nfsv4.exportd(8)

💖 NAME 💖

nfsv4.exportd — NFSv4 Server Mount Daemon

Yes bestie, you are reading nfsv4.exportd(8), the manual page. Buckle up. 🎀

---

✨ SYNOPSIS ✨

/usr/sbin/nfsv4.exportd [options]

---

🦋 DESCRIPTION 🦋

okay so nfsv4.exportd is the whole entire girlboss in charge of managing NFSv4 exports. Here's the vibe: the NFS server (nfsd) keeps a little cache of authentication and authorization info, and that cache is what it uses to figure out who is making each request, and then what access permissions that source has to any local filesystem. main character detective work, honestly. 🔍

But when the info it needs isn't in the cache? It doesn't just guess, it does not have that energy. It sends a request over to nfsv4.exportd to fill in the missing deets. 💌

And how does nfsv4.exportd answer? It pulls from a table of information stored in /var/lib/nfs/etab — a table that's maintained by exportfs(8), possibly based on the contents of exports(5) — and uses that to respond to each request. slay. ✨

---

👑 OPTIONS 👑

• -d kind or --debug kind — turn on debugging, we love a debug era. valid kinds are: all, auth, call, general and parse.
• -l or --log-auth — enables logging of the responses to authentication and access requests coming from nfsd. Each response then gets cached by the kernel for 30 minutes (or as set by --ttl below, iykyk), and it'll be refreshed after 15 minutes — that's half the ttl time — if the relevant client is still active. 📝

heads up: -l is equivalent to -d auth, so you can also turn it on in /etc/nfs.conf with "debug = auth" in the [exportd] section. two paths, same slay.

• -i or --cache-use-ipaddr — normally, each client IP address gets matched against every host identifier (name, wildcard, netgroup etc) found in /etc/exports, and a combined identity is formed from all the matching identifiers. Often lots of clients will map to the same combined identity, so doing this mapping reduces how many distinct access details the kernel has to store — very efficient, very demure. specifying -i suppresses that mapping, so access to each filesystem is requested and cached separately for each client IP address. doing this can increase the burden of updating the cache slightly, but it can make the log messages produced by the -l option easier to read. tradeoffs, bestie. 💅
• -T or --ttl — provide a time-to-live (TTL) for cached information given to the kernel. the kernel will normally request an update if the info is needed after half of this time has expired. increasing the provided number — which is in seconds — reduces the rate of cache update requests, and this is especially noticeable when those requests are logged with -l. BUT increasing it also means changes to hostname-to-address mappings can take longer to be noticed. 👀 the default TTL is 1800 (30 minutes).
• -F or --foreground — run in the foreground (do not daemonize). stay present. 🫶
• -h or --help — display the usage message. the classic.
• -t N or --num-threads=N or --num-threads N — this option specifies the number of worker threads that nfsv4.exports spawns. (yes, the page says nfsv4.exports, we do not make the rules 💀) the default is 1 thread, which is probably enough. more threads are usually only needed for NFS servers that have to handle mount storms of hundreds of NFS mounts in a few seconds, or when your DNS server is slow or unreliable. 🌀
• -g or --manage-gids — accept requests from the kernel to map user id numbers into lists of group id numbers, for use in access control. an NFS request will normally (except when using Kerberos or other cryptographic authentication) contain a user-id and a list of group-ids. due to a limitation in the NFS protocol, at most 16 group ids can be listed. if you use the -g flag, then the list of group ids received from the client gets replaced by a list of group ids determined by an appropriate lookup on the server. note that the 'primary' group id is not affected, so a newgroup command on the client will still be effective. this function requires a Linux Kernel with version at least 2.6.21. 🐧
• -L or --no-netlink — disable the use of netlink for kernel communication and force the use of the legacy /proc/net/rpc interfaces instead. this can be useful for debugging or for working around kernel netlink issues. 🔧

---

🌈 CONFIGURATION FILE 🌈

Many of the options you can set on the command line can also be controlled through values set in the [exportd] section — or, in some cases, the [nfsd] section — of the /etc/nfs.conf configuration file. 📄✨

Values recognized in the [exportd] section include cache-use-ipaddr, ttl, manage-gids, no-netlink, and debug — and each one has the same effect as the option with the same name. no cap. 🤝

---

🍓 FILES 🍓

• /etc/exports — input file for exportfs, listing exports, export options, and access control lists.

---

⭐ SEE ALSO ⭐

exportfs(8), exports(5), showmount(8), nfs.conf(5), firewall-cmd(1),

RFC 7530 — "Network File System (NFS) Version 4 Protocol"

RFC 8881 — "Network File System (NFS) Version 4 Minor Version 1 Protocol"

---

and that's the whole page, bestie!! 🎀 this was the nfsv4.exportd(8) page from the System Manager's Manual, dated 02 Feb 2021. go forth and export your filesystems responsibly. mwah. 💖✨🦋