15

I have a Synology NAS box (running DSM 5.1), and I've exported a directory via NFS. I'm attempting to mount it on my Ubuntu box.

It mostly works fine, but I'm having issues with user and group mappings. On the Ubuntu box, I am uid 1000 (roger), gid 1000 (roger). On the Synology, I have uid 1026 (roger), group 100 (users).

If I use NFSv3, it uses numeric uid/gid values, which means that the ownership is messed up on the Synology.

If I were to only ever access the NFS mount from the same Ubuntu box, using the same user, this'd be fine, but I also access the directory from a Windows box, using CIFS (SMB), which means that the permissions are wrong.

If I use NFSv4 (mount -o nfsvers=4), with the default settings on the Synology, then files owned by roger.users on the Synology appear owned by roger.users when viewed from the Ubuntu box. This is good.

However, when I touch a file:

roger@ubuntu$ touch /mounts/diskstation/music/foo

It ends up owned by 1000.1000 on the Synology, and shown as owned by nobody.4294967294 when viewed from the Ubuntu box.

Everything I can find on the topic on the Synology forums is either dated from 2011, when NFSv4 wasn't supported, or consists of people asking the same question and then giving up.

For completeness, /etc/exports has:

/volume1/music  10.0.0.0/24(rw,async,no_wdelay,root_squash,insecure_locks,sec=sys,anonuid=1025,anongid=100)

...and I'm mounting it on the Ubuntu box with:

mount -t nfs diskstation:/volume1/music /mounts/diskstation/music/ -o rw,nfsvers=4

I found some hints that the sec=sys might be a problem: Why NFSv4 uid/gid mapping doesn’t work with AUTH_UNIX (AUTH_SYS), but that doesn't have a solution.

Is there a simple way to get around this problem? Is there a more complex (cough Kerberos cough) way to solve this?

Seriously, if Kerberos is the answer, I'll take that hit, but I'd like to know before wasting a bunch of time on it.

Update: while the Synology documentation talks about various Kerberos options, I can't find them in the UI. The release notes state "If Kerberos security flavor is implemented...". I found (but cannot find again) a page which implies that it might not be on certain models. I have a DS211, according to the System Information page. Maybe I'm out of luck?

  • configure ldap server separately. Then on NFS client (your ubuntu box), configure ldap client. Also configure autofs service for automounting nfs shares (from NAS) on nfs client machine (ubuntu). On NFS client, create ssh users to access the user's content – Sathish Jan 6 '15 at 2:10
6

For NFSv4 ID mapping to work properly, both client and server must be running the idmapd ID Mapper daemon and have the same Domain configured in /etc/idmapd.conf.

This way your NFS Client sends its ID credentials as roger@example.com in the NFS commands on the wire, and your NFS Server idmapper maps that to a user called roger on the NFS Server. The UID and GID don't matter, they are mapped on each system by the idmapper.

However I don't bother with that on my Synology. My Shared Folder has the following permissions:

  • Permissions
    • Local Users
      • Admin = read/write
  • NFS Permissions
    • Squash
      • Map all users to admin

This results in anonuid=1024,anongid=100 (the admin user and users group) being added to the export in /etc/exports on the NAS.

My NFS Client (which doesn't have the ID Mapper running) sends my NFS commands as my user (1000:1000) and because that UID and GID don't exist on the NAS, it translates my UID and GID to 1024:100 so I am treated as the Admin user who has full permission.

This is a terribly unprofessional and insecure use of NFS for a business environment, but just for me to access my files at home it is an abuse of NFS behaviour which is acceptable to me.

Another option is to make roger's UID and GID the same on the NFS Client and NAS, then you can use NFSv4 without ID Mapping, or you could then use NFSv3 which relies only on UID and GID.

0

I had the same problem trying to find out the models this was on. Turns out Kerberos is part of the Active Directory Server package, and the package description includes the Synology models it’s available on. (I got the 1515, not the 1515+, so I’m out of luck as well.)

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.