Skip to content

Commit 265d8d8

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #286656 from khdownie/kendownie-rootsquash
root squash article
2 parents 96397ee + 2fab141 commit 265d8d8

File tree

4 files changed

+174
-1
lines changed

4 files changed

+174
-1
lines changed

‎articles/storage/files/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,8 @@
169169
href: authorize-oauth-rest.md
170170
- name: Enable threat protection
171171
href: ../common/azure-defender-storage-configure.md?toc=/azure/storage/files/toc.json
172+
- name: Configure root squash (NFS shares)
173+
href: nfs-root-squash.md
172174
- name: Data protection
173175
items:
174176
- name: Data protection overview

‎articles/storage/files/files-nfs-protocol.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ The status of items that appear in this table might change over time as support
8181
| [Premium tier](storage-files-planning.md#storage-tiers) | ✔️ |
8282
| [Standard tiers (Hot, Cool, and Transaction optimized)](storage-files-planning.md#storage-tiers)| ⛔ |
8383
| [POSIX-permissions](https://en.wikipedia.org/wiki/File-system_permissions#Notation_of_traditional_Unix_permissions)| ✔️ |
84-
| Root squash| ✔️ |
84+
| [Root squash](nfs-root-squash.md)| ✔️ |
8585
| Access same data from Windows and Linux client| ⛔ |
8686
| [Identity-based authentication](storage-files-active-directory-overview.md) | ⛔ |
8787
| [Azure file share soft delete](storage-files-prevent-file-share-deletion.md) | ✔️ |

‎articles/storage/files/media/nfs-root-squash/toggle-root-squash.png

42.2 KB
Loading

‎articles/storage/files/nfs-root-squash.md

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
---
2+
title: Configure root squash settings for NFS Azure file shares
3+
description: Root squash is a security feature that prevents unauthorized root-level access to the NFS server by client machines. Learn how to configure root squash for NFS Azure file shares.
4+
author: khdownie
5+
ms.service: azure-file-storage
6+
ms.custom: linux-related-content
7+
ms.topic: conceptual
8+
ms.date: 09/13/2024
9+
ms.author: kendownie
10+
---
11+
12+
# Configure root squash for Azure Files
13+
14+
Permissions for NFS file shares are enforced by the client OS rather than the Azure Files service. Root squash is an administrative security feature in NFS that prevents unauthorized root-level access to the NFS server by client machines. This functionality is an important part of protecting user data and system settings from manipulation by untrusted or compromised clients.
15+
16+
Administrators should enable root squash in environments where multiple users or systems access the NFS share, especially in scenarios where client machines aren't fully trusted. By converting root users to anonymous users, root squash ensures that even if a client machine is compromised, the attacker can't exploit root privileges to access or modify critical files on the NFS server.
17+
18+
In this article, you learn how to configure and change root squash settings for NFS Azure file shares.
19+
20+
## Applies to
21+
22+
| File share type | SMB | NFS |
23+
|-|:-:|:-:|
24+
| Standard file shares (GPv2), LRS/ZRS | ![No, this article doesn't apply to standard SMB Azure file shares LRS/ZRS.](../media/icons/no-icon.png) | ![NFS shares are only available in premium Azure file shares.](../media/icons/no-icon.png) |
25+
| Standard file shares (GPv2), GRS/GZRS | ![No, this article doesn't apply to standard SMB Azure file shares GRS/GZRS.](../media/icons/no-icon.png) | ![NFS is only available in premium Azure file shares.](../media/icons/no-icon.png) |
26+
| Premium file shares (FileStorage), LRS/ZRS | ![No, this article doesn't apply to premium SMB Azure file shares.](../media/icons/no-icon.png) | ![Yes, this article applies to premium NFS Azure file shares.](../media/icons/yes-icon.png) |
27+
28+
## How root squash works with Azure Files
29+
30+
Root squash works by re-mapping the user ID (UID) and the group ID (GID) of the root user to a UID and GID belonging to the anonymous user on server. Root users accessing the file system are automatically converted to the anonymous, less-privileged user/group with limited permissions.
31+
32+
Although root squash is the default behavior in NFS, it's not the default option when creating an NFS Azure file share. You must explicitly enable root squash on the file share. You can do this when you create an NFS Azure file share, or later on.
33+
34+
## Root squash settings
35+
36+
You can choose from three root squash settings:
37+
38+
- **No root squash:** Turn off root squashing. This option is mainly useful for diskless clients or workloads as specified by workload documentation. This is the default setting when creating a new NFS Azure file share.
39+
- **All squash:** Map all UIDs and GIDs to the anonymous user. Useful for shares that require read-only access by all clients.
40+
- **Root squash:** Map requests from UID/GID 0 (root) to the anonymous UID/GID. This doesn't apply to any other UIDs or GIDs that might be equally sensitive, such as user bin or group staff.
41+
42+
The following table highlights the UID behavior observed from the server when specific root squash options are configured.
43+
44+
| **Option** | **Client UID** | **Server UID** |
45+
|------------|----------------|----------------|
46+
| root_squash | 0 | 65534 |
47+
| root_squash | 1000 | 1000 |
48+
| no_root_squash | 0 | 0 |
49+
| no_root_squash | 1000 | 1000 |
50+
| all_squash | 0 | 65534 |
51+
| all_squash | 1000 | 65534 |
52+
53+
## Configure root squash on an existing NFS file share
54+
55+
You can configure root squash settings via the Azure portal, Azure PowerShell, or Azure CLI.
56+
57+
# [Portal](#tab/azure-portal)
58+
59+
1. Sign in to the Azure portal and navigate to the FileStorage storage account containing the NFS Azure file share.
60+
61+
1. In the service menu, under **Data storage**, select **File shares**.
62+
63+
1. Select the file share for which you want to modify the root squash setting.
64+
65+
1. In the service menu, select **Properties**. Then toggle the **Root squash** setting as desired.
66+
67+
:::image type="content" source="media/nfs-root-squash/toggle-root-squash.png" alt-text="Screenshot showing how to configure root squash settings for an NFS file share in the Azure portal." lightbox="media/nfs-root-squash/toggle-root-squash.png":::
68+
69+
1. Select **Save** to update the root squash value.
70+
71+
# [Azure PowerShell](#tab/azure-powershell)
72+
73+
1. Sign in to Azure and select your subscription.
74+
75+
```azurepowershell-interactive
76+
Connect-AzAccount
77+
Select-AzSubscription -SubscriptionId "<your-subscription-id>"
78+
```
79+
80+
1. To enable root squash on the file share, run the following command. Replace `<resouce-group-name>`, `<storage-account-name>`, and `<file-share-name>` with your own values.
81+
82+
```azurepowershell-interactive
83+
Update-AzRmStorageShare `
84+
-ResourceGroupName <resource-group-name> `
85+
-StorageAccountName <storage-account-name> `
86+
-Name <file-share-name> `
87+
-RootSquash RootSquash
88+
```
89+
90+
1. To disable root squash on the file share, run the following command. Replace `<resouce-group-name>`, `<storage-account-name>`, and `<file-share-name>` with your own values.
91+
92+
```azurepowershell-interactive
93+
Update-AzRmStorageShare `
94+
-ResourceGroupName <resource-group-name> `
95+
-StorageAccountName <storage-account-name> `
96+
-Name <file-share-name> `
97+
-RootSquash NoRootSquash
98+
```
99+
100+
1. To force squash for all users, run the following command to map all user IDs to anonymous. Replace `<resouce-group-name>`, `<storage-account-name>`, and `<file-share-name>` with your own values.
101+
102+
```azurepowershell-interactive
103+
Update-AzRmStorageShare `
104+
-ResourceGroupName <resource-group-name> `
105+
-StorageAccountName <storage-account-name> `
106+
-Name <file-share-name> `
107+
-RootSquash AllSquash
108+
```
109+
110+
1. To view the root squash property for a file share, run the following command. Replace `<resouce-group-name>`, `<storage-account-name>`, and `<file-share-name>` with your own values.
111+
112+
```azurepowershell-interactive
113+
Get-AzRmStorageShare `
114+
-ResourceGroupName <resource-group-name> `
115+
-StorageAccountName <storage-account-name> `
116+
-Name <file-share-name> | fl -Property ResourceGroupName, StorageAccountName, Name, QuotaGiB,AccessTier,EnabledProtocols,RootSquash
117+
```
118+
119+
# [Azure CLI](#tab/azure-cli)
120+
121+
1. Sign in to Azure and set your subscription.
122+
123+
```azurecli-interactive
124+
az login
125+
az account set --subscription "<your-subscription-id>"
126+
```
127+
128+
1. To enable root squash on the file share, run the following command. Replace `<resouce-group-name>`, `<storage-account-name>`, and `<file-share-name>` with your own values.
129+
130+
```azurecli-interactive
131+
az storage share-rm update \
132+
--resource-group <resource-group-name> \
133+
--storage-account <storage-account-name> \
134+
--name <file-share-name> \
135+
--root-squash RootSquash
136+
```
137+
138+
1. To disable root squash on the file share, run the following command. Replace `<resouce-group-name>`, `<storage-account-name>`, and `<file-share-name>` with your own values.
139+
140+
```azurecli-interactive
141+
az storage share-rm update \
142+
--resource-group <resource-group-name> \
143+
--storage-account <storage-account-name> \
144+
--name <file-share-name> \
145+
--root-squash NoRootSquash
146+
```
147+
148+
1. To force squash for all users, run the following command to map all user IDs to anonymous. Replace `<resouce-group-name>`, `<storage-account-name>`, and `<file-share-name>` with your own values.
149+
150+
```azurecli-interactive
151+
az storage share-rm update \
152+
--resource-group <resource-group-name> \
153+
--storage-account <storage-account-name> \
154+
--name <file-share-name> \
155+
--root-squash AllSquash
156+
```
157+
158+
1. To view the root squash property for a file share, run the following command. Replace `<resouce-group-name>`, `<storage-account-name>`, and `<file-share-name>` with your own values.
159+
160+
```azurecli-interactive
161+
az storage share-rm show \
162+
--resource-group <resource-group-name> \
163+
--storage-account <storage-account-name> \
164+
--name <file-share-name>
165+
```
166+
167+
---
168+
169+
## See also
170+
171+
- [NFS Azure file shares](files-nfs-protocol.md)

0 commit comments

Comments
 (0)