Linux NFS Exports, Root Squashing & Port Requirements

Understanding root_squash vs no_root_squash (UID 65534 nobody), NFSv3 vs NFSv4 port requirements (RPC 111, NFS 2049), and firewall rules.

Trap 1: The root_squash Trap (UID 65534 / nobody)

By default, the Linux NFS server (nfs-kernel-server) enforces root_squash on all exported directories.

The Symptom:

When a client machine running as root (UID 0) writes a file to the mounted NFS share, the file is created on the server owned by nobody:nogroup (UID 65534). Root operations fail with permission errors if nobody lacks write permissions.

Architectural Explanation:

NFS root squashing is a security feature designed to prevent a client machine where someone has root access from gaining full root compromise over the NFS server's filesystem.

Configuration in /etc/exports:

• Default (Secure):

  /srv/nfs/data 192.168.1.0/24(rw,sync,root_squash,no_subtree_check)

• Dedicated Admin/Backup Share (Allows client root to remain UID 0):

  /srv/nfs/backup 192.168.1.50(rw,sync,no_root_squash,no_subtree_check)

---

Trap 2: NFSv3 vs. NFSv4 Firewall Port Requirements

NFS connection timeouts are almost always caused by firewall blocking:

| NFS Version | Required Ports | Firewall Configuration |

| :--- | :--- | :--- |

| NFSv4 | TCP 2049 only | Clean and firewall friendly. Single port. |

| NFSv3 | TCP/UDP 111 (RPC Portmapper) + TCP 2049 + dynamic mountd & statd ports | Complex. Requires pinning dynamic ports in /etc/default/nfs-kernel-server. |

sudo mount -t nfs -o vers=4 192.168.1.76:/srv/nfs/data /mnt/data