Linux – NFS: force file mode/mask on mount

NFSv4 does user@DOMAIN lookups (not simple UID/GID enforcement like NFSv3) so you need to have the same authentication database (files, LDAP, whatever) on both systems. With v3 all you need is to have the same UID/GID as the file...not necessarily the same username. If you don't need any of the features of v4, I'd recommend going with v3 on Linux. Historically, Linux has had a pretty flaky v4 implementation.

Given you're coming from Windows, you'll find that NFS is....different.

The issue you're running into is fairly common. NFS is passing the UID and GID of the files/directories back and forth between the machines with the assumption that the user and group IDs are mapped identically on both. This means that you can get a situation where the UID/GID on the server is passed back to a NFS client, but it can't matched in the client's /etc/passwd or /etc/group, which means no access.

In the (distant) past this was co-oridnated with NIS and NIS+, although there are other schemes that have been wedged into this framework (Samba's Winbind being one of them). However, this requires a central ID server, followed by a lot of hand-fixing permissions.

There are different ways to fix this, but the cheapest/quickest is to create a group with the same group ID number on both machines - say, group ID 50000 - and set the group bits on the file server while adding the appropriate user to the group on the client; then use the group permissions on the files to control access. Not a great solution but it will work. Note that you could have problems with services that explicitly change their group at runtime (aka privledge drop) and you might need to change the setting that controls what group is assumed at runtime to ensure it is the one you have created.

For those files that come inbound via a Windows share (aka Samba) simply force the group to be the same as the one you create. That way all files automatically get the "right" GID.