NFS-Root not working when booting over PXE

debian-squeezeinitramfsnfspxe-boottftp

I am desperately trying to get a diskless client running over PXE-Boot using a NFS-Share as a root file system. I did this before some years ago but for some reason I am stucked at this since days.

The TFTP-Server itself is running fine and booting a netinstaller works also fine. The kernel and initrd are loaded also but the bootprocess stops with this (screenshot) kernel panic.

I'm using the squeeze standard i386-Kernel and I have prepared the initrd with this config:

MODULES=most
BUSYBOX=y
KEYMAP=n
COMPRESS=gzip
BOOT=nfs
DEVICE=
NFSROOT=auto

I also tried

MODULES=netboot

with the same outcome.

My PXE-configuration looks like this:

LABEL linux
KERNEL diskless/debian-default/vmlinuz-2.6.32-5-686
APPEND root=/dev/nfs initrd=diskless/debian-default/vmlinuz-2.6.32-5-686 nfsroot=192.168.140.2:/storage/nfs-boot-images/default-squeeze ip=dhcp rw

Furthermore I have captured the network communication of the client via tcpdump and learned that the client isn't even trying to connect to the NFS-share.

Does anybody has got an idea what is going wrong here?

Best Answer

this is wrong;

initrd=diskless/debian-default/vmlinuz-2.6.32-5-686

you are trying to load as initrd what in fact is the KERNEL; see the kernel line. That's why when the kernel tries to mount a kernel copy as the initial ram disk it panics... correct that line and you'll be fine

Related Solutions

Ubuntu PXE boot mount wrong NFS share

In case anyone come for an answer, I would like to put my fix here.

I got around this problem by changing from nfs-kernel-server to unfsd. Without changing anything in the PXE configuration or on the client the problem disappeared.

Didn't try Fox's fix for fsid though.

Linux – NFS. Non-root mount requests

The most likely reason you are having problems with non-root mounts is the "secure" export option, which is on by default. It disallows mount requests that come in with a source port greater than 1024. On most systems, binding to a port less than 1024 requires root access, so this is a fairly decent way of ensuring the mount was made by root.

The issue, as explained in the README for my NfSpy penetration testing tool, is that the NFS protocol (versions 2, 3, and even 4, without proper configuration) completely trusts the user ID sent in requests from client machines. By limiting requests to only those made by root, you limit your trust to only users on the client machine who have root access. Without this setting (using "insecure" in your exports file), any user can claim to have any UID and access any file on the export.

The reason it is working on Linux is probably because /bin/mount is setuid root:

~$ ls -l /bin/mount
-rwsr-xr-x 1 root root 72188 2011-01-20 13:54 /bin/mount

Just a hunch, but check the permissions on the mount binary on your FreeBSD system. If it is setuid, then you still have a problem, and I don't know what it is. If not, then that would explain what's going on.

Good luck with this, but please consider the security implications of allowing any user on a system to access any file on your server. I recommend using NFS4 with GSS authentication mechanisms instead of the traditional AUTH_SYS flavor.

Related Topic