21.7. The /etc/exports Configuration File
/etc/exportsfile controls which file systems are exported to remote hosts and specifies options. Blank lines are ignored, comments can be made by starting a line with the hash mark (
#), and long lines can be wrapped with a backslash (
\). Each exported file system should be on its own individual line, and any lists of authorized hosts placed after an exported file system must be separated by space characters. Options for each of the hosts must be placed in parentheses directly after the host identifier, without any spaces separating the host and the first parenthesis. Valid host types are
<export> <host1>(<options>) <hostN>(<options>)...
- single host — Where one particular host is specified with a fully qualified domain name, hostname, or IP address.
- wildcards — Where a
?character is used to take into account a grouping of fully qualified domain names that match a particular string of letters. Wildcards should not be used with IP addresses; however, it is possible for them to work accidentally if reverse DNS lookups fail.Be careful when using wildcards with fully qualified domain names, as they tend to be more exact than expected. For example, the use of
*.example.comas a wildcard allows sales.example.com to access an exported file system, but not bob.sales.example.com. To match both possibilities both
*.*.example.commust be specified.
- IP networks — Allows the matching of hosts based on their IP addresses within a larger network. For example,
192.168.0.0/28allows the first 16 IP addresses, from 192.168.0.0 to 192.168.0.15, to access the exported file system, but not 192.168.0.16 and higher.
- netgroups — Permits an NIS netgroup name, written as
@<group-name>, to be used. This effectively puts the NIS server in charge of access control for this exported file system, where users can be added and removed from an NIS group without affecting
/etc/exportsfile only specifies the exported directory and the hosts permitted to access it, as in the following example:
/exported/directory/. Because no options are specified in this example, the following default NFS options take effect:
ro— Mounts of the exported file system are read-only. Remote hosts are not able to make changes to the data shared on the file system. To allow hosts to make changes to the file system, the read/write (
rw) option must be specified.
wdelay— Causes the NFS server to delay writing to the disk if it suspects another write request is imminent. This can improve performance by reducing the number of times the disk must be accessed by separate write commands, reducing write overhead. The
no_wdelayoption turns off this feature, but is only available when using the
root_squash— Prevents root users connected remotely from having root privileges and assigns them the user ID for the user
nfsnobody. This effectively "squashes" the power of the remote root user to the lowest local user, preventing unauthorized alteration of files on the remote server. Alternatively, the
no_root_squashoption turns off root squashing. To squash every remote user, including root, use the
all_squashoption. To specify the user and group IDs to use with remote users from a particular host, use the
anongidoptions, respectively. In this case, a special user account can be created for remote NFS users to share and specify
<uid-value>is the user ID number and
<gid-value>is the group ID number.
no_acloption when exporting the file system.
rwoption is not specified, then the exported file system is shared as read-only. The following is a sample line from
/etc/exportswhich overrides two default options:
/another/exported/directory/read/write and all transfers to disk are committed to the disk before the write request by the client is completed.
exportsman page for details on these lesser used options.
/etc/exportsfile is very precise, particularly in regards to use of the space character. Remember to always separate exported file systems from hosts and hosts from one another with a space character. However, there should be no other space characters in the file except on comment lines.
/home bob.example.com(rw) /home bob.example.com (rw)
bob.example.comread/write access to the
/homedirectory. The second line allows users from
bob.example.comto mount the directory as read-only (the default), while the rest of the world can mount it read/write.
/etc/exportsfile. When the
nfsservice starts, the
/usr/sbin/exportfscommand launches and reads this file, passes control to
rpc.mountd(if NFSv2 or NFSv3) for the actual mounting process, then to
rpc.nfsdwhere the file systems are then available to remote users.
/usr/sbin/exportfscommand allows the root user to selectively export or unexport directories without restarting the NFS service. When given the proper options, the
/usr/sbin/exportfscommand writes the exported file systems to
rpc.mountdrefers to the
xtabfile when deciding access privileges to a file system, changes to the list of exported file systems take effect immediately.
-r— Causes all directories listed in
/etc/exportsto be exported by constructing a new export list in
/etc/lib/nfs/xtab. This option effectively refreshes the export list with any changes that have been made to
-a— Causes all directories to be exported or unexported, depending on what other options are passed to
/usr/sbin/exportfs. If no other options are specified,
/usr/sbin/exportfsexports all file systems specified in
-o file-systems— Specifies directories to be exported that are not listed in
/etc/exports. Replace file-systems with additional file systems to be exported. These file systems must be formatted in the same way they are specified in
/etc/exports. Refer to Section 21.7, “The
/etc/exportsConfiguration File” for more information on
/etc/exportssyntax. This option is often used to test an exported file system before adding it permanently to the list of file systems to be exported.
/etc/exports; only options given from the command line are used to define exported file systems.
-u— Unexports all shared directories. The command
/usr/sbin/exportfs -uasuspends NFS file sharing while keeping all NFS daemons up. To re-enable NFS sharing, type
-v— Verbose operation, where the file systems being exported or unexported are displayed in greater detail when the
exportfscommand is executed.
/usr/sbin/exportfscommand, it displays a list of currently exported file systems.
/usr/sbin/exportfscommand, refer to the
exportfs with NFSv4
exportfscommand is used in maintaining the NFS table of exported file systems. When typed in a terminal with no arguments, the
exportfscommand shows all the exported directories.
MOUNTprotocol, which was used with the NFSv2 and NFSv3 protocols, the mounting of file systems has changed.
mount --bind /usr/local/opt /exports/opt
mount --bind /usr/local/etc /exports/etc
exportfs -o fsid=0,insecure,no_subtree_check gss/krb5p:/exports
exportfs -o rw,nohide,insecure,no_subtree_check gss/krb5p:/exports/opt
exportfs -o rw,nohide,insecure,no_subtree_check gss/krb5p:/exports/etc
--bindoption which creates unbreakable links.
/home /home/sam /home/john /home/joe
mount server:/home /mnt/home
mount -t nfs4 server:/ /mnt/home
server:/home" and "
server:/". To make the exports configurations compatible for all version, one needs to export (read only) the root filesystem with an
fsid=0signals the NFS server that this export is the root.
/ *(ro,fsid=0) /home *(rw,sync,nohide)
mount server:/home /mnt/home" and "
mount -t nfs server:/home /mnt/home" will work as expected.