Mount a SCITAS-provided NFS share#
Our central storage system includes a /export
filesystem designed to export folders using the NFS protocol version 4.
These shares are only accessible from inside the EPFL network.
You can access the /export filesystem through the nfs.hpc.epfl.ch endpoint.
As long as you have access to a /work/<unit> folder on our clusters,
you automatically get access to an /export/<unit_share> folder as well.
<unit> and <unit_share> usually have identical names.
Tip
If you would like to access your share on /export from your personal
workstation, we highly recommend you use CIFS
instead. Both the CIFS and the NFS endpoints grant access to the exact same
files.
Accessing these directories requires authenticating against EPFL's Active Directory and obtaining a Kerberos ticket.
Configure your server#
Warning
The following procedure requires root access to your server and an Active Directory account allowed to register your server.
Required packages#
Kerberos configuration#
Your /etc/krb5.conf file should look like this:
[libdefaults]
rdns = false
default_realm = INTRANET.EPFL.CH
dns_canonicalize_hostname = fallback
dns_lookup_realm = false
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
default_ccache_name = KEYRING:persistent:%{uid}
udp_preference_limit = 0
qualify_shortname = ""
[realms]
INTRANET.EPFL.CH = {
}
[domain_realm]
intranet.epfl.ch = INTRANET.EPFL.CH
.intranet.epfl.ch = INTRANET.EPFL.CH
hpc.epfl.ch = INTRANET.EPFL.CH
.hpc.epfl.ch = INTRANET.EPFL.CH
epfl.ch = INTRANET.EPFL.CH
.epfl.ch = INTRANET.EPFL.CH
Joining EPFL's Active Directory#
sudo realm join --verbose intranet.epfl.ch --computer-ou="<AD_OU_DN>" --client-software=sssd -U '<AD_USERNAME>'
Where <AD_OU_DN> is the distinguished name of your unit in Active Directory
and <AD_USERNAME> is the name of your Active Directory account with delegated
administrative privileges, specifically the permission to register servers in
Active Directory.
Your server will join EPFL's Active Directory domain and your SSSD
configuration (/etc/sssd/sssd.conf) will be updated to enable the use of the
Active Directory domain. We recommend reviewing the generated sssd.conf file
and adjust parameters according to your system's needs. You will find a basic
working example below:
[sssd]
domains = intranet.epfl.ch
config_file_version = 2
[domain/intranet.epfl.ch]
default_shell = /bin/bash
krb5_store_password_if_offline = True
cache_credentials = True
krb5_realm = INTRANET.EPFL.CH
realmd_tags = manages-system joined-with-adcli
id_provider = ad
fallback_homedir = /home/%u@%d
ad_domain = intranet.epfl.ch
use_fully_qualified_names = False
ldap_id_mapping = True
access_provider = ad
ad_gpo_ignore_unreadable = True
override_homedir = /home/%u
default_shell = /bin/bash
use_fully_qualified_names = False
fallback_homedir = /home/%u
krb5_renewable_lifetime = 90d
krb5_renew_interval = 500
krb5_validate=true
ID mapping#
ID mapping enables your system to display the names of users and groups
associated with the files. To configure your system to look up names in EPFL's
Active Directory when using NFSv4, your /etc/idmapd.conf should look like
this:
Mount the NFS share#
The rpc-gssd service must be started before you can mount an NFS share.
You can then create a mountpoint and mount your share.
sudo mkdir -p <MOUNTPOINT>
sudo mount -t nfs4 -o sec=krb5p nfs.hpc.epfl.ch:/<unit_share> <MOUNTPOINT>
Where <MOUNTPOINT> is the path where you want to mount the share on your server.
You may want to add an entry to /etc/fstab to ensure your share gets mounted
automatically after a reboot.
Access control#
Unfortunately, the traditional UNIX permission system cannot be used on an NFS
share. You would have to use the NFSv4 permission system instead. You can read
ACLs through the nfs4_getfacl command and edit them with the nfs4_setfacl
command. Please refer to our documentation about access
control for more details.