The following steps need only be done once:
The following steps need to be performed on every boot; this should really be done by init scripts. The necessary init scripts already exist in recent Fedora distributions. See also debian/nfs-common.init and debian/nfs-kernel-server.init in the patched nfs-utils tarball for example init scripts.
Depending on your distribution of linux you may have to add nfs4 to the list of filesystems to exclude from the nightly updatedb run. For example in Ubuntu you would add "nfs4" to the PRUNEFS list in /etc/updatedb.conf.
Exporting and mounting can be automated using /etc/fstab and /etc/exports; see the man pages fstab(5) and exports(5). Note that exports behave quite differently under v4 and v3, so some additional explanation may be called for:
NFSv4 no longer has a separate "mount" protocol. Instead of exporting a number of distinct exports, an NFSv4 client sees the NFSv4 server's exports as existing inside a single filesystem, called the nfsv4 "pseudofilesystem".
On the current linux implementation, the pseudofilesystem is a single real filesystem, identified at export with the fsid=0 option.
In the example above, we exported only a single filesystem, which the client mounted as "/". You can provide clients with multiple filesystems to mount, producing NFSv3-like-behavior, by creative use of mount --bind. For example, you could export /usr/local/bin to clients as /bin and /usr/local/etc as /etc as follows:
mkdir /export mkdir /export/bin mkdir /export/etc mount --bind /usr/local/bin /export/bin mount --bind /usr/local/etc /export/etc exportfs -ofsid=0,insecure,no_subtree_check *:/export exportfs -orw,nohide,insecure,no_subtree_check *:/export/bin exportfs -orw,nohide,insecure,no_subtree_check *:/export/etc
Note that the paths returned by the "showmount" program are meaningful only to clients using nfs versions 2 and 3; in the above example, "showmount" will list the paths /export, /export/bin/, and /export/etc, but nfsv4 clients should mount yourserver:/, yourserver:/bin, or yourserver:/etc.
Mounting and exporting krb5
To mount a filesystem using krb5, provide the "-osec=krb5" option to mount.
To export a filesystem using krb5, add the export option "sec=krb5". (Note: if your kernel is older than 2.6.23, or nfs-utils older than 1.1.1, you will instead need to export to a special client named "gss/krb5".)
There are two additional modes which provide increase security, at the expense of some performance: krb5i provides integrity protection for all nfs traffic, and krb5p in addition encrypts all traffic. You can replace "krb5" by "krb5i" or "krb5p" in the above to use those modes, and on the server side you can allow the client to use of any of them with an export option like "sec=krb5:krb5i:krb5p". (See the exports(5) man page for details.)
All of these options should also work for NFSv3 exports and mounts.