etc/krb5.conf:ro \
21-
-v /host/path/to/idmapd.conf:/etc/idmapd.conf:ro \
22-
-v /etc/passwd:/etc/passwd:ro \
2319
--cap-add SYS_ADMIN \
2420
-p 2049:2049 \
2521
erichough/nfs-server

‎doc/feature/logging.md

+157
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
# Logging
2+
3+
By default, the image will output a reasonable level of logging information so you can see verify that the server is operating as expected.
4+
5+
You can bump up the log level via the `NFS_LOG_LEVEL` environment variable. Currently, the only acceptable value is `DEBUG`.
6+
7+
In your `docker-run` command:
8+
```
9+
docker run -e NFS_LOG_LEVEL=DEBUG ... erichough/nfs-server
10+
```
11+
or in `docker-compose.yml`:
12+
```YAML
13+
version: 3
14+
services:
15+
nfs:
16+
image: erichough/nfs-server
17+
...
18+
environment:
19+
- LOG_LEVEL: DEBUG
20+
```
21+
22+
### Normal log output
23+
24+
Normal, non-debug logging will look something like this:
25+
26+
```
27+
==================================================================
28+
SETTING UP ...
29+
==================================================================
30+
----> building /etc/exports from environment variables
31+
----> collected 4 valid export(s) from NFS_EXPORT_* environment variables
32+
----> kernel module nfs is loaded
33+
----> kernel module nfsd is loaded
34+
----> kernel module rpcsec_gss_krb5 is loaded
35+
----> setup complete
36+
37+
==================================================================
38+
STARTING SERVICES ...
39+
==================================================================
40+
----> mounting rpc_pipefs filesystem onto /var/lib/nfs/rpc_pipefs
41+
----> mounting nfsd filesystem onto /proc/fs/nfsd
42+
----> starting rpcbind
43+
----> exporting filesystem(s)
44+
----> starting rpc.mountd on port 32767
45+
----> starting statd on port 32765 (outgoing from port 32766)
46+
----> starting idmapd
47+
----> starting rpc.nfsd on port 2049 with 16 server thread(s)
48+
----> starting rpc.svcgssd
49+
----> all services started normally
50+
51+
==================================================================
52+
SERVER STARTUP COMPLETE
53+
==================================================================
54+
----> list of enabled NFS protocol versions: 3
55+
----> list of container exports:
56+
----> /nfs/htpc-media *(ro,no_subtree_check,insecure,async)
57+
----> /nfs/homes/staff *(rw,no_subtree_check,insecure,sec=krb5p)
58+
----> /nfs/homes/ehough *(rw,no_subtree_check,insecure,no_root_squash,sec=krb5p)
59+
----> /nfs/backup/duplicacy *(rw,no_subtree_check,insecure,sec=krb5p,all_squash,anonuid=0,anongid=0)
60+
----> list of container ports that should be exposed:
61+
----> 111 (TCP and UDP)
62+
----> 2049 (TCP and UDP)
63+
----> 32765 (TCP and UDP)
64+
----> 32767 (TCP and UDP)
65+
66+
==================================================================
67+
READY AND WAITING FOR NFS CLIENT CONNECTIONS
68+
==================================================================
69+
70+
```
71+
72+
### Debug output
73+
74+
Debug output will look something like this:
75+
76+
```
77+
==================================================================
78+
SETTING UP ...
79+
==================================================================
80+
----> /etc/exports is baked into the image
81+
----> kernel module nfs is loaded
82+
----> kernel module nfsd is loaded
83+
----> kernel module rpcsec_gss_krb5 is loaded
84+
----> setup complete
85+
86+
==================================================================
87+
STARTING SERVICES ...
88+
==================================================================
89+
----> mounting rpc_pipefs filesystem onto /var/lib/nfs/rpc_pipefs
90+
mount: mount('rpc_pipefs','/var/lib/nfs/rpc_pipefs','rpc_pipefs',0x00008000,'(null)'):0
91+
----> mounting nfsd filesystem onto /proc/fs/nfsd
92+
mount: mount('nfsd','/proc/fs/nfsd','nfsd',0x00008000,'(null)'):0
93+
----> starting rpcbind
94+
----> exporting filesystem(s)
95+
exporting *:/nfs/backup/duplicacy
96+
exporting *:/nfs/homes/ehough
97+
exporting *:/nfs/homes/staff
98+
exporting *:/nfs/htpc-media
99+
----> starting rpc.mountd on port 32767
100+
----> starting statd on port 32765 (outgoing from port 32766)
101+
----> starting idmapd
102+
rpc.idmapd: Setting log level to 11
103+
104+
rpc.idmapd: libnfsidmap: using domain: hough.matis
105+
rpc.idmapd: libnfsidmap: Realms list: 'HOUGH.MATIS'
106+
rpc.idmapd: libnfsidmap: processing 'Method' list
107+
rpc.idmapd: static_getpwnam: name 'nfs/blue@HOUGH.MATIS' mapped to 'root'
108+
rpc.idmapd: static_getpwnam: localname 'melissa' for 'melissa@HOUGH.MATIS' not found
109+
rpc.idmapd: static_getpwnam: name 'ehough@HOUGH.MATIS' mapped to 'ehough'
110+
rpc.idmapd: static_getgrnam: group 'nfs/blue@HOUGH.MATIS' mapped to 'root'
111+
rpc.idmapd: static_getgrnam: local group 'melissa' for 'melissa@HOUGH.MATIS' not found
112+
rpc.idmapd: static_getgrnam: group 'ehough@HOUGH.MATIS' mapped to 'ehough'
113+
rpc.idmapd: libnfsidmap: loaded plugin /usr/lib/libnfsidmap/static.so for method static
114+
rpc.idmapd: Expiration time is 600 seconds.
115+
rpc.idmapd: Opened /proc/net/rpc/nfs4.nametoid/channel
116+
rpc.idmapd: Opened /proc/net/rpc/nfs4.idtoname/channel
117+
----> starting rpc.nfsd on port 2049 with 16 server thread(s)
118+
rpc.nfsd: knfsd is currently down
119+
rpc.nfsd: Writing version string to kernel: -2 +3 +4 +4.1 +4.2
120+
rpc.nfsd: Created AF_INET TCP socket.
121+
rpc.nfsd: Created AF_INET UDP socket.
122+
rpc.nfsd: Created AF_INET6 TCP socket.
123+
rpc.nfsd: Created AF_INET6 UDP socket.
124+
----> starting rpc.svcgssd
125+
entering poll
126+
----> all services started normally
127+
128+
==================================================================
129+
SERVER STARTUP COMPLETE
130+
==================================================================
131+
----> list of enabled NFS protocol versions: 4.2, 4.1, 4, 3
132+
----> list of container exports:
133+
----> /nfs/backup/duplicacy *(rw,sync,wdelay,hide,nocrossmnt,insecure,root_squash,all_squash,no_subtree_check,secure_locks,acl,no_pnfs,anonuid=0,anongid=0,sec=krb5p,rw,insecure,root_squash,all_squash)
134+
----> /nfs/homes/ehough *(rw,sync,wdelay,hide,nocrossmnt,insecure,no_root_squash,no_all_squash,no_subtree_check,secure_locks,acl,no_pnfs,anonuid=65534,anongid=65534,sec=krb5p,rw,insecure,no_root_squash,no_all_squash)
135+
----> /nfs/homes/staff *(rw,sync,wdelay,hide,nocrossmnt,insecure,root_squash,no_all_squash,no_subtree_check,secure_locks,acl,no_pnfs,anonuid=65534,anongid=65534,sec=krb5p,rw,insecure,root_squash,no_all_squash)
136+
----> /nfs/htpc-media *(ro,async,wdelay,hide,nocrossmnt,insecure,root_squash,no_all_squash,no_subtree_check,secure_locks,acl,no_pnfs,anonuid=65534,anongid=65534,sec=sys,ro,insecure,root_squash,no_all_squash)
137+
----> list of container ports that should be exposed:
138+
----> 111 (TCP and UDP)
139+
----> 2049 (TCP and UDP)
140+
----> 32765 (TCP and UDP)
141+
----> 32767 (TCP and UDP)
142+
143+
==================================================================
144+
READY AND WAITING FOR NFS CLIENT CONNECTIONS
145+
==================================================================
146+
leaving poll
147+
handling null request
148+
svcgssd_limit_krb5_enctypes: Calling gss_set_allowable_enctypes with 7 enctypes from the kernel
149+
sname = nfs/blue@HOUGH.MATIS
150+
doing downcall
151+
mech: krb5, hndl len: 4, ctx len 52, timeout: 1552111964 (31564 from now), clnt: nfs@blue, uid: 0, gid: 0, num aux grps: 1:
152+
( 1) 0
153+
sending null reply
154+
writing message: \x \x6082024606092a864886f71201020201006e82023530820231a003020105a10302010ea20703050020000000a38201306182012c30820128a003020105a10d1b0b484f5547482e4d41544953a2153013a003020103a10c300a1b036e66731b036e6173a381fa3081f7a003020113a103020106a281ea0481e79cf640041a02f97332a25760a707a3f039f61301d07b2dfbb8bf9448cbfd168d0958c7717b535f7799c87390469c94045a6cd3f54c91ddeda9274b1ea492a43e6b17dec3ad17aaa94b9e61cdd4f4c8e7a35d8e84d56c7657e63536358e1316e2e8362922b47b465dd57aa29cb743128432decee09c3a06e6b4d5f6cebcd0978ee37bf0155a01a6ed623dc7b3068163fedaadec1e1509788db701c5308c703aa0e3196188e40c22afc361d2d9762750627c091516f05059a1f965df187dc981f4ac59bf3f424f23e676109a8c93af93b66f704f78703e1ef642fddf5b01d7deb40db26642e9f4f0a481e73081e4a003020111a281dc0481d9299c7ea474abf5d08a5f4f977254552e712f783f89bf40eb2cbd0082614593e377ec8cfe1c1ffb1bc0fad366382258f63857928240933914478fbceadc3b3bfe2e1f9a477c601d6b20c19898813878f45cea78ae601a342f000faf89c2e0e4c37fdb5db7937ac327ac0470c1f97dd421a112a6739467132d598db38ff99f9a88a8ac44e72f5cd088bd4d6159e15be75a7447d556134bda4fa0a96e64e3350d3a198e0635e4e7fb4900962aed3912fe0f316a1fa27121133232816b1177c707c0c37b396add3b347be38db756f05815ca3de5b3874782d80bf9 1552080460 0 0 \x01000000 \x60819906092a864886f71201020202006f8189308186a003020105a10302010fa27a3078a003020111a271046fdfb95cbe1237d785691a0ca14b4f7443142dda2b2a1b2845499bdb69b538719fbfc99b71d72ae61d7bd9966c106b2381fd08690082de26da5b8f521081035b5d7b8bf6c6eda85fd73c1c76ff03bec7693695e0b3d9e72069ec3772f93c4dbc5e8ce698a0854b494714bd5801204af3
155+
finished handling null request
156+
entering poll
157+
```

‎doc/feature/nfs4-user-id-mapping.md

+1-2
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,11 @@
11
# NFSv4 User ID Mapping
22

3-
If you'd like to run [`idmapd`](http://man7.org/linux/man-pages/man8/idmapd.8.html) to map between NFSv4 IDs (e.g. `foo@bar.com`) and local users, simply provide [`idmapd.conf`](https://linux.die.net/man/5/idmapd.conf) and `/etc/passwd` to the container. This step is required for [Kerberos](kerberos.md).
3+
If you'd like to run [`idmapd`](http://man7.org/linux/man-pages/man8/idmapd.8.html) to map between NFSv4 IDs (e.g. `foo@bar.com`) and local users, simply provide [`idmapd.conf`](https://linux.die.net/man/5/idmapd.conf) to the container.
44

55
docker run \
66
-v /host/path/to/exports.txt:/etc/exports:ro \
77
-v /host/files:/nfs \
88
-v /host/path/to/idmapd.conf:/etc/idmapd.conf:ro \
9-
-v /etc/passwd:/etc/passwd:ro \
109
--cap-add SYS_ADMIN \
1110
-p 2049:2049 \
1211
erichough/nfs-server

0 commit comments

Comments
 (0)