How to configure anonymous user mapping for an NFS export

Shared NFS write areas can receive requests from clients whose local UID and GID numbers do not match the server. Anonymous user mapping makes the server treat every request for one export as the same server-side identity, so new files do not depend on each client's account database.

Linux NFS exports use all_squash to map every client UID and GID to the anonymous identity. The anonuid and anongid options set the numeric server UID and GID for that mapped access, while filesystem ownership and permissions still decide whether the mapped identity can read, write, create, or delete files.

UID and GID 65534 match the Linux NFS default anonymous ID. Use a dedicated service UID and GID instead when the export should not write as nobody or nogroup, and keep the client selector as narrow as the environment allows.

1. Open a shell on the NFS server with an account that can use sudo.
2. Set the export directory ownership and mode for the anonymous identity.

   $ sudo install -d -o 65534 -g 65534 -m 2770 /srv/nfs/projects

   The names for UID and GID 65534 can display as nobody, nogroup, or another distribution-specific name. Use numeric ownership so the export rule and filesystem permissions refer to the same server-side IDs.

3. Open the saved export definition.

   $ sudoedit /etc/exports.d/projects.exports

   Use /etc/exports instead when the server keeps all export rules in one file. Drop-in files under /etc/exports.d must end with .exports to be read by exportfs.

4. Add all_squash with the chosen anonymous UID and GID.

   /srv/nfs/projects 192.0.2.0/24(rw,sync,no_subtree_check,all_squash,anonuid=65534,anongid=65534)

   Keep no whitespace between the client selector and its option list. 192.0.2.0/24(rw,all_squash) applies the options to that subnet, while 192.0.2.0/24 (rw,all_squash) changes how exports(5) parses the rule.

5. Reload the active export table from the saved files.

   $ sudo exportfs -rv
   exporting 192.0.2.0/24:/srv/nfs/projects

   Related: How to reload NFS exports

6. Verify that the active export includes all_squash.

   $ sudo exportfs -v
   /srv/nfs/projects
   		192.0.2.0/24(sync,wdelay,hide,no_subtree_check,sec=sys,rw,root_squash,all_squash)

   exportfs may show defaults such as wdelay, hide, sec=sys, and root_squash in addition to options saved in the file. When anonuid and anongid are set to the default 65534 values, some output omits them even though the saved export line still controls the anonymous IDs.

7. Mount the export from a Linux client allowed by the selector.

   $ sudo mount -t nfs4 files.example.net:/srv/nfs/projects /mnt/projects

   Replace files.example.net with the NFS server name and use an empty local mount point. The client must match the host, subnet, wildcard, or netgroup in the export line.

   Related: How to mount an NFS export on Linux

8. Create a test file from the mounted client path.

   $ touch /mnt/projects/anonymous-map-test

   If this returns Permission denied, check the server-side directory owner, group, mode, ACLs, active all_squash option, and saved anonuid / anongid values.

9. Confirm on the server that the file belongs to the anonymous identity.

   $ sudo stat -c '%U %G %u:%g %n' /srv/nfs/projects/anonymous-map-test
   nobody nogroup 65534:65534 /srv/nfs/projects/anonymous-map-test

   A different owner or numeric ID means the client is using another export rule, the export table was not reloaded, or the file was created before the anonymous mapping was applied.

10. Remove the temporary write-test file.

    $ sudo rm /srv/nfs/projects/anonymous-map-test