day3 RHCE
10、配置NFS服务
在server0配置NFS服务，要求如下：
以只读的形式共享目录/public同时只能被example.com域中的系统访问。
以读写的形式共享目录/protected同时只能被example.com域中的系统访问。
访问/protected需要通过Kerberos安全加密，您可以使用下面提供的密钥：
http://classroom.example.com/pub/keytabs/server0.keytab
目录/protected应该包含名为project拥有人为ldapuser0的子目录
用户ldapuser0能以读写形式访问/protected/project
server0 [root@server0 ~]# systemctl restart nfs-server.service [root@server0 ~]# systemctl enable nfs-server.service [root@server0 ~]# systemctl enable nfs-secure [root@server0 ~]# systemctl restart nfs-secure [root@server0 ~]# systemctl restart nfs-secure-server.service (无法重启，无法tab补齐)重启nfs用于安全验证的服务 [root@server0 ~]# systemctl enable nfs-secure-server.service [root@server0 ~]# firewall-cmd --permanent --add-service=nfs [root@server0 ~]# firewall-cmd --permanent --add-service=rpc-bind 重启开机启动rpc-bind [root@server0 ~]# firewall-cmd --permanent --add-service=mountd [root@server0 ~]# firewall-cmd --reload [root@server0 ~]# vim /etc/sysconfig/nfs 辅助配置文件 13 RPCNFSDARGS="-V 4.2" 声明一下nfs版本， [root@server0 ~]# mkdir /public [root@server0 ~]# mkdir /protected [root@server0 ~]# chmod 777 /protected/ 读写 [root@server0 ~]# vim /etc/exports nfs的主要配置文件 /public *.example.com(ro) /protected *.example.com(rw,sec=krb5p) #认证方式sec=krb5p [root@server0 ~]# exportfs -r 重新mount /etc/exports中分享出来的目录 [root@server0 ~]# wget -O /etc/krb5.keytab http://classroom.example.com/pub/keytabs/server0.keytab krb5.keytab 与/etc/exports 同一目录 [root@server0 ~]# id ldapuser0 [root@server0 ~]# mkdir -pv /protected/project [root@server0 ~]# ll /protected/project/ -d [root@server0 ~]# chown ldapuser0:ldapuser0 /protected/project/ 用户，组为ldapuser0 [root@server0 ~]# systemctl restart nfs-server.service [root@server0 ~]# systemctl restart nfs-secure [root@server0 ~]# systemctl restart nfs-secure-server.service （重启成功）
[root@server0 ~]# showmount -e 172.25.0.11
nfs加密的方式，一共有三种方式krb5，krb5i，krb5p： krb5 基于Kerberos票据的认证； krb5i 挂载时校验数据完整性； krb5p通过kerberos认证，并且对数据进行加密
11、挂载一个NFS共享
在desktop0上挂载一个来自server0上的NFS共享，并符合下列要求：
/pulbic共享挂载到本地的/mnt/nfsmount。
/protected挂载到本地的/mnt/nfssecure,并使用安全的方式，密钥下载地址：
http://classroom.example.com/pub/keytabs/desktop0.keytab
用户ldapuser0能够在/mnt/nfssecure/project上创建文件。
这些文件系统在系统启动时自动挂载
[root@server0 ~]# showmount -e 172.25.0.11 [root@desktop0 ~]# mkdir /mnt/nfsmount [root@desktop0 ~]# mkdir /mnt/nfssecure [root@desktop0 ~]# mount server0.example.com:/public /mnt/nfsmount/ [root@desktop0 ~]# mount server0.example.com:/protected /mnt/nfssecure/ [root@desktop0 ~]# vim /etc/fstab server0.example.com:/public /mnt/nfsmount nfs defaults 0 0 server0.example.com:/protected /mnt/nfssecure nfs defaults,sec=krb5p,v4.2 0 0 [root@desktop0 ~]# wget -O /etc/krb5.keytab http://classroom.example.com/pub/keytabs/desktop0.keytab [root@server0 ~]# systemctl restart nfs [root@server0 ~]# systemctl enable nfs [root@server0 ~]# systemctl enable nfs-server [root@server0 ~]# systemctl restart nfs-server [root@desktop0 ~]# systemctl enable nfs-secure （nfs两个用于安全验证的服务） [root@desktop0 ~]# systemctl restart nfs-secure (tab无法补齐) [root@desktop0 ~]# systemctl enable nfs-secure-server.service [root@desktop0 ~]# systemctl restart nfs-secure-server.service [root@desktop0 ~]# mount -a [root@desktop0 ~]# df -h
测试 [root@desktop0 ~]# su - ldapuser0 [ldapuser0@desktop0 nfsmount]$ ll /mnt [ldapuser0@desktop0 nfsmount]$ cd /mnt/nfssecure -bash: cd: /mnt/nfssecure: Permission denied ##提示被拒绝 [ldapuser0@desktop0 nfsmount]$ exit kerbero登录 [root@desktop0 ~]# ssh ldapuser0@localhost Are you sure you want to continue connecting (yes/no)? yes ldapuser0@localhost's password: ##密码为kerberos [ldapuser0@desktop0 nfssecure]$ cd /mnt/nfssecure/project/ [ldapuser0@desktop0 project]$ ll /mnt/nfssecure/project/ -d [ldapuser0@desktop0 project]$ touch 3333 [ldapuser0@desktop0 project]$ exit [ldapuser0@desktop0 project]$ exit
[root@server0 ~]# systemctl restart nfs [root@server0 ~]# systemctl enable nfs [root@server0 ~]# systemctl restart nfs-server.service [root@server0 ~]# systemctl enable nfs-server.service [root@server0 ~]# firewall-cmd --permanent --add-service=nfs [root@server0 ~]# firewall-cmd --permanent --add-service=rpc-bind [root@server0 ~]# firewall-cmd --permanent --add-service=mountd [root@server0 ~]# firewall-cmd --reload [root@server0 ~]# vim /etc/sysconfig/nfs RPCNFSDARGS="-V 4.2" [root@server0 ~]# mkdir /public [root@server0 ~]# mkdir /protected [root@server0 ~]# chmod 777 /protected/ [root@server0 ~]# ll /protected/ -d drwxrwxrwx. 2 root root 6 Oct 19 21:39 /protected/ [root@server0 ~]# vim /etc/exports /public *(ro) /protected *(rw) /public *.example.com(ro) /protected *.example.com(rw) [root@server0 ~]# exportfs -r [root@server0 ~]# systemctl restart nfs [root@server0 ~]# systemctl restart nfs-server [root@server0 ~]# showmount -e 172.25.0.11
[root@desktop0 ~]# showmount -e 172.25.0.11 [root@desktop0 ~]# systemctl restart nfs [root@desktop0 ~]# systemctl restart nfs-server [root@desktop0 ~]# systemctl enable nfs [root@desktop0 ~]# systemctl enable nfs-server.service [root@desktop0 ~]# mkdir -pv /mnt/nfssmount [root@desktop0 ~]# mkdir -pv /mnt/nfssecure [root@desktop0 ~]# mount 172.25.0.11:/public /mnt/nfsmount/ [root@desktop0 ~]# mount 172.25.0.11:/protected /mnt/nfssecure/ [root@desktop0 ~]# mount server0.example.com:/public /mnt/nfsmount/ [root@desktop0 ~]# mount server0.example.com:/protected /mnt/nfssecure/ [root@desktop0 ~]# mount -a [root@desktop0 ~]# df -h 172.25.0.11:/public 10G 3.1G 7.0G 31% /mnt/nfsmount [root@desktop0 ~]# mount 172.25.0.11:/protected on /mnt/nfssecure 172.25.0.11:/public on /mnt/nfsmount [root@desktop0 mnt]# cd nfsmount/ [root@desktop0 nfsmount]# touch 3 touch: cannot touch ‘3’: Read-only file system [root@desktop0 ~]# cd /mnt/nfssecure/ [root@desktop0 nfssecure]# touch 4 [root@desktop0 nfssecure]# ll total 0 -rw-r--r--. 1 nfsnobody nfsnobody 0 Oct 19 21:46 4
[root@server0 ~]# cd /protected/ [root@server0 protected]# mkdir project [root@server0 ~]# chown ldapuser0:ldapuser0 /protected/project/ [root@server0 ~]# ll /protected/project/ -d drwxr-xr-x. 2 ldapuser0 root 6 Oct 19 21:50 /protected/project/ [root@desktop0 ~]# su - ldapuser0 [ldapuser0@desktop0 ~]$ cd /mnt/nfssecure/project [ldapuser0@desktop0 project]$ touch 4 [ldapuser0@desktop0 project]$ ll total 0 -rw-rw-r--. 1 ldapuser0 ldapuser0 0 Oct 19 21:52 4
[root@server0 ~]# wget -O /etc/krb5.keytab http://classroom.example.com/pub/keytabs/server0.keytab [root@server0 ~]# vim /etc/exports /public *.example.com(ro) /protected *.example.com(rw,sec=krb5p) [root@server0 ~]# exportfs -r [root@server0 ~]# systemctl restart nfs-secure [root@server0 ~]# systemctl enable nfs-secure [root@server0 ~]# systemctl restart nfs-secure-server [root@server0 ~]# systemctl enable nfs-secure-server [root@desktop0 ~]# wget -O /etc/krb5.keytab http://classroom.example.com/pub/keytabs/desktop0.keytab [root@desktop0 ~]# systemctl restart nfs-secure [root@desktop0 ~]# systemctl restart nfs-secure-server [root@desktop0 ~]# systemctl enable nfs-secure-server [root@desktop0 ~]# systemctl enable nfs-secure [root@desktop0 ~]# systemctl restart nfs-server [root@desktop0 ~]# systemctl enable nfs-server [ldapuser0@desktop0 ~]$ vim /etc/fstab server0.example.com:/public /mnt/nfsmount nfs defaults 0 0 server0.example.com:/protected /mnt/nfssecure nfs defaults,sec=krb5p,v4.2 0 0 [root@desktop0 ~]# mount -a [root@desktop0 ~]# df -h
[root@desktop0 ~]# su - ldapuser0 [ldapuser0@desktop0 ~]$ ll /mnt/ ls: cannot access /mnt/nfssecure: Operation not permitted total 4 drwxr-xr-x. 3 root root 4096 Oct 19 21:20 data drwxr-xr-x. 2 root root 6 Oct 19 21:39 nfsmount ??????????? ? ? ? ? ? nfssecure [root@desktop0 ~]# ssh ldapuser0@loaclhost kerberos [ldapuser0@desktop0 ~]$ ll /mnt
