Integrating shared storage on a server (AlmaLinux 9, AlmaLinux 10, Rocky Linux 9, and Rocky Linux 10)

Valid for Cloud Servers, Dedicated Servers, and Bare Metal Servers managed in the Cloud Panel.

This article explains how to integrate shared storage on a server running AlmaLinux or Rocky Linux. These instructions apply to AlmaLinux 9, AlmaLinux 10, Rocky Linux 9, and Rocky Linux 10.

Requirements

You have assigned the shared storage to your server in the Cloud Panel.
You have configured the access permissions for the required server in the detailed view of the shared storage.
You have downloaded the Kerberos key. You will find instructions in the following article: Shared Storage: Downloading the Kerberos Key
You have made a note of the NFS path.
Time synchronization is running on the server (for example, chrony or systemd-timesyncd) and the system time is correct. Kerberos is sensitive to time differences between the client and the server.
Name resolution (DNS, including reverse DNS and the FQDN) is working correctly, because Kerberos depends on it.

Note

If you have assigned a domain to the server, it must be reachable over the internet.

Log in to the server as root, or as a user with sudo privileges.
Make sure that NFS and Kerberos are installed. To install NFS and Kerberos, enter the following command:
sudo dnf install nfs-utils krb5-workstation -y
If unzip is not yet installed on your server for unpacking ZIP files, install the software with the following command:
sudo dnf install unzip -y
Change to the directory that contains the ZIP file you downloaded (for example, your home directory), and unpack the file into /etc. This places the keytab file it contains in /etc/krb5.keytab. Replace the placeholder FILENAME with the actual file name. To do this, enter the following command:
sudo unzip FILENAME.zip -d /etc
Example:
sudo unzip nas4_uid123456789.zip -d /etc

Please Note

You must complete this step before you activate the NFS services, because the system requires the keytab file to be present in order to start them.

Optional: check whether the keytab file has been unpacked correctly and contains valid keys:
sudo klist -k /etc/krb5.keytab

Note

The klist command is provided by the krb5-workstation package.

In AlmaLinux 9, AlmaLinux 10, Rocky Linux 9, and Rocky Linux 10, the service is controlled by the configuration in /etc/nfs.conf. Start the service and make sure that the status is shown as active (running):
sudo systemctl start rpc-gssd
sudo systemctl status rpc-gssd
To exit the status display, press the q key.
Create the directory in which the shared storage is to be mounted:
sudo mkdir /mnt/nfs

Note

To mount more than one shared storage, create additional directories accordingly (for example, /mnt/nfs2).

Open the /etc/fstab file with the vi editor. To do this, enter the following command:
sudo vi /etc/fstab

Notes

The vi editor has an insert mode and a command mode. You can switch to insert mode by pressing the i key. In this mode, the characters you type are inserted into the text immediately. To switch to command mode, press the ESC key. When you use command mode, your keyboard input is interpreted as a command.
To exit vi and save the file, enter the command :wq and then press Enter.

To mount the shared storage permanently, add the entry for the mount point configuration in the following format:
NFS_PATH /mnt/nfs nfs sec=krb5,_netdev 0 0
Example:
vid15943.nas3.lan:/vid15943 /mnt/nfs nfs sec=krb5,_netdev 0 0

Notes

You need the NFS path for this.
The sec=krb5 option enables Kerberos authentication.
The _netdev mount option marks the file system as a network drive. As a result, the system waits during the boot process until the network is available before it attempts to mount the file system.
You can also specify nofail (for example, sec=krb5,_netdev,nofail) so that a failed mount does not block the boot process.

To exit vi and save the file, enter the command :wq and then press Enter.
The NFS client must start after the Kerberos service; this start order is already defined in the systemd unit files. Enable the services with the following commands so that they start automatically when the system boots:
sudo systemctl enable --now rpc-gssd
sudo systemctl enable nfs-client.target
To mount all the file systems defined in fstab, enter the following command:
sudo mount -a
If no error message appears, the mount was successful. In that case, you can safely restart the server. If an error message appears, correct the entry in /etc/fstab before you restart the server.

Caution

Before you restart the server, always make sure that the /etc/fstab configuration is correct. Otherwise, the server may boot into emergency mode the next time it starts.

Restart the server, provided that everything is working. To do this, enter the following command:
sudo reboot
To make sure that the shared storage has been provisioned successfully and with the correct storage capacity, you can display the mount point:
sudo findmnt /mnt/nfs
Alternatively, you can display the active storage devices with the following command:
sudo df -h | grep nfs

The shared storage is now available under /mnt/nfs.

Troubleshooting

rpc-gssd will not start

Check whether the /etc/krb5.keytab file exists:

sudo ls -la /etc/krb5.keytab

If the file does not exist, unpack the Kerberos files into the /etc directory again. The Kerberos files must be present before the service starts.

rpc-gssd is not active

If rpc-gssd is not active, open the /etc/nfs.conf file and make sure that the following entry is active in the [gssd] section. Remove the comment character # if it is present:

[gssd]
use-gss-proxy = yes

use-gss-proxy is set but gssproxy is not active

If use-gss-proxy = yes is set, you must make sure that this service is running. To do this, enter the following commands:

systemctl enable --now gssproxy
systemctl start gssproxy

Mount errors or access denied

Check the logs:

sudo journalctl -u rpc-gssd -n 50

Check whether the NFS path in /etc/fstab is correct:

sudo findmnt --verify

Check whether the keytab contains valid keys:

sudo klist -k /etc/krb5.keytab

Also check the time synchronization, because Kerberos denies access if the time difference is too large:

sudo timedatectl

The server starts in emergency mode

If the server boots into emergency mode after an incorrect fstab entry, complete the following:

Enter the root password to obtain a maintenance shell.
Correct the incorrect entry in /etc/fstab (for example, with vi /etc/fstab).
Continue the boot process with systemctl default, or restart the server with reboot.

Content

Troubleshooting
To top