What are the steps to set up a secure NFS server on Ubuntu for shared storage?

12 June 2024

In today's interconnected world, sharing files seamlessly across multiple systems is a cornerstone of efficient operations. Network File System (NFS) is one of the most reliable and robust methods to achieve this. Setting up an NFS server on Ubuntu can seem daunting at first, but with the right steps, it becomes a straightforward task. This guide will help you set up a secure NFS server on Ubuntu to enable shared storage for your network. By the end, you will be well-equipped to deploy an NFS server that offers both security and functionality.

NFS, or Network File System, allows a user on a client computer to access files over a network as though they were on the user's local storage. This capability is invaluable for systems that require shared storage across different locations. NFS is widely used in Unix and Linux environments, making it a popular choice for IT professionals and system administrators.

NFS operates by allowing a server to share directories and files with clients over a network. These shared files are accessible as if they were on the local hard drive. The beauty of NFS lies in its simplicity and seamless integration with the Linux file hierarchy. But beyond that, NFS also provides robust security features which, when configured correctly, ensure that your data remains safe from unauthorized access.

Setting Up the NFS Server on Ubuntu

Before you can share directories with clients, you need to set up an NFS server. This process involves installing the necessary packages, configuring the server, and sharing directories.

Installing NFS Server

To begin, you need to install the NFS kernel server package. This package provides the tools required to run an NFS server on your system. Open your terminal and enter the following command:

sudo apt update
sudo apt install nfs-kernel-server

This command updates the package list and installs the NFS kernel server to your system. The term 'sudo apt' ensures that the command is executed with root user privileges.

Configuring the NFS Server

After installation, you need to configure the directories you wish to share. This configuration is done in the /etc/exports file. Open the file with a text editor:

sudo nano /etc/exports

Add the directory you want to share along with the client permissions. For example:


Here, /share_directory is the directory being shared, specifies the client network, and the options (rw,sync,no_subtree_check) define the access permissions and behaviors.

Exporting the Shared Directories

After editing the /etc/exports file, you need to export the shared directories. Use the following command:

sudo exportfs -a

This command makes the directories available to the specified client systems.

Starting the NFS Service

You will then start the NFS service to make the server operational:

sudo systemctl start nfs-kernel-server
sudo systemctl enable nfs-kernel-server

The first command starts the NFS kernel server, while the second ensures that the service starts automatically on boot.

Securing Your NFS Server

Security is paramount when setting up an NFS server, as shared files over a network can be vulnerable to unauthorized access. Here are the steps to ensure your NFS server is secure.

Configuring Host-Based Access Control

NFS controls access based on client addresses, which are specified in the /etc/exports file. Ensure only trusted IP addresses or subnets have access. For example:


This limits access to the client with IP

Implementing User-Based Access Control

To enhance security, implement user-based access control. By default, NFS uses a feature called root squash which maps the root user on the client side to a non-privileged user on the server, typically nfsnobody. This prevents root users on client systems from having root access on the NFS server:


Here, no_root_squash would be used cautiously if you trust the root users on the client systems.

Using Firewalls and Securing Ports

It's crucial to ensure that only authorized clients can access your NFS server. Use firewall rules to restrict access to NFS ports. The following commands will allow NFS traffic through the ufw (Uncomplicated Firewall):

sudo ufw allow from to any port nfs

This command allows NFS traffic from the subnet.

Setting Up the NFS Client Systems

Once the NFS server is up and running, the next step is to configure the client systems that will access the shared directories.

Installing NFS Client Packages

First, you need to install the necessary NFS client packages on each client system:

sudo apt update
sudo apt install nfs-common

Mounting the NFS Share

To access the shared directory from the client, you need to mount the NFS share. Create a directory where you want to mount the NFS share:

sudo mkdir -p /mnt/nfs_share

Then, use the mount command to mount the NFS share to this directory:

sudo mount /mnt/nfs_share

Replace with the IP address of your NFS server and /share_directory with the path of the shared directory. This command mounts the NFS share at the specified mount point on the client system.

Automating the Mount

To ensure the NFS share is mounted automatically at boot, add the following entry to the /etc/fstab file: /mnt/nfs_share nfs defaults 0 0

This configuration ensures that the NFS share is mounted automatically each time the client system boots.

Best Practices for NFS Server Management

To maintain a secure and efficient NFS server, follow these best practices:

Regularly Update Your System

Keeping your Ubuntu system and NFS packages up-to-date is crucial for security and performance enhancements. Use the following commands to update your system regularly:

sudo apt update
sudo apt upgrade

Monitor NFS Server Logs

Regularly monitor your NFS server logs to detect any unauthorized access attempts or issues. Logs can be found in /var/log directory. Use the following command to view logs:

sudo tail -f /var/log/syslog

Implementing Subtree Check

Enabling subtree check can improve security by ensuring that NFS clients only have access to the specified directory and its subdirectories. However, it can also introduce performance overhead. Balance between security and performance based on your needs.

By following these steps, you will set up a secure and efficient NFS server on Ubuntu, enabling shared storage across your network. Installing the NFS server, configuring shared directories, ensuring security measures, and setting up client systems are fundamental processes for a reliable NFS environment. Regular maintenance and adherence to best practices will further enhance your NFS server's stability and security. Network File System remains a powerful tool in the Linux ecosystem, providing robust and seamless file-sharing capabilities essential for modern IT infrastructure.

In summary, correctly configuring and securing an NFS server on Ubuntu ensures that your shared storage is not only accessible but also protected against unauthorized access, making it an invaluable asset in your network file-sharing toolkit.

Copyright 2024. All Rights Reserved