<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">Yes the default squash is to 99.</span><br>
<br>
I did test setting the squash_g/uid to 0, and the behaviour did change. But that just seems to let root take actions on files/dirs owned by root .</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Is that how the nodemaps are supposed to work? It seems odd to me that setting admin to off and trusted to on doesn't allow clients to mount unless I also go in and set root to 0:0.</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Under the old way you just set the squash u/gid and then set your norootsquash list (a method I've been using for years).</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">[root@scmds2501 ~]# lctl get_param -R nodemap.default.*</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">nodemap.default.admin_nodemap=0</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">nodemap.default.audit_mode=1</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">nodemap.default.deny_unknown=0</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">nodemap.default.exports=</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">[</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof"> { nid: 172.17.1.127@o2ib, uuid: 5dd1bac6-cb91-1169-183d-f084efaba32d }, { nid: 172.17.1.221@o2ib, uuid: bd67c3f7-8a44-4fac-8685-2e234742a2c2 },</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">]</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">nodemap.default.fileset=</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">nodemap.default.forbid_encryption=0</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">nodemap.default.id=0</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">nodemap.default.map_mode=all</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">nodemap.default.squash_gid=99</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">nodemap.default.squash_projid=99</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">nodemap.default.squash_uid=99</span></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span class="elementToProof">nodemap.default.trusted_nodemap=1</span></div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> lustre-discuss <lustre-discuss-bounces@lists.lustre.org> on behalf of lustre-discuss-request@lists.lustre.org <lustre-discuss-request@lists.lustre.org><br>
<b>Sent:</b> Friday, February 13, 2026 4:04 PM<br>
<b>To:</b> lustre-discuss@lists.lustre.org <lustre-discuss@lists.lustre.org><br>
<b>Subject:</b> [EXTERNAL] lustre-discuss Digest, Vol 239, Issue 19</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Send lustre-discuss mailing list submissions to<br>
lustre-discuss@lists.lustre.org<br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.lustre.org_listinfo.cgi_lustre-2Ddiscuss-2Dlustre.org&d=DwICAg&c=CJqEzB1piLOyyvZjb8YUQw&r=a1-ymUluZsecMceDMlAHsomwMJl4Iqg-UcfvwQZVldk&m=kz9q20-DXpg7quLZcf40us_D3ehPJZJhFAlVJr744ciuZjyv-rEIsSs0kjdT-gw6&s=Bb3fge-EG_Cx4csq80n962jK_9vM_c270nkN8bxGfwU&e=">
https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.lustre.org_listinfo.cgi_lustre-2Ddiscuss-2Dlustre.org&d=DwICAg&c=CJqEzB1piLOyyvZjb8YUQw&r=a1-ymUluZsecMceDMlAHsomwMJl4Iqg-UcfvwQZVldk&m=kz9q20-DXpg7quLZcf40us_D3ehPJZJhFAlVJr744ciuZjyv-rEIsSs0kjdT-gw6&s=Bb3fge-EG_Cx4csq80n962jK_9vM_c270nkN8bxGfwU&e=</a>
<br>
or, via email, send a message with subject or body 'help' to<br>
lustre-discuss-request@lists.lustre.org<br>
<br>
You can reach the person managing the list at<br>
lustre-discuss-owner@lists.lustre.org<br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of lustre-discuss digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: getting "permission dendied" on mount when trying to use<br>
nodemaps for root squashing (Hans Henrik Happe)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Fri, 13 Feb 2026 14:29:54 +0100<br>
From: Hans Henrik Happe <happe@nbi.dk><br>
To: lustre-discuss@lists.lustre.org<br>
Subject: Re: [lustre-discuss] getting "permission dendied" on mount<br>
when trying to use nodemaps for root squashing<br>
Message-ID: <3b4ae3f4-3b32-43cc-bec5-52b417ab98d5@nbi.dk><br>
Content-Type: text/plain; charset="utf-8"; Format="flowed"<br>
<br>
Hi,<br>
<br>
Have you looked at the squash id's. I think they defaults to 99, but <br>
RHEL uses another id for the nobody user.<br>
<br>
A full list of parameters would make it easier to give input. If you <br>
could post this:<br>
<br>
lctl get_param nodemap.default.*<br>
<br>
Cheers,<br>
Hans Henrik<br>
<br>
On 09/02/2026 16.05, Kurt Strosahl via lustre-discuss wrote:<br>
> Good Morning,<br>
><br>
> ? ?I'm trying to set up nodemaps on a new lustre file system. <br>
> Presently when I turn on the nodemaps I get permission denied for <br>
> servers in the default nodemap.<br>
><br>
> I've defined two custom nodemaps.? An AdminSystems nodemap (for <br>
> servers that will need to perform actions as root, and a LustreServers <br>
> nodemap (for the lustre servers themselves)<br>
><br>
> Every other client will be in the default map. (whose gid/uid/projid <br>
> mappings we trust)<br>
><br>
> I set the following:<br>
> [root@scmds2501 ~]# lctl get_param nodemap.*.admin_nodemap<br>
> nodemap.AdminSystems.admin_nodemap=1<br>
> nodemap.LustreServers.admin_nodemap=1<br>
> Nodemap.default.admin_nodemap=0<br>
><br>
> [root@scmds2501 ~]# lctl get_param nodemap.*.trusted_nodemap<br>
> nodemap.AdminSystems.trusted_nodemap=1<br>
> nodemap.LustreServers.trusted_nodemap=1<br>
> Nodemap.default.trusted_nodemap=1<br>
><br>
> When I turn on the nodemap feature I get a permission denied when <br>
> mounting on a client node that isn't in the Admin nodemap.<br>
><br>
> Interestingly, on a test client that was mounted before I turned on <br>
> the nodemap I can write files as myself (into a directory that I <br>
> established beforehand owned by me).<br>
><br>
> Our desired end state is an Admin nodemap we can add and remove <br>
> systems to as needed that can take action as root, and all other <br>
> lustre clients being able to access the file system, but having no <br>
> root access.? The LustreServers nodemap is there to keep the lustre <br>
> file servers themselves safe from any unexpected changes.<br>
><br>
> w/r,<br>
><br>
> Kurt J. Strosahl (he/him)<br>
> System Administrator: Lustre, HPC<br>
> Scientific Computing Group, Thomas Jefferson National Accelerator Facility<br>
><br>
><br>
> _______________________________________________<br>
> lustre-discuss mailing list<br>
> lustre-discuss@lists.lustre.org<br>
> <a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.lustre.org_listinfo.cgi_lustre-2Ddiscuss-2Dlustre.org&d=DwICAg&c=CJqEzB1piLOyyvZjb8YUQw&r=a1-ymUluZsecMceDMlAHsomwMJl4Iqg-UcfvwQZVldk&m=kz9q20-DXpg7quLZcf40us_D3ehPJZJhFAlVJr744ciuZjyv-rEIsSs0kjdT-gw6&s=Bb3fge-EG_Cx4csq80n962jK_9vM_c270nkN8bxGfwU&e=">
https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.lustre.org_listinfo.cgi_lustre-2Ddiscuss-2Dlustre.org&d=DwICAg&c=CJqEzB1piLOyyvZjb8YUQw&r=a1-ymUluZsecMceDMlAHsomwMJl4Iqg-UcfvwQZVldk&m=kz9q20-DXpg7quLZcf40us_D3ehPJZJhFAlVJr744ciuZjyv-rEIsSs0kjdT-gw6&s=Bb3fge-EG_Cx4csq80n962jK_9vM_c270nkN8bxGfwU&e=</a>
<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href=""></a>https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.lustre.org_pipermail_lustre-2Ddiscuss-2Dlustre.org_attachments_20260213_6c4ae96c_attachment-2D0001.htm&d=DwICAg&c=CJqEzB1piLOyyvZjb8YUQw&r=a1-ymUluZsecMceDMlAHsomwMJl4Iqg-UcfvwQZVldk&m=kz9q20-DXpg7quLZcf40us_D3ehPJZJhFAlVJr744ciuZjyv-rEIsSs0kjdT-gw6&s=2Vw5XlY4oOvfC42sBRy_RFNVzPPvNRJ-0QYvpImxRek&e=
><br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
_______________________________________________<br>
lustre-discuss mailing list<br>
lustre-discuss@lists.lustre.org<br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.lustre.org_listinfo.cgi_lustre-2Ddiscuss-2Dlustre.org&d=DwICAg&c=CJqEzB1piLOyyvZjb8YUQw&r=a1-ymUluZsecMceDMlAHsomwMJl4Iqg-UcfvwQZVldk&m=kz9q20-DXpg7quLZcf40us_D3ehPJZJhFAlVJr744ciuZjyv-rEIsSs0kjdT-gw6&s=Bb3fge-EG_Cx4csq80n962jK_9vM_c270nkN8bxGfwU&e=">https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.lustre.org_listinfo.cgi_lustre-2Ddiscuss-2Dlustre.org&d=DwICAg&c=CJqEzB1piLOyyvZjb8YUQw&r=a1-ymUluZsecMceDMlAHsomwMJl4Iqg-UcfvwQZVldk&m=kz9q20-DXpg7quLZcf40us_D3ehPJZJhFAlVJr744ciuZjyv-rEIsSs0kjdT-gw6&s=Bb3fge-EG_Cx4csq80n962jK_9vM_c270nkN8bxGfwU&e=</a>
<br>
<br>
<br>
------------------------------<br>
<br>
End of lustre-discuss Digest, Vol 239, Issue 19<br>
***********************************************<br>
</div>
</span></font></div>
</body>
</html>