JavaScript is required to for searching.
Skip Navigation Links
Exit Print View
System Administration Guide: Network Services     Oracle Solaris 11 Express 11/10
search filter icon
search icon

Document Information

Preface

Part I Network Services Topics

1.  Network Service (Overview)

2.  Managing Web Cache Servers

3.  Time-Related Services

Part II Accessing Network File Systems Topics

4.  Managing Network File Systems (Overview)

5.  Network File System Administration (Tasks)

6.  Accessing Network File Systems (Reference)

NFS Files

/etc/default/nfslogd File

/etc/nfs/nfslog.conf File

NFS Daemons

automountd Daemon

lockd Daemon

mountd Daemon

nfs4cbd Daemon

nfsd Daemon

nfslogd Daemon

nfsmapid Daemon

Configuration Files and nfsmapid

Precedence Rules

nfsmapid and DNS TXT Records

Checking for the NFS Version 4 Domain

Configuring the NFS Version 4 Default Domain

Additional Information About nfsmapid

reparsed Daemon

statd Daemon

NFS Commands

automount Command

clear_locks Command

fsstat Command

mount Command

mount Options for NFS File Systems

Using the mount Command

umount Command

mountall Command

umountall Command

sharemgr Command

create Subcommand

delete Subcommand

list Subcommand

show Subcommand

set Subcommand

unset Subcommand

add-share Subcommand

move-share Subcommand

remove-share Subcommand

set-share Subcommand

enable Subcommand

disable Subcommand

start Subcommand

stop Subcommand

share Subcommand

unshare Subcommand

-h Feature

sharectl Command

set Subcommand

get Subcommand

status Subcommand

share Command

Non-File-System-Specific share Options

NFS-Specific share Options

Setting Access Lists With the share Command

unshare Command

shareall Command

unshareall Command

showmount Command

setmnt Command

nfsref Command

Commands for Troubleshooting NFS Problems

nfsstat Command

pstack Command

rpcinfo Command

snoop Command

truss Command

NFS Over RDMA

How the NFS Service Works

Version Negotiation in NFS

Features in NFS Version 4

Unsharing and Resharing a File System in NFS Version 4

File-System Namespace in NFS Version 4

Volatile File Handles in NFS Version 4

Client Recovery in NFS Version 4

OPEN Share Support in NFS Version 4

Delegation in NFS Version 4

ACLs and nfsmapid in NFS Version 4

UDP and TCP Negotiation

File Transfer Size Negotiation

How File Systems Are Mounted

Effects of the -public Option and NFS URLs When Mounting

Client-Side Failover

Failover Terminology

What Is a Replicated File System?

Failover and NFS Locking

Client-Side Failover in NFS Version 4

Large Files

How NFS Server Logging Works

How the WebNFS Service Works

How WebNFS Security Negotiation Works

WebNFS Limitations With Web Browser Use

Secure NFS System

Secure RPC

DH Authentication

KERB Authentication

Using Secure RPC With NFS

How Mirrormounts Work

When to Use Mirrormounts

Mounting a File System Using Mirrormounts

Unmounting a File System Using Mirrormounts

How NFS Referrals Work

When to Use NFS Referrals?

Creating an NFS Referral

Removing an NFS Referral

Autofs Maps

Master Autofs Map

Mount Point /home

Mount Point /net

Direct Autofs Maps

Mount Point /-

Indirect Autofs Maps

How Autofs Works

How Autofs Navigates Through the Network (Maps)

How Autofs Starts the Navigation Process (Master Map)

Autofs Mount Process

Simple Autofs Mount

Hierarchical Mounting

Autofs Unmounting

How Autofs Selects the Nearest Read-Only Files for Clients (Multiple Locations)

Autofs and Weighting

Variables in a Map Entry

Maps That Refer to Other Maps

Executable Autofs Maps

Modifying How Autofs Navigates the Network (Modifying Maps)

Default Autofs Behavior With Name Services

Autofs Reference

Autofs and Metacharacters

Ampersand (&)

Asterisk (*)

Autofs and Special Characters

Part III SLP Topics

7.  SLP (Overview)

8.  Planning and Enabling SLP (Tasks)

9.  Administering SLP (Tasks)

10.  Incorporating Legacy Services

11.  SLP (Reference)

Part IV Mail Services Topics

12.  Mail Services (Overview)

13.  Mail Services (Tasks)

14.  Mail Services (Reference)

Part V Serial Networking Topics

15.  Solaris PPP 4.0 (Overview)

16.  Planning for the PPP Link (Tasks)

17.  Setting Up a Dial-up PPP Link (Tasks)

18.  Setting Up a Leased-Line PPP Link (Tasks)

19.  Setting Up PPP Authentication (Tasks)

20.  Setting Up a PPPoE Tunnel (Tasks)

21.  Fixing Common PPP Problems (Tasks)

22.  Solaris PPP 4.0 (Reference)

23.  Migrating From Asynchronous Solaris PPP to Solaris PPP 4.0 (Tasks)

24.  UUCP (Overview)

25.  Administering UUCP (Tasks)

26.  UUCP (Reference)

Part VI Working With Remote Systems Topics

27.  Working With Remote Systems (Overview)

28.  Administering the FTP Server (Tasks)

29.  Accessing Remote Systems (Tasks)

Part VII Monitoring Network Services Topics

30.  Monitoring Network Performance (Tasks)

Glossary

Index

NFS Commands

These commands must be run as root to be fully effective, but requests for information can be made by all users:

automount Command

This command installs autofs mount points and associates the information in the automaster files with each mount point. The syntax of the command is as follows:

automount [ -t duration ] [ -v ]

-t duration sets the time, in seconds, that a file system is to remain mounted, and -v selects the verbose mode. Running this command in the verbose mode allows for easier troubleshooting.

If not specifically set, the value for duration is set to 5 minutes. In most circumstances, this value is good. However, on systems that have many automounted file systems, you might need to increase the duration value. In particular, if a server has many users active, checking the automounted file systems every 5 minutes can be inefficient. Checking the autofs file systems every 1800 seconds, which is 30 minutes, could be more optimal. By not unmounting the file systems every 5 minutes, /etc/mnttab can become large. To reduce the output when df checks each entry in /etc/mnttab, you can filter the output from df by using the -F option (see the df(1M) man page) or by using egrep.

You should consider that adjusting the duration also changes how quickly changes to the automounter maps are reflected. Changes cannot be seen until the file system is unmounted. Refer to Modifying the Maps for instructions on how to modify automounter maps.

The same specifications you would make on the command line can be made using the sharectl command. However, unlike the command line options, the SMF repository preserves your specifications, through service restarts, system reboots, as well as system upgrades. These are the parameters that can be set for the automount command.

timeout

Sets the duration for a file system to remain idle before the file system is unmounted. This keyword is the equivalent of the -t argument for the automount command. The default value is 600.

automount_verbose

Provides notification of autofs mounts, unmounts, and other nonessential events. This keyword is the equivalent of the -v argument for automount. The default value is FALSE.

clear_locks Command

This command enables you to remove all file, record, and share locks for an NFS client. You must be root to run this command. From an NFS server, you can clear the locks for a specific client. From an NFS client, you can clear locks for that client on a specific server. The following example would clear the locks for the NFS client that is named tulip on the current system.

# clear_locks tulip

Using the -s option enables you to specify which NFS host to clear the locks from. You must run this option from the NFS client, which created the locks. In this situation, the locks from the client would be removed from the NFS server that is named bee.

# clear_locks -s bee

Caution

Caution - This command should only be run when a client crashes and cannot clear its locks. To avoid data corruption problems, do not clear locks for an active client.


fsstat Command

The fsstat utility enables you to monitor file system operations by file system type and by mount point. Various options allow you to customize the output. See the following examples.

This example shows output for NFS version 3, version 4, and the root mount point.

% fsstat nfs3 nfs4 /
  new     name   name    attr    attr   lookup   rddir   read   read   write   write
 file    remov   chng     get     set      ops     ops    ops  bytes     ops   bytes
3.81K       90  3.65K   5.89M   11.9K    35.5M   26.6K   109K   118M   35.0K   8.16G  nfs3
  759      503    457   93.6K   1.44K     454K   8.82K  65.4K   827M     292    223K  nfs4
25.2K    18.1K  1.12K   54.7M    1017     259M   1.76M  22.4M  20.1G   1.43M   3.77G  /

This example uses the -i option to provide statistics about the I/O operations for NFS version 3, version 4, and the root mount point.

% fsstat -i nfs3 nfs4 /
 read    read    write   write   rddir   rddir   rwlock   rwulock
  ops   bytes      ops   bytes     ops   bytes      ops       ops
 109K    118M    35.0K   8.16G   26.6K   4.45M     170K      170K  nfs3
65.4K    827M      292    223K   8.82K   2.62M    74.1K     74.1K  nfs4
22.4M   20.1G    1.43M   3.77G   1.76M   3.29G    25.5M     25.5M  /

This example uses the -n option to provide statistics about the naming operations for NFS version 3, version 4, and the root mount point.

% fsstat -n nfs3 nfs4 /
lookup   creat   remov  link   renam  mkdir  rmdir   rddir  symlnk  rdlnk
 35.5M   3.79K      90     2   3.64K      5      0   26.6K      11   136K  nfs3
  454K     403     503     0     101      0      0   8.82K     356  1.20K  nfs4
  259M   25.2K   18.1K   114    1017     10      2   1.76M      12  8.23M  /

For more information, see the fsstat(1M) man page.

mount Command

With this command, you can attach a named file system, either local or remote, to a specified mount point. For more information, see the mount(1M) man page. Used without arguments, mount displays a list of file systems that are currently mounted on your computer.

Many types of file systems are included in the standard Oracle Solaris installation. Each file-system type has a specific man page that lists the options to mount that are appropriate for that file-system type. The man page for NFS file systems is mount_nfs(1M). For UFS file systems, see mount_ufs(1M).

The Solaris 7 release includes the ability to select a path name to mount from an NFS server by using an NFS URL instead of the standard server:/pathname syntax. See How to Mount an NFS File System Using an NFS URL for further information.


Caution

Caution - The version of the mount command does not warn about invalid options. The command silently ignores any options that cannot be interpreted. Ensure that you verify all of the options that were used so that you can prevent unexpected behavior.


mount Options for NFS File Systems

The subsequent text lists some of the options that can follow the -o flag when you are mounting an NFS file system. For a complete list of options, refer to the mount_nfs(1M) man page.

bg|fg

These options can be used to select the retry behavior if a mount fails. The bg option causes the mount attempts to be run in the background. The fg option causes the mount attempt to be run in the foreground. The default is fg, which is the best selection for file systems that must be available. This option prevents further processing until the mount is complete. bg is a good selection for noncritical file systems because the client can do other processing while waiting for the mount request to be completed.

forcedirectio

This option improves performance of large sequential data transfers. Data is copied directly to a user buffer. No caching is performed in the kernel on the client. This option is off by default.

Previously, all write requests were serialized by both the NFS client and the NFS server. The NFS client has been modified to permit an application to issue concurrent writes, as well as concurrent reads and writes, to a single file. You can enable this functionality on the client by using the forcedirectio mount option. When you use this option, you are enabling this functionality for all files within the mounted file system. You could also enable this functionality on a single file on the client by using the directio() interface. Unless this functionality has been enabled, writes to files are serialized. Also, if concurrent writes or concurrent reads and writes are occurring, then POSIX semantics are no longer being supported for that file.

For an example of how to use this option, refer to Using the mount Command.

largefiles

With this option, you can access files that are larger than 2 Gbytes. Whether a large file can be accessed can only be controlled on the server, so this option is silently ignored on NFS version 3 mounts. By default, all UFS file systems are mounted with largefiles. For mounts that use the NFS version 2 protocol, the largefiles option causes the mount to fail with an error.

nolargefiles

This option for UFS mounts guarantees that no large files can exist on the file system. See the mount_ufs(1M) man page. Because the existence of large files can only be controlled on the NFS server, no option for nolargefiles exists when using NFS mounts. Attempts to NFS-mount a file system by using this option are rejected with an error.

nosuid|suid

The nosuid option is the equivalent of specifying the nodevices option with the nosetuid option. When the nodevices option is specified, the opening of device-special files on the mounted file system is disallowed. When the nosetuid option is specified, the setuid bit and setgid bit in binary files that are located in the file system are ignored. The processes run with the privileges of the user who executes the binary file.

The suid option is the equivalent of specifying the devices option with the setuid option. When the devices option is specified, the opening of device-special files on the mounted file system is allowed. When the setuid option is specified, the setuid bit and the setgid bit in binary files that are located in the file system are honored by the kernel.

If neither option is specified, the default option is suid, which provides the default behavior of specifying the devices option with the setuid option.

The following table describes the effect of combining nosuid or suid with devices or nodevices, and setuid or nosetuid. Note that in each combination of options, the most restrictive option determines the behavior.

Behavior From the Combined Options
Option
Option
Option
The equivalent of nosetuid with nodevices
nosuid
nosetuid
nodevices
The equivalent of nosetuid with nodevices
nosuid
nosetuid
devices
The equivalent of nosetuid with nodevices
nosuid
setuid
nodevices
The equivalent of nosetuid with nodevices
nosuid
setuid
devices
The equivalent of nosetuid with nodevices
suid
nosetuid
nodevices
The equivalent of nosetuid with devices
suid
nosetuid
devices
The equivalent of setuid with nodevices
suid
setuid
nodevices
The equivalent of setuid with devices
suid
setuid
devices

The nosuid option provides additional security for NFS clients that access potentially untrusted servers. The mounting of remote file systems with this option reduces the chance of privilege escalation through importing untrusted devices or importing untrusted setuid binary files. All these options are available in all Oracle Solaris file systems.

public

This option forces the use of the public file handle when contacting the NFS server. If the public file handle is supported by the server, the mounting operation is faster because the MOUNT protocol is not used. Also, because the MOUNT protocol is not used, the public option allows mounting to occur through a firewall.

rw|ro

The -rw and -ro options indicate whether a file system is to be mounted read-write or read-only. The default is read-write, which is the appropriate option for remote home directories, mail-spooling directories, or other file systems that need to be changed by users. The read-only option is appropriate for directories that should not be changed by users. For example, shared copies of the man pages should not be writable by users.

sec=mode

You can use this option to specify the authentication mechanism to be used during the mount transaction. The value for mode can be one of the following.

  • Use krb5 for Kerberos version 5 authentication service.

  • Use krb5i for Kerberos version 5 with integrity.

  • Use krb5p for Kerberos version 5 with privacy.

  • Use none for no authentication.

  • Use dh for Diffie-Hellman (DH) authentication.

  • Use sys for standard UNIX authentication.

The modes are also defined in /etc/nfssec.conf.

soft|hard

An NFS file system that is mounted with the soft option returns an error if the server does not respond. The hard option causes the mount to continue to retry until the server responds. The default is hard, which should be used for most file systems. Applications frequently do not check return values from soft-mounted file systems, which can make the application fail or can lead to corrupted files. If the application does check the return values, routing problems and other conditions can still confuse the application or lead to file corruption if the soft option is used. In most situations, the soft option should not be used. If a file system is mounted by using the hard option and becomes unavailable, an application that uses this file system hangs until the file system becomes available.

Using the mount Command

Refer to the following examples.

umount Command

This command enables you to remove a remote file system that is currently mounted. The umount command supports the -V option to allow for testing. You might also use the -a option to unmount several file systems at one time. If mount-points are included with the -a option, those file systems are unmounted. If no mount points are included, an attempt is made to unmount all file systems that are listed in /etc/mnttab except for the “required” file systems, such as /, /usr, /var, /proc, /dev/fd, and /tmp. Because the file system is already mounted and should have an entry in /etc/mnttab, you do not need to include a flag for the file-system type.

The -f option forces a busy file system to be unmounted. You can use this option to unhang a client that is hung while trying to mount an unmountable file system.


Caution

Caution - By forcing an unmount of a file system, you can cause data loss if files are being written to.


See the following examples.

Example 6-1 Unmounting a File System

This example unmounts a file system that is mounted on /usr/man:

# umount /usr/man

Example 6-2 Using Options with umount

This example displays the results of running umount -a -V:

# umount -a -V
umount /home/kathys
umount /opt
umount /home
umount /net

Notice that this command does not actually unmount the file systems.

mountall Command

Use this command to mount all file systems or a specific group of file systems that are listed in a file-system table. The command provides a way of doing the following:

Because all file systems that are labeled as NFS file-system type are remote file systems, some of these options are redundant. For more information, see the mountall(1M) man page.

Note that the following two examples of user input are equivalent:

# mountall -F nfs
# mountall -F nfs -r

umountall Command

Use this command to unmount a group of file systems. The -k option runs the fuser -k mount-point command to kill any processes that are associated with the mount-point. The -s option indicates that unmount is not to be performed in parallel. -l specifies that only local file systems are to be used, and -r specifies that only remote file systems are to be used. The -h host option indicates that all file systems from the named host should be unmounted. You cannot combine the -h option with -l or -r.

The following is an example of unmounting all file systems that are mounted from remote hosts:

# umountall -r

The following is an example of unmounting all file systems that are currently mounted from the server bee:

# umountall -h bee

sharemgr Command

This release includes the sharemgr utility, which is an administrative tool that provides an enhanced method of sharing files and performing related tasks. Previously, such tasks were accomplished by adding entries to the /etc/dfs/dfstab file and using the share command to create a temporary share. You made the share permanent by rebooting the system or using the shareall command. Related administrative tasks necessitated that you manually edit configuration files. The sharemgr utility simplifies this process by introducing two concepts:

The sharemgr utility accomplishes different tasks by using subcommands. Options and their related properties can be used with each subcommand. The utility uses the following syntax:

# sharemgr [subcommand] [option] [share_group]

Note - The sharemgr utility provides a unique way of checking the validity of a desired configuration. The -n option allows you to test the validity of the options and properties you want to use with a specific subcommand. The test does not change your configuration. For example, if you use the -n option with the subcommand create, no share group is created.


The following tables describes the subcommands supported by the sharemgr utility.

Table 6-2 Subcommands Supported by sharemgr

Subcommand
Description
Makes (or creates) a new share group
Removes a share group
Lists the current share groups
Lists the shares by share group
Sets a share group's properties, including the group's security property
Removes (or unsets) properties from a share group
Adds a new share to a share group
Moves a share from one share group to another
Removes a share from a share group
Updates the properties associated with a share
Unshares one or more share groups
Shares one or more share groups
Used by the smf utility to share one or more share groups
Used by the smf utility to unshare one or more share groups
Share a path to the default group
Unshare a path to the default group
Provides online-help descriptions of sharemgr and its subcommands and options, and shows the syntax to use

The following table describes the properties supported by the sharemgr utility.

Table 6-3 Properties Supported by sharemgr Utility

Property
Value
Description
aclok
boolean
Enable access control lists (ACL) for NFS version 2.
anon
UID
Specify the User ID for unknown users.
index
file path
Include the specified file in a content list for a directory.
log
tag
Specify a tag for NFS server logging. Note that these tags are defined in the /etc/nfs/nfslog.conf file.
nosub
boolean
Disallow clients from mounting subdirectories of shares.
nosuid
boolean
Disallow the use of the setuid() and setgid() functions.
public
boolean
Move the location of a public file handle from root to an exported directory for WebNFS-enabled browsers and clients. Only one file system (or share) on each server can use this property. This property is not accepted by a share group. For more information, see share_nfs(1M) man page.
ro
access-list, boolean, or an asterisk (*)
If the property is set to an access-list, permissions for the list are set to read-only. For information about access lists, see the share_nfs(1M) man page.

If you set the property to no value or true, permissions for the share group are set to read-only.

If you set the property to an asterisk (*), permissions for all hosts are set to read-only.


Note - To use this property, you must use the -S option to set the security mode. For more information about setting a security mode, see set Subcommand.


root
access-list or an asterisk (*)
If the property is set to an access-list, permissions for the list are set to root access. For information about access-lists, see the share_nfs(1M) man page.

If you set the property to an asterisk (*), all hosts have root access.


Note - To use this property, you must use the -S option to set the security mode. For more information about setting a security mode, see set Subcommand.


rw
access-list, boolean, or an asterisk (*)
If the property is set to an access-list, permissions for the list are set to read-write. For information about access-lists, see the share_nfs(1M) man page.

If you set the property to no value or true, permissions for the share group are set to read-write.

If you set the property to an asterisk (*), permissions for all hosts are set to read-write.


Note - To use this property, you must use the -S option to set the security mode. For more information about setting a security mode, see set Subcommand.


window
integer
For the dh security mode, set the number of seconds a credential is available.

Note - To use this property, you must use the -S option to set the security mode. For more information about setting a security mode, see set Subcommand.



Note - sharemgr and sharectl are the preferred utilities for managing your file systems and file-sharing protocols.


For procedures that use the sharemgr utility, see the following:

Also, see the sharemgr(1M) man page.

The sharectl utility is an administrative tool that enables you to configure and manage file-sharing protocols, such as NFS. For more information, see the following:

The sections that follow describe each subcommand for sharemgr and provide examples.

create Subcommand

The create subcommand makes (or creates) a share group. After you create a share group, use the add-share subcommand to add shares to the group. Note the following:

This subcommand supports the following options:

-n

Checks the validity of a desired configuration.

-P

Specifies a file-system type. The default is NFS.

-p

Specifies a property for the new share group.

-h

Provides an online-help description.

The create subcommand uses the following syntax:

# sharemgr create [-h] [-n] [-P protocol] [-p property=value] share_group

The following example creates my_group with the following parameters:

example# sharemgr create -P nfs -p rw=true -p nosuid=true my_group
delete Subcommand

This subcommand removes a share group. Before using this option, use the remove-share subcommand to delete all shares from the group. Alternately, use the -f option with this subcommand to force the removal of a group that might still contain shares. The -f option unshares and removes all shares from the share group, so the share group can be removed.

To remove a protocol from a share group, use the -P option. Note that when using the -P option, the share group is not removed. Only the protocol is removed from the group.

This subcommand supports the following options:

-n

Checks the validity of command-line string

-f

Forces a share group to be removed

-P

Specifies a file-system type to be removed from the group

-h

Provides an online-help description

This subcommand uses the following syntax:

# sharemgr delete [-h] [-n] [-f] [-P protocol] share_group
list Subcommand

This subcommand provides a list of current share groups. You can customize the output by using various options with this subcommand.

This subcommand supports the following options:

-P

Enables you to see a list of groups that use a specific file-system type.

-v

Is the verbose option and provides the following:

  • Group name

  • Status of the group, specifically whether the group is enabled or disabled

  • File-system type used by the group

-h

Provides an online-help description.

This subcommand uses the following syntax:

# sharemgr list [-h] [-P protocol] [-v]

The following example shows the output for the -v option:

example# sharemgr list -v
group01   enabled    nfs
group02   disabled   nfs
show Subcommand

This subcommand provides a list of shares by group. By specifying one or more share groups, you can limit the output to a list of shares in the specified groups. If no groups are specified, the list shows the shares in each group.

This subcommand supports the following options:

-p

Shows you the properties assigned to each group.

-v

Is the verbose option. If included, the verbose option provides the resource name and descriptions of each share.

-x

Creates an XML file for the output. Because this option automatically includes the information you would get from the -p and -v options, no other options are needed when you use this option.

-h

Provides an online-help description.

This subcommand uses the following syntax:

# sharemgr show [-h] [-v] [-p] [-x] [share_group...]

The following example uses the -p option to show the shares and group properties for my_group:

example01# sharemgr show -p my_group
my_group    nfs=(rw=true nosuid=true)
    /export/home/home0
    /export/home/home1

The next example uses the -v option to show the shares in my_group and their descriptions:

example02# sharemgr show -v my_group
my_group
    HOME0=/export/home/home0    "Home directory set 0"
    HOME1=/export/home/home1    "Home directory set 1"
set Subcommand

This subcommand sets properties to a share group. Note the following conditions:

A group can be associated with more than one protocol and can have different properties for each protocol.

This subcommand supports the following options:

-n

Checks the validity of the command-line string.

-P

Specifies a file-system type.

-p

Specifies a property for the share group.

-S

Specifies the security mode, such as sys, dh, or krb5. For more information about security modes, see the nfssec(5) man page.

-s

Specifies the path to the share, which is a file or a directory.

-h

Provides an online-help description.

This subcommand uses the following syntax:

# sharemgr set [-h] [-n] [-P protocol] [-s share-path] [-S security-mode] [-p property=value] share_group

The following example sets the user ID for unknown users in my_group to 1234546:

example01# sharemgr set -p anon=123456 my_group

In the next example, the following occurs:

example02# sharemgr create -P nfs -p rw=true -p nosuid=true my_group    
example02# sharemgr set -P nfs -p nosuid=false my_group
unset Subcommand

This subcommand removes (or unsets) properties from a share group.

This subcommand supports the following options:

-n

Checks the validity of the command-line string

-P

Specifies the protocol associated with the properties being removed from the group

-p

Specifies the property to be removed from the share group

-s

Specifies the path to the share, which is a file or a directory.

-h

Provides an online-help description

This subcommand uses the following syntax:

# sharemgr unset [-h] [-n] -P protocol [-s share-path] [-p property] share_group
add-share Subcommand

After creating a share group, use this subcommand to add shares to the group. A share is a path to a file or a directory. Note that a share can exist in one group only. If you try to add a share to another group, you will get an error message.

This subcommand supports the following options:

-n

Checks the validity of the command-line string.

-s

Specifies the path to the share, which is a file or a directory.

-t

Specifies that the share is transient. Transient shares are automatically removed from the group when you reboot the system or use the disable or stop subcommands.

-d

Adds descriptive text about the share.

-r

Assigns the share a resource name that identifies the share. Note that the resource name only uses alphanumeric characters, the hyphen (-), and the underscore (_). The first character in the name must be alphabetic.

-h

Provides an online-help description.

This subcommand uses the following syntax:

# sharemgr add-share [-h] [-n] -s share-path [-t] [-d description] [-r resource-name] share_group

The following example adds the shares /export/home/home0 and /export/home/home1 to my_group.

example# sharemgr add-share -s /export/home/home0 my_group
example# sharemgr add-share -s /export/home/home1 my_group
move-share Subcommand

Use this subcommand to move a share from one group to another.

This subcommand supports the following options:

-n

Checks the validity of the command-line string

-s

Specifies the path to the share, which is a file or a directory

-h

Provides an online-help description

This subcommand uses the following syntax:

# sharemgr move-share [-h] [-n] -s share-path share_group

The following example shows a share that was added to my_group and then moved to your_group.

example# sharemgr add-share -s /export/home/home0 my_group
example# sharemgr move-share -s /export/home/home0 your_group
remove-share Subcommand

Use this subcommand to remove a share from a share group.

This subcommand supports the following options:

-n

Checks the validity of the command-line string

-s

Specifies the path to the share, which is a file or a directory

-h

Provides an online-help description

This subcommand uses the following syntax:

# sharemgr remove-share [-h] [-n] -s share-path share_group

The following example removes the share /export/home/home0 from my_group.

example# sharemgr remove-share -s /export/home/home0 my_group
set-share Subcommand

Use this subcommand to change the properties associated with a share. Currently, you can use this subcommand to change the descriptive text associated with a specific share.

This subcommand supports the following options:

-n

Checks the validity of the command-line string.

-s

Specifies the path to the share, which is a file or a directory.

-d

Adds descriptive text about the share.

-r

Assigns the share a resource name that identifies the share. Note that the resource name only uses alphanumeric characters, the hyphen (-), and the underscore (_). The first character in the name must be alphabetic.

-h

Provides an online-help description.

This subcommand uses the following syntax:

# sharemgr set-share [-h] [-n] -s share-path [-d description] [-r resource-name] share_group

The following example shows how a description is changed.

example# sharemgr add-share -s /export/home/home0 -d "original text" my_group
example# sharemgr set-share -s /export/home/home0 -d "new text" my_group
enable Subcommand

Use this subcommand to share (or enable) the shares in the groups that you specify. Note that the groups you create are enabled by default. You must use this subcommand to enable a group that has previously been disabled with the disable subcommand.


Note - If you specify a protocol, only the groups that are associated with that protocol are enabled.


This subcommand supports the following options:

-a

Specifies all groups

-n

Checks the validity of the command-line string

-P

Specifies a file-system type

-h

Provides an online-help description

This subcommand uses the following syntax:

# sharemgr enable [-h] [-n] [-P protocol] [share_group | -a]

The following example shares (or enables) the shares in all groups that use NFS.

example01# sharemgr enable -P NFS -a

In this next example, all shares in my_group are shared (or enabled).

example02# sharemgr enable my_group
disable Subcommand

Use this subcommand to unshare (or disable) the shares in the groups that you specify. This subcommand can be reversed by using the enable subcommand.


Note - If you specify a protocol, only the groups that are associated with that protocol are disabled.


This subcommand supports the following options:

-a

Specifies all groups

-n

Checks the validity of the command-line string

-P

Specifies a file-system type

-h

Provides an online-help description

This subcommand uses the following syntax:

# sharemgr disable [-h] [-P protocol] [share_group | -a]

The following example unshares (or disables) the shares in all groups that use NFS.

example01# sharemgr disable -P NFS -a

In this next example, all shares in my_group are unshared (or disabled).

example02# sharemgr disable my_group
start Subcommand

This subcommand is similar to the enable subcommand with these distinctions:

This subcommand supports the following options:

-a

Specifies all groups

-h

Provides an online-help description

Table 6-4 Two Ways to Start a Share Group

Using the start Subcommand
Using the svcadm Command
The start subcommand uses the following syntax:
# sharemgr start [-h] [share-group | -a]

The following example enables the shares in all groups to start sharing.

# sharemgr start -a
The svcadm command uses the following syntax:
# svcadm start network/shares/group:share-group

The following example enables the shares in my-group to start sharing.

# svcadm start network/shares/group:my-group
stop Subcommand

This subcommand is similar to the disable subcommand with these distinctions:

This subcommand supports the following options:

-a

Specifies all groups

-h

Provides an online-help description

Table 6-5 Two Ways to Stop a Share Group

Using the stop Subcommand
Using the svcadm Command
The stop subcommand uses the following syntax:
# sharemgr stop [-h] [share-group | -a]

The following example unshares the shares in all groups.

# sharemgr stop -a
The svcadm command uses the following syntax:
# svcadm stop network/shares/group:share-group

The following example unshares the shares in my-group.

# svcadm stop network/shares/group:my-group
share Subcommand

Use this subcommand to share a path in the default share group. The default action is for file systems that are shared with this subcommand are transient shares so they will not be retained after a reboot. This subcommand uses the same options as the share command. See share Command or the share(1M)

This subcommand supports the following options:

-p

Specifies that the share will be persistent

This subcommand uses the following syntax:

# sharemgr share [-F fstype] [-p] [-o optionlist] [-d description] [pathname [resourcename]]
unshare Subcommand

Use this subcommand to unshare a path in the default share group. The default action is for file systems that are unshared with this subcommand are transient. That is, the file system will be shared when the system is rebooted. This subcommand uses the same options as the unshare command. See unshare Command or the unshare(1M)

This subcommand supports the following options:

-p

Specifies that the unshare will be persistent

This subcommand uses the following syntax:

# sharemgr unshare [-F fstype] [-p] [-o optionlist] sharepath
-h Feature

The sharemgr utility has an online help feature that describes sharemgr and its subcommands and options, and shows proper syntax. For online help, use -h.

This feature uses the following syntax:

# sharemgr [subcommand] -h

The following example uses -h to provide a complete description of the sharemgr utility.

example01# sharemgr -h
USAGE: # sharemgr [subcommand] [option] [share_group]

DESCRIPTION: Configures and manages file sharing

SUBCOMMANDS:
create        Makes (or creates) a new share group
delete        Removes a share group
list          Lists the current share groups
show          Lists the shares by share group
set           Sets a share group's properties
unset         Removes (or unsets) properties from a share group
add-share     Adds a new share to a share group
move-share    Moves a share from one share group to another
remove-share  Removes a share from a share group
set-share     Updates the properties associated with a share
disable       Unshares one or more share groups
enable        Shares one or more share groups
start         Used by the smf utility to share one or more share groups
stop          Used by the smf utility to unshare one or more share groups
-h            Online-help feature

SEE ALSO:
sharemgr(1M) man page
System Administration Guide: Network Services

This next example uses -h to provide information about the set subcommand.

example02# sharemgr set -h
USAGE: # sharemgr set [-h] [-n] [-P protocol] [-S security-mode] [-p property=value] share_group

DESCRIPTION: Sets a share group's properties

OPTIONS:
-h  Online-help feature
-n  Checks the validity of the command-line string
-P  Specifies a file-system type.
-p  Specifies a property for the share group.
-S  Specifies the security mode, such as sys, dh, or krb5

PROPERTIES:
aclok={true|false}        Enable access control lists (ACL) for NFS version 2.
anon=UID                  Specify the User ID for unknown users.
index=file path           Include the specified file in a content list for a directory.
log=tag                   Specify a tag to use for log messages.
nosub={true|false}        Disallow clients from mounting subdirectories of shares.
nosuid={true|false}       Disallow the use of the setuid() and setgid() functions.
ro={access-list|true|*}   If ro is set to an access-list, permissions for the list
                          are read-only. If ro is set to no value or to true, 
                          permissions for the share group are read-only. If ro
                          is set to an asterisk (*), permissions for all hosts
                          are set to read-only.
root={access-list|*}      If root  is set to an access-list, permissions for the
                          list are set to allow root access. If root is set to
                          an asterisk (*), all hosts have root access.
rw={access-list|true|*}   If rw is set to an access list, permissions for the list
                          are set to read-write. If rw is set to no value or to 
                          true, permissions for the share group are set to 
                          read-write. If rw is set to an asterisk (*), permissions
                          for all hosts are set to read-write.
window=integer            For the dh security mode, set the number of seconds a
                          credential is available.

SEE ALSO:
sharemgr(1M) man page
System Administration Guide: Network Services
nfssec(5) man page for more information about security modes

For help, you can also refer to the sharemgr(1M) man page.

sharectl Command

This release includes the sharectl utility, which is an administrative tool that enables you to configure and manage file-sharing protocols, such as NFS. You can use this command to do the following:

The sharectl utility uses the following syntax:

# sharectl subcommand [option] [protocol]

The sharectl utility supports the following subcommands:

Table 6-6 Subcommands for sharectl Utility

Subcommand
Description
set
Defines the properties for a file-sharing protocol. For a list of properties and property values, see the parameters described in the nfs(4) man page.
get
Displays the properties and property values for the specified protocol.
status
Displays whether the specified protocol is enabled or disabled. If no protocol is specified, the status of all file-sharing protocols is displayed.

Note - sharemgr and sharectl are the preferred utilities for managing your file systems and file-sharing protocols.


For more information about the sharectl utility, see the following:

For information about the sharemgr utility, see the following:

set Subcommand

The set subcommand, which defines the properties for a file-sharing protocol, supports the following options:

-h

Provides an online-help description

-p

Defines a property for the protocol

The set subcommand uses the following syntax:

# sharectl set [-h] [-p property=value] protocol

Note - The following:


The following example sets the minimum version of the NFS protocol for the client to 3:

# sharectl set -p nfs_client_versmin=3 nfs
get Subcommand

The get subcommand, which displays the properties and property values for the specified protocol, supports the following options:

-h

Provides an online-help description.

-p

Identifies the property value for the specified property. If the -p option is not used, all property values are displayed.

The get subcommand uses the following syntax:

# sharectl get [-h] [-p property] protocol

Note - You must have root privileges to use the get subcommand.


The following example uses nfsd_servers, which is the property that enables you to specify the maximum number of concurrent NFS requests:

# sharectl get -p nfsd_servers nfs
nfsd_servers=16

In the following example, because the -p option is not used, all property values are displayed:

# sharectl get nfs
listen_backlog=32
protocol=ALL
servers=32
lockd_listen_backlog=32
lockd_servers=20
lockd_retransmit_timeout=5
grace_period=90
nfsmapid_domain=company.com
server_versmin=2
server_versmax=4
client_versmin=2
client_versmax=4
max_connections=-1
status Subcommand

The status subcommand, which displays whether the specified protocol is enabled or disabled, supports the following option:

-h

Provides an online-help description

The status subcommand uses the following syntax:

# sharectl status [-h] [protocol]

The following example shows the status of the NFS protocol:

# sharectl status nfs
nfs       enabled

share Command


Note - The sharemgr and sharectl are the preferred utilities for managing your file systems and file-sharing protocols. See sharemgr Command and sharectl Command


With this command, you can make a local file system on an NFS server available for mounting. You can also use the share command to display a list of the file systems on your system that are currently shared. The NFS server must be running for the share command to work. The NFS server software is started automatically during boot if an entry is in /etc/dfs/dfstab. The command does not report an error if the NFS server software is not running, so you must verify that the software is running.

The objects that can be shared include any directory tree. However, each file system hierarchy is limited by the disk slice or partition that the file system is located on. For instance, sharing the root (/) file system would not also share /usr, unless these directories are on the same disk partition or slice. Normal installation places root on slice 0 and /usr on slice 6. Also, sharing /usr would not share any other local disk partitions that are mounted on subdirectories of /usr.

A file system cannot be shared if that file system is part of a larger file system that is already being shared. For example, if /usr and /usr/local are on one disk slice, /usr can be shared or /usr/local can be shared. However, if both directories need to be shared with different share options, /usr/local must be moved to a separate disk slice.

You can gain access to a file system that is read-only shared through the file handle of a file system that is read-write shared. However, the two file systems have to be on the same disk slice. You can create a more secure situation. Place those file systems that need to be read-write on a separate partition or separate disk slice from the file systems that you need to share as read-only.


Note - For information about how NFS version 4 functions when a file system is unshared and then reshared, refer to Unsharing and Resharing a File System in NFS Version 4.


Non-File-System-Specific share Options

Some of the options that you can include with the -o flag are as follows.

rw|ro

The pathname file system is shared read-write or read-only for all clients.

rw=accesslist

The file system is shared read-write for the clients that are listed only. All other requests are denied. Starting with the Solaris 2.6 release, the list of clients that are defined in accesslist has been expanded. See Setting Access Lists With the share Command for more information. You can use this option to override an -ro option.

NFS-Specific share Options

The options that you can use with NFS file systems include the following.

aclok

This option enables an NFS server that supports the NFS version 2 protocol to be configured to do access control for NFS version 2 clients. Without this option, all clients are given minimal access. With this option, the clients have maximal access. For instance, on file systems that are shared with the -aclok option, if anyone has read permissions, everyone does. However, without this option, you can deny access to a client who should have access permissions. A decision to permit too much access or too little access depends on the security systems already in place. See Using Access Control Lists to Protect UFS Files in System Administration Guide: Security Services for more information about access control lists (ACLs).


Note - To use ACLs, ensure that clients and servers run software that supports the NFS version 3 and NFS_ACL protocols. If the software only supports the NFS version 3 protocol, clients obtain correct access but cannot manipulate the ACLs. If the software supports the NFS_ACL protocol, the clients obtain correct access and can manipulate the ACLs.


anon=uid

You use uid to select the user ID of unauthenticated users. If you set uid to -1, the server denies access to unauthenticated users. You can grant root access by setting anon=0, but this option allows unauthenticated users to have root access, so use the root option instead.

index=filename

When a user accesses an NFS URL, the -index=filename option forces the HTML file to load, instead of displaying a list of the directory. This option mimics the action of current browsers if an index.html file is found in the directory that the HTTP URL is accessing. This option is the equivalent of setting the DirectoryIndex option for httpd. For instance, suppose that the dfstab file entry resembles the following:

share -F nfs -o ro,public,index=index.html /export/web

These URLs then display the same information:

nfs://<server>/<dir>
nfs://<server>/<dir>/index.html
nfs://<server>//export/web/<dir>
nfs://<server>//export/web/<dir>/index.html
http://<server>/<dir>
http://<server>/<dir>/index.html
log=tag

This option specifies the tag in /etc/nfs/nfslog.conf that contains the NFS server logging configuration information for a file system. This option must be selected to enable NFS server logging.

nosuid

This option signals that all attempts to enable the setuid or setgid mode should be ignored. NFS clients cannot create files with the setuid or setgid bits on.

public

The -public option has been added to the share command to enable WebNFS browsing. Only one file system on a server can be shared with this option.

root=accesslist

The server gives root access to the hosts in the list. By default, the server does not give root access to any remote hosts. If the selected security mode is anything other than -sec=sys, you can only include client host names in the accesslist. Starting with the Solaris 2.6 release, the list of clients that are defined in accesslist is expanded. See Setting Access Lists With the share Command for more information.


Caution

Caution - Granting root access to other hosts has wide security implications. Use the -root= option with extreme caution.


root=client-name

The client-name value is used with AUTH_SYS authentication to check the client's IP address against a list of addresses provided by exportfs(1B). If a match is found, root access is given to the file systems being shared.

root=host-name

For secure NFS modes, such as AUTH_SYS or RPCSEC_GSS, the server checks the clients' principal names against a list of host-based principal names that are derived from an access list. The generic syntax for the client's principal name is root@hostname. For Kerberos V the syntax is root/hostname.fully.qualified@REALM. When you use the host-name value, the clients on the access list must have the credentials for a principal name. For Kerberos V, the client must have a valid keytab entry for its root/hostname.fully.qualified@REALM principal name. For more information, see Configuring Kerberos Clients in System Administration Guide: Security Services.

sec=mode[:mode]

mode selects the security modes that are needed to obtain access to the file system. By default, the security mode is UNIX authentication. You can specify multiple modes, but use each security mode only once per command line. Each -mode option applies to any subsequent -rw, -ro, -rw=, -ro=, -root=, and -window= options until another -mode is encountered. The use of -sec=none maps all users to user nobody.

window=value

value selects the maximum lifetime in seconds of a credential on the NFS server. The default value is 30000 seconds or 8.3 hours.

Setting Access Lists With the share Command

In Solaris releases prior to 2.6, the accesslist that was included with either the -ro=, -rw=, or -root= option of the share command was restricted to a list of host names or netgroup names. Starting with the Solaris 2.6 release, the access list can also include a domain name, a subnet number, or an entry to deny access. These extensions should simplify file access control on a single server without having to change the namespace or maintain long lists of clients.

This command provides read-only access for most systems but allows read-write access for rose and lilac:

# share -F nfs -o ro,rw=rose:lilac /usr/src

In the next example, read-only access is assigned to any host in the eng netgroup. The client rose is specifically given read-write access.

# share -F nfs -o ro=eng,rw=rose /usr/src

Note - You cannot specify both rw and ro without arguments. If no read-write option is specified, the default is read-write for all clients.


To share one file system with multiple clients, you must type all options on the same line. Multiple invocations of the share command on the same object “remember” only the last command that is run. This command enables read-write access to three client systems, but only rose and tulip are given access to the file system as root.

# share -F nfs -o rw=rose:lilac:tulip,root=rose:tulip /usr/src

When sharing a file system that uses multiple authentication mechanisms, ensure that you include the -ro, -ro=, -rw, -rw=, -root, and -window options after the correct security modes. In this example, UNIX authentication is selected for all hosts in the netgroup that is named eng. These hosts can only mount the file system in read-only mode. The hosts tulip and lilac can mount the file system read-write if these hosts use Diffie-Hellman authentication. With these options, tulip and lilac can mount the file system read-only even if these hosts are not using DH authentication. However, the host names must be listed in the eng netgroup.

# share -F nfs -o sec=dh,rw=tulip:lilac,sec=sys,ro=eng /usr/src

Even though UNIX authentication is the default security mode, UNIX authentication is not included if the -sec option is used. Therefore, you must include a -sec=sys option if UNIX authentication is to be used with any other authentication mechanism.

You can use a DNS domain name in the access list by preceding the actual domain name with a dot. The string that follows the dot is a domain name, not a fully qualified host name. The following entry allows mount access to all hosts in the eng.example.com domain:

# share -F nfs -o ro=.:.eng.example.com /export/share/man

In this example, the single “.” matches all hosts that are matched through the NIS namespace. The results that are returned from these name services do not include the domain name. The “.eng.example.com” entry matches all hosts that use DNS for namespace resolution. DNS always returns a fully qualified host name. So, the longer entry is required if you use a combination of DNS and the other namespaces.

You can use a subnet number in an access list by preceding the actual network number or the network name with “@”. This character differentiates the network name from a netgroup or a fully qualified host name. You must identify the subnet in either /etc/networks or in an NIS namespace. The following entries have the same effect if the 192.168 subnet has been identified as the eng network:

# share -F nfs -o ro=@eng /export/share/man
# share -F nfs -o ro=@192.168 /export/share/man
# share -F nfs -o ro=@192.168.0.0 /export/share/man

The last two entries show that you do not need to include the full network address.

If the network prefix is not byte aligned, as with Classless Inter-Domain Routing (CIDR), the mask length can be explicitly specified on the command line. The mask length is defined by following either the network name or the network number with a slash and the number of significant bits in the prefix of the address. For example:

# share -f nfs -o ro=@eng/17 /export/share/man
# share -F nfs -o ro=@192.168.0/17 /export/share/man

In these examples, the “/17” indicates that the first 17 bits in the address are to be used as the mask. For additional information about CIDR, look up RFC 1519.

You can also select negative access by placing a “-” before the entry. Note that the entries are read from left to right. Therefore, you must place the negative access entries before the entry that the negative access entries apply to:

# share -F nfs -o ro=-rose:.eng.example.com /export/share/man

This example would allow access to any hosts in the eng.example.com domain except the host that is named rose.

unshare Command

This command allows you to make a previously available file system unavailable for mounting by clients. You can use the unshare command to unshare any file system, whether the file system was shared explicitly with the share command or automatically through /etc/dfs/dfstab. If you use the unshare command to unshare a file system that you shared through the dfstab file, be careful. Remember that the file system is shared again when you exit and reenter run level 3. You must remove the entry for this file system from the dfstab file if the change is to continue.

When you unshare an NFS file system, access from clients with existing mounts is inhibited. The file system might still be mounted on the client, but the files are not accessible.


Note - For information about how NFS version 4 functions when a file system is unshared and then reshared, refer to Unsharing and Resharing a File System in NFS Version 4.


The following is an example of unsharing a specific file system:

# unshare /usr/src

shareall Command

This command allows for multiple file systems to be shared. When used with no options, the command shares all entries in /etc/dfs/dfstab. You can include a file name to specify the name of a file that lists share command lines. If you do not include a file name, /etc/dfs/dfstab is checked. If you use a “-” to replace the file name, you can type share commands from standard input.

The following is an example of sharing all file systems that are listed in a local file:

# shareall /etc/dfs/special_dfstab

unshareall Command

This command makes all currently shared resources unavailable. The -F FSType option selects a list of file-system types that are defined in /etc/dfs/fstypes. This flag enables you to choose only certain types of file systems to be unshared. The default file-system type is defined in /etc/dfs/fstypes. To choose specific file systems, use the unshare command.

The following is an example of unsharing all NFS-type file systems:

# unshareall -F nfs

showmount Command

This command displays one of the following:


Note - The showmount command only shows NFS version 2 and version 3 exports. This command does not show NFS version 4 exports.


The command syntax is as follows:

showmount [ -ade ] [ hostname ]

-a

Prints a list of all the remote mounts. Each entry includes the client name and the directory.

-d

Prints a list of the directories that are remotely mounted by clients.

-e

Prints a list of the files that are shared or are exported.

hostname

Selects the NFS server to gather the information from.

If hostname is not specified, the local host is queried.

The following command lists all clients and the local directories that the clients have mounted:

# showmount -a bee
lilac:/export/share/man
lilac:/usr/src
rose:/usr/src
tulip:/export/share/man

The following command lists the directories that have been mounted:

# showmount -d bee
/export/share/man
/usr/src

The following command lists file systems that have been shared:

# showmount -e bee
/usr/src                                (everyone)
/export/share/man                    eng

setmnt Command

This command creates an /etc/mnttab table. The mount and umount commands consult the table. Generally, you do not have to run this command manually, as this command runs automatically when a system is booted.

nfsref Command

The nfsref command is used to add, delete or list NFSv4 referrals. The command syntax is as follows:

nfsref add path location [ location … ]

nfsref remove path

nfsref lookup path

path

Selects the name for the reparse point.

location

Identifies one or more NFS or SMB shared file systems to be associated with the reparse point.