I have a Synology NAS box (running DSM 5.1), and I've exported a directory via NFS. I'm attempting to mount it on my Ubuntu box.
It mostly works fine, but I'm having issues with user and group mappings. On the Ubuntu box, I am uid 1000 (roger), gid 1000 (roger). On the Synology, I have uid 1026 (roger), group 100 (users).
If I use NFSv3, it uses numeric uid/gid values, which means that the ownership is messed up on the Synology.
If I were to only ever access the NFS mount from the same Ubuntu box, using the same user, this'd be fine, but I also access the directory from a Windows box, using CIFS (SMB), which means that the permissions are wrong.
If I use NFSv4 (mount -o nfsvers=4
), with the default settings on the Synology, then files owned by roger.users
on the Synology appear owned by roger.users
when viewed from the Ubuntu box. This is good.
However, when I touch
a file:
roger@ubuntu$ touch /mounts/diskstation/music/foo
It ends up owned by 1000.1000
on the Synology, and shown as owned by nobody.4294967294
when viewed from the Ubuntu box.
Everything I can find on the topic on the Synology forums is either dated from 2011, when NFSv4 wasn't supported, or consists of people asking the same question and then giving up.
For completeness, /etc/exports
has:
/volume1/music 10.0.0.0/24(rw,async,no_wdelay,root_squash,insecure_locks,sec=sys,anonuid=1025,anongid=100)
...and I'm mounting it on the Ubuntu box with:
mount -t nfs diskstation:/volume1/music /mounts/diskstation/music/ -o rw,nfsvers=4
I found some hints that the sec=sys
might be a problem: Why NFSv4 uid/gid mapping doesn’t work with AUTH_UNIX (AUTH_SYS), but that doesn't have a solution.
Is there a simple way to get around this problem? Is there a more complex (cough Kerberos cough) way to solve this?
Seriously, if Kerberos is the answer, I'll take that hit, but I'd like to know before wasting a bunch of time on it.
Update: while the Synology documentation talks about various Kerberos options, I can't find them in the UI. The release notes state "If Kerberos security flavor is implemented...". I found (but cannot find again) a page which implies that it might not be on certain models. I have a DS211, according to the System Information page. Maybe I'm out of luck?