Re: NFS connection dropped

Kimmo,

 > allowed. Which one is the _real_ reason for dropping the connection
 > cannot be extracted from the log message - this makes error-tracking a
 > little bit tricky...

Yes, for sure. However, Guarddog is just a GUI editor for iptables. 
iptables is responsible for the log format. I don't think the iptables 
log format is user-adjustable.


 >> STATD_PORT=4001
 >> LOCKD_TCPPORT=4002
 >> LOCKD_UDPPORT=4002
 >> MOUNTD_PORT=4003
 >
 > This makes the nfs and mountd ports to be static instead of being
 > dynamically set, right?

Yes. Actually, beware that the "/etc/sysconfig/nfs" file might be Red 
Hat specific. Check that your nfs daemon init script actually reads this 
file. It might not in Suse.


 > But, in my /etc/services the nfs (tcp/udp) is connected to 2049, mountd
 > to 763 and the following lines exist, too:
 > terabase        4000/tcp   # Terabase
...
 > pxc-roid        4004/udp   # pxc-roid
 >
 > Do I see a problem here??

Select a different arbitrary range if 4000-4004 is in use. (It wasn't on 
my Fedora system). My "nfs" port is 2049 in /etc/services, and that's 
fine, but mountd isn't listed. I'm not sure if defining mountd in 
/etc/services conflicts with the static ports defined in /etc/sysconfig/nfs.


 >> rquotad 4004/tcp # rpc.rquotad tcp port
 >> rquotad 4004/udp # rpc.rquotad udp port
 >
 > This is _not_ clear to me (see above, too). Does it have somthing to do
 > with quota and if so, why on earth should it be enabled?? AFAIK, quota
 > is not needed by nfs.

This is probably optional, since quotas are optional in NFS. Feel free 
to experiment :-)


 >> This works for me (on Fedora Core 4) - after much painful research!
 >>
 > Painful or not, but I think this should be fixed in the next release of
 > guarddog. If one enables the "nfs" protocol she/he should be sure

NIS doesn't work either, without major hacking (more port pinning). In 
fact, any service that uses the "portmap" service to assign ports is 
broken in GD, because portmap assigns ports to the requesting daemons 
(NFS, NIS) dynamically by default.

So... ideally the developer would modify GD to become aware of and open 
portmap-assigned ports for enabled services. Whether that's actually 
possible, I have no idea! But it would be an extremely useful feature...

Kimmo, if you are just trying to sync data from one computer to another, 
consider using something like "rsync -av -e ssh source dest". This 
synchronizes one directory with another (you might need to use the 
"--delete" options too) using ssh (port 22). See 
http://www.mikerubel.org/computers/rsync_snapshots/ for some interesting 
information on this technique - that's how I make backups. It is more 
secure than NFS, and pretty convenient if you use passwordless 
authentication 
(http://www-128.ibm.com/developerworks/library/l-keyc.html). But perhaps 
that's more complicated than what you need.

Isn't networking fun? :-)


- Mike



-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf