File Storage NAS:Encryption in transit for NFS file systems

How it works

The NAS client defines a network file system type named alinas that is compatible with the standard mount command. When you mount a file system of the alinas type on an ECS instance and specify the tls parameter, the NAS client starts a Stunnel listener process. This process forwards and encrypts requests from the ECS instance to the NAS server. A backend process named aliyun-alinas-mount-watchdog runs in the background to ensure the Stunnel listener process remains available.

Prerequisites

• A general-purpose NAS NFS file system has been created. For more information, see Create a file system.

  Important

  Before you enable encryption in transit, if an NFS file system is already mounted to the target directory (for example, /mnt) on your ECS instance, you must first unmount the file system. You can then follow the instructions in this topic to remount it. For information about how to unmount a file system, see Unmount a file system in the NAS console.

• The target ECS instance has an internet connection or is associated with an elastic IP address (EIP). For more information, see Network bandwidth.

• The ECS instance and the NAS file system are in the same region and VPC.

Usage notes

• Only general-purpose NAS NFS file systems are supported.

• The NAS client is supported on the following operating systems:

  Operating system	Supported versions
  Alibaba Cloud Linux	Alibaba Cloud Linux 2.1903 64-bit Alibaba Cloud Linux 3.2104 LTS 64-bit
  Red Hat	Red Hat Enterprise Linux 7.x 64-bit Red Hat Enterprise Linux 8.x 64-bit
  CentOS	CentOS 7.x 64-bit CentOS 8.x 64-bit
  Ubuntu	Ubuntu 16.04 64-bit Ubuntu 18.04 64-bit Ubuntu 20.04 64-bit
  Debian	Debian 9.x 64-bit Debian 10.x 64-bit

• Performance impact of encryption in transit

  Compared with unencrypted mounts, enabling encryption in transit increases access latency by approximately 10% and decreases IOPS by approximately 10%.

• Notes on using the NAS client

  • The NAS client uses a Stunnel listener process as a TLS encryption proxy. For throughput-intensive applications, the Stunnel listener process consumes significant CPU resources for encryption and decryption. In extreme cases, each mount can consume an entire CPU core.

  • Encryption in transit for the NAS client relies on a third-party certificate that requires periodic renewal. NAS sends notifications by email and internal message one month before the certificate expires. Monitor these notifications and promptly update the aliyun-alinas-utils version of the NAS client. If you fail to update the client, any file system mounted with encryption becomes unresponsive after the certificate expires.

  • The NAS client modifies the /etc/hosts file on your ECS instance. When you mount a file system, a new mount target mapping is written to the /etc/hosts file. When you unmount the file system, the client deletes the previously written mapping.

  • When the NAS client uses a Stunnel listener process as a TLS proxy, it occupies an IP address from the 127.0.1.1 to 127.0.255.254 range and uses port 12049. Ensure that the target IP address and port are available.

    You can run the ss -ant | grep -w 12049 command to check if the target port is occupied. If the output is empty, the port is available. If the port is occupied, you must modify the configuration file. For more information, see Modify the NAS client configuration file.

Step 1: Download and install the NAS client

Step 2: Mount with encryption in transit

1. Mount the NFS file system.

   • NFSv3

     sudo mount -t alinas -o tls,vers=3 file-system-id.region.nas.aliyuncs.com:/ /mnt

   • NFSv4.0

     sudo mount -t alinas -o tls,vers=4.0 file-system-id.region.nas.aliyuncs.com:/ /mnt

   The following table describes the parameters in the mount command.

   Note

   When you mount the file system, the NAS client automatically uses the optimal mount parameters. You do not need to specify them manually. For more information, see Mount command parameters.

   Parameter	Description
   file-system-id.region.nas.aliyuncs.com:/ /mnt	The format is <mount target domain>:<NAS file system directory> <Local mount directory>. Replace the variables with your actual values. Mount target domain: In the File Storage NAS console, navigate to the File System List page, find your file system, and click Manage in the Actions column. You can find the mount target domain on the Mount Targets page. For more information, see Manage mount targets. NAS file system directory: The root directory (/) or a subdirectory (for example, /share) of the NAS file system. If you specify a subdirectory, ensure that it already exists in the NAS file system. Local mount directory: A directory on your Linux ECS instance (for example, /mnt). Ensure that this directory exists on your local file system.
   vers	The version of the NFS protocol. vers=3: Mounts the file system by using NFSv3. vers=4.0: Mounts the file system by using NFSv4.0.
   tls	Enables encryption in transit.

2. Run the mount -l command to view the mount result.

   If the output contains information similar to the following, the mount is successful.

   alinas-xxx.cn-zhangjiakou.tls.127.0.1.3:/ on /mnt type nfs (rw,relatime,vers=3,rsize=1048576,wsize=1048576,namlen=255,hard,nolock,noresvport,proto=tcp,port=12050,timeo=600,retrans=2,sec=sys,mountaddr=127.0.1.3,mountvers=3,mountport=12050,mountproto=tcp,local_lock=all,addr=127.0.1.3)

   After a successful mount, you can run the df -h command to view the capacity of the file system.

3. Optional: Configure the file system to mount automatically on system startup.

   To ensure the file system automatically remounts after a system restart, you can configure the /etc/fstab file in the Linux ECS instance to automatically mount the NFS file system.

   1. Open the /etc/fstab configuration file and add a mount entry.

      file-system-id.region.nas.aliyuncs.com:/ /mnt alinas _netdev,tls 0 0

      For a description of the main parameters in this example, see Mount an NFS file system. The other parameters are described below.

      Parameter	Description
      _netdev	Prevents the client from attempting to mount the file system before the network is ready.
      0 (the first value after tls)	A non-zero value indicates that the file system should be backed up by the dump command. For a NAS file system, set this value to 0.
      0 (the second value after tls)	Indicates the order for file system checks by fsck at startup. For a NAS file system, set this value to 0. This prevents fsck from checking the file system at startup.

   2. Run the reboot command to restart the ECS instance.

      Restarting the server may interrupt your services. We recommend that you perform this operation during off-peak hours.

      Note

      To prevent boot failures, verify that your /etc/fstab entry is correct before you restart the ECS instance. If the automatic mount is configured correctly, you can see the mounted NAS file system by running the df -h command after the ECS instance restarts.

NAS client logs

You can review NAS client logs in the /var/log/aliyun/alinas/ directory to troubleshoot mount errors. You can also customize the log content by modifying the parameters in the log configuration file at /etc/aliyun/alinas/alinas-utils.conf. After you modify the configuration file, run the sudo service aliyun-alinas-mount-watchdog restart command to restart the backend watchdog process.

Troubleshooting

• Symptom

  When you mount the file system, you receive the following error:

  $sudo mount -t alinas -o tls,vers=4.0 xxx cn-hangzhou.nas.aliyuncs.com /mnt
  Failed to find a loopback ip from 127.0.1.1 ~ 127.0.255.254 with port 12049

• Cause

  The mount fails because the IP address or port 12049 required by the Stunnel listener process is already in use.

• Solution

  • Solution 1: Find and terminate the process that is using port 12049, and then mount the file system again.

  • Solution 2: Modify the proxy_port parameter in the NAS client configuration file at /etc/aliyun/alinas/alinas-utils.conf to an unused port number, and then mount the file system again.

    [DEFAULT]
    logging_level = INFO
    logging_max_bytes = 1048576
    logging_file_count = 10
    [mount]
    stunnel_debug_enabled = false
    # Validate the certificate hostname on mount. This option is not supported by certain stunnel versions.
    stunnel_check_cert_hostname = false
    # Use OCSP to check certificate validity. This option is not supported by certain stunnel versions.
    stunnel_check_cert_validity = false
    proxy_port = 12050
    [mount-watchdog]
    poll_interval_sec = 1
    unmount_grace_period_sec = 30