> For the complete documentation index, see [llms.txt](https://ghoulsec.gitbook.io/ghoulsec-vault/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ghoulsec.gitbook.io/ghoulsec-vault/server-are-fun/securing-linux/nfs-network-file-system.md).

# NFS - Network File System

To install and configure NFS (Network File System) on Ubuntu securely, you need to ensure that the NFS server and client are properly set up, access is limited to trusted IP addresses, and encryption/authentication measures are in place. Here are the steps to install and configure NFS securely on an Ubuntu server:

#### Step 1: Install NFS Server and Client

1. **Install the NFS server on your Ubuntu server:**

   ```bash
   sudo apt update
   sudo apt install nfs-kernel-server
   ```
2. **Install the NFS client on the client machine (if you need to mount the NFS share):**

   ```bash
   sudo apt install nfs-common
   ```

#### Step 2: Create the Directory to Share

1. **Create the directory you want to share via NFS:**

   ```bash
   sudo mkdir -p /mnt/nfs_share
   sudo chown nobody:nogroup /mnt/nfs_share
   sudo chmod 777 /mnt/nfs_share
   ```

   **Note:** Adjust permissions (`777`) as per your requirements. You may choose more restrictive permissions for security purposes.

#### Step 3: Configure `/etc/exports` File

1. **Edit the `/etc/exports` file to define what directories will be shared and who has access:**

   ```bash
   sudo nano /etc/exports
   ```
2. **Add an entry for the shared directory:** Example:

   ```
   /mnt/nfs_share   192.168.1.0/24(rw,sync,no_subtree_check,no_root_squash)
   ```

   **Explanation of options:**

   * `192.168.1.0/24`: Specifies the IP range (replace with the appropriate IP address or subnet).
   * `rw`: Allows read-write access.
   * `sync`: Forces changes to be written to disk before a response is sent.
   * `no_subtree_check`: Improves performance by skipping subtree checking.
   * `no_root_squash`: This option can be risky as it allows root on the client to have root access on the server (use `root_squash` instead for more security).

   For better security, you can restrict access only to specific IP addresses or subnets.

#### Step 4: Apply Changes

1. **Export the shared directories:**

   ```bash
   sudo exportfs -a
   ```
2. **Restart the NFS server:**

   ```bash
   sudo systemctl restart nfs-kernel-server
   ```

#### Step 5: Secure NFS with Firewall Rules

1. **Allow NFS ports in the firewall (assuming you're using UFW):**

   ```bash
   sudo ufw allow from 192.168.1.0/24 to any port nfs
   sudo ufw enable
   ```

   Replace `192.168.1.0/24` with your trusted subnet.
2. **Check the firewall status to ensure proper configuration:**

   ```bash
   sudo ufw status
   ```

#### Step 6: Mount the NFS Share on the Client

1. **Create a mount point on the client machine:**

   ```bash
   sudo mkdir -p /mnt/nfs_client_share
   ```
2. **Mount the NFS share:**

   ```bash
   sudo mount 192.168.1.100:/mnt/nfs_share /mnt/nfs_client_share
   ```

   Replace `192.168.1.100` with the IP address of your NFS server.
3. **To mount the NFS share automatically on boot, add the following line to `/etc/fstab`:**

   ```bash
   192.168.1.100:/mnt/nfs_share /mnt/nfs_client_share nfs defaults 0 0
   ```

#### Step 7: Verify the Setup

1. **Check NFS export status on the server:**

   ```bash
   showmount -e
   ```
2. **Check the mounted NFS share on the client:**

   ```bash
   mount | grep nfs
   ```
3. **Test reading/writing to the NFS share:** On the client, try creating a file in the NFS mount directory:

   ```bash
   touch /mnt/nfs_client_share/testfile
   ```