安全機制

  1. 查詢 nfs ports
    [root@kvm8 ~]# rpcinfo -p 192.168.122.8
       program vers proto   port  service
        100000    4   tcp    111  portmapper
        100000    3   tcp    111  portmapper
        100000    2   tcp    111  portmapper
        100000    4   udp    111  portmapper
        100000    3   udp    111  portmapper
        100000    2   udp    111  portmapper
        100024    1   udp  55661  status
        100024    1   tcp  46633  status
        100003    2   tcp   2049  nfs
        100003    3   tcp   2049  nfs
        100003    4   tcp   2049  nfs
        100227    2   tcp   2049  nfs_acl
        100227    3   tcp   2049  nfs_acl
        100003    2   udp   2049  nfs
        100003    3   udp   2049  nfs
        100003    4   udp   2049  nfs
        100227    2   udp   2049  nfs_acl
        100227    3   udp   2049  nfs_acl
        100021    1   udp  37591  nlockmgr
        100021    3   udp  37591  nlockmgr
        100021    4   udp  37591  nlockmgr
        100021    1   tcp  50290  nlockmgr
        100021    3   tcp  50290  nlockmgr
        100021    4   tcp  50290  nlockmgr
        100005    1   udp    892  mountd
        100005    1   tcp    892  mountd
        100005    2   udp    892  mountd
        100005    2   tcp    892  mountd
        100005    3   udp    892  mountd
        100005    3   tcp    892  mountd
    

  2. 查詢 nfs tcp ports
    [root@kvm8 ~]# rpcinfo -p 192.168.122.8 | grep tcp |awk '{print $4}' |sort -u
    111
    2049
    42586
    46633
    46697
    46790
    49698
    

  3. 查詢 nfs udp ports
    [root@kvm8 ~]# rpcinfo -p 192.168.122.8 | grep udp |awk '{print $4}' |sort -u
    111
    2049
    37474
    43938
    49830
    55661
    57818
    

  4. 指定 rpc mount port
    [root@kvm8 ~]# vim /etc/sysconfig/nfs 
    # Port rpc.mountd should listen on.
    MOUNTD_PORT=892
    

  5. 防火牆設定
    [root@kvm8 ~]# vim /etc/sysconfig/iptables
    -A INPUT -i lo -j ACCEPT
    ######################################################
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 892 -j ACCEPT
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 111 -j ACCEPT
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 2049 -j ACCEPT
    
    -A INPUT -m state --state NEW -m udp -p udp --dport 111 -j ACCEPT
    -A INPUT -m state --state NEW -m udp -p udp --dport 2049 -j ACCEPT
    ######################################################
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
    

  6. 防火牆重新啟動
    [root@kvm8 ~]# /etc/init.d/iptables restart
    
  7. 開機啟動防火牆
    [root@kvm8 ~]# chkconfig iptables on
    
  8. 測試 nfs 掛載
    [root@dyH ~]# showmount -e kvm8.deyu.wang
    Export list for kvm8.deyu.wang:
    /home 192.168.122.0/24
    
    [root@dyH ~]# mount -t nfs -o nfsvers=4 kvm8.deyu.wang:/home /mnt/home
    [root@dyH ~]# ll /mnt/home/
    total 19
    drwxr-xr-x. 5 nobody nobody  1024 Aug  1 19:49 deyu1
    drwx------. 4 nobody nobody  1024 Aug  1 14:56 deyu2
    drwx------. 4 nobody nobody  1024 Aug  1 14:56 deyu3
    drwx------. 2 root   root   12288 Aug  1 11:40 lost+found