Introduction

Mounting remote file systems is a fundamental task for sysadmins, developers, and power users who need transparent access to remote data. Two of the most popular solutions on Linux are SSHFS (SSH Filesystem via FUSE) and NFS (Network File System). Each has its strengths and trade-offs in terms of performance, security, ease of setup, and flexibility. This article explores both methods in depth, offering installation guides, configuration examples, security best practices, performance tuning tips, and troubleshooting advice.

1. SSHFS: SSH-Based Filesystem

1.1 Overview

SSHFS uses the FUSE framework to mount directories over SSH. It leverages the security and authentication mechanisms of SSH, making it simple to set up with no need for additional network services or complicated exports.

1.2 Prerequisites

• Linux client with fuse and sshfs packages installed.
• SSH server running on the remote machine.
• User account on the remote host with appropriate permissions.

1.3 Installation

On most distributions:

sudo apt-get update
sudo apt-get install sshfs        
sudo yum install fuse-sshfs       
sudo pacman -S sshfs              
  

1.4 Basic Usage

Mount a remote directory:

mkdir -p ~/mnt/remote
sshfs user@remote.example.com:/path/to/share ~/mnt/remote
  

Unmount:

fusermount -u ~/mnt/remote
  

1.5 Advanced Options

• -o allow_other: Allow other users to access the mount.
• -o reconnect: Automatically reconnect when connection drops.
• -o IdentityFile=~/.ssh/id_rsa: Specify private key.
• -o follow_symlinks: Follow symbolic links on the server side.

1.6 Security Considerations

• SSHFS inherits SSH’s encryption ensure strong ciphers in /etc/ssh/sshd_config.
• Use key-based authentication with passphrase-protected keys.
• Limit SSHFS users via AllowUsers or Match User blocks.
• Enable fail2ban to mitigate brute-force attempts.

1.7 Performance Tips

• Enable caching: -o cache_timeout=600, -o attr_timeout=600.
• Tune SSH compression: -o Compression=no for CPU-bound workloads.
• Adjust TCP window sizes via sysctl.

2. NFS: Network File System

2.1 Overview

NFS is a mature, high-performance solution ideal for LAN environments and multi-server sharing. Versions 3 and 4 are widely used, with NFSv4 offering built-in security features.

2.2 Prerequisites

• Server: nfs-kernel-server (or equivalent) installed and running.
• Client: nfs-common (or equivalent) installed.
• Properly configured /etc/exports on the server.

2.3 Server Configuration

Edit /etc/exports:

/srv/data 192.168.1.0/24(rw,sync,no_subtree_check)
  

Export and restart:

exportfs -a
systemctl restart nfs-server
  

2.4 Client Mounting

mkdir -p ~/mnt/nfs
mount -t nfs4 192.168.1.10:/srv/data ~/mnt/nfs
  

To enable at boot, add to /etc/fstab:

192.168.1.10:/srv/data  /home/user/mnt/nfs  nfs4  defaults  0  0
  

2.5 Security and Access Control

• Use root_squash to map remote root to anonymous user.
• Implement Kerberos / sec=krb5 for NFSv4 authentication.
• Restrict networks and hosts in /etc/exports.

2.6 Performance Optimization

• Mount options: rsize=65536,wsize=65536, noatime.
• Network tuning: Jumbo frames, TCP offload features.
• Use async cautiously for write performance at the cost of data integrity on crash.

3. Comparing SSHFS and NFS

4. Advanced Topics

4.1 Using VPN to Secure File System Traffic

For additional security or complex network topologies, you can tunnel file system traffic over a VPN. Popular solutions include
OpenVPN and
WireGuard.
This approach encrypts all traffic and can simplify firewall rules by treating remote hosts as part of a private subnet.

4.2 Automount with systemd

Create a mount unit /etc/systemd/system/remote-sshfs.mount:

[Unit]
Description=SSHFS Mount

[Mount]
What=user@remote:/data
Where=/mnt/remote
Type=fuse.sshfs
Options=IdentityFile=/home/user/.ssh/id_rsa,allow_other,reconnect

[Install]
WantedBy=multi-user.target
  

Then enable and start:

sudo systemctl enable remote-sshfs.mount
sudo systemctl start remote-sshfs.mount
  

4.3 Performance Tuning

• Experiment with FUSE options: large_read, noappledouble on macOS clients.
• For NFS, consider async with battery-backed caches.
• Benchmark with fio or dd to identify IOPS vs throughput bottlenecks.

4.4 Troubleshooting

• Check dmesg and journalctl for FUSE or NFS errors.
• Enable verbose SSHFS logs: -o sshfs_debug, -o log_level=debug.
• Use rpcinfo and showmount to diagnose NFS exports.
• Verify network connectivity and firewall rules (ports 2049 for NFS, 22 for SSHFS).

Conclusion

Both SSHFS and NFS have their places in a sysadmin’s toolkit. SSHFS shines for quick, secure remote mounts without additional services, while NFS delivers higher performance and better integration in LAN and cluster environments. By following the installation guides, security recommendations, and tuning tips outlined above, you can confidently deploy whichever solution best fits your use case.

© 2024 Remote Filesystems Inc. All rights reserved.