Skip to content

Commit 5e5f770

Browse files
khdowniekhdownie
committed
root squash article
1 parent 0723d31 commit 5e5f770

File tree

2 files changed

+168
-0
lines changed

2 files changed

+168
-0
lines changed

‎articles/storage/files/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,8 @@
211211
href: ../../backup/manage-afs-powershell.md?toc=/azure/storage/files/toc.json
212212
- name: REST API
213213
href: ../../backup/manage-azure-file-share-rest-api.md?toc=/azure/storage/files/toc.json
214+
- name: Root squash (NFS shares)
215+
href: nfs-root-squash.md
214216
- name: Availability and disaster recovery
215217
items:
216218
- name: Storage redundancy

‎articles/storage/files/nfs-root-squash.md

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
---
2+
title: Configure root squash settings for NFS Azure file shares
3+
description: Root squash is a security feature that prevents unauthorized root-level access to the NFS server by client machines. Learn how to configure root squash for NFS Azure file shares.
4+
author: khdownie
5+
ms.service: azure-file-storage
6+
ms.custom: linux-related-content
7+
ms.topic: conceptual
8+
ms.date: 09/12/2024
9+
ms.author: kendownie
10+
---
11+
12+
# Configure root squash for Azure Files
13+
14+
Permissions for NFS file shares are enforced by the client OS rather than the Azure Files service. Root squash is an administrative security feature in NFS that prevents unauthorized root-level access to the NFS server by client machines. This functionality is an important part of protecting user data and system settings from manipulation by untrusted or compromised clients.
15+
16+
Administrators should enable root squash in environments where multiple users or systems access the NFS share, especially in scenarios where client machines aren't fully trusted. By converting root users to anonymous users, root squash ensures that even if a client machine is compromised, the attacker can't exploit root privileges to access or modify critical files on the NFS server.
17+
18+
In this article, you learn how to configure and change root squash settings for NFS Azure file shares.
19+
20+
## Applies to
21+
22+
| File share type | SMB | NFS |
23+
|-|:-:|:-:|
24+
| Standard file shares (GPv2), LRS/ZRS | ![No, this article doesn't apply to standard SMB Azure file shares LRS/ZRS.](../media/icons/no-icon.png) | ![NFS shares are only available in premium Azure file shares.](../media/icons/no-icon.png) |
25+
| Standard file shares (GPv2), GRS/GZRS | ![No, this article doesn't apply to standard SMB Azure file shares GRS/GZRS.](../media/icons/no-icon.png) | ![NFS is only available in premium Azure file shares.](../media/icons/no-icon.png) |
26+
| Premium file shares (FileStorage), LRS/ZRS | ![No, this article doesn't apply to premium SMB Azure file shares.](../media/icons/no-icon.png) | ![Yes, this article applies to premium NFS Azure file shares.](../media/icons/yes-icon.png) |
27+
28+
## How root squash works with Azure Files
29+
30+
Root squash works by re-mapping the user ID (UID) and the group ID (GID) of the root user to a UID and GID belonging to the anonymous user on server. Root users accessing the file system are automatically converted to the anonymous, less-privileged user/group with limited permissions.
31+
32+
Although root squash is the default behavior in NFS, it's not the default option when creating an NFS Azure file share. You must explicitly enable root squash on the file share. You can do this when you create an NFS Azure file share, or later on.
33+
34+
## Root squash settings
35+
36+
You can choose from three root squash settings:
37+
38+
- **No root squash:** Turn off root squashing. This option is mainly useful for diskless clients or workloads as specified by documentation. This is the default setting when creating a new NFS Azure file share.
39+
- **All squash:** Map all UIDs and GIDs to the anonymous user. Useful for shares that require read only access by all clients.
40+
- **Root squash:** Map requests from UID/GID 0 (root) to the anonymous UID/GID. This doesn't apply to any other UIDs or GIDs that might be equally sensitive, such as user bin or group staff.
41+
42+
The following table highlights the UID behavior observed from the server when specific root squash options are configured.
43+
44+
| **Option** | **Client UID** | **Server UID** |
45+
|------------|----------------|----------------|
46+
| root_squash | 0 | 65534 |
47+
| root_squash | 1000 | 1000 |
48+
| no_root_squash | 0 | 0 |
49+
| no_root_squash | 1000 | 1000 |
50+
| all_squash | 0 | 65534 |
51+
| all_squash | 1000 | 65534 |
52+
53+
## Configure root squash on an existing NFS file share
54+
55+
You can configure root squash settings via the Azure portal, Azure PowerShell, or Azure CLI.
56+
57+
58+
# [Portal](#tab/azure-portal)
59+
60+
1. Sign in to the Azure portal and navigate to the FileStorage storage account containing the NFS Azure file share.
61+
62+
1. In the service menu, under **Data storage**, select **File shares**.
63+
64+
1.
65+
66+
# [Azure PowerShell](#tab/azure-powershell)
67+
68+
1. Sign in to Azure and select your subscription.
69+
70+
```azurepowershell-interactive
71+
Connect-AzAccount
72+
Select-AzSubscription -SubscriptionId "<your-subscription-id>"
73+
```
74+
75+
1. To enable root squash on the file share, run the following command. Replace `<resouce-group-name>`, `<storage-account-name>`, and `<file-share-name>` with your own values.
76+
77+
```azurepowershell-interactive
78+
Update-AzRmStorageShare `
79+
-ResourceGroupName <resource-group-name> `
80+
-StorageAccountName <storage-account-name> `
81+
-Name <file-share-name> `
82+
-RootSquash RootSquash
83+
```
84+
85+
1. To disable root squash on the file share, run the following command. Replace `<resouce-group-name>`, `<storage-account-name>`, and `<file-share-name>` with your own values.
86+
87+
```azurepowershell-interactive
88+
Update-AzRmStorageShare `
89+
-ResourceGroupName <resource-group-name> `
90+
-StorageAccountName <storage-account-name> `
91+
-Name <file-share-name> `
92+
-RootSquash NoRootSquash
93+
```
94+
95+
1. To force squash for all users, run the following command to map all user IDs to anonymous. Replace `<resouce-group-name>`, `<storage-account-name>`, and `<file-share-name>` with your own values.
96+
97+
```azurepowershell-interactive
98+
Update-AzRmStorageShare `
99+
-ResourceGroupName <resource-group-name> `
100+
-StorageAccountName <storage-account-name> `
101+
-Name <file-share-name> `
102+
-RootSquash AllSquash
103+
```
104+
105+
1. To view the root squash property for a file share, run the following command. Replace `<resouce-group-name>`, `<storage-account-name>`, and `<file-share-name>` with your own values.
106+
107+
```azurepowershell-interactive
108+
Get-AzRmStorageShare `
109+
-ResourceGroupName <resource-group-name> `
110+
-StorageAccountName <storage-account-name> `
111+
-Name <file-share-name> | fl -Property ResourceGroupName, StorageAccountName, Name, QuotaGiB,AccessTier,EnabledProtocols,RootSquash
112+
```
113+
114+
# [Azure CLI](#tab/azure-cli)
115+
116+
1. Sign in to Azure and set your subscription.
117+
118+
```azurecli-interactive
119+
az login
120+
az account set --subscription "<your-subscription-id>"
121+
```
122+
123+
1. To enable root squash on the file share, run the following command. Replace `<resouce-group-name>`, `<storage-account-name>`, and `<file-share-name>` with your own values.
124+
125+
```azurecli-interactive
126+
az storage share-rm update \
127+
--resource-group <resource-group-name> \
128+
--storage-account <storage-account-name> \
129+
--name <file-share-name> \
130+
--root-squash RootSquash
131+
```
132+
133+
1. To disable root squash on the file share, run the following command. Replace `<resouce-group-name>`, `<storage-account-name>`, and `<file-share-name>` with your own values.
134+
135+
```azurecli-interactive
136+
az storage share-rm update \
137+
--resource-group <resource-group-name> \
138+
--storage-account <storage-account-name> \
139+
--name <file-share-name> \
140+
--root-squash NoRootSquash
141+
```
142+
143+
1. To force squash for all users, run the following command to map all user IDs to anonymous. Replace `<resouce-group-name>`, `<storage-account-name>`, and `<file-share-name>` with your own values.
144+
145+
```azurecli-interactive
146+
az storage share-rm update \
147+
--resource-group <resource-group-name> \
148+
--storage-account <storage-account-name> \
149+
--name <file-share-name> \
150+
--root-squash AllSquash
151+
```
152+
153+
1. To view the root squash property for a file share, run the following command. Replace `<resouce-group-name>`, `<storage-account-name>`, and `<file-share-name>` with your own values.
154+
155+
```azurecli-interactive
156+
az storage share-rm show \
157+
--resource-group <resource-group-name> \
158+
--storage-account <storage-account-name> \
159+
--name <file-share-name>
160+
```
161+
162+
---
163+
164+
## See also
165+
166+
- [NFS Azure file shares](files-nfs-protocol.md)

0 commit comments

Comments
 (0)