How to Install and Configure NFS and NFSv4 on CentOS 6

Here is the process I used to install and configure NFS/NFSv4.

NFS (Network File System) lets one Linux machine (the server) share a directory so that other machines (the clients) can mount it and use it like a local folder.

Before you start

Two machines on the same network: one server and one client. A test setup is best for a first try.
Root access, or sudo, on both. The commands below are written as I ran them, as root.
The IP address of each machine. 192.168.0.15 below is just my example.

Configuring the server machine first

yum install nfs-utils nfs4-acl-tools portmap xinetd

Note: you might have trouble installing portmap. Originally I linked to an RPM you could download, but that link pointed to a CentOS 5.9 package, so I have taken it out.

Correction (added later): CentOS 6 does not use portmap. It was replaced by rpcbind, and that is why the portmap install fails. You also do not need xinetd for NFS. On CentOS 6 use:

yum install nfs-utils nfs4-acl-tools rpcbind

Make sure the following packages are installed:

rpm -qa nfs*
rpm -qa portmap*
rpm -qa xinetd*

rpm -qa lists installed packages that match the pattern. On CentOS 6, check for rpcbind* instead of portmap*.

Start the services and set them to start at boot:

service portmap start
service xinetd start
chkconfig portmap on
chkconfig xinetd on

Correction (added later): on CentOS 6 the service is rpcbind:

service rpcbind start
chkconfig rpcbind on

service ... start starts it now; chkconfig ... on makes it start automatically at boot.

Create and export a directory

For testing, make a directory on the server machine:

mkdir /data

Edit the exports file:

vi /etc/exports

Add a line with the directory, your client IP and its permissions (rw gives read and write; you can add other options):

/data        192.168.0.15/24(rw)

Note: 192.168.0.15/24 actually means the whole 192.168.0.0/24 network (every address from 192.168.0.0 to 192.168.0.255), not just one client. To allow only a single client, leave off the /24, for example /data 192.168.0.15(rw). There must be no space between the address and the bracket.

Restart NFS, enable it at boot and re-read the exports file:

service nfs restart
chkconfig nfs on
exportfs -r

exportfs -r re-exports everything in /etc/exports, so you can apply changes without restarting NFS.

Verify the export with showmount:

showmount -e Your-Client-IP

Correction (added later): showmount -e asks a server which directories it exports, so give it the server’s IP, not the client’s. On the server itself you can run it with no address:

showmount -e
showmount -e Your-Server-Machine-IP

Restrict access with TCP wrappers

Edit /etc/hosts.deny and add:

portmap:ALL

Then edit /etc/hosts.allow and add:

portmap:Client-Server-IP/24

This blocks every machine from the port mapper except the ones listed in hosts.allow.

Note (added later): on CentOS 6 the daemon is called rpcbind, so use rpcbind in place of portmap in both files. man hosts_access documents the network/netmask form, for example rpcbind: 192.168.0.0/255.255.255.0, which is the safe way to write a whole network.

Now go to the client machine

The client also needs nfs-utils installed. Create the folder you will mount onto first (the mount point must exist):

mkdir -p /Client/Machine/dir

Mount the share:

mount -t nfs Your-Server-Machine-IP:/data /Client/Machine/dir

For NFSv4:

mount -t nfs4 Your-Server-Machine-IP:/data /Client/Machine/dir

To check it worked, run df -h or mount | grep nfs on the client and look for the server’s address. Create a test file in the folder and check it appears in /data on the server.

Keep the mount after a reboot

This way you can use the shared folder, but it will only stay available while the system is up. It will not be available after a reboot. To keep it after a reboot, add an entry to fstab:

vi /etc/fstab

Your-Server-Machine-IP:/data     /Client/Machine/dir

Correction (added later): an fstab line needs at least the filesystem type and options as well. A complete line looks like this (use nfs4 as the type for NFSv4):

Your-Server-Machine-IP:/data     /Client/Machine/dir     nfs     defaults,_netdev     0 0

_netdev tells the system this is a network filesystem, so it waits for the network before mounting. You can test the line without rebooting by running mount -a.

Then enable the service that mounts network filesystems at boot:

chkconfig netfs on

NFSv4 configuration

For the firewall, open TCP port 2049, which is used by NFSv4.

Note (added later): NFSv4 needs only TCP 2049. Older NFSv3 also needs the port mapper on port 111 (TCP and UDP) plus mountd and other helper services, which use changing ports unless you fix them in /etc/sysconfig/nfs. If you can use NFSv4, the firewall is much simpler.

How do I see NFS statistics?

nfsstat
showmount -e
showmount -d
showmount -a server.ip

nfsstat shows NFS client and server statistics.
showmount -e lists the server’s exports.
showmount -d lists only the directories that clients have mounted.
showmount -a lists client host names and the directories they have mounted.

Notes for today

CentOS 6 reached end of life on 30 November 2020 and gets no security updates. Rocky Linux and AlmaLinux are the common free replacements; Debian and Ubuntu are alternatives.
On systemd systems (CentOS 7 and later, Rocky, AlmaLinux) the server service is nfs-server:
Terminal window
```
sudo dnf install nfs-utils
sudo systemctl enable --now nfs-server
sudo exportfs -ra
```
systemctl enable --now starts the service and enables it at boot in one step. yum still works as an alias for dnf.
With firewalld, open NFS like this:
Terminal window
```
sudo firewall-cmd --permanent --add-service=nfs
sudo firewall-cmd --reload
```
For NFSv3 clients you would also add the rpc-bind and mountd services.
TCP wrappers (/etc/hosts.allow and /etc/hosts.deny) were deprecated in RHEL 7 and removed in RHEL 8, so on Rocky or AlmaLinux restrict access with the client list in /etc/exports and the firewall instead.
Security: by default NFS uses root_squash, which means the root user on a client is treated as an unprivileged user on the share. Leave this default on unless you have a clear reason. Export only to the clients or network that need access.
Documentation: https://docs.rockylinux.org/