Setting up an NFS server on Linux to share directory via NFS

Level: Advanced
Estimated time: ~30 minutes
Goal: Configure an NFS server on Linux to share a directory with multiple clients, facilitating the automation of routine tasks and proactive security auditing.

Introduction

Managing shared storage across a fleet of servers is a foundational requirement for maintaining production environments with high uptime requirements. The NFS (Network File System) protocol allows a system to share directory via NFS over a network, acting as a NAS (Network Attached Storage). By deploying an NFS server on Linux, you can provide centralized file access to NFS multiple clients simultaneously. This tutorial covers how to set up NFS server on Linux efficiently, using NFSv4.2 by default.

Prerequisites

Before you begin, make sure the following conditions are met:

• Operating system: Ubuntu 22.04/24.04 LTS, Debian 12/13, or CentOS/RHEL 9/AlmaLinux 10
• Required software: nfs-kernel-server (2.6+) for Ubuntu/Debian or nfs-utils (2.x+) for CentOS/RHEL/AlmaLinux
• Access: sudo or root access on all machines
• Network: Servers must be able to communicate over a private network.
• Required knowledge: Confident use of the Linux command line.

Terminology

Familiarize yourself with the following core concepts before proceeding:

• NFS (Network File System): A protocol allowing users to access files over a network as if they were local storage.
• NFS Server: The central machine that hosts the files and makes them available over the network.
• NFS Client: The remote machine that connects to the server to access the shared files.
• Shared Directory: The local folder on the server that will be made available to clients.
• Export: The process of making a local directory available over the network to clients.
• /etc/exports: The primary configuration file used by the NFS daemon to determine which directories to export and their access rules.
• Mounting: The process of attaching a remote network share to a local directory structure.
• Mount Point: The local directory on the client where the remote filesystem is attached.
• nfs-utils: The software package containing the necessary utilities and daemons for the NFS client and server.
• RPC (Remote Procedure Call): A protocol that one program can use to request a service from a program located in another computer.
• Portmapper / rpcbind: A service that maps RPC program numbers to network port numbers, required for NFS to negotiate connections.
• Permissions: Access rights that dictate who can read, write, or execute files.
• Read-Only Access (RO): A permission state allowing clients to view but not modify files.
• Read-Write Access (RW): A permission state allowing clients to modify the shared files.
• root_squash: A security feature that maps requests from a remote root user to a non-privileged user (nobody) to prevent unauthorized root access.
• Firewall: A network security system that monitors and controls incoming and outgoing network traffic.
• Linux Filesystem: The structured method used by Linux to store and organize files on disk.
• Hostname: A human-readable label assigned to a device connected to a computer network.
• IP Address: A unique numerical identifier assigned to each device connected to a network.
• Automount: The practice of automatically mounting filesystems on boot.
• NAS (Network Attached Storage): A file-level storage architecture that makes data accessible over a network.

Step 1: Install required packages

First, install the necessary software on the server and clients. The nfs-utils package provides the necessary daemons and tools to manage the file system. Modern setups should default to NFSv4.2, which is stateful and simplifies firewall rules.

On the NFS Server (Debian/Ubuntu):

sudo apt update
sudo apt install nfs-kernel-server

On the NFS Server (CentOS/RHEL/AlmaLinux):

sudo dnf install nfs-utils
sudo systemctl enable --now rpcbind nfs-server

On the NFS Client (Debian/Ubuntu):

sudo apt update
sudo apt install nfs-common

On the NFS Client (CentOS/RHEL/AlmaLinux):

sudo dnf install nfs-utils

You should see the installation complete successfully. The necessary RPC and NFS services are now installed and running.

Step 2: Create the shared directory and set NFS permissions

Create the directory you intend to export on the server

sudo mkdir -p /mnt/nfs_share

Set the appropriate NFS permissions so that clients can access the files. For this tutorial, we will assign ownership to the dedicated unprivileged service user and grant appropriate group permissions.

Debian/Ubuntu:

sudo chown nobody:nogroup /mnt/nfs_share
sudo chmod 2775 /mnt/nfs_share

CentOS/RHEL/AlmaLinux:

sudo chown nobody:nobody /mnt/nfs_share
sudo chmod 2775 /mnt/nfs_share

This configuration avoids bypassing the local Linux permission model, ensuring that NFS access control is not your only security layer. The 2775 permission safely enables group collaboration without violating the principle of least privilege.

Step 3: Configure NFS server Linux

To define the export rules, you must edit the /etc/exports file on the server.

Open the file:

sudo nano /etc/exports

Add the following line to grant access to a specific client subnet (e.g., <CLIENT_SUBNET>):

/mnt/nfs_share <CLIENT_SUBNET>(rw,sync,no_subtree_check,root_squash)

This configures the server to export the directory with the following options:

• rw: Grants Read-Write Access (RW). Use ro for Read-Only Access (RO).
• sync: Forces changes to be written to disk before replying to the client.
• no_subtree_check: Disables subtree checking, which improves reliability.
• root_squash: Explicitly maps requests from a remote root user to an unprivileged user (nobody). This is the default behavior but should always be stated explicitly for auditing. Use no_root_squash only for strictly controlled environments.

Apply the export configuration:

Debian/Ubuntu:

sudo exportfs -a
sudo systemctl restart nfs-kernel-server

CentOS/RHEL/AlmaLinux:

sudo exportfs -a
sudo systemctl restart nfs-server

The server is now actively exporting the directory to the network.

Step 4: Configure the firewall

You must allow NFS traffic through the firewall on the server to permit client connections.

Using UFW (Debian/Ubuntu):

On a fresh Ubuntu installation, UFW is inactive by default. On a clean Debian 13 system, it may not even be installed. If you intend to use UFW, ensure it is installed (sudo apt install ufw) and explicitly enabled before adding your rules:

sudo ufw enable
sudo ufw allow from <CLIENT_SUBNET> to any port nfs

Using Firewalld (CentOS/RHEL/AlmaLinux):

sudo firewall-cmd --permanent --zone=public --add-service=nfs
sudo firewall-cmd --permanent --zone=public --add-service=rpc-bind
sudo firewall-cmd --permanent --zone=public --add-service=mountd
sudo firewall-cmd --reload

Clients from the allowed subnet can now reach the NFS services.

Step 5: Verify the export with the showmount command

On the server, proactively verify the active exports and internal audit state to ensure security compliance. Run the following command to check the exact export options applied by the NFS daemon:

sudo cat /var/lib/nfs/etab

Alternatively, you can use `sudo exportfs -v` to view the verbose export list.

Next, from the client machine, use the showmount command to verify that the export is visible over the network. Replace <SERVER_IP> with the actual IP address of your NFS server.

showmount -e <SERVER_IP>

Expected output:

Export list for <SERVER_IP>:
/mnt/nfs_share <CLIENT_SUBNET>

If the export is listed, the server configuration is correct and reachable from the client.

Step 6: Mount NFS filesystem on the client

To use the share, you must mount NFS filesystem to a local mount point on the client.

Create the mount point:

sudo mkdir -p /mnt/client_share

Mount the directory:

sudo mount -t nfs -o vers=4.2 <SERVER_IP>:/mnt/nfs_share /mnt/client_share

The share is now mounted. You can verify it by running df -h to see the network drive attached. Specifying vers=4.2 ensures the client explicitly uses the latest protocol version instead of silently downgrading to NFSv3 or NFSv4.0.

Open /etc/fstab:

sudo nano /etc/fstab

Add the following line:

<SERVER_IP>:/mnt/nfs_share    /mnt/client_share   nfs auto,nofail,noatime,_netdev,hard,vers=4.2,timeo=600 0 0

This prevents the client from hanging the boot process if the server is temporarily unreachable.

Verification

To confirm that the NFS permissions and network settings are correct, run a read/write test from the client:

touch /mnt/client_share/test_file.txt
ls -l /mnt/client_share/

Expected output:

-rw-r--r-- 1 nobody nogroup 0 May 24 12:00 test_file.txt

If the file is created successfully, your clients can communicate with the server and write data as intended.

Reverting changes

To unmount the share on the client:

sudo umount /mnt/client_share

Remove the entry from /etc/fstab on the client if you added one.

To stop sharing the directory on the server, remove the corresponding line from /etc/exports and apply the changes:

Debian/Ubuntu:

sudo exportfs -a
sudo systemctl restart nfs-kernel-server

CentOS/RHEL/AlmaLinux:

sudo exportfs -a
sudo systemctl restart nfs-server

To completely remove the installed packages:

Debian/Ubuntu:

sudo apt remove nfs-kernel-server nfs-common

CentOS/RHEL/AlmaLinux:

sudo dnf remove nfs-utils

This action will completely disable NFS functionality on your machines.

Conclusion

You have successfully learned how to set up NFS server on Linux. By properly configuring the settings, you can securely share directory via NFS with NFS multiple clients. This setup serves as a reliable foundation for automating routine administrative tasks and centralizing logs for proactive security auditing.

Document Version: 1.0
Last Updated: May 2026
Owner: Technical Documentation Team