To configure an NFS server:

1. Install the nfs-utils package:

   sudo yum install nfs-utils

2. Edit the /etc/exports file to define the directories that the server will make available for clients to mount, for example:

   /var/folder 192.0.2.102(rw,async)
   /usr/local/apps *(all_squash,anonuid=501,anongid=501,ro)
   /var/projects/proj1 192.168.1.0/24(ro) mgmtpc(rw)

   Each entry consists of the local path to the exported directory, followed by a list of clients that can mount the directory with client-specific mount options in parentheses. If this example:

   • The client system with the IP address 192.0.2.102 can mount /var/folder with read and write permissions. All writes to the disk are asynchronous, which means that the server does not wait for write requests to be written to disk before responding to further requests from the client.

   • All clients can mount /usr/local/apps read-only, and all connecting users including root are mapped to the local unprivileged user with UID 501 and GID 501.

   • All clients on the 192.168.1.0 subnet can mount /var/projects/proj1 read-only, and the client system named mgmtpc can mount the directory with read-write permissions.

   Note:

   There is no space between a client specifier and the parenthesized list of options.

   For more information, see the exports(5) manual page.

3. Start the nfs-server service, and configure the service to start following a system reboot:

   sudo systemctl start nfs-server
   sudo systemctl enable nfs-server

4. If the server will serve NFSv4 clients, edit /etc/idmapd.conf and edit the definition for the Domain parameter to specify the DNS domain name of the server, for example:

   Domain = mydom.com

   This setting prevents the owner and group being unexpectedly listed as the anonymous user or group (nobody or nogroup) on NFS clients when the all_squash mount option has not been specified.

5. If you need to allow access through the firewall for NFSv4 clients only, use the following commands:

   sudo firewall-cmd --zone=zone --add-service=nfs
   sudo firewall-cmd --permanent --zone=zone --add-service=nfs

   This configuration assumes that rpc.nfsd listens for client requests on TCP port 2049.

6. If you need to allow access through the firewall for NFSv3 clients as well as NFSv4 clients:

   1. Edit /etc/sysconfig/nfs and create port settings for handling network mount requests and status monitoring:

      # Port rpc.mountd should listen on.
      MOUNTD_PORT=892
      
      # Port rpc.statd should listen on.
      STATD_PORT=662

      The port values shown in this example are the default settings that are commented-out in the file.

   2. Edit /etc/sysctl.conf and configure settings for the TCP and UDP ports on which the network lock manager should listen:

      fs.nfs.nlm_tcpport = 32803
      fs.nfs.nlm_udpport = 32769

   3. To verify that none of the ports that you have specified in /etc/sysconfig/nfs or /etc/sysctl.conf is in use, enter the following commands:

      sudo lsof -i tcp:32803
      sudo lsof -i udp:32769
      sudo lsof -i :892
      sudo lsof -i :662

      If any port is in use, use the lsof -i command to determine an unused port and amend the setting in /etc/sysconfig/nfs or /etc/sysctl.conf as appropriate.

   4. Shut down and reboot the server.

      sudo systemctl reboot

      NFS fails to start if one of the specified ports is in use, and reports an error in /var/log/messages. Edit /etc/sysconfig/nfs or /etc/sysctl.conf as appropriate to use a different port number for the service that could not start, and attempt to restart the nfslock and nfs-server services. You can use the rpcinfo -p command to confirm on which ports RPC services are listening.

   5. Restart the firewall service and configure the firewall to allow NFSv3 connections:

      sudo systemctl restart firewalld

      sudo firewall-cmd --zone=zone \
        --add-port=2049/tcp --add-port=2049/udp \
        --add-port=111/tcp --add-port=111/udp \
        --add-port=32803/tcp --add-port=32769/udp \
        --add-port=892/tcp --add-port=892/udp \
        --add-port=662/tcp --add-port=662/udp

      sudo firewall-cmd --permanent --zone=zone \
        --add-port=2049/tcp --add-port=2049/udp \
        --add-port=111/tcp --add-port=111/udp \
        --add-port=32803/tcp --add-port=32769/udp \
        --add-port=892/tcp --add-port=892/udp \
        --add-port=662/tcp --add-port=662/udp

      The port values shown in this example assume that the default port settings in /etc/sysconfig/nfs and /etc/sysctl.conf are available for use by RPC services. This configuration also assumes that rpc.nfsd and rpcbind listen on ports 2049 and 111 respectively.

7. Use the showmount -e command to display a list of the exported file systems, for example:

   sudo showmount -e

   Export list for host01.mydom.com
   /var/folder 192.0.2.102
   /usr/local/apps *
   /var/projects/proj1 192.168.1.0/24 mgmtpc

   showmount -a lists the current clients and the file systems that they have mounted, for example:

   sudo showmount -a

   mgmtpc.mydom.com:/var/projects/proj1

   Note:

   To be able to use the showmount command from NFSv4 clients, MOUNTD_PORT must be defined in /etc/sysconfig/nfs and a firewall rule must allow access on this TCP port.

If you want to export or unexport directories without editing /etc/exports and restarting the NFS service, use the exportfs command. The following example makes /var/dev available with read and write access by all clients, and ignores any existing entries in /etc/exports.

sudo exportfs -i -o ro *:/var/dev

For more information, see the exportfs(8), exports(5), and showmount(8) manual pages.

To mount an NFS file system on a client:

1. Install the nfs-utils package:

   sudo yum install nfs-utils

2. Use showmount -e to discover what file systems an NFS server exports, for example:

   sudo showmount -e host01.mydom.com

   Export list for host01.mydom.com
   /var/folder 192.0.2.102
   /usr/local/apps *
   /var/projects/proj1 192.168.1.0/24 mgmtpc

3. Use the mount command to mount an exported NFS file system on an available mount point:

   sudo mount -t nfs -o ro,nosuid host01.mydoc.com:/usr/local/apps /apps

   This example mounts /usr/local/apps exported by host01.mydoc.com with read-only permissions on /apps. The nosuid option prevents remote users from gaining higher privileges by running a setuid program.

4. To configure the system to mount an NFS file system at boot time, add an entry for the file system to /etc/fstab, for example:

   host01.mydoc.com:/usr/local/apps      /apps      nfs      ro,nosuid  0 0

For more information, see the mount(8), nfs(5), and showmount(8) manual pages.

To configure a Samba server:

1. Install the samba and samba-winbind packages:

   sudo yum install samba samba-winbind

2. Edit /etc/samba/smb.conf and configure the sections to support the required services, for example:

   [global]
   security = ADS
   realm = MYDOM.REALM
   password server = krbsvr.mydom.com
   load printers = yes
   printing = cups
   printcap name = cups
   
   [printers]
   comment = All Printers
   path = /var/spool/samba
   browseable = no
   guest ok = yes
   writable = no
   printable = yes
   printer admin = root, @ntadmins, @smbprintadm
   
   [homes]
   comment = User home directories
   valid users = @smbusers
   browsable = no
   writable = yes
   guest ok = no
   
   [apps]
   comment = Shared /usr/local/apps directory
   path = /usr/local/apps
   browsable = yes
   writable = no
   guest ok = yes

   The [global] section contains settings for the Samba server. In this example, the server is assumed to be a member of an Active Directory (AD) domain that is running in native mode. Samba relies on tickets issued by the Kerberos server to authenticate clients who want to access local services.

   For more information, see About Samba Configuration for Windows Workgroups and Domains.

   The [printers] section specifies support for print services. The path parameter specifies the location of a spooling directory that receives print jobs from Windows clients before submitting them to the local print spooler. Samba advertises all locally configured printers on the server.

   The [homes] section provide a personal share for each user in the smbusers group. The settings for browsable and writable prevent other users from browsing home directories, while allowing full access to valid users.

   The [apps] section specifies a share named apps, which grants Windows users browsing and read-only permission to the /usr/local/apps directory.

3. Configure the system firewall to allow incoming TCP connections to ports 139 and 445, and incoming UDP datagrams on ports 137 and 138:

   sudo firewall-cmd --zone=zone --add-port=139/tcp --add-port=445/tcp --add-port=137-138/udp
   sudo firewall-cmd --permanent --zone=zone --add-port=139/tcp --add-port=445/tcp --add-port=137-138/udp

   Add similar rules for other networks from which Samba clients can connect.

   The nmdb daemon services NetBIOS Name Service requests on UDP port 137 and NetBIOS Datagram Service requests on UDP port 138.

   The smbd daemon services NetBIOS Session Service requests on TCP port 139 and Microsoft Directory Service requests on TCP port 445.

4. Start the smb service, and configure the service to start following a system reboot:

   sudo systemctl start smb
   sudo systemctl enable smb

If you change the /etc/samba/smb.conf file and any files that it references, the smb service will reload its configuration automatically after a delay of up to one minute. You can force smb to reload its configuration by sending a SIGHUP signal to the service daemon:

sudo killall -SIGHUP smbd

Making smb reload its configuration has no effect on established connections. You must restart the smb service or the existing users of the service must disconnect and then reconnect.

To restart the smb service, use the following command:

sudo systemctl restart smb

For more information, see the smb.conf(5) and smbd(8) manual pages and https://www.samba.org/samba/docs/.

Windows systems on an enterprise network usually belong either to a workgroup or to a domain.

Workgroups are usually only configured on networks that connect a small number of computers. A workgroup environment is a peer-to-peer network where systems do not rely on each other for services and there is no centralized management. User accounts, access control, and system resources are configured independently on each system. Such systems can share resources only if configured to do so.

A Samba server can act as a standalone server within a workgroup.

More typically, corporate networks configure domains to allow large numbers of networked systems to be administered centrally. A domain is a group of trusted computers that share security and access control. Systems known as domain controllers provides centralized management and security. Windows domains are usually configured to use Active Directory (AD), which uses the Lightweight Directory Access Protocol (LDAP) to implement versions of Kerberos and DNS providing authentication, access control to domain resources, and name service. Some Windows domains use Windows NT4 security, which does not use Kerberos to perform authentication.

A Samba server can be a member of an AD or NT4 security domain, but it cannot operate as a domain controller. As domain member Samba server must authenticate itself with a domain controller and so is controlled by the security rules of the domain. The domain controller authenticates clients, and the Samba server controls access to printers and network shares.

To access a share on a Samba server from Windows, open Computer or Windows Explorer, and enter the host name of the Samba server and the share name using the following format:

\\server_name\share_name

If you enter \\server_name , Windows displays the directories and printers that the server is sharing. You can also use the same syntax to map a network drive to a share name.

You can use the findsmb command to query a subnet for Samba servers. The command displays the IP address, NetBIOS name, workgroup, operating system and version for each server that it finds.

Alternatively, you can use the smbtree command, which is a text-based SMB network browser that displays the hierarchy of known domains, servers in those domains, and shares on those servers.

The GNOME and KDE desktops provide browser-based file managers that you can use to view Windows shares on the network. Enter smb: in the location bar of a file manager to browse network shares.

To connect to a Windows share from the command line, use the smbclient command:

smbclient //server_name/share_name [-U username]

After logging in, enter help at the smb:\> prompt to display a list of available commands.

To mount a Samba share, use a command such as the following:

sudo mount -t cifs //server_name/share_name mountpoint -o credentials=credfile

In the previous command, the credentials file contains settings for username, password, and domain, for example:

username=eddie
password=clydenw
domain=MYDOMWKG

The argument to domain can be the name of a domain or a workgroup.

sudo chmod 400 credfile

If the Samba server is a domain member server in an AD domain and your current login session was authenticated by the Kerberos server in the domain, you can use your existing session credentials by specifying the sec=krb5 option instead of a credentials file:

sudo mount -t cifs //server_name/share_name mountpoint -o sec=krb5

For more information, see the findsmb(1), mount.cifs(8), smbclient(1), and smbtree(1) manual pages.