NFS

NFS — tarmoq orqali remote serverdagi directory va filelarni local file systemga o‘xshab ishlatish imkonini beradigan protocol. To‘liq nomi Network File System. U Unix va Linux muhitlarida shared home directory, application data, backup, media va virtualization storage uchun keng qo‘llanadi.

NFS client remote exportni mount pointga ulaydi va oddiy file operationlari orqali ishlaydi.

Server va client

NFS server ma’lum directory’larni export qiladi.

Client exportni mount qiladi:

server:/data → /mnt/data

Application local path bilan ishlaydi.

Asl I/O network orqali serverga boradi.

Export

Export qaysi directory, qaysi client va qanday option bilan ochilishini belgilaydi.

Rule:

• subnet;
• host;
• read-only;
• read-write;
• root mapping;
• sync;
• security flavor

ga ega bo‘lishi mumkin.

Internetga umumiy export ochish xavfli.

NFS versiyalari

NFSning bir nechta avlodi mavjud.

Yangi avlodlar:

• yaxshiroq state management;
• authentication;
• locking;
• compound operation;
• firewallga qulayroq port modeli;
• parallel accessga oid imkoniyatlar

berishi mumkin.

Client va server qo‘llaydigan version kelishiladi.

Stateless va stateful model

Eski NFS avlodlari ko‘proq stateless operationlarga yaqin bo‘lgan.

Yangi versiyalarda open, lock va delegation kabi state mavjud.

Server restart yoki network uzilishida client state’ni tiklashi kerak.

Grace period lock reclaim uchun ishlatilishi mumkin.

Mount

Client mount optionlari behaviorni belgilaydi:

• read/write;
• hard yoki soft;
• timeo;
• retrans;
• protocol;
• version;
• cache;
• security.

Production data uchun timeoutni noto‘g‘ri qisqartirish silent I/O xatosi yoki application buzilishiga olib kelishi mumkin.

Hard mount

Server javob bermasa client requestni qayta urinishda davom etadi.

Application thread D state’ga o‘xshash uninterruptible waitda qolishi mumkin.

Data integrity uchun keng ishlatiladi.

Server recovery va redundant network muhim.

Soft mount

Ma’lum retry’dan keyin I/O error qaytarishi mumkin.

Application xatoni to‘g‘ri boshqarmasa data corruption xavfi mavjud.

Read-only yoki ayrim tolerant workloadlarda ko‘rib chiqilishi mumkin.

Tanlov data talabiga mos bo‘ladi.

File handle

Client file yoki directory’ni server bergan file handle orqali aniqlaydi.

Serverdagi object o‘chirilsa yoki filesystem o‘zgarsa stale file handle xatosi yuz berishi mumkin.

Remount yoki application retry kerak bo‘lishi mumkin.

UID va GID

Klassik NFS permissioni numeric UID va GIDga tayanadi.

Client va serverda ayni raqam boshqa userga tegishli bo‘lsa access noto‘g‘ri bo‘ladi.

Central identity yoki id mapping ishlatiladi.

Faqat username bir xil bo‘lishi yetarli emas.

root_squash

Client root userining serverdagi root huquqini cheklaydi.

U odatda anonymous yoki nobody identityga map qilinadi.

Bu compromised client rootining shared storage’da to‘liq huquq olishiga qarshi himoya.

no_root_squash ehtiyotkor va cheklangan holatda ishlatiladi.

Locking

Bir nechta client ayni file’ni o‘zgartirsa file locking zarur.

Protocol versioniga qarab lock alohida service yoki asosiy protocol ichida bo‘lishi mumkin.

Application lockdan foydalanmasa last-write-wins yoki corruption yuz beradi.

Database’ning NFS support talablari tekshiriladi.

Cache

Client file data va attribute’larni cache qiladi.

Bu performance’ni oshiradi.

Boshqa clientdagi o‘zgarish darhol ko‘rinmasligi mumkin.

Close-to-open consistency ko‘p workload uchun yetarli, ammo qat’iy distributed locking emas.

Sync va async export

Server write’ni stable storage’ga yozgandan keyin javob berishi durability’ni oshiradi.

Async rejim tezroq, ammo power failure’da acknowledged data yo‘qolishi ehtimoli yuqori.

Storage controller cache va battery protection ham hisobga olinadi.

Performance

NFS performance’iga:

• network latency;
• bandwidth;
• server disk;
• metadata;
• client count;
• file size;
• mount option;
• protocol version

ta’sir qiladi.

Kichik file metadata workload katta sequential file’dan boshqacha.

Redundancy

Bitta NFS server single point of failure.

HA uchun:

• clustered server;
• replicated storage;
• floating IP;
• failover;
• redundant network;
• shared backend

ishlatiladi.

Client server identity va file handle continuity’ni saqlashi kerak.

Security

Klassik AUTH_SYS client yuborgan UID/GIDga ishonadi.

Ishonchsiz networkda kuchli authentication va encryption kerak.

Kerberosga oid security flavor identity, integrity va privacy himoyasini berishi mumkin.

Firewall faqat kerakli clientlarga ruxsat beradi.

NFS va firewall

Eski versionlarda bir nechta dynamic RPC port ishlatilishi mumkin.

Yangi versiyada asosiy trafik bitta ma’lum portga yaqinlashtirilgan.

Server va client yordamchi service’lari aniq tekshiriladi.

Faqat port ochish authentication o‘rnini bosmaydi.

NFS va SMB

NFS Unix/Linux permission va POSIXga yaqin workloadlarda keng.

SMB Windows file sharing, Active Directory va user-friendly share modelida keng.

Ikkala protocol turli locking, ACL va naming semanticsga ega.

Bitta file’ni bir vaqtda NFS va SMB orqali berish ehtiyotkor integration talab qiladi.

Backup

NFS share ichidagi data server yoki storage darajasida backup qilinadi.

Client tomondan file copy barcha permission, sparse file va open database consistency’sini saqlamasligi mumkin.

Snapshot va application-aware backup ishlatiladi.

Restore yangi exportda tekshiriladi.

ID mapping

NFSv4ga oid muhitda user va group nomlarini domain bilan map qilish mumkin. Client va server domain konfiguratsiyasi mos bo‘lmasa file owner nobody ko‘rinishi ehtimoli bor. Kerberos principal va local account mapping alohida tekshiriladi.

Bog‘liq tushunchalar

Network File System, NFS, File sharing, NFS export, Mount, File locking, UID, GID, root_squash, Distributed file system, SMB, NAS