Services for Network File System

Services for Network File System (NFS) provides a file sharing solution that enables you to transfer files between computers running Windows Server 2008 and UNIX operating systems using the NFS protocol.

For more information about Services for NFS, see the Windows Server TechCenter (http://go.microsoft.com/fwlink/?LinkId=92798).

  • Overview of Services for Network File System

  • Checklist: Get Started with Services for Network File System

  • Best Practices for Services for Network File System

  • Installing and Uninstalling Services for Network File System

  • Configuring Server for NFS

  • Securing Server for NFS

  • Managing Server for NFS

  • Troubleshooting Services for Network File System


Overview of Services for Network File System

Services for Network File System (NFS) provides a file sharing solution for enterprises that have a mixed Windows and UNIX environment. With Services for NFS, you can transfer files between computers running Windows Server 2008 and UNIX operating systems using the NFS protocol.

For more information about Services for NFS, see the Windows Server TechCenter (http://go.microsoft.com/fwlink/?LinkId=92798).

What new functionality is provided in Windows Server 2008 R2?

Services for NFS includes the following improvements between Windows Server 2008 and Windows Server 2008 R2:

  • Netgroup support. Services for NFS supports netgroups, which are used to create network-wide named groups of hosts. Netgroups simplify control of user and group login and shell access to remote computers, and enable system administrators to more easily manage NFS access control lists.

  • RPCSEC_GSS support. Services for NFS provides native support for RPCSEC_GSS, which enables applications to take advantage of GSS-API security features.

    Note

    RPCSEC_GSS support includes authentication and integrity. Privacy is not provided.

  • Using WMI to manage Server for NFS. WMI enables NFS remote management by allowing Web Based Enterprise Management (WBEM) applications to communicate with WMI providers on the local or remote computers to manage WMI objects.

  • Unmapped UNIX User access. An Unmapped UNIX User option is now available for NFS shares. Windows servers can be used for storing NFS data without creating UNIX-to-Windows account mapping. Mapped user accounts will use standard Windows security identifiers (SIDs) and unmapped users will use Custom NFS SIDs.

Note

Although User Name Mapping server functionality does not exist for Windows Server 2008 R2, User Name Mapping client functionality is present. Services for NFS can still retrieve mappings from existing legacy User Name Mapping servers.

Additional references

  • Checklist: Get Started with Services for Network File System

  • Best Practices for Services for Network File System

  • Installing and Uninstalling Services for Network File System

  • Configuring Server for NFS

  • Securing Server for NFS

  • Managing Server for NFS


Checklist: Get Started with Services for Network File System

The following checklist provides a guide to help you start working with Services for Network File System (NFS). For additional information, see the Windows Server TechCenter (http://go.microsoft.com/fwlink/?LinkId=92798).

 | Task | Reference
Check box | Review general information and best practices for Services for NFS. | Overview of Services for Network File System Best Practices for Services for Network File System
Check box | Install Services for NFS. | Installing and Uninstalling Services for Network File System
Check box | Configure Server for NFS. | Configuring Server for NFS
Check box | Secure Server for NFS. | Securing Server for NFS
Check box | Manage Server for NFS. | Managing Server for NFS
Check box | Troubleshoot Services for NFS. | Troubleshooting Services for Network File System


Best Practices for Services for Network File System

This topic summarizes best practices for working with Services for Network File System (NFS) in a Windows Server 2008 environment. Areas covered include general best practices and tips for working with Server for NFS in a server cluster. For more information about Services for NFS, see the Windows Server TechCenter (http://go.microsoft.com/fwlink/?LinkId=92798).

General best practices

Use the correct utilities to administer Services for NFS.

You cannot use Services for NFS or command-line utilities to administer earlier versions of Services for NFS. Also, you cannot use earlier versions of Services for NFS or command-line utilities to administer newer versions of Services for NFS.

You can use Services for NFS to administer Services for NFS components on a remote computer if both computers are running Windows Server 2008.

Open firewall ports.

Services for NFS requires several ports that must be open in Windows Firewall and other firewalls. When prompted, make sure that you allow Services for NFS components.

Provide user-level security.

With Server for NFS, you can control access by users and groups to Services for NFS resources. You must configure and populate Active Directory Domain Services with user identifier (UID) and group identifier (GID) information or install User Name Mapping on one computer in your network to associate Windows user accounts with UNIX user accounts. In some cases you may also need to install Server for NFS Authentication.

Secure files.

Server for NFS only supports storage volumes that are formatted for the NTFS file system. NTFS volumes enable you to provide file-level security by allowing and denying file access to specific users and groups. When you want anonymous users to access files, make sure that directory and file permissions provide appropriate access for anonymous users. In addition, when sharing the directory, use host-level NFS access control when creating the NFS shared resource to provide an additional level of security to protect the files in the directory.

Secure new drives.

When you add a new drive to a computer running Server for NFS, be sure to modify the permissions protecting the root directory of the drive to make sure that untrusted users, including Everyone users, cannot write to the directory. This will prevent untrusted users from being able to compromise Server for NFS security by protecting shared directories on the drive.

Allow users to disconnect before stopping the Server for NFS service.

Before you stop Server for NFS or uninstall it, notify users who are connected to Services for NFS shared resources that you are about to stop the service. You can then stop the service after the users have had the opportunity to close open files and disconnect from shared directories.

Use naming conventions to identify shares with EUC encoding.

If a directory is shared with one type of Extended UNIX Code (EUC) encoding (such as EUC-JP) and a client that is configured to use a different EUC encoding (such as EUC-TW) attempts to connect to the shared directory, unexpected results can occur. To prevent this, establish a naming convention to use when sharing directories with EUC encoding so that users of client computers can know how shared directories are encoded.

Protect configuration files.

If you create configuration files (such as a character translation file or an audit log file), be sure to protect them with a discretionary access control list (DACL) that grants Full Control to the built-in System account and to the Administrators group. The DACL should contain no other entries.

Best practices for running Server for NFS in a server cluster

Stop Server for NFS before stopping the server cluster.

To ensure proper operation of Server for NFS in a server cluster, when stopping the server cluster, first stop Server for NFS, then stop the server cluster.

Ensure shared resource availability when a node fails.

To ensure that a shared directory cluster resource will be available after the node containing the resource fails, make the cluster resource dependent on the appropriate physical disk resource.

Use the appropriate tool to manage NFS Share cluster resources.

Although you can use Windows Explorer to view the properties of an NFS Share cluster resource, you should not use it to change those properties. You should only use Cluster Administrator or the cluster command to create and administer shared NFS directories on a server cluster.

Avoid conflicting share names.

Ensure that the share name of every shared directory on the server cluster is unique. Otherwise, if one node in the cluster fails over to another node, and if shared directories on the two nodes have the same name, then only one of the shared directories will be available.

Ensure the availability of audit logs.

Do not designate a shared disk resource as the location of the Server for NFS audit log. Only one node in the cluster can own the log file. This means that if the ownership of a group is moved to another node, the audit events for the remaining shared resources on the original node cannot be recorded in the file. To ensure the availability of Server for NFS audit logs, you should log events to the Event Viewer event log.

Move shared resources or take them offline before stopping Server for NFS.

When Server for NFS is stopped on a cluster node hosting active NFS shared resources, the Cluster service responds as though this were a failure of one of its managed resources. Consequently, the Cluster service will try to restart the service in an attempt to keep the resource available. Before you attempt to stop Server for NFS on a server cluster node, either move all groups containing NFS shared resources to another node on the cluster, or take all NFS shared resources on the node offline.

Take resources offline before modifying.

Be sure to take an NFS shared directory resource offline before modifying its properties. Failing to do so might produce unexpected results.

Administer Server for NFS only from computers in a trusted domain.

To ensure that Server for NFS configuration changes are properly replicated, always use a computer that belongs to a trusted domain when you administer Server for NFS running on a cluster. This is necessary because Server for NFS configuration changes are not properly replicated among nodes in a cluster if you run Services for NFS Administration or nfsadmin on a computer that belongs to a domain that is not trusted by the domain of the cluster.

Restart the Server for NFS service after the Cluster service restarts.

If the Cluster service must be restarted on a node in the cluster, stop and then restart the Server for NFS service on that node. This will ensure that Server for NFS configuration changes will be replicated properly among the nodes of the cluster.

Choose the appropriate sharing mode.

When you create an NFS shared directory resource, you have the option of sharing the root of the specified directory or all the subdirectories in the directory. Before choosing this option, first decide whether you will need to control access to the subdirectories or change their share names. If you need to do this, you must share the subdirectories separately because when you create an NFS shared directory resource to share the subdirectories, you cannot set access permissions, allow (or deny) anonymous access, or change the share name of the subdirectories separately.

If you choose to share all the subdirectories in the directory, make sure that the permissions protecting the directory do not allow untrusted users to create subdirectories. Otherwise, a malicious user can overwhelm the Cluster service by creating a very large number of subdirectories that would automatically be shared as a cluster resource.

Use the command line properly when creating or modifying NFS Share cluster resources.

If you use the cluster command to create and modify NFS Share cluster resources, the following considerations apply:

  • When you create the cluster resource using the cluster command, you can set some nonprivate properties, but not all.

  • When using the cluster command to set properties, do not rely on default values because they might not be valid for an NFS Share cluster resource. Always set property values explicitly.

  • To set or view permissions on an NFS Share cluster resource, use Cluster Administrator. You can also use the nfsshare command to view permissions, but not to set them.

Use hard mounts.

Users of client computers should be instructed to use hard mounts when mounting NFS directories shared on the server cluster. This will ensure that, if the node sharing the directory fails, the client computer will not time out before the failover to another node is complete.

Use the correct virtual server name.

Users of client computers should be instructed to mount NFS directories shared on the server cluster using the virtual server name from the same group as the shared directory. Using a virtual server name from another group or using the node name allows the client computer to mount the directory, but the mount can be lost in case of a failover.

Additional references

  • Overview of Services for Network File System

  • Checklist: Get Started with Services for Network File System

  • Best Practices for Services for Network File System

  • Installing and Uninstalling Services for Network File System

  • Configuring Server for NFS

  • Securing Server for NFS

  • Managing Server for NFS


Installing and Uninstalling Services for Network File System

This section contains the following procedures for installing and uninstalling Services for Network File System (NFS), as well as information about upgrading:

  • Understanding Upgrades in Services for Network File System

  • Install and Uninstall Services for Network File System Using the Windows Interface

  • Install and Uninstall Services for Network File System Using OCSetup.exe


Understanding Upgrades in Services for Network File System

Points to consider for an upgrade

  • Windows Server 2003 R2 includes User Name Mapping. Windows Server 2008 does not. Upgrading to Windows Server 2008 removes the User Name Mapping service.

Note

Windows Server 2008 can still retrieve UNIX-style identity data from remote User Name Mapping servers. Windows Server 2008 can also retrieve UNIX-style identity data from Active Directory Domain Services (AD DS). Customers can either set up a centralized remote User Name Mapping server or integrate UNIX-style identity data into AD DS.

  • Anonymous access in Windows Server 2008 is handled differently. The Network Access: Let Everyone permissions apply to anonymous users security policy must be set to enable anonymous access.

  • Customers need to ensure that Windows Server 2008 firewall settings are still valid after migration.

    Note

    Services for Network File System (NFS) in Windows Server 2003 R2 requires that you manually configure the Windows Firewall. In Windows Server 2008, this is not necessary.

Additional references

  • Overview of Services for Network File System

  • Installing and Uninstalling Services for Network File System


Install and Uninstall Services for Network File System Using the Windows Interface

You need to install Services for Network File System (NFS) components on a computer running Windows Server 2008. These instructions assume that you are installing all of the components on a single computer.

Installing and uninstalling Services for NFS components

  • Installing Services for NFS components

  • Uninstalling Services for NFS components
To install Services for NFS components

  1. Click Start, point to Administrative Tools, and then click Server Manager.

  2. In the left pane, click Manage Roles.

  3. Click Add Roles. The Add Roles Wizard appears.

  4. Click Next. The Select Server Roles options appear.

  5. Select the File Server check box and click Next.

  6. The File Server screen appears. Click Next to view the Role Services options.

  7. Select the Services for Network File System (NFS) check box and click Next.

  8. Confirm your selection and click Install.

  9. When the installation completes, the installation results will appear. Click Close.

Additional references

  • Installing and Uninstalling Services for Network File System

To uninstall Services for NFS components

  1. Click Start, point to Administrative Tools, and then click Server Manager.

  2. In the left pane, click Manage Roles.

  3. Follow the steps below that apply to your situation:

    • If the NFS service is the only service installed, you must remove the entire File Services role.

      1. In the right-hand pane, below Roles Summary, click Remove roles. The Remove Roles Wizard appears.

      2. The Before You Begin page appears. Click Next.

      3. On the Remove Server Roles page, ensure the File Services check box is clear and click Next.

      4. Confirm your selection by clicking Remove.

      5. When the Removal Results window appears, restart to complete the role removal.

    • If the NFS service is not the only service installed, you only need to remove the Services for NFS role service.

      1. In the right-hand pane, next to Role Services, click Remove role services.

      2. On the Select Role Services page, ensure the Services for Network File System (NFS) check box is clear and click Next.

      3. Confirm your selection by clicking Remove.

      4. When the Removal Results window appears, restart to complete the removal.

Additional references

  • Installing and Uninstalling Services for Network File System


Install and Uninstall Services for Network File System Using OCSetup.exe

Before running OCSetup.exe at a command prompt, set the command prompt to run as an administrator (even if you are logged on as an administrator on the computer).

  1. Click the Start button, and select All Programs.

  2. Select Accessories.

  3. Right-click the command prompt, and click Run as administrator.

Examples

The following table gives examples of using the OCSetup command to install the different Services for NFS components.

Component Command

Server for NFS, Client for NFS, Services for NFS Administration

Ocsetup ServicesForNFS-ServerAndClient;ServerForNFS-Infrastructure;NFS-Administration;ClientForNFS-Infrastructure

Server for NFS, Services for NFS Administration

Ocsetup ServicesForNFS-ServerAndClient;ServerForNFS-Infrastructure;NFS-Administration

Client for NFS, Services for NFS Administration

Ocsetup ServicesForNFS-ServerAndClient;ClientForNFS-Infrastructure;NFS-Administration
Note

To uninstall Services for NFS components, append the above commands with /uninstall.

Additional references

  • Overview of Services for Network File System

  • Best Practices for Services for Network File System

  • Installing and Uninstalling Services for Network File System


Configuring Server for NFS

This section contains the following procedures for configuring Server for NFS:

  • Start and Stop Server for NFS

  • Specify How Server for NFS Obtains Windows User and Group Information

  • Set the Lock Grace Period

  • Release Locks

  • Set Up Activity Logging

  • Specify Server for NFS TCP and UDP Settings

  • Enable NFS Version

  • Configure File Name Character Translation

  • Configure the Authentication Renewal Period

  • Configure Case Sensitivity for File and Folder Names

  • Change the Directory Cache Memory Setting


Start and Stop Server for NFS

Starting Server for NFS

  • Using the Windows interface

  • Using the command prompt
To start Server for NFS from the Windows interface

  1. Open Services for Network File System: click Start, point to Administrative Tools, and then click Services for Network File System (NFS).

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NFS, and then click Start service.

Additional references

  • Configuring Server for NFS

To start Server for NFS from the command prompt

  1. Open a command prompt with elevated privileges.

    1. Click Start, and then click All Programs.

    2. Point to Accessories, right-click the Command Prompt icon, and then click Run as administrator.

  2. At the command prompt, type:

    nfsadmin server [ComputerName] start

    Argument Description

    ComputerName

    The name of the computer on which you want to start Server for NFS.

    Note

    To view the complete syntax for this command, at a command prompt, type: nfsadmin server /?

Additional references

  • Configuring Server for NFS

Stopping Server for NFS

  • Using the Windows interface

  • Using the command prompt
To stop Server for NFS from the Windows interface

  1. Open Services for Network File System: click Start, point to Administrative Tools, and then click Services for Network File System (NFS).

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NFS, and then click Stop service.

Note

Before attempting to stop Server for NFS running on a node in a server cluster, either move all groups containing NFS shared resources to another node or take all NFS shared resources offline.

Additional references

  • Configuring Server for NFS

To stop Server for NFS from the command line

  1. Open a command prompt with elevated privileges.

    1. Click Start, and then click All Programs.

    2. Point to Accessories, right-click the Command Prompt icon, and then select Run as administrator.

  2. At the command prompt, type:

    nfsadmin server [ComputerName] stop

    Argument Description

    ComputerName

    The name of the computer on which you want to stop Server for NFS.

    Notes
    • Before attempting to stop Server for NFS running on a node in a server cluster, either move all groups containing NFS shared resources to another node or take all NFS shared resources offline.
    • To view the complete syntax for this command, at a command prompt, type: nfsadmin server /?

Additional references

  • Configuring Server for NFS


Specify How Server for NFS Obtains Windows User and Group Information

When a user logs on to a UNIX host computer, the user's name and password are compared to those in a password file. If they match a user name and password in the file, the server returns a corresponding user identifier (UID) and group identifier (GID). The UID and GID identify the user for Network File System (NFS) browsing and mounting operations.

Server for NFS makes it possible for clients to access NFS resources without separately logging on to Server for NFS. Instead, the first time you try to access an NFS resource, Server for NFS looks up your UNIX UID and GID information in either Active Directory Domain Services or User Name Mapping. If your UNIX UID and GID information is mapped to Windows user and group accounts, the Windows names are returned to Server for NFS, which then uses the Windows user and group names to grant file access. If your UNIX UID and GID information is not mapped, then Server for NFS will deny file access.

Note

User Name Mapping has changed. Server functionality no longer exists, but client functionality is present. Services for NFS can still retrieve mappings from existing legacy User Name Mapping servers.

Specifying how Server for NFS obtains Windows user and group information

You can perform this procedure using the following methods:

  • Using the Windows interface

  • Using a command line

To specify how Server for NFS obtains UID and GID information using the Windows interface

  1. Open Services for Network File System: click Start, point to Administrative Tools, and then click Services for Network File System (NFS).

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Services for NFS, and then click Properties.

  4. Specify how Server for NFS obtains UID and GID information for users:

    • To use Active Directory Lookup, select the Active Directory domain name check box, type the domain name, and then click Apply.

    • To use User Name Mapping, select the User Name Mapping check box, type the name of the mapping server you want to use for authentication, and then click Apply.

    Notes
    • Before using Active Directory Lookup, you must install and populate the Identity Management for UNIX Active Directory schema extension, included in Windows Server 2008, or use an equivalent schema that includes UNIX UID and GID fields. Identity Management for UNIX greatly simplifies this aspect of Windows-to-UNIX user account management in Active Directory Domain Services.
    • You can specify the IP address of the User Name Mapping server instead of the name of the server.
    • Before using User Name Mapping, the computer running Server for NFS must be listed in the .maphosts file on the computer running User Name Mapping.

Additional references

  • Configuring Server for NFS

  • Best Practices for Services for Network File System

  • Troubleshooting Services for Network File System

To specify how Server for NFS obtains UID and GID information using the command line

  1. Open a command prompt with elevated privileges.

    1. Click Start, and then click All Programs.

    2. Point to Accessories, right-click the Command Prompt icon, and then click Run as administrator.

  2. Specify how Server for NFS obtains user UID and GID information for users.

    • To use Active Directory Lookup, type:

      nfsadmin mapping [ComputerName] config adlookup=yes addomain=DomainName

    Argument Description

    DomainName

    The name of the domain controller you want to use.

    ComputerName

    The name of the computer you want to manage.

    Notes
    • To view the complete syntax for this command, at a command prompt, type: nfsadmin mapping /?
    • Before using Active Directory Lookup, you must install and populate the Identity Management for UNIX Active Directory schema extension, included in Windows Server 2008, or use an equivalent schema that includes UNIX UID and GID fields. Identity Management for UNIX simplifies this aspect of Windows-to-UNIX user account management in Active Directory Domain Services.

Additional references

  • Configuring Server for NFS

  • Best Practices for Services for Network File System


Set the Lock Grace Period

Setting the lock grace period

  • Using the Windows interface

  • Using the command prompt
To set the lock grace period using the Windows interface

  1. Open Services for Network File System: click Start, point to Administrative Tools, and then click Services for Network File System (NFS).

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NFS, and then click Properties.

  4. Click the Locking tab.

  5. In Waiting Period, type the number of seconds within which Services for NFS clients can reestablish file locks after a network or server service interruption.

  6. To save this setting, click Apply.

Additional references

  • Configuring Server for NFS

  • Best Practices for Services for Network File System

  • Troubleshooting Services for Network File System

To set the lock grace period using the command prompt

  1. Open a command prompt with elevated privileges.

    1. Click Start, and then click All Programs.

    2. Point to Accessories, right-click the Command Prompt icon, and then select Run as administrator.

  2. At the command prompt, type:

    nfsadmin server [Computer Name] config lockperiod=LockingGracePeriod

    Argument Description

    ComputerName

    The name of the computer you want to manage.

    LockingGracePeriod

    The time period (in seconds) within which users can reestablish locks after the server restarts.

    Note

    To view the complete syntax for this command, at a command prompt, type: nfsadmin server /?

Additional references

  • Configuring Server for NFS

  • Best Practices for Services for Network File System


Release Locks

Releasing locks

  • Using the Windows interface

  • Using the command prompt
To release locks using the Windows interface

  1. Open Services for Network File System: click Start, point to Administrative Tools, and then click Services for Network File System (NFS).

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NFS, and then click Properties.

  4. Click the Locking tab.

  5. In the list of clients, click the client whose locks you want to release, click Release Locks, and then click Apply.

Additional references

  • Configuring Server for NFS

  • Best Practices for Services for Network File System

  • Troubleshooting Services for Network File System

To release locks using the command prompt

  1. Open a command prompt with elevated privileges.

    1. Click Start, and then click All Programs.

    2. Point to Accessories, right-click the Command Prompt icon, and then select Run as administrator.

  2. To list all locks, type:

    nfsadmin server [ComputerName] –l

  3. To release locks, type:

    nfsadmin server [ComputerName] –r [Client | all]

    Argument Description

    ComputerName

    The name of the computer you want to manage.

    Client

    The client whose locks you want to release.

    All

    Releases all locks.

    Notes
    • To view the complete syntax for this command, at a command prompt, type:
    • nfsadmin server /?

Additional references

  • Configuring Server for NFS

  • Best Practices for Services for Network File System


Set Up Activity Logging

Setting up activity logging

The following procedure describes the process of setting up activity logging for Server for NFS.

To set up logging using the Windows interface

  1. Open Services for Network File System: click Start, point to Administrative Tools, and then click Services for Network File System (NFS).

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NFS, and then click Properties.

  4. Click the Activity Logging tab.

  5. In Server for NFS Events, select the events to log from the following options:

    • Mount and unmount requests

    • Lock and unlock requests

    • Read and write requests

    • Create and delete requests

  6. To save the settings, click Apply.

    Notes
    • By default, no events are logged. If recording activity logs to a text file, the log file must be on your local computer. To stop logging an event, clear its check box.
    • If you choose to record Server for NFS activities in the event log, the string corresponding to the file name could be truncated due to a system limitation. One solution to this problem is to record activity logs to a text file. On a server cluster, we recommend that you record activities to Event Viewer because its data replicates to all the nodes in the cluster. In this scenario, recording activities to a text file in addition to the event log can help associate complete file names with a particular activity log entry.

Additional references

  • Configuring Server for NFS

  • Best Practices for Services for Network File System


Specify Server for NFS TCP and UDP Settings

Specifying TCP and UDP settings

  • Using the Windows interface

  • Using the command prompt
To specify Server for NFS TCP and UDP settings using the Windows interface

  1. Open Services for Network File System: click Start, point to Administrative Tools, and then click Services for Network File System (NFS) .

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NFS, and then click Properties.

  4. Click the Server Settings tab.

  5. Select the desired transport protocol setting from the Transport protocol drop-down list, and then click Apply.

    Important

    These changes will not take effect until Server for NFS is restarted.

Additional references

  • Configuring Server for NFS

  • Best Practices for Services for Network File System

  • Troubleshooting Services for Network File System

To specify Server for NFS TCP and UDP settings using the command prompt

  1. Open a command prompt with elevated privileges.

    1. Click Start, and then click All Programs.

    2. Point to Accessories, right-click the Command Prompt icon, and then click Run as administrator.

  2. At the command prompt, type:

    nfsadmin server [ComputerName] config [Protocol]= [Transport]

    Argument Description

    ComputerName

    The name of the computer you want to manage.

    Protocol

    The name of the NFS protocol you want to configure.

    Term

    Definition

    PortmapProtocol

    Specifies the Portmap protocol.

    MountProtocol

    Specifies the Mount protocol.

    NLMProtocol

    Specifies the Network Lock Manager protocol.

    NSMProtocol

    Specifies the Network Status Manager protocol.

    Transport

    The transport or combination of transports to enable for the given NFS protocol.

    Term

    Definition

    TCP

    Enables only the Transmission Control Protocol (TCP) transport.

    UDP

    Enables only the User Data Protocol (UDP) transport.

    TCP+UDP

    Enables both the TCP and UDP transports.

    Important

    These changes will not take effect until Server for NFS is restarted.

    Note

    To view the complete syntax for this command, at a command prompt, type: nfsadmin server /?

Additional references

  • Configuring Server for NFS

  • Best Practices for Services for Network File System


Enable NFS Version

Enabling NFS version 3

  • Using the Windows interface

  • Using the command prompt
To enable NFS version 3 using the Windows interface

  1. Open Services for Network File System: click Start, point to Administrative Tools, and then click Services for Network File System (NFS).

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NFS, and then click Properties.

  4. Click the Server Settings tab.

  5. Select the Enable NFS version 3 support check box, and then click Apply.
Important

These changes will not take effect until Server for NFS is restarted.

Additional references

  • Configuring Server for NFS

  • Best Practices for Services for Network File System

  • Troubleshooting Services for Network File System

To enable NFS version 3 using the command prompt

  1. Open a command prompt with elevated privileges.

    1. Click Start, and then click All Programs.

    2. Point to Accessories, right-click the Command Prompt icon, and then click Run as administrator.

  2. At the command prompt, type:

nfsadmin server [\\remoteMachineName] config enablev3={yes | no}

Argument | Description
ComputerName | The name of the computer you want to configure.
Important

These changes will not take effect until Server for NFS is restarted.

Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin server /?
  • NFS version 3 support is enabled by default.

Additional references

  • Configuring Server for NFS

  • Best Practices for Services for Network File System


Configure File Name Character Translation

Configuring file name character translation

  • Using the Windows interface

  • Using the command prompt
To configure file name character translation using the Windows interface

  1. Open Services for Network File System: click Start, point to Administrative Tools, and then click Services for Network File System (NFS).

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NFS, and then click Properties.

  4. Click the Filename Handling tab.

  5. Select the Translate file names check box.

  6. In the Character translation file box, type the fully qualified path of the file containing the character-translation map, or click Browse to find the file, and then click Apply.

    Important

    These changes will not take effect until Server for NFS is restarted.

    Important

    To prevent unauthorized users from tampering with the file name character translation file and causing Server for NFS to fail, ensure that the file is protected with a discretionary access control list (DACL) that grants Full Control to the built-in System account and to the Administrators group. The DACL should contain no other entries.

Additional references

  • Configuring Server for NFS

  • Best Practices for Services for Network File System

  • Troubleshooting Services for Network File System

To configure file name character translation using the command prompt

  1. Open a command prompt with elevated privileges:

    1. Click Start, and then click All Programs.

    2. Point to Accessories, right-click the Command Prompt icon, and then click Run as administrator.

  2. At the command prompt, type:

    nfsadmin server [ComputerMachineName] config translationfile=file

    Argument Description

    remoteMachineName

    The name of the computer you want to configure.

    file

    The fully qualified path and name of the file containing the character-translation map list. If you do not specify a file, character translation will be disabled.

    Important

    These changes will not take effect until Server for NFS is restarted.
Important

To prevent unauthorized users from tampering with the file name character translation file and causing Server for NFS to fail, ensure that the file is protected with a discretionary access control list (DACL) that grants Full Control to the built-in System account and to the Administrators group. The DACL should contain no other entries.

Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin server /?

Additional references

  • Configuring Server for NFS

  • Best Practices for Services for Network File System


Configure the Authentication Renewal Period

Configuring the authentication renewal period

  • Using the Windows interface

  • Using the command prompt
To configure how often authentication is renewed using the Windows interface

  1. Open Services for Network File System: click Start, point to Administrative Tools, and then click Services for Network File System (NFS).

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NFS, and then click Properties.

  4. Click the Server Settings tab.

  5. Choose one of the following options:

    • To prevent Server for NFS from periodically renewing authentication, click Do not renew authentication.

    • To configure Server for NFS to renew authentication periodically, click Renew authentication every: and type how many seconds will elapse before authentication will be renewed. The default value is 600 seconds.

  6. Click Apply.

Additional references

  • Configuring Server for NFS

  • Best Practices for Services for Network File System

  • Troubleshooting Services for Network File System

To configure how often authentication is renewed using the command prompt

  1. Open a command prompt with elevated privileges.

    1. Click Start, and then click All Programs.

    2. Point to Accessories, right-click the Command Prompt icon, and then click Run as administrator.

  2. Choose one of the following options:

    • To prevent Server for NFS from periodically renewing authentication, type:

      nfsadmin server [ComputerName] config renewauth=no

    • To configure Server for NFS to renew authentication periodically, type:

      nfsadmin server [ComputerName] config renewauth=yes

      nfsadmin server [ComputerName] config renewauthinterval=seconds

      Argument Description

      ComputerName

      The name of the computer you want to configure.

      seconds

      The number of seconds that will elapse before authentication is renewed. The default value is 600.

      Note

      To view the complete syntax for this command, at a command prompt, type: nfsadmin server /?

Additional references

  • Configuring Server for NFS

  • Best Practices for Services for Network File System


Configure Case Sensitivity for File and Folder Names

Configuring case sensitivity

  • Using the Windows interface

  • Using the command prompt
To configure case sensitivity for file and folder names using the Windows interface

  1. Open Services for Network File System: click Start, point to Administrative Tools, and then click Services for Network File System (NFS) .

  2. If necessary, connect to the computer you want to manage.

  3. Right-click Server for NFS, and then click Properties.

  4. Click the Filename Handling tab.

  5. Do one of the following:

    • To enable case-sensitive file and directory name lookups, select the Enable case sensitive filename support in Server for NFS check box.

    • To disable case-sensitive file and directory name lookups, clear the Enable case sensitive filename support in Server for NFS check box.

  6. Click Apply.

    Important
    • These changes will not take effect until Server for NFS is restarted.
    • You also need to disable Windows kernel case-insensitivity in order for Server for NFS to support case-sensitive file names. You can disable Windows kernel case-insensitivity by clearing the following registry key to 0:
    • HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel
    • DWORD “obcaseinsensitive”

Additional references

  • Configuring Server for NFS

  • Best Practices for Services for Network File System

  • Troubleshooting Services for Network File System

To configure case sensitivity for file and folder names using the command prompt

  1. Open a command prompt.

  2. To enable case sensitivity, type:

    nfsadmin server [ComputerName] config casesensitivelookups=yes

  3. To disable case sensitivity and optionally specify the case of file names returned by Server for NFS, type:

    nfsadmin server [ComputerName] config casesensitivelookups=no [ntfscase={upper | lower | preserve}]

    Argument Description

    ComputerName

    The name of the computer you want to configure.

    Important

    These changes will not take effect until Server for NFS is restarted.

    Notes
    • The ntfscase option sets the case sensitivity for the NTFS file system. The default case sensitivity is preserve (preserve case).
    • To view the complete syntax for this command, at a command prompt, type:
    • nfsadmin server /?

Additional references

  • Configuring Server for NFS

  • Best Practices for Services for Network File System


Change the Directory Cache Memory Setting

Server for NFS maintains a cache of directory information that it can search instead of directories on the physical disk. By default, this cache is configured to use 128 KB of memory per directory that Server for NFS caches. You can change the amount of memory that the directory cache uses by configuring the folder cache size using the command prompt.

Changing the directory cache memory setting

The following procedure describes how to adjust the amount of memory the directory cache uses.

To configure the folder cache size using the command prompt

  1. Open a command prompt with elevated privileges.

    1. Click Start, and then click All Programs.

    2. Point to Accessories, right-click the Command Prompt icon, and then click Run as administrator.

  2. Type the following:

    nfsadmin server [\\remoteMachineName] config dircache=size

    Value Description

    remoteMachineName

    The name of the computer you want to configure.

    size

    The size in kilobytes (KB) to set the directory cache to. The default size is 128 KB.
Notes
  • To view the complete syntax for this command, at a command prompt, type:
  • nfsadmin server /?

Additional references

  • Configuring Server for NFS

  • Best Practices for Services for Network File System


Securing Server for NFS

This section contains the following procedures for securing Server for NFS:

  • Understanding Windows Security Descriptors in Server for NFS

  • Understanding DACLs in Server for NFS

  • Allow Root and Anonymous Access to Resources by NFS Clients

  • Use Setuid, Setgid, and Sticky Bits with Server for NFS

  • Add Clients and Groups to the NFS Share Permissions List


Understanding Windows Security Descriptors in Server for NFS

Server for NFS uses the Windows security descriptor when implementing Network File System (NFS) access permissions. The security descriptor is the structure that governs security assignments for Windows. The security descriptor contains the following components:

  • File owner

  • File group

  • Discretionary access control list (DACL)

  • System access control list (SACL)

Note

The SACL is used for auditing and does not affect file permissions.

Within the security descriptor, the file owner and group refer to security identifiers (SIDs). An SID can be thought of as the internal representation for an individual user or group. The primary reason for using SIDs is to differentiate among accounts across different domains that share the same account name. Even though the names are the same, they represent different accounts and can be given different permissions to the same file.

Additional references

  • Securing Server for NFS

  • Understanding DACLs in Server for NFS

  • Best Practices for Services for Network File System


Understanding DACLs in Server for NFS

The discretionary access control list (DACL) within the security descriptor provides an important part of Windows security. The DACL is a list of entries that grant or deny certain rights to specific users or groups. A list entry is called an access control entry (ACE). Each ACE consists of the following:

  • A security identifier (SID) to identify a particular user or group

  • An access list that specifies the permissions allowed or denied for the user or group

The following is an example of a DACL:

  • DACL: User1 Full Control (All)

  • ToolGroup:Read (RX)

  • Everyone:Read (RX)

In this DACL, User1 has read, write, and execute access to the file. Members of the group ToolGroup have read and execute access. Members of the group Everyone (all users) have read and execute access.

The following rules govern access to a file:

  • If no DACL is present, everyone is granted full access.

  • If a DACL is present, but contains no entries, everyone is denied access.

  • The file owner always has the ability to change the DACL.

In turn, these rules apply to the DACL:

  • DACL entries are searched sequentially.

  • All permissions are implicitly denied.

  • Once a permission has been denied, it cannot be granted.

  • Once a permission has been granted, it cannot be denied.

Additional references

  • Securing Server for NFS

  • Best Practices for Services for Network File System


Allow Root and Anonymous Access to Resources by NFS Clients

Allowing root access

You can allow UNIX users to have root access to resources. Some of these methods include:

  • Assigning the client computer root access when the shared resource is exported.

  • Mapping (through either Active Directory Lookup or User Name Mapping) the UNIX user root (UID 0) to the Windows user Administrator—and also, mapping the group to which the root belongs to the Windows group Administrators.

For example, consider a situation in which the directory Testdir is owned by Administrators. This directory was created with an account that is a member of the Windows group Administrators. The permissions listed were set after the directory was created. At the UNIX client, the permissions look like this:

ls ld /testdir
drwxrwxr-x 2 root root 64 Nov 3 12:11 /testdir/

When the directory is owned by Administrators, Server for NFS reports a user identifier (UID) and group identifier (GID) pair of 0,0.

Allowing anonymous access

By default, Server for NFS does not allow anonymous users to access a shared directory. When you share a directory, you can allow anonymous access to the directory and you can change the default anonymous UID and GID values to the UID and GID of any valid UNIX user and group accounts. If you change the anonymous UID and anonymous GID for a shared resource, those values will be used when reporting the owner of a file owned by a Windows user which is not mapped to UNIX user, even if anonymous access is not allowed.

Note

To enable anonymous access, enable the Network Access: Let Everyone permissions apply to anonymous users policy.

To allow anonymous access to an NFS share using the Windows interface

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. In the details pane, right-click the shared directory you want to manage.

  3. Click Sharing.

  4. Click NFS Sharing.

  5. Select Allow anonymous access.

  6. To specify a nondefault value for the anonymous user identifier (UID) or anonymous group identifier (GID), type the value in the Anonymous UID or Anonymous GID box.

  7. Click Apply.

Additional references

  • Securing Server for NFS

  • Best Practices for Services for Network File System

  • Troubleshooting Services for Network File System

To allow anonymous access to an NFS share using the command prompt

  1. Open a command prompt with elevated privileges.

    1. Click Start, and click All Programs.

    2. Point to Accessories, right-click the Command Prompt icon, and then click Run as administrator.

  2. At the command prompt, type:

    nfsshare -o option=value...sharename

    Argument Description

    sharename

    The name of the shared directory.

    -o

    Specifies one or more options to be set and must be set to at least one of the following:

    anon={yes | no}

    Specifies whether anonymous (unmapped) users can access the shared directory. The default value is no.

    anonuid=uid

    Specifies that anonymous (unmapped) users will access the share directory using uid as their user identifier (UID). The default value is -2. The anonymous UID will be used when reporting the owner of a file owned by an unmapped user, even if anonymous access is disabled.

    anongid=gid

    Specifies that anonymous (unmapped) users will access the share directory using gid as their group identifier (GID). The default value is -2. The anonymous GID will be used when reporting the owner of a file owned by an unmapped user, even if anonymous access is disabled.

    Note

    To view the complete syntax for this command, at a command prompt, type: nfsshare /?

Additional references

  • Securing Server for NFS

  • Best Practices for Services for Network File System


Use Setuid, Setgid, and Sticky Bits with Server for NFS

Users of client computers can use the chmod utility to set the setuid (set-user-identifier-on-execution), setgid (set-group-identifier-on-execution), and sticky file mode bits on files or directories that are stored on an NTFS file system partition and shared through Server for NFS. When the file or directory is subsequently accessed by a UNIX-based client, the standard semantics for these bits will apply. For example, an executable file that has the setuid bit set will execute under the user ID (UID) of the file owner, not the UID of the user who is executing the file.

Typically, when the setuid or setgid bit is set on a file, the owner or group of the file is changed to the owner or group ID (GID) where the file will be executed. Unless a user has the right to restore files or directories, Windows security allows a user to take ownership of a file (if the file permissions allow it), but not to transfer ownership to a second user. Consequently, to use chown or chgrp to change the owner or group of a file to another user or group, you must have the privilege to restore files and directories. By default, this privilege is assigned to members of the Administrators and Backup Operators groups, although it can be assigned to other groups or to individual users. In addition, the account of the user running chown or chgrp and the user or group to whom ownership is being transferred must be properly mapped through Active Directory Lookup or User Name Mapping.

Some UNIX-based Network File System (NFS) servers apply special interpretations or restrictions for the setuid, setgid, and sticky bits. Some versions of UNIX, for example, enforce mandatory locking on a directory with the setgid bit set but no execute permissions. Server for NFS does not implement special interpretations or restrictions on using these bits.

Security issue

Typical UNIX setuid and setgid behavior present a known security issue in UNIX. An intruder can exploit setuid and setgid behavior by overwriting an executable file with a Trojan horse and then running the executable file. The executable file runs with the rights of the owner, instead of running as the intruder.

To prevent this known security issue, by default, setuid and setgid are disabled and will not affect the UID or GID settings if the file or directory has both of the following characteristics:

  • One or both of the following bits is set: setgid or setuid.

  • The file or directory is group writable, group executable, world writable, or world executable.

Some customers may find this security measure problematic because it is different from the typical behavior of UNIX, although the typical behavior of UNIX setuid and setgid is not specified as part of the NFS protocol.

Changing setuid and setgid behavior

Use the following procedure to change the behavior of the setuid and setgid bits:

To change setuid and setgid behavior

  1. Open Registry Editor.

  2. Set the following registry key:

    HKEY_Local_Machine\System\CurrentControlSet\Services\NfsSvr\Parameters\SafeSetUidGidBits = (DWORD)

    • A value of 1 causes safer setuid and setgid behavior.

    • A value of 0 causes the standard UNIX behavior.

Additional references

  • Securing Server for NFS

  • Best Practices for Services for Network File System


Add Clients and Groups to the NFS Share Permissions List

Adding clients and groups to the NFS share permissions list

  • Using the Windows interface

  • Using the command prompt
To add clients and groups to the NFS share permissions list using the Windows interface

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. In the details pane, right-click the shared directory you want to manage.

  3. Click Sharing.

  4. Click NFS Sharing.

  5. If the directory is not already shared, click Share this folder, and then, in the Share name box, type a name for the share.

  6. Click Permissions, click Add, and then choose either of the following actions:

    • In the Names list, click the clients and groups you want to add, and then click Add.

    • In the Add Names box, type the names of clients or groups you want to add, separating names in the list with a semicolon (;).

  7. To see a list of the members of a group, in the Names list, click a group, click Members.

  8. In the Type of Access list, click the type of access you want to allow the selected clients and groups.

  9. Select Allow Root Access if you want a user identified as root to have access other than as an anonymous user. By default, the user identifier (UID) root user is coerced to the anonymous UID.

  10. In the Encoding list, click the type of directory and file name encoding to be provided to the selected clients and groups. In addition to the default American National Standards Institute (ANSI) encoding, the following encoding is available:

    • BIG5 (Chinese)

    • EUC-JP (Japanese)

    • EUC-KR (Korean)

    • EUC-TW (Chinese)

    • GB2312-80 (Simplified Chinese)

    • KSC5601 (Korean)

    • SHIFT-JIS (Japanese)

    Note

    If this option is set to ANSI on systems configured for non-English locales, the encoding scheme is set to the default encoding scheme for the locale. The following are the default encoding schemes for the indicated locales:

    • Japanese: SHIFT-JIS

    • Korean: KS_C_5601-1987

    • Simplified Chinese: GB

    • Traditional Chinese: BIG5

  11. To close the dialog box, click OK.

Additional references

  • Securing Server for NFS

  • Best Practices for Services for Network File System

  • Troubleshooting Services for Network File System

To add clients and groups to the NFS share permissions list using the command prompt

  1. Open the command prompt with elevated privileges.

    1. Click the Start button, and click All Programs.

    2. Click Accessories.

    3. Right-click the command prompt, and select Run as administrator.

  2. At the command prompt, type:

    nfsshare -o option [=host[:host]...] sharename

    Argument Description

    sharename

    The name of the shared directory.

    -o option

    Specifies one or more options to set and must be set to at least one of the following:

    • big5 (Chinese)

    • euc-jp (Japanese)

    • euc-kr (Korean)

    • euc-tw (Chinese)

    • gb2312-80 (Simplified Chinese)

    • ksc5601 (Korean)

    • shift-jis (Japanese)

    If this option is not set, the default encoding scheme is used.

    noroot[=host[:host]...]

    Denies root access to the shared directory by the clients or client groups specified by host. Separate client and group names with a colon (:). If you do not specify a host, root access is denied to all clients and groups for which root access is not explicitly granted.

    ro[=host[:host]...]

    Provides read-only access to the shared directory by the clients or client groups specified by host. Separate client and group names with a colon (:). If you do not specify a host, read-only access is granted to all clients and groups for which access is not explicitly granted or denied.

    root[=host[:host]...]

    Provides root access to the shared directory by the clients or client groups specified by host. Separate client and group names with a colon (:). If you do not specify a host, root access is granted to all clients and groups for which root access is not explicitly denied.

    rw[=host[:host]...]

    Provides read/write access to the shared directory by the clients or client groups specified by host. Separate client and group names with a colon (:). If you do not specify a host, read/write access is granted to all clients and groups for which access is not explicitly granted or denied.

    Notes
    • To view the complete syntax for this command, at a command prompt, type:
    • nfsshare /?
    • By default, when a directory is shared, all client computers are granted read-only access, and anonymous access is not allowed.

Additional references

  • Securing Server for NFS

  • Best Practices for Services for Network File System


Managing Server for NFS

This section contains the following procedures for managing Server for NFS:

  • Create an NFS Shared Network Resource

  • Configure DFS Shared Resources for NFS

  • Manage NFS Client Groups


Create an NFS Shared Network Resource

Creating an NFS shared network resource

  • Using the Windows interface

  • Using the command prompt
To create a shared resource using the Windows interface

  1. Open Windows Explorer: click Start, point to Programs or All Programs, point to Accessories, and then click Windows Explorer.

  2. In the details pane, right-click the shared directory you want to manage.

  3. Click NFS Sharing.

  4. Select Share this Folder.

  5. Type a name for the shared resource in the Share Name text box.

  6. Click Apply.

Additional references

  • Managing Server for NFS

  • Best Practices for Services for Network File System

  • Troubleshooting Services for Network File System

To create a shared resource using the command prompt

  1. Open a command prompt with elevated privileges.

    1. Click Start, and then select All Programs.

    2. Point to Accessories, right-click the Command Prompt icon, and then select Run as administrator.

  2. At the command prompt, type:

    nfsshare ShareName=drive:path

    Argument Description

    sharename

    The name of the directory to share.

    Notes
    • To view the complete syntax for this command, at a command prompt, type:
    • nfsshare /?

Additional references

  • Managing Server for NFS

  • Best Practices for Services for Network File System


Configure DFS Shared Resources for NFS

Configuring DFS shared resources for NFS

To configure DFS shared resources for NFS

  1. Set up an NFS server and create an NFS shared resource.

  2. Install Client for NFS on the computer that is running Distributed File System (DFS).

  3. On the DFS server, add a link in DFS that points to the shared resource on the NFS server.

  4. To access the NFS shared resource from any computer, connect to the DFS server as you would normally connect to any Windows file server.

  5. Browse to the link you created.

Additional references

  • Managing Server for NFS


Manage NFS Client Groups

Managing NFS client groups

  • Create an NFS client group

  • Rename an NFS client group

  • Delete an NFS client group
To create an NFS client group using the command prompt

  1. Open a command prompt with elevated privileges.

    1. Click Start, and then select All Programs.

    2. Point to Accessories, right-click the Command Prompt icon, and then select Run as administrator.

  2. At the command prompt, type:

    nfsadmin server [ComputerName] creategroup GroupName

    Argument Description

    ComputerName

    The name of the computer you want to manage.

    GroupName

    The name of the group to create.

    Notes
    • To view the complete syntax for this command, at a command prompt, type:
    • nfsadmin server /?
    • You cannot give a group the same name as a client in the group.

Additional references

  • Managing Server for NFS

To rename an NFS client group using the command prompt

  1. Open a command prompt with elevated privileges.

    1. Click Start, and then click All Programs.

    2. Point to Accessories, right-click the Command Prompt icon, and then select Run as administrator.

  2. At the command prompt, type:

    nfsadmin server [ComputerName] renamegroup OldName NewName

    Argument Description

    ComputerName

    The name of the computer you want to manage.

    OldName

    The current name of the group you want to change.

    NewName

    The new name for the group.

    Notes
    • To view the complete syntax for this command, at a command prompt, type:
    • nfsadmin server /?
    • You cannot give a group the same name as a client in the group.

Additional references

  • Managing Server for NFS

To delete an NFS client group using the command prompt

  1. Open a command prompt with elevated privileges.

    1. Click Start, and then select All Programs.

    2. Point to Accessories, right-click the Command Prompt icon, and then select Run as administrator.

  2. At the command prompt, type:

    nfsadmin server [ComputerName] deletegroup GroupName

    Argument Description

    ComputerName

    The name of the computer you want to manage.

    GroupName

    The name of the group to delete.

    Notes
    • To view the complete syntax for this command, at a command prompt, type:
    • nfsadmin server /?

Additional references

  • Managing Server for NFS


Troubleshooting Services for Network File System

This section lists a few common issues you might encounter when working with Services for Network File System (NFS).

For more information about Services for NFS, see the Windows Server TechCenter (http://go.microsoft.com/fwlink/?LinkId=92798).

  • Despite appearing to have appropriate permissions, the user cannot access folder or file

  • Authenticated users cannot access Network File System resources

  • Users, including properly mapped users, cannot change the current directory to a shared directory or create files in the directory, even though anonymous access to the directory is allowed

  • All files created on Server for NFS are owned by Anonymous

  • Files created by a new user are owned by Anonymous

  • A user cannot write to a file

  • Users of Japanese UNIX systems cannot view file names in Japanese

  • Server for NFS configuration settings are not replicated across nodes in a server cluster

  • Server for NFS fails to stop on a server cluster

  • An NFS shared network resource on a server cluster node fails to come online

  • Creating or modifying an NFS shared resource fails with the error: The share path specified does not exist, or you are trying to modify the properties of an online shared resource

  • User Name Mapping is properly configured, but users are not being mapped correctly

  • A group containing an NFS shared resource fails to come online on a particular cluster server node

  • The showmount –e command for a virtual server lists all shared resources on the node rather than those in the same group as the virtual server

  • The root user is not granted proper permissions

  • Anonymous access fails

What problem are you having?

Despite appearing to have appropriate permissions, the user cannot access a folder or file

Cause

The user belongs to one or more groups that are not mapped consistently, Active Directory Domain Services is not accessible, or User Name Mapping is not running.

Solution

To ensure proper file access, ensure that Windows and UNIX groups that are mapped to each other, in either Active Directory Domain Services or User Name Mapping, contain the same users, and that the members of the Windows and UNIX groups are properly mapped to each other. Also, ensure that Active Directory Domain Services is accessible or the User Name Mapping service is running on the designated server.

Authenticated users cannot access Network File System resources

Cause

Active Directory Lookup or User Name Mapping is not properly configured to work with this computer.

Solution

If you are using Active Directory Lookup, ensure that Services for Network File System (NFS) is pointing to the proper Active Directory domain.

If you are using User Name Mapping, ensure that the .maphosts file on the computer running User Name Mapping specifies the names or IP addresses of computers that can map user accounts by using User Name Mapping. If users cannot access NFS resources intermittently and configuring the .maphosts file does not solve the problem, it might be that too many client computers are trying to access User Name Mapping simultaneously.

Users, including properly mapped users, cannot change the current directory to a shared directory or create files in the directory, even though anonymous access to the directory is allowed

Cause

Either the NFS client does not support NFS version 3, or Server for NFS is not configured to support NFS 3. Also, the discretionary access control list (DACL) protecting the shared directory does not have an entry for Everyone, and so the access mode bit for Other is reported as 0. Because NFS 2 clients rely on directory mode settings rather than performing a separate access check for the shared directory, the client incorrectly fails the attempted access.

Solution

Do one of the following:

  • To the DACL protecting the directory being shared, add an entry that grants Everyone read or read/write access, as appropriate.

  • Ensure that the NFS client supports NFS 3, and enable NFS 3 support by Server for NFS.

The shared directory is not accessible even though it is listed as available.

Cause

The directory was moved after it was shared.

Solution

Return the directory to its original location, or stop sharing the directory and then reshare it.

All files created on Server for NFS are owned by Anonymous

Cause

Authentication is not configured properly.

Solution

Ensure that mappings are set up correctly in Active Directory Domain Services or in User Name Mapping, and that Server for NFS is correctly configured to use either Active Directory Lookup or User Name Mapping. Also, be sure all domain controllers are properly configured.

Files created by a new user are owned by Anonymous

Cause

If you are using User Name Mapping, then User Name Mapping and Server for NFS have not yet refreshed data from the Network Information Service (NIS) server. Typically, User Name Mapping refreshes data from NIS once an hour, and Server for NFS refreshes data from User Name Mapping once an hour.

Solution

The new user should wait at least two hours before attempting to access or create files on Server for NFS, or the administrator of the computer running User Name Mapping can refresh the mapping database.

A user cannot write to a file

Cause

File permissions or attributes do not allow write access to the file or its directory.

Solution

If the directory is owned by the Administrators group, make an individual user account the owner of the directory. Ensure that the user's UNIX account is mapped to a valid Windows account and that the NTFS file system permissions of the directory and file allow write access to the Windows user account. Ensure that the read-only attribute is not set on the file or the directory.

Users of Japanese UNIX systems cannot view file names in Japanese

Cause

Extended UNIX character (EUC) set is not enabled.

Solution

Configure the shared resource to use the appropriate character encoding.

Server for NFS configuration settings are not replicated across nodes in a server cluster

Cause

The Cluster service is not running, was not running when Server for NFS started, or failed after Server for NFS started.

Solution

Take all NFS shared resources owned by the node offline, or move the cluster groups containing NFS shared resources to another node. Stop Server for NFS, start the Cluster service if needed, and then restart Server for NFS. Return the NFS shared resources online or move the cluster groups back to the node.

Server for NFS fails to stop on a server cluster

Cause

This is by design. When an NFS shared resource is online on a cluster node, the cluster service automatically restarts Server for NFS to keep the shared resources online.

Solution

Before stopping Server for NFS on a server cluster node, take all NFS shared resources owned by the node offline, or move the cluster groups containing NFS shared resources to another node.

An NFS shared resource on a server cluster node fails to come online

Cause

An NFS shared resource with the same alias or path already exists on the node.

Solution

Make sure that the shared path and alias are unique across the cluster. Also, avoid having nonclustered NFS shared resources on a server cluster node.

Cause

The user who installed the cluster service does not have read permission on the directory that is shared, so the path cannot be validated.

Solution

Grant read access to the directory for the user who installed the cluster service.

Cause

The disk resource containing the directory being shared is offline, so the cluster service cannot verify the path of the share.

Solution

Bring the disk resource online, and then bring the NFS shared resource online. We recommend that the NFS shared resource be made dependent on the disk resource that contains the shared folder.

Cause

The disk is inaccessible due to hardware error.

Solution

Take the NFS shared resources on the disk offline. Ensure that the disk is accessible from all cluster nodes, and then bring the NFS shared resources online.

Cause

There are a large number of subdirectories under a subdirectories-only share, and the resource times out before all the shared resources are created when the resource is coming online.

Solution

Increase the time-out interval for the resource.

Creating or modifying an NFS shared resource fails with the error: The share path specified does not exist, or you are trying to modify the properties of an online shared resource

Cause

The specified directory does not exist.

Solution

Make sure that the directory exists and that the path is correct.

Cause

The shared resource is online.

Solution

Take the shared resource offline, make the required modifications, and then bring the shared resource online.

Cause

The disk resource containing the shared directory is offline, so the cluster service cannot verify the path of the share.

Solution

Bring the disk online, make the necessary modifications to the NFS shared resource, and then bring the NFS shared resource online.

User Name Mapping is properly configured, but users are not being mapped correctly

Cause

Server for NFS is not set to use the correct User Name Mapping server.

Solution

Ensure that the specified User Name Mapping server is valid. If the User Name Mapping server is on a server cluster, ensure that the following conditions exist:

  • User Name Mapping is installed on all cluster nodes

  • User Name Mapping data is being replicated to all nodes in the cluster

  • Server for NFS is using the name of a Network Name cluster resource as the User Name Mapping server, not localhost or the name of any of the cluster nodes

Cause

Server for NFS has not received updated maps from the mapping server. If Server for NFS and User Name Mapping are on different computers, this occurs once every 30 minutes.

Solution

Force Server for NFS to refresh the maps by doing one of the following:

  • Use the nfsadmin server command to execute an operation, such as by setting a value to its current value.

  • Restart Server for NFS.

Cause

Account changes on the Windows domain controller or the Network Information Service (NIS) server have not been received by User Name Mapping.

Solution

Force Server for NFS to refresh the maps by doing one of the following:

  • In Services for Network File System, click Server for NFS, and then click Apply.

  • Use the nfsadmin server command to execute an operation, such as by setting a value to its current value.

  • Restart Server for NFS.

Cause

Local accounts on a cluster node were mapped to UNIX user accounts. Local accounts are not valid on all nodes in a cluster.

Solution

Ensure that all Windows accounts mapped to UNIX accounts on User Name Mapping running on a cluster are Windows domain accounts.

Cause

The passwd and group files are not at the same location on all nodes of the cluster, or on a network drive.

Solution

Ensure that the passwd and group files are identical and at identical locations on local disks of all nodes.

Cause

The Server for NFS server is not on the list of permitted User Name Mapping server clients.

Solution

Ensure that the .maphosts files on all User Name Mapping server cluster nodes are identical to permit the node running Server for NFS to obtain maps from the User Name Mapping server.

Cause

The server running User Name Mapping has failed.

Solution

Correct the cause of failure and then restart User Name Mapping on the server.

Cause

A Windows account mapped to a UNIX account is disabled or no longer exists.

Solution

If the Windows account exists but is disabled, enable it. If the account does not exist, create a new account and, if necessary, recreate the corresponding advanced map.

Cause

A Windows user account has not been granted the credentials to log on to the network.

Solution

Grant the required credentials to the Windows user account, and then force Server for NFS to refresh the maps by doing one of the following:

  • Use the nfsadmin server command to execute an operation, such as by setting a value to its current value.

  • Restart Server for NFS.

Cause

Windows and UNIX groups mapped to each other do not contain the same members.

Solution

Ensure that all Windows users in a group are mapped to UNIX users in the corresponding UNIX group, and that all UNIX users in a group are mapped to users in the corresponding Windows group.

Cause

User Name Mapping settings are not properly replicated on all nodes in a server cluster.

Solution

Ensure that User Name Mapping on a server cluster is configured properly to allow replication on all nodes.

A group containing an NFS shared resource fails to come online on a particular cluster server node

Cause

Server for NFS is not installed on the node.

Solution

Install Server for NFS on the node.

Cause

The node is not configured as the preferred owner of the group.

Solution

Configure the group properties to make the node the preferred owner of the group.

Cause

One of the resources in the group does not list the node as a possible owner even though the group specifies the node as a preferred owner.

Solution

Configure the resource's properties to specify the node as a possible owner.

The showmount –e command for a virtual server lists all shared resources on the node rather than those in the same group as the virtual server

Cause

This is by design. There is only one instance of Server for NFS running on a node that will enumerate all shared resources on that node. It does not distinguish between shared resources in different cluster groups.

Solution

Maintain different groups on different nodes.

The root user is not granted proper permissions

Cause

The shared resource does not have root access enabled.

Solution

Right-click the shared directory, click Properties, click NFS Sharing, click Permissions, and then click Allow root access.

Cause

The computer from which the root user is accessing the shared resource is not permitted root access.

Solution

Right-click the shared directory, click Properties, click Permissions, and then do one of the following:

  • Grant root access to ALL MACHINES.

  • Grant root access to a client group containing the computer.

  • Grant root access to the computer itself.

Cause

The root user does not have read/write permission.

Solution

Grant the appropriate permissions to the Windows user mapped to the root user. Right-click the shared directory, click Properties, click Permissions, and then click Root access allowed.

Cause

The root user account is not properly mapped to a Windows user account.

Solution

Map the root user to a Windows account in the Administrators or Domain Admins group, and map the root user's group to the same Windows group.

Cause

Server for NFS has not received updated maps from User Name Mapping.

Solution

Force Server for NFS to refresh the maps by doing one of the following:

  • Use the nfsadmin server command to execute an operation, such as by setting a value to its current value.

  • Restart Server for NFS.

Cause

The root user's user identifier (UID) is not 0. Server for NFS grants root access only to a UNIX user with a UID of 0.

Solution

Change the root user's UID to 0.

Anonymous access fails

Cause

Local security policy is not set to enable Everyone permissions to apply to anonymous users (the default).

Solution

Use the Local Security Policy manager to enable Network Access: Let Everyone permissions apply to anonymous users in Security Options in Local Policies.


Server for NFS properties - file name handling

The File Name Handling tab enables you to determine the level of file name conversion support provided by Server for NFS. UNIX clients expect the case of their file names to be preserved. The Windows Server operating system does not require case sensitivity by default—however, case in file names is maintained by the NTFS file system. Server for NFS can be configured to provide case-sensitive search capabilities, as well as translation support for characters that may not be supported on client or server file systems.

Character translation mappings are stored in a text file. File names containing an unsupported character will be translated using the character mappings in the translation file.

Case sensitivity in file name searches is enabled by default in Server for NFS. The default can be overridden to return file names in uppercase or lowercase letters. Additionally, file names with a leading period (.) can be configured to automatically mark the file as hidden on NTFS to provide interoperability for local or network access from Windows clients.

Understanding the character translation file

Although Windows and UNIX file systems do not allow certain characters in file names, the characters that are prohibited by each operating system are not the same. For example, a valid UNIX file name can contain a colon (:), while a valid Windows file name cannot. If a UNIX user attempts to create a file in a NFS shared folder on a computer running a Windows Server operating system with Server for NFS, the file name will then contain an illegal character and the attempt will fail.

You can eliminate this problem by enabling the use of a character translation file, as described in the previous section. Each entry in the character translation file maps a single character from UNIX to a recognized counterpart in Windows. For example, to map a colon (:) in UNIX to a dash (-) in Windows, the translation file would contain the following line:

0x00 0x3a : 0x00 0x2d ; replace client : with - on server

If this entry appears in the file name character translation file on a Server for NFS computer when an NFS client creates a file named re:salesquotas on a Server for NFS shared resource, Server for NFS names the file re-salesquotas. This is the name that appears in Windows Explorer when local or remote Windows users display the contents of the shared folder. NFS clients that list the contents of the shared directory will see the file name as re:salesquotas. Character translation takes place for all files shared through NFS by the server, regardless of whether they were created by an NFS client.

The character translation file is a simple text file containing one or more of the mappings in the format:

0xnn 0xnn : 0xnn 0xnn [ ; comment]

Nn (nn) is the hexadecimal value of one byte of a two-byte Unicode character, and comment is an optional comment, which is preceded by a semicolon (;). Everything from the semicolon to the end of the line is ignored. The first set of hexadecimal values in the entry represents the character on the client (UNIX) computer, while the second set is the character used on the Windows-based computer running Server for NFS.

Additional considerations

  • Do not map a period (.) to a different character because it is used in the file name syntax of both Windows and UNIX file systems.

  • To prevent unauthorized users from tampering with the file name character translation file and causing Server for NFS to fail, you can ensure that the file is protected by using a discretionary access control list (DACL) that grants Full Control to the built-in System account and the Administrators group. The DACL should contain no other entries.


Server for NFS properties

The NFS Server Properties enable you to configure the general behavior of Server for NFS.


Server for NFS properties - locking

The Locking tab of NFS Server Properties determines how Server for NFS handles file-locking requests. If a Network File System (NFS) client requests a file lock, Server for NFS provides file locking on behalf of the client. If the session is interrupted before the operation is completed, Server for NFS can be configured to wait for a specified number of seconds, which enables the client to reconnect and request to reclaim the lock before clearing the lock.

The Locking tab also provides a way for you to manually clear file locks that may be outstanding.


Server for NFS properties - logging

Server for NFS supports full logging of events to the Event Viewer, a text file, or both locations. Using the Audit Logging tab, you can determine the location and level of logging for Server for NFS.