NFS filesystem advanced mount options

In the Filesystem Manager, select Add Mount Configuration or Modify Mount Configuration from the Filesystem menu, then select Remote. After you have selected a remote filesystem, select Advanced Options.

When mounting a remote filesystem, an NFS client can specify options that characterize the individual mount request. The following options can be set from the Filesystem Manager:

Mount in background

specifies that the NFS mount should be retried in the background if the server's mount daemon (mountd) does not respond.

Yes: This is recommended for automatic mounts done during system startup. The default is to mount in the foreground.
No: This is recommended if you wish to see whether the mount was successful.

NFS mount type

specifies how the client acts if the server does not respond to its NFS request.

Hard: retries indefinitely. The client will continue to attempt the NFS file operation indefinitely if the operation fails. Hard mounts should be used when the server and the link to the server are known to be reliable. Hard mounts with the interruptible option enabled is the recommended method of mounting remote filesystems. The default is hard mount.
Soft: retries NFS file operation n times as set by the number of retries before reporting error option; returns error if no server response in n tries. Soft mounts are recommended for filesystems whose servers are considered unreliable, or if the link is slow. Unlike spongy mounts, soft mounts may time out during read and write operations.
Spongy: sets soft semantics for stat, lookup, fsstat, readlink, and readdir NFS operations and hard semantics for all other NFS operations on the filesystem. Spongy mounts are preferable to soft mounts because spongy mounts will not time out during read and write operations. They are recommended for slow, long-distance, or unreliable links, and for unreliable servers.

Keyboard interruptible

allows keyboard interrupts on hard mounts.

Yes: allows the user to kill a process that is hung while waiting for a response on a hard-mounted filesystem. This option is useful if the server or the connection to the server is known to be slow or unreliable. It is recommended to always have the intr option on. A keyboard interrupt is configured by entering stty intr key where key is the keyboard key you wish to use to issue an interrupt.
No: specifies that the user cannot terminate an NFS operation from the keyboard. This should only be used if the server and link to the server are known to be reliable. Non-interruptible is the default.

SUID and SGID file permissions

controls SUID and SGID execution permissions for binaries in exported filesystems; for more information, see ``SUID/SGID bits and security'' in the System Administration Guide and ``SUID, SGID, and sticky bit clearing on writes'' in the System Administration Guide.

Honor: accepts imported SUID and SGID execution permissions as they are set in the remote filesystem. This is the default.
Ignore: ignores imported SUID and SGID execution permissions. This option is recommended if you are concerned with filesystem security.

Cache attributes

Yes: caches the file attributes. This eliminates redundant requests to the server for file information/attributes. This option is the default.
No: does not cache attributes. Use this option when close synchronization with the server is required. Note that using this option will drastically impair performance on the filesystem being mounted.

Read/write buffer size (bytes)

specifies client read and write buffer sizes in bytes (the default size is 8192 bytes). This should be lowered if you have a slow Ethernet card.

Timeout period for each operation (seconds)

sets the initial NFS timeout for each RPC operation to n seconds. The default is 300 seconds.

Number of retries before reporting error

specifies (for soft mounts only) the number of NFS retransmissions the client will make before reporting an error. The default is 5.

/etc/nfs

Transport protocol

sets the transport protocol for this filesystem

TCP: specifies the Transmission Control Protocol (TCP); this is recommended if reliable connections are required
UDP: specifies the User Datagram Protocol (UDP); this is the default

Infrastructure

All NAP enforcement methods can be implemented using a minimum of one computer running Windows Server 2008 R2 or Windows Server 2008. All enforcement methods require that NPS is installed on this computer and configured to evaluate the health of NAP clients. Additional required services depend on the enforcement method. For example, IPsec, VPN, and DHCP enforcement methods require a NAP enforcement server running Windows Server 2008 R2 or Windows Server 2008. The 802.1X enforcement method requires network hardware that supports the 802.1X authentication method and is capable of controlling port characteristics using RADIUS tunnel attributes. For more information, see NAP Configuration Overview.

MCITP Boot camp USA : MCITP CCNA Boot camp UK, MCITP MCSE CCNA Boot camp Asia, MCITP CCNA MCSE Bootcamp, MCITP MCSE RHCE Training

Cost

Because support for it is built into the Windows operating system, the cost of deploying NAP is typically low, but depends on how well your existing network hardware and software support your design. If you have deployed Windows Server 2008 R2 or Windows Server 2008 on your network, then you already have some or all of the components required to deploy NAP. Some NAP enforcement methods might require an upgrade of the components of your network infrastructure. For example, deploying NAP with 802.1X enforcement can be costly if you do not already have hardware that supports 802.1X authentication. If you already have hardware that supports 802.1X, then it is likely that you can deploy NAP with 802.1X enforcement at minimal cost. If your hardware does not support NAP, in some cases adding support can be as simple as downloading and installing new firmware. To determine the costs associated with a NAP deployment, review hardware and software requirements for the enforcement methods you have chosen and determine whether server and network hardware upgrades are required. Additional costs that might also be associated with a NAP deployment include planning and design costs and the training of support personnel.

Complexity

NAP with IPsec enforcement is generally the most complex enforcement method to deploy because it requires a public key infrastructure (PKI) and IPsec policies to create logical networks. However, Windows Server 2008 R2 and Windows Server 2008 include tools for managing and monitoring IPsec that eliminates much of this complexity. The 802.1X enforcement method is next in terms of complexity, followed by VPN enforcement. DHCP enforcement is the least complex enforcement method to deploy.

Security

IPsec enforcement is a powerful method for protecting compliant computers from any others; it can be combined with server and domain isolation to ensure that after a computer has demonstrated it is compliant, it will still be restricted to communicating only with authorized hosts. IPsec provides other benefits, too. Network packets are authenticated, which reduces the risk of man-in-the-middle and replay attacks, and traffic can be encrypted with IPsec, providing a high degree of protection from eavesdropping attacks.

Like IPsec, 802.1X offers a high degree of protection. Several enhancements to 802.1X are also available that provide improved security. Until a client has demonstrated that it complies with the organization�s health requirements, its access to the network will be restricted by the network switches and wireless access points. These restrictions can be very difficult to bypass, even by a determined malicious user.

VPN enforcement is a good choice for protecting remote access to the corporate network. Clients that connect to a NAP-enabled VPN server can be granted restricted access to the network at the point of entry using IP packet filters. The health of remote client computers is evaluated when the client connects and it is monitored during the VPN session. If a client computer becomes noncompliant, then access is restricted until the computer is compliant.

DHCP enforcement restricts noncompliant computers by providing a limited IPv4 address configuration. It is the least secure NAP enforcement method. It is easily bypassed by an advanced user who has administrative privileges on the computer.

Combining NAP enforcement methods

It is possible to use more than one enforcement method simultaneously. An organization might invest additional resources into combining these enforcement technologies because they have complementary strengths and weaknesses. NAP with VPN enforcement can be used to enforce organizational compliance policies on remote clients, while NAP with IPsec enforcement can be used for local clients. 802.1X and IPsec offer a particularly robust combination because together they can restrict network connectivity at multiple layers of the network protocol stack. The following table shows which enforcement methods can be combined. Keep in mind that the complexity of your NAP deployment will increase when you combine enforcement methods.

	IPsec	802.1X	VPN	DHCP
IPsec
802.1X			X
VPN		X		X
DHCP

Microsoft Course 20413