LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 07-11-2003, 10:00 AM   #1
brainlego
LQ Newbie
 
Registered: Jul 2003
Distribution: redhat 9
Posts: 7

Rep: Reputation: 0
exporting NFS shares in redhat 9 / mounting them in OS X 10.2.6


i'm new to linux - installed redhat 9 a couple of weeks ago with the aim of creating a shared media drive (music) for the macs on my local home network.

redhat 9 seemed to install OK and connects without problem through my router to the internet. I have given static IP's to all my boxes.

I have enabled apache on the linux box and i can connect to it from my mac (locally) without any problem.

i can ssh between both - mac->linux & linux->mac.

I have followed the help instructions for enabling nfs sharing. I've logged in as root and setup to share "/home/media" (which is the home directory for the user "media") to "192.168.0.48" which is my mac. Privileges are set to read/write.

from redhat terminal "rpcinfo -p" returns portmapper, nfs, and mountd as all being active.

from the os x terminal (logged in as user "w3") "rpcinfo -p 192.168.0.20" returns a "connection refused"

I think the issue lies somewhere with UID and/or permissions but i'm not sure...

I want the share to be available to a number of different users on the local network.

Can anybody shed some light on this? I've read numerous forum posts and been through the nfs-HOWTO/troubleshooting page but can't seem to find a way forward...
 
Old 07-11-2003, 10:17 AM   #2
mlp68
Member
 
Registered: Jun 2002
Location: NY
Distribution: Gentoo,RH
Posts: 333

Rep: Reputation: 40
Is your firewall perhaps getting in the way? I needed to add the ports.

Shut the FW down and see if it works then. Also, pls post the output of exportfs, iptables -L.

mlp
 
Old 07-11-2003, 08:57 PM   #3
brainlego
LQ Newbie
 
Registered: Jul 2003
Distribution: redhat 9
Posts: 7

Original Poster
Rep: Reputation: 0
worx with firewall OFF...

I can get it to mount by turning off the firewall via the redhat GUI.

Here is the listing from both those commands. I'm going to work on figuring out how to edit the iptables and what an iptable with nfs sharing enabled should look like.

Any suggestions on how do do this or where to look appreciated.

Listings:

[root@fairyland root]# exportfs
/home/media darkmatter

[root@fairyland root]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Lokkit-0-50-INPUT all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
RH-Lokkit-0-50-INPUT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain RH-Lokkit-0-50-INPUT (2 references)
target prot opt source destination
ACCEPT udp -- clock.redhat.com anywhere udp spt:ntp dpt:ntp
ACCEPT udp -- clock.redhat.com anywhere udp spt:ntp dpt:ntp
ACCEPT udp -- kirsty.paradise.net.nz anywhere udp spt:domain dp
ts:1025:65535
ACCEPT udp -- rachel.paradise.net.nz anywhere udp spt:domain dp
ts:1025:65535
ACCEPT tcp -- anywhere anywhere tcp dpt:http flags:S
YN,RST,ACK/SYN
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh flags:SY
N,RST,ACK/SYN
ACCEPT udp -- anywhere anywhere udp spts:bootps:boot
pc dpts:bootps:bootpc
ACCEPT udp -- anywhere anywhere udp spts:bootps:boot
pc dpts:bootps:bootpc
ACCEPT all -- anywhere anywhere
REJECT tcp -- anywhere anywhere tcp dpts:0:1023 flag
s:SYN,RST,ACK/SYN reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp dpt:nfs flags:SY
N,RST,ACK/SYN reject-with icmp-port-unreachable
REJECT udp -- anywhere anywhere udp dpts:0:1023 reje
ct-with icmp-port-unreachable
REJECT udp -- anywhere anywhere udp dpt:nfs reject-w
ith icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp dpts:x11:6009 fl
ags:SYN,RST,ACK/SYN reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp dpt:xfs flags:SY
N,RST,ACK/SYN reject-with icmp-port-unreachable
[root@fairyland root]#
 
Old 07-12-2003, 09:30 PM   #4
mlp68
Member
 
Registered: Jun 2002
Location: NY
Distribution: Gentoo,RH
Posts: 333

Rep: Reputation: 40
Hi brainlego,

you need to allow port 111 (sunrpc, the portmapper) and then port 2049 (nfs) in.

Add (assuming 192.168.0.48 is still your mac as in your original post) to /etc/sysconfig/iptables ( you need to place them *before* the first "drop" line -- remember, the first line that matches determines the action).

-A RH-Lokkit-0-50-INPUT -s 192.168.0.48 -d 0/0 --dport 111 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -s 192.168.0.48 -d 0/0 --dport 2049 -j ACCEPT

Then stop and restart the firewall.

If you want a generic way of finding out what's going on and to debug these kinds of problems, try the following.

I added a new chain "LOG_AND_DROP" in iptables. The idea is to reroute all packets orgininally destined for "DROP" (lines which end in "-j DROP") to that new chain, which in the end also sends it to DROP, but logs it before it does so. My first lines in /etc/sysconfig/iptables look like this:


Quote:
# Firewall configuration written by lokkit
# Manual customization of this file is not recommended.
# Note: ifup-post will punch the current nameservers through the
# firewall; such entries will *not* be listed here.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Lokkit-0-50-INPUT - [0:0]
-A INPUT -j RH-Lokkit-0-50-INPUT
-A FORWARD -j RH-Lokkit-0-50-INPUT
-A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT

-N LOG_AND_DROP
-A LOG_AND_DROP -j LOG --log-level info --log-prefix dropped-packet:
-A LOG_AND_DROP -j DROP
Then those entries which have -j DROP originally get changed to -j LOG_AND_DROP. Each time a "DROP" rule kicks in, you will know about this -- in /var/log/messages you will find entries like

Quote:
Jul 12 22:05:57 mlphome kernel: dropped-packet:IN=eth0 OUT= MAC= SRC=192.168.12.1 DST=192.168.12.255 LEN=78 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=32790 DPT=137 LEN=58
Now if this is your clean home subnet and you don't get many offending packets, you might want to leave this enabled and maybe let tripwire scan your logs. I do that since I have ports (well, one port) open to an external host (at work), and I sure want to know if someone tries to get in there from an unauthorized host. This logging of all rejects can potentially lead to a lot of output if the subnet isn't that "clean" after all. In that case you can globally disable the logging by commenting out the middle "LOG_AND_DROP" line (so you just send it to DROP, not to log) and enable the line only when you are actually in the process of debugging your firewall. The other nice thing is that you can then enable logging in a hurry if you suspect that you are under attack and want to log all stuff. Or you can leave the "benign" DROP's as -j DROP and send only those rejects to LOG_AND_DROP that you want to know about - such as incoming connections from the outside from an unauthorized host (you will catch external scans this way, for example).

Finally, you can make a similar "LOG_AND_ACCEPT" chain and see who gets allowed in and compare notes if that matches what you had intended.

Ok. long post, hope it helps.

mlp
 
Old 07-24-2003, 07:45 PM   #5
brainlego
LQ Newbie
 
Registered: Jul 2003
Distribution: redhat 9
Posts: 7

Original Poster
Rep: Reputation: 0
arghhhhhhhhhhhhh......

hi mlp - thanks for your lengthy reply. Unfortunately i'm way back at the bus-stop...

(sorry - I haven't replied earlier - this is very much a part-time activity for me...)

I can't figure out how to edit the iptables.

I can open /etc/sysconfig/iptables in emacs, add the lines and save it. But when I reboot there are no rules at all listed with iptables -L. It's completely clean.

Redhat documentation writes about editing iptables via terminal.

If I try to add lines to iptables via terminal it doesn't seem to accept the --dport command?

Plus, I have upgraded to the new nfs and can't get it to share even with the firewall switched off. exportfs shows the share being active, rpcinfo -P from both machines shows the 2 portmapper and 2 nfs ports active.

Could this be a problem with the new nfs not being recognised by OS X...?

i'm not really sure where to go from here...
 
Old 07-25-2003, 01:16 AM   #6
mlp68
Member
 
Registered: Jun 2002
Location: NY
Distribution: Gentoo,RH
Posts: 333

Rep: Reputation: 40
Hi brainlego,

I don't know what OS X can do, nfs-wise, but if it doesn't handle NFS V3 you should fall back to V2. Get back to the point where you could nfs-mount without the firewall.

Before that, see that not much other network stuff is going on, and (assuming 192.168.0.48 is still your mac as in your original post) capture the output of

tcpdump -i eth0 host 192.168.0.48

for a while while the Mac tries to nfs-mount (and fails). Once we got problem #1 solved, we can get back to that and see what the problem is.

Now, after you have edited the rules in /etc/sysconfig/iptables, do

/etc/rc.d/init.d/iptables restart

I suspect that you have a "bug" in there and iptables croaks on it. You would find any complaints filed at boot time in /var/log/messages, but you don't need to reboot if you tweak your rules, and with the above command you can actually see what's wrong. I put a deliberate typo in mine. and...

Quote:
[root@mlphome root]# /etc/rc.d/init.d/iptables restart
Flushing all current rules and user defined chains: [ OK ]
Clearing all current rules and user defined chains: [ OK ]
Applying iptables firewall rules: iptables-restore v1.2.7a: Couldn't load target `RH-Lokkit-0-50-IINPUT':/lib/iptables/libipt_RH-Lokkit-0-50-IINPUT.so: cannot open shared object file: No such file or directory

Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[FAILED]
[root@mlphome root]#
So you see at once what's going on.

The other remote possibility is that you made a new kernel w/o support for iptables, or that someting switched iptables off. Do

Quote:
[root@mlphome root]# chkconfig --list iptables
iptables 0ff 1ff 2n 3n 4n 5n 6ff
[root@mlphome root]#
it should say on for run levels 2,3,4,5. If not, do

chkconfig iptables on

Ok, one step at a time, let's get nfs to work first.

mlp
 
Old 07-25-2003, 05:39 AM   #7
brainlego
LQ Newbie
 
Registered: Jul 2003
Distribution: redhat 9
Posts: 7

Original Poster
Rep: Reputation: 0
cool - thanks...

By accident I discovered I could sudo mount the share from OS X.

So I figured the share was actually working, and perhaps because I had added the nfs share while logged in as root was causing problems.

After deleting the share, and then adding it again while logged in as a user - it works fine.

I'm working through through the iptables stuff now...
 
Old 07-25-2003, 06:46 AM   #8
brainlego
LQ Newbie
 
Registered: Jul 2003
Distribution: redhat 9
Posts: 7

Original Poster
Rep: Reputation: 0
sorted...

i think i have it sorted.

I had a problem with the syntax in /etc/sysconfig/iptables. When I tried restarting iptables it showed an arg error with --dport command.

I did a bit more reading and added the following 4 lines:

-A RH-Lokkit-0-50-INPUT -p tcp --dport 111 -s 192.168.0.0/255.255.255.0 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp --dport 111 -s 192.168.0.0/255.255.255.0 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp --dport 2049 -s 192.168.0.0/255.255.255.0 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp --dport 2049 -s 192.168.0.0/255.255.255.0 -j ACCEPT

iptables restarted OK. share mounts OK from OS X.

Many thanks...
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Mounting NFS Shares ... UID Problem Riddick Linux - Software 1 01-06-2005 09:48 AM
mounting NFS shares help pls mlu Linux - Networking 1 11-23-2004 09:32 PM
Conditionally mounting nfs shares eagle862 Linux - Networking 1 11-02-2004 11:46 PM
Support for mounting NFS shares glock19 Linux - General 1 05-09-2002 07:02 PM
Exporting (via NFS) smbmount'ed shares joeschmoe Linux - Networking 1 11-02-2001 01:38 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 12:58 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration