Handling UID/GID Mapping for NFS-based Homes
In this lesson, you will learn how to ensure that your users maintain consistent file ownership when accessing their home directories across different machines via NFS.
When you mount a user's home directory over NFS, the Linux kernel identifies file ownership based on the numeric UID (User ID) and GID (Group ID) stored in the filesystem metadata. If your central authentication server (like LDAP or SSSD) assigns UID 1005 to "alice" on Machine A, but Machine B inadvertently maps that same username to UID 1006, "alice" will be unable to read or write her own files when she logs into Machine B. NFS relies on this numeric parity; it does not "know" about the username, only the ID.
To prevent permission errors and security gaps, you must ensure that identity lookup services remain synchronized across your infrastructure. When using NFS-based homes, the server and all client nodes must resolve the same username to the exact same numeric ID.
Consider this scenario: if your server exports /home/nfs and a client attempts to access it, the client-side system must be configured to prioritize the centralized identity source (via /etc/nsswitch.conf) over local files like /etc/passwd.
To maintain consistency, verify your SSSD or LDAP configurations on all nodes:
# Check if the client resolves the user to the correct ID
getent passwd alice
If getent returns a different UID on different machines, your NFS mount will show "nobody" as the owner, or worse, grant a user access to the wrong files. Always ensure your central identity provider is the authoritative source for these IDs across your entire network. By keeping the UID/GID mapping unified, the NFS layer can transparently map the file ownership, allowing users to move seamlessly between workstations without experiencing "Permission Denied" errors or cross-talk between user data.
Key Takeaway: Consistency in numeric UIDs and GIDs across all network nodes is mandatory for NFS-based home directories, as file ownership is determined strictly by these IDs rather than usernames.