Restricting access to volumes and directories

Use export options to restrict directory access

You can use the export options to restrict access to directories in various ways.

Restricting access to /home

You can restrict access to the /home directory to particular groups by

using the chmod command to change access modes for the directory
using the -rw or -access options in the /etc/exports file to limit write privilege to specific hosts

The -access option

The -access option lists the hosts that can mount exported directories. When you use the -access option, only the hosts listed can mount the associated directory.

Syntax

The syntax for the -access option is as follows:

-access=hostname[:...:hostname]

Limits

There is no limit to the number of host names you can specify with the -access option. However, the length of a line in the /etc/exports file cannot exceed 1,024 characters.

Note: If you cannot fit all the host names in a 1,024-character line, you can use netgroups in place of host names.

The -root option

The -root option lists the hosts that can mount exported directories as root. Hosts that mount exported directories as root have full control over the directories and can perform the following operations:

Create and delete directories and files.
Change ownership and group associations of directories and files.
Set access permissions for directories and files.

Syntax

The syntax for the -root option is as follows:

-root=hostname[:...:hostname]

Limits

You can specify 1 to 256 host names with the -root option.

Restrictions

You cannot use netgroup names with the -root option.

The -rw option

The -rw option lists the hosts that can modify the exported directories; hosts not listed by the -rw option have read privilege only.

Syntax

The syntax for the -rw option is as follows:

-rw=hostname[:...:hostname]

Limits

You can specify 1 to 256 host names with the -rw option.

Restrictions

You cannot use netgroup names with the -rw option.

The -ro option

The -ro option lists the clients that cannot modify the exported directories.

Syntax

The syntax for the -ro option is as follows:

-ro=hostname[:...:hostname]

Related information

The following table lists additional information that you might find helpful.


Read...	To learn about...
The na_exports(1) man page.	More about the /etc/exports file.
"The /etc/netgroup file"	How to create and maintain netgroups.

Part No. 210-02334
File: nfs5.htm
Last updated: 02/24/99 12:16:26