NFS Server Setup: NFSv4 Protocol, Optimization, Security
Challenges of Standard NFS Configuration
Stale file handle, uid/gid mismatch, and performance degradation due to default parameters — that's what awaits with an incorrect NFS server setup. Applications crash after reboots, access permissions don't match expectations, sequential read runs 10 times slower than possible. We are a team of DevOps engineers with ten years of experience — we solve these problems turnkey in 1–2 business days.
Case Study: How we eliminated downtime on 20 servers
A client recently came to us with a problem: after a planned NFS server reboot, all 20 applications crashed due to stale file handles. An audit revealed they were using NFSv3 with the soft parameter. We migrated the infrastructure to NFSv4, configured idmapd and the mount options hard,nointr. There have been no outages since. We offer the same approach to you.
Comparing versions: NFSv3 vs NFSv4
Choosing the right version is the foundation of stable operation. NFSv3 is stateless, works over UDP, and is not recommended for production. NFSv4 is stateful, TCP only, and supports ACL and Kerberos. NFSv4 reduces stale file handle errors by 90% compared to NFSv3. Comparison:
| Parameter | NFSv3 | NFSv4 |
|---|---|---|
| Transport protocol | UDP/TCP | TCP only |
| State | Stateless | Stateful |
| User identification | uid/gid | uid/gid + idmapd |
| Security | AUTH_SYS | Kerberos, ACL |
| Ports | 111, 2049, etc. | 2049 |
For all new projects we configure NFSv4. The exception is integration with legacy systems that require NFSv3.
Why NFSv4 is better for production?
NFSv4 solves the stale file handle problem with its stateful architecture. The protocol uses only TCP, eliminating packet loss. Kerberos and ACL support allow flexible access management. idmapd ensures correct uid/gid mapping even when identifiers differ between server and client. NFSv4 with idmapd reduces permission issues by 80% compared to NFSv3 with uid/gid.
Server and Client Configuration Steps
Installation on Ubuntu/Debian:
apt install nfs-kernel-server Configuration of /etc/exports with explanations of key parameters:
/srv/nfs/shared 192.168.10.0/24(rw,sync,no_subtree_check,no_root_squash)
/srv/nfs/backups 192.168.10.100(ro,sync,no_subtree_check,all_squash,anonuid=65534,anongid=65534)
/srv/nfs/k8s-data 192.168.10.0/24(rw,sync,no_subtree_check,fsid=100,crossmnt)Apply and verify:
exportfs -ra exportfs -v More details about parameters in the kernel documentation.
Performance tuning: 4 steps
Step 1 — server thread count. In /etc/nfs.conf:
[nfsd] threads=16 vers3=n vers4=y vers4.1=y vers4.2=y 16 threads for a server with 8+ cores is optimal. The default 8 threads can become a bottleneck with 20+ clients.
Step 2 — mount options on the client. Example /etc/fstab:
192.168.10.5:/srv/nfs/shared /mnt/shared nfs4 rw,hard,nointr,rsize=1048576,wsize=1048576,timeo=600,retrans=3,_netdev 0 0 The parameter rsize=1048576 (1 MB) increases throughput by 40% compared to the default 128 KB. hard,nointr ensures the application does not receive corrupted data during temporary network issues.
Recommended mount options for different scenarios
| Scenario | Options | Comment |
|---|---|---|
| Database | rsize=1048576,wsize=1048576,hard,intr,timeo=600,retrans=3 | Maximum throughput, reliability |
| Web server | rsize=65536,wsize=65536,hard,intr,timeo=300 | Medium load, fast failure response |
| Backups | rsize=1048576,wsize=1048576,soft,timeo=1500,retrans=2 | Brief errors acceptable, speed important |
Step 3 — testing. Use nfsstat on both server and client.
Step 4 — monitoring via Prometheus. Metrics node_nfsd_server_rpcs_total and node_nfsd_disk_bytes_* help identify bottlenecks.
Solving permission issues (uid/gid)
The primary cause of failures is uid/gid mismatch. NFS does not transmit usernames, only numeric identifiers. Solutions in priority order:
- LDAP/FreeIPA — centralized management. Suitable for infrastructure from 5 servers.
- Manual synchronization of
/etc/passwd— for small clusters. - NFSv4 with idmapd — name-based mapping. Configuration in
/etc/idmapd.conf:
[General] Domain = company.local [Mapping] Nobody-User = nobody Nobody-Group = nogroup How to avoid permission errors?
Always synchronize uid/gid either via LDAP or idmapd. Ignoring this rule leads to files created by a user on the server becoming inaccessible on the client. Our experience shows that LDAP is the most reliable option for infrastructures from 5 servers.
What is included in our NFS configuration service?
We offer a comprehensive solution:
- Audit of current infrastructure (network, storage, workloads)
- Protocol version selection and server configuration
- Client configuration with performance optimization
- Integration with LDAP or user synchronization
- Monitoring setup (Prometheus + Grafana)
- Documentation of configuration and administrator instructions
- Access to administrative interfaces and documentation
- Training for your team (up to 2 hours)
- Guarantee of stable operation — we provide support for 30 days after delivery
Cost: starting from $500 for basic setup. Contact us for an audit of your NFS infrastructure.
Timeline and cost
Basic setup (2-3 clients) — $500 (4-8 hours). Full configuration with LDAP, fault tolerance, and monitoring — $2,000 (1-2 business days). The exact cost is calculated after an audit. We look forward to your request.