TaskFirst, configure the NFS server to allow access to /srv/backup for host lfcs00098nfs1 to store...

Objective: Configure the Linux NFS (Network File System) server so that two specified client hosts can access the same backup directory with different permissions.

The required configuration is:

NFS client

Required access

Export options

lfcs00098nfs1

Read and write (store backups)

rw,sync,insecure

lfcs00098nfs2

Read-only (restore backups)

ro,sync,insecure

The essential distinction is that the first client must be able to create and modify backup files, while the second client must be restricted to reading existing backup data.

The task explicitly requires the insecure option for both client hosts.

Linux NFS uses /etc/exports to configure which directories are shared, which hosts can access them, and which permissions apply.

Step 1: Connect to the correct Linux server.

The video specifies that this task must be completed on host lfcs00098.

From the candidate terminal, execute:

ssh lfcs00098

This establishes an SSH connection to the designated NFS server.

All NFS export configuration changes must be performed on this server, not on the client hosts.

Step 2: Verify that the NFS server software is installed.

On the Ubuntu environment shown in the video, the NFS server package is normally:

nfs-kernel-server

Check whether the package is installed:

dpkg -l nfs-kernel-server

You can also inspect the service:

systemctl status nfs-kernel-server

If the package is installed and the service is running, continue.

The task is to configure an existing NFS server, so do not reinstall packages unnecessarily.

Step 3: Verify that the backup directory exists.

The task specifies the NFS export directory:

/srv/backup

Execute:

ls -ld /srv/backup

This displays the directory's permissions, owner and group.

For example:

drwxr-xr-x 2 root root 4096 Oct 12 10:00 /srv/backup

The output above is illustrative.

If the directory does not exist, first establish whether the task environment is incomplete. If it is genuinely necessary to create the specified export point, execute:

sudo mkdir -p /srv/backup

Do not modify existing backup files or directory ownership unless needed for authorized client access.

Step 4: Inspect the existing NFS export configuration.

The primary NFS export configuration file is:

/etc/exports

Display its contents:

sudo cat /etc/exports

You can also inspect the configuration using:

sudo nano /etc/exports

The file defines local directories exported to NFS clients.

The general format is:

/directory client1(options) client2(options)

Each client hostname is immediately followed by its own parenthesized options.

There must be no space between the hostname and the opening parenthesis.

This syntax is explicitly documented in the Linux NFS exports(5) manual.

Step 5: Check the currently active NFS exports.

Execute:

sudo exportfs -v

This lists the currently active exports and their effective options.

Check whether /srv/backup is already exported and whether either required client already has an entry.

If an existing configuration is present, modify it carefully rather than creating overlapping or conflicting export entries.

Step 6: Verify that the NFS client hostnames can be resolved.

The task identifies two clients:

lfcs00098nfs1

lfcs00098nfs2

Check name resolution:

getent hosts lfcs00098nfs1

Then:

getent hosts lfcs00098nfs2

These commands query the operating system's configured hostname-resolution services.

Both hostnames should resolve correctly in the exam environment.

Do not replace these hostnames with invented IP addresses.

NFS export configuration supports hostnames, including single hostnames recognized by the system resolver.

Step 7: Back up the existing NFS exports configuration.

Before making changes, execute:

sudo cp -a /etc/exports /etc/exports.bak

This creates a backup copy while preserving file metadata.

It allows recovery if the configuration is accidentally modified incorrectly.

Step 8: Edit the /etc/exports file.

Execute:

sudo nano /etc/exports

Alternatively:

sudo vim /etc/exports

Navigate to the end of the file, or locate the existing export for /srv/backup if one is already present.

Step 9: Configure read/write access for the backup-storage client.

The first requirement is:

First, configure the NFS server to allow access to /srv/backup for host lfcs00098nfs1 to store backups.

The corresponding export configuration is:

/srv/backup lfcs00098nfs1(rw,sync,insecure)

/srv/backup

This is the directory that the NFS server makes available to the specified client.

lfcs00098nfs1

This is the only client identified by this entry.

rw — Read/Write

Allows the NFS client to perform both read and write operations, subject to the underlying filesystem permissions.

This is necessary because the client must store backups.

sync — Synchronous Writes

Makes the NFS server acknowledge write requests only after the relevant changes have been committed to stable storage, as defined by the NFS server's write semantics.

This is appropriate for backup data where durability matters.

insecure — Allow Unprivileged Source Ports

Normally, NFS's secure export behavior requires certain client requests to originate from a privileged port below 1024.

The insecure option relaxes this restriction, permitting requests from unprivileged source ports.

The task explicitly requires this option.

The official NFS manual confirms the behavior of rw, sync and insecure.

Step 10: Configure read-only access for the backup-restore client.

The second requirement is:

Next, configure the NFS server to allow access to /srv/backup for host lfcs00098nfs2 to restore backups only.

The corresponding configuration is:

/srv/backup lfcs00098nfs2(ro,sync,insecure)

lfcs00098nfs2

Specifies the second authorized NFS client.

ro — Read Only

Allows the client to read existing backup files but prevents writes through the NFS export.

This matches the requirement to restore backups only.

sync

Specifies synchronous server behavior. It is safe to include this option even though the export is read-only.

insecure

Allows requests from unprivileged client source ports, as explicitly requested.

The most important difference between the two client definitions is:

lfcs00098nfs1(rw,sync,insecure)

lfcs00098nfs2(ro,sync,insecure)

The second client must not be given rw access.

Step 11: Add the complete NFS export configuration.

The preferred combined entry in /etc/exports is:

/srv/backup lfcs00098nfs1(rw,sync,insecure) lfcs00098nfs2(ro,sync,insecure)

This single line defines the same exported directory with separate permissions for the two clients.

The configuration can also be expressed as two client-specific entries, provided the resulting export table is valid and does not contain conflicting definitions.

Using one line is concise and follows the official exports(5) syntax for multiple clients sharing an export path.

NFS server export table

Step 12: Save the NFS configuration file.

If using Nano, press Ctrl+O, Enter and Ctrl+X.

If using Vim, press Esc, type :wq, and press Enter.

Verify the saved configuration:

sudo cat /etc/exports

The file must contain:

/srv/backup lfcs00098nfs1(rw,sync,insecure) lfcs00098nfs2(ro,sync,insecure)

Preserve any unrelated exports already present on the system.

Step 13: Apply the NFS export configuration.

Execute:

sudo exportfs -ra

exportfs manages the NFS export table.

-r refreshes the export table from the configuration.

-a applies the operation to all configured exports.

This command reloads export definitions without requiring a complete operating system reboot.

For verbose output, you can execute:

sudo exportfs -rav

Ubuntu's official NFS server documentation and the Linux NFS manual describe using exportfs to apply changes made to /etc/exports.

Step 14: Verify the active NFS export configuration.

Execute:

sudo exportfs -v

The output should show /srv/backup exported to both client hosts.

The effective configuration must include the following permissions:

Client

Required effective access

lfcs00098nfs1

rw,insecure

lfcs00098nfs2

ro,insecure

The command may also display other default export options such as root_squash, wdelay, sec=sys, or no_subtree_check, depending on the installed version and configuration.

Their presence does not necessarily indicate an error.

What matters is that the two specified clients have the correct effective access and the required insecure option.

Step 15: Check the NFS server service.

Execute:

sudo systemctl status nfs-kernel-server

The service should report an active operating state.

For a concise check:

systemctl is-active nfs-kernel-server

Expected:

active

If the service is inactive, inspect the logs:

sudo journalctl -u nfs-kernel-server -n 50 --no-pager

If the service is installed and configured correctly but stopped, start it:

sudo systemctl start nfs-kernel-server

There is ordinarily no need to restart a healthy NFS server merely because export rules changed; exportfs -ra is designed to refresh the export table.

Step 16: Verify the backup directory permissions.

Execute:

ls -ld /srv/backup

NFS export permissions and Unix filesystem permissions are separate controls.

Even if lfcs00098nfs1 has an export configured with rw, its application user must also have the necessary filesystem permissions to write to the directory.

Likewise, ro at the export level prevents NFS writes from lfcs00098nfs2, regardless of permissive underlying file permissions.

Do not automatically execute:

sudo chmod 777 /srv/backup

This would unnecessarily grant broad filesystem access.

Also avoid adding:

no_root_squash

unless explicitly required.

The task does not request disabling NFS root squashing, and doing so could expose unnecessary privileges to clients.

Step 17: Verify NFS access from the backup-storage client.

If the client is accessible, connect to:

ssh lfcs00098nfs1

Create a temporary mountpoint:

sudo mkdir -p /mnt/lfcs-backup-test

Mount the NFS export, using the actual NFS server hostname and a protocol version supported by the server:

sudo mount -t nfs lfcs00098:/srv/backup /mnt/lfcs-backup-test

Verify the mount:

findmnt /mnt/lfcs-backup-test

Using a client identity authorized to write to the backup directory, test file creation:

touch /mnt/lfcs-backup-test/lfcs-write-test

If the directory permissions permit this identity to write, the command should succeed.

This tests the read/write access requested for lfcs00098nfs1.

Root access from the client may be mapped to an unprivileged user because of NFS root squashing, so a failure when using root does not automatically mean that the export is configured incorrectly.

Step 18: Verify read-only access from the restore client.

Connect to:

ssh lfcs00098nfs2

Create a mountpoint if necessary:

sudo mkdir -p /mnt/lfcs-backup-test

Mount the export:

sudo mount -t nfs lfcs00098:/srv/backup /mnt/lfcs-backup-test

Verify that backup files can be listed and read:

ls -la /mnt/lfcs-backup-test

Where a readable file is available, open or inspect it using a suitable command.

Next, attempt to create a temporary file:

touch /mnt/lfcs-backup-test/lfcs-readonly-test

This operation must fail because the export is read-only.

An illustrative error is:

Read-only file system

Even if the error wording differs, the important result is that write access is denied by the server.

Step 19: Clean up any test resources.

On the writing client, remove only the temporary verification file you created:

rm -f /mnt/lfcs-backup-test/lfcs-write-test

Unmount the temporary client mount:

sudo umount /mnt/lfcs-backup-test

Repeat the unmount on the other client.

Do not delete or alter actual backup files.

Step 20: Perform final verification on the NFS server.

Reconnect to the NFS server:

ssh lfcs00098

Verify the persistent configuration:

sudo grep '/srv/backup' /etc/exports

Expected:

/srv/backup lfcs00098nfs1(rw,sync,insecure) lfcs00098nfs2(ro,sync,insecure)

Verify the active exports:

sudo exportfs -v

Confirm NFS service health:

systemctl is-active nfs-kernel-server

The final state must satisfy every requirement.

Requirement

Expected result

Exported directory

/srv/backup

Backup-storage client

lfcs00098nfs1

Backup-storage access

Read/write

Backup-restore client

lfcs00098nfs2

Backup-restore access

Read-only

insecure for first client

Present

insecure for second client

Present

Active exports

Correctly refreshed

NFS service

Active

Final Solution

The essential server-side commands are:

# Connect to the NFS server

ssh lfcs00098

# Check the export directory

ls -ld /srv/backup

# Examine existing exports

sudo cat /etc/exports

sudo exportfs -v

# Back up the configuration

sudo cp -a /etc/exports /etc/exports.bak

# Edit the exports file

sudo nano /etc/exports

Add or update the /srv/backup entry to read:

/srv/backup lfcs00098nfs1(rw,sync,insecure) lfcs00098nfs2(ro,sync,insecure)

Save and execute:

# Apply changes

sudo exportfs -ra

# Verify active exports

sudo exportfs -v

# Confirm NFS service status

systemctl is-active nfs-kernel-server

# Verify persistent configuration

sudo grep '/srv/backup' /etc/exports

Technical Verification and References

The solution has been checked against the official Linux NFS manuals and Ubuntu Server documentation.

Linux NFS exports(5) — Defines the export configuration syntax, rw, ro, sync and insecure options.

Ubuntu Server — Network File System (NFS) — Documents the NFS server configuration and export-management procedure.

Linux exportfs(8) — Documents reloading, managing and displaying active exports.

Video verification finding: Task 10 identifies the NFS server lfcs00098 and requires separate access modes for lfcs00098nfs1 and lfcs00098nfs2. The essential answer is the NFS export configuration above. Actual client access must be tested on the relevant systems; correct syntax alone does not establish that network connectivity and filesystem permissions are functioning.

Expected result: The NFS server exports /srv/backup to lfcs00098nfs1 with read/write access and to lfcs00098nfs2 with read-only access. Both client configurations explicitly include insecure, and the settings remain persistent in /etc/exports.