rpc.mountd(8)

📦
version 3.1.1 · 9 versions
, in arch rolling, nixos 26.05, nixpkgs unstable, ubuntu stonking

💖 rpc.mountd(8) — System Manager's Manual 💖

okay bestie, gather round, because we're about to talk about rpc.mountd, aka the NFS mount daemon, and she is lowkey the backbone of your whole NFS situation. this is the manual page, but make it make sense. let's go ✨

🌸 NAME 🌸

rpc.mountd — the NFS mount daemon. that's her. that's the whole name. iconic.

🎀 SYNOPSIS 🎀

/usr/sbin/rpc.mountd [options]

yes, she lives at /usr/sbin/rpc.mountd and she takes options. we'll get to those, don't worry. 💅

✨ DESCRIPTION ✨

so the rpc.mountd daemon implements the server side of the NFS MOUNT protocol — which is, like, an NFS side protocol used by NFS version 2 [RFC1094] and NFS version 3 [RFC1813]. she also responds to requests from the Linux kernel to authenticate clients and to hand over details of access permissions. multitasking queen. 👑

the NFS server (nfsd) keeps a cache of authentication and authorization info, which it uses to figure out the source of each request, and then what access permissions that source has to any local filesystem. when the info it needs isn't in the cache, the server sends a request to mountd to fill in the missing bits. and mountd uses a table of information stored in /var/lib/nfs/etab — maintained by exportfs(8), possibly based on the contents of exports(5) — to respond to each request. it's giving "I got you, bestie." 🫶

🦋 Mounting exported NFS File Systems 🦋

the NFS MOUNT protocol has several procedures. the most important ones are MNT (mount an export) and UMNT (unmount an export).

a MNT request has two arguments:

  • an explicit argument that contains the pathname of the root directory of the export to be mounted
  • an implicit argument that is the sender's IP address

when she receives a MNT request from an NFS client, rpc.mountd checks both the pathname and the sender's IP address against her export table. if the sender is permitted to access the requested export, rpc.mountd returns an NFS file handle for the export's root directory to the client. then the client can use that root file handle plus NFS LOOKUP requests to navigate the directory structure of the export. slay. 🔥

🌈 The rmtab File 🌈

the rpc.mountd daemon registers every successful MNT request by adding an entry to the /var/lib/nfs/rmtab file. and when she gets a UMNT request from an NFS client, rpc.mountd simply removes the matching entry from /var/lib/nfs/rmtab — as long as the access control list for that export allows that sender to access the export. periodt.

clients can discover the list of file systems an NFS server is currently exporting, or the list of other clients that have mounted its exports, by using the showmount(8) command. showmount(8) uses other procedures in the NFS MOUNT protocol to report information about the server's exported file systems. cute, right? 💖

⚠️ but note, bestie: there is little to guarantee that the contents of /var/lib/nfs/rmtab are accurate. a client may continue accessing an export even after invoking UMNT. and if the client reboots without sending a UMNT request, stale entries remain for that client in /var/lib/nfs/rmtab. so like… don't fully trust her. 💀

🧚 Mounting File Systems with NFSv4 🧚

version 4 (and later) of NFS does not use a separate NFS MOUNT protocol. instead, mounting is performed using regular NFS requests handled by the NFS server in the Linux kernel (nfsd). consequently, /var/lib/nfs/rmtab is not updated to reflect any NFSv4 activity. so if you were looking for rmtab entries from your NFSv4 mounts… yeah, she's not there. 🙈

✨ OPTIONS ✨

okay bestie, this is the good part. every single flag, no skips, let's go 💅

  • -d kind or --debug kind — turns on debugging. the valid *kind*s are: all, auth, call, general and parse. pick your fighter 🎀
  • -l or --log-auth — logs the responses to authentication and access requests that come from nfsd. each response then gets cached by the kernel for 30 minutes (or whatever --ttl says below), and gets refreshed after 15 minutes — that's half the ttl time — if the relevant client is still active. also, heads up: -l is literally equivalent to -d auth, so you can turn it on in /etc/nfs.conf with debug = auth inside the [mountd] section. no cap 🫶
rpc.mountd always logs authentication responses to MOUNT requests when NFSv3 is used. but to get similar logs for NFSv4? you need this option. periodt.
  • -i or --cache-use-ipaddr — normally each client IP address gets matched against each host identifier (name, wildcard, netgroup, etc) found in /etc/exports, and a combined identity is formed from all the matching identifiers. often lots of clients map to the same combined identity, so doing this mapping reduces the number of distinct access details the kernel has to store. specifying -i suppresses that mapping, so access to each filesystem is requested and cached separately for each client IP address. this can increase the burden of updating the cache slightly, but it can make the log messages from -l way easier to read. iykyk 😌
  • -T or --ttl — provides a time-to-live (TTL) for cached info given to the kernel. the kernel will normally request an update if the info is needed after half of this time has expired. the number you give it is in seconds, and increasing it reduces the rate of cache update requests — which is especially noticeable when those requests are logged with -l. but increasing it also means changes to hostname-to-address mappings can take longer to be noticed. the default TTL is 1800 (30 minutes). ⏰
  • -F or --foreground — run in foreground (do not daemonize). main character energy, stays in the room 💅
  • -h or --help — display usage message. classic.
  • -o num or --descriptors num — sets the limit on the number of open file descriptors to num. the default is to leave the limit unchanged. don't touch it if you don't need it, fr fr.
  • -N mountd-version or --no-nfs-version mountd-version — use this to request that rpc.mountd does not offer certain versions of NFS. the current version of rpc.mountd can support NFS version 2, 3 and 4. if either one of these versions shouldn't be offered, rpc.mountd must be invoked with the option --no-nfs-version <vers>. 🚫
  • -n or --no-tcp — don't advertise TCP for mount.
  • -p num or -P num or --port num — specifies the port number used for RPC listener sockets. if you don't specify this option, rpc.mountd will try to consult /etc/services; if it gets a port successfully, it sets the same port for all listener sockets, otherwise it chooses a random ephemeral port for each listener socket.

this option can be used to fix the port value of rpc.mountd's listeners when NFS MOUNT requests must traverse a firewall between clients and servers. 🔥

  • -H prog or --ha-callout prog — specify a high availability callout program. this program receives callouts for all MOUNT and UNMOUNT requests, which lets rpc.mountd be used in a High Availability NFS (HA-NFS) environment. 🫡

the callout program is run with 4 arguments:

  1. mount or unmount, depending on the reason for the callout
  2. the name of the client performing the mount
  3. the path that the client is mounting
  4. the number of concurrent mounts that we believe the client has of that path
this callout is not needed with 2.6 and later kernels. instead, mount the nfsd filesystem on /proc/fs/nfsd. okay? okay. 💀
  • -s, --state-directory-path directory — specify a directory in which to place state information (etab and rmtab). if you don't specify this option, the default /var/lib/nfs is used. 🗂️
  • -r, --reverse-lookup — rpc.mountd tracks IP addresses in the rmtab file. when a DUMP request is made (by someone running showmount -a, for instance), it returns IP addresses instead of hostnames by default. this option causes rpc.mountd to perform a reverse lookup on each IP address and return that hostname instead.
⚠️ enabling this can have a substantial negative effect on performance in some situations. be careful bestie 😭
  • -t N or --num-threads=N or --num-threads N — specifies the number of worker threads that rpc.mountd spawns. the default is 1 thread, which is probably enough. more threads are usually only needed for NFS servers that need to handle mount storms of hundreds of NFS mounts in a few seconds, or when your DNS server is slow or unreliable. 🌪️
  • -u or --no-udp — don't advertise UDP for mounting.
  • -V version or --nfs-version version — use this to request that rpc.mountd offer certain versions of NFS. the current version of rpc.mountd can support both NFS version 2 and the newer version 3. ✨
  • -v or --version — print the version of rpc.mountd and exit.
  • -c or --apply-root-cred — when mountd is asked to allow an NFSv3 mount to a subdirectory of the exported directory, it will check whether the user asking to mount has lookup rights to the directories below that exported directory. when performing that check, mountd will apply any root squash or all squash rules that were specified for that client.

performing lookup checks as the user requires that the mountd daemon be run as root, or that it be given CAP_SETUID and CAP_SETGID privileges so it can change its own effective user and effective group settings. when troubleshooting, please also note that LSM frameworks such as SELinux can sometimes prevent the daemon from changing the effective user/groups despite the capability settings. 🙈

in earlier versions of mountd, the same checks were performed using the mountd daemon's root privileges, meaning it could authorise access to directories that are not normally accessible to the user requesting to mount them. this option enables that legacy behaviour.

note: if there's a need to provide access to specific subdirectories that aren't normally accessible to a client, it's always possible to add export entries that explicitly grant such access. that ability does not depend on this option being enabled. 💖
  • -g or --manage-gids — accept requests from the kernel to map user id numbers into lists of group id numbers for use in access control. an NFS request will normally (except when using Kerberos or other cryptographic authentication) contain a user-id and a list of group-ids. due to a limitation in the NFS protocol, at most 16 group ids can be listed. if you use the -g flag, then the list of group ids received from the client will be replaced by a list of group ids determined by an appropriate lookup on the server. note that the 'primary' group id is not affected, so a newgroup command on the client will still be effective. this function requires a Linux Kernel with version at least 2.6.21. 🧠
  • -L or --no-netlink — disable the use of netlink for kernel communication and force the use of the legacy /proc/net/rpc interfaces instead. this can be useful for debugging or working around kernel netlink issues. 🔧

🌸 CONFIGURATION FILE 🌸

lots of the options you can set on the command line can also be controlled through values set in the [mountd] section — or, in some cases, the [nfsd] section — of the /etc/nfs.conf configuration file. ✨

values recognized in the [mountd] section include manage-gids, no-netlink, cache-use-ipaddr, descriptors, port, threads, ttl, reverse-lookup, and state-directory-path, ha-callout — and each of them has the same effect as the option with the same name. cute, right? 🎀

the values recognized in the [nfsd] section include TCP, UDP, vers3, and vers4, which each have the same meaning as given by rpc.nfsd(8).

🛡️ TCP_WRAPPERS SUPPORT 🛡️

you can protect your rpc.mountd listeners using the tcp_wrapper library or iptables(8). iconic.

note that the tcp_wrapper library supports only IPv4 networking. 💀

add the hostnames of NFS peers that are allowed to access rpc.mountd to /etc/hosts.allow. use the daemon name mountd — even if the rpc.mountd binary has a different name. yes, really. 🙈

hostnames used in either access file will be ignored when they can't be resolved into IP addresses. for further information see the tcpd(8) and hosts_access(5) man pages.

🌈 IPv6 and TI-RPC support 🌈

TI-RPC is a pre-requisite for supporting NFS on IPv6. if TI-RPC support is built into rpc.mountd, it attempts to start listeners on network transports marked 'visible' in /etc/netconfig. as long as at least one network transport listener starts successfully, rpc.mountd will operate. 🦋

📁 FILES 📁

  • /etc/exports — input file for exportfs, listing exports, export options, and access control lists
  • /var/lib/nfs/rmtab — table of clients accessing server's exports

👀 SEE ALSO 👀

exportfs(8), exports(5), showmount(8), rpc.nfsd(8), rpc.rquotad(8), nfs(5), nfs.conf(5), tcpd(8), hosts_access(5), iptables(8), netconfig(5)

  • RFC 1094 - "NFS: Network File System Protocol Specification"
  • RFC 1813 - "NFS Version 3 Protocol Specification"
  • RFC 7530 - "Network File System (NFS) Version 4 Protocol"
  • RFC 8881 - "Network File System (NFS) Version 4 Minor Version 1 Protocol"

💜 AUTHOR 💜

Olaf Kirch, H. J. Lu, G. Allan Morris III, and a host of others.

and that's the whole thing bestie, we ate that entire manpage and left zero crumbs 🍓 the footer says this page is from 31 Dec 2009 and lives at rpc.mountd(8) — a certified vintage icon, no notes, periodt 💅✨

📦 where this page comes from