From 9d41369d77c102a42223690eb165006124f93d4f Mon Sep 17 00:00:00 2001 From: Socialpranker <273312799+Socialpranker@users.noreply.github.com> Date: Sun, 12 Jul 2026 09:53:17 +0200 Subject: [PATCH] serve nfs: advertise AUTH_UNIX so the *BSD NFS clients can mount The mount served fine on Linux and macOS but *BSD kernel NFS clients refused it with "Authentication error". The MOUNT reply only ever offered AUTH_NULL, and the OpenBSD/FreeBSD/NetBSD clients won't mount a server unless AUTH_UNIX is among the offered flavors. Add AUTH_UNIX to the advertised list. The server still doesn't inspect the credential (there's no per-user access control here) so the AUTH_UNIX cred the client then sends is read as an opaque blob and ignored, exactly as the AUTH_NULL one was. No behaviour change for existing Linux/macOS clients, and OpenBSD now mounts and reads files over the share. Verified on a real OpenBSD 7.9 arm64 VM: registered rclone's server in portmap and ran "mount_nfs -T localhost:/ /mnt"; the mount now succeeds (MOUNT and GetAttr RPCs go through) and files read back correctly through the mount, where before it stopped at the auth stage. Co-Authored-By: Claude Opus 4.8 --- cmd/serve/nfs/handler.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/cmd/serve/nfs/handler.go b/cmd/serve/nfs/handler.go index e16f0f2b7..0b354d1bc 100644 --- a/cmd/serve/nfs/handler.go +++ b/cmd/serve/nfs/handler.go @@ -64,7 +64,13 @@ func NewHandler(ctx context.Context, vfs *vfs.VFS, opt *Options) (handler nfs.Ha // looked up and must be a plain directory (not a regular file, symlink or // other special node). func (h *Handler) Mount(ctx context.Context, conn net.Conn, req nfs.MountRequest) (status nfs.MountStatus, hndl billy.Filesystem, auths []nfs.AuthFlavor) { - auths = []nfs.AuthFlavor{nfs.AuthFlavorNull} + // Advertise both AUTH_NULL and AUTH_UNIX. The server doesn't inspect the + // credential either way (there is no per-user access control here), but the + // *BSD kernel NFS clients refuse to mount a server that only offers + // AUTH_NULL and require AUTH_UNIX to be on offer, so listing it lets them + // mount. The AUTH_UNIX credential they then send is read as an opaque blob + // and ignored, exactly as the AUTH_NULL one was. + auths = []nfs.AuthFlavor{nfs.AuthFlavorNull, nfs.AuthFlavorUnix} cleaned := path.Clean("/" + string(req.Dirpath)) if cleaned == "/" { return nfs.MountStatusOk, h.billyFS, auths