AutoFS and NFS Client Mounts: On-Demand Network Filesystems

By LinuxCert.Guru Team·

Objective

This guide covers NFS server configuration and AutoFS client setup on RHEL. By the end, you will know how to:

  • Configure and export an NFS share from a server
  • Open the correct firewall services for NFS communication
  • Set the SELinux boolean required for read-write NFS exports
  • Verify an NFS export using a manual mount before automating it
  • Configure an indirect AutoFS map for on-demand NFS mounting
  • Configure a direct AutoFS map using the /- master map entry
  • Verify and troubleshoot AutoFS mounts using system commands and logs
  • Understand how this topic connects to RHCSA exam objectives

Permanently mounted NFS shares stay mounted whether anyone is using them or not. On a system with many network shares that are accessed infrequently, that wastes resources and creates unnecessary network load. AutoFS solves this by mounting shares on demand when they are accessed and unmounting them automatically after a configurable period of inactivity. The result is the same transparent access for users, with none of the overhead of keeping unused mounts active.

How NFS and AutoFS Work Together

Component Role Configured On
NFS Server Exports directories so clients can access them over the network Server (/etc/exports)
Firewall Allows NFS traffic through. Must be configured on the server. Server (firewalld)
SELinux Controls what NFS is permitted to do. Boolean required for rw exports. Server (setsebool)
AutoFS Mounts NFS shares on demand, unmounts them after inactivity Client (/etc/auto.master and map files)
Indirect Map Mounts shares below a common parent directory Client (e.g. /etc/auto.nfs)
Direct Map Mounts shares at specific absolute paths Client (e.g. /etc/auto.direct)

Part 1: Configure the NFS Server

Step 1: Install and Enable NFS

# Install the NFS server package
dnf install nfs-utils -y

# Enable and start the NFS server
systemctl enable --now nfs-server

# Verify the service is running
systemctl status nfs-server

Step 2: Create and Export the Shared Directory

# Create the directory to be shared
mkdir -p /srv/nfsshare

# Set appropriate ownership
chown nobody:nobody /srv/nfsshare

# Set permissions
chmod 777 /srv/nfsshare

# Add an export entry to /etc/exports
echo "/srv/nfsshare  *(rw,sync,no_root_squash)" >> /etc/exports

# Apply the export configuration
exportfs -rav

# Verify the export is active
exportfs -v

Understanding the export options:

  • rw: allow read and write access (not just read-only)
  • sync: write data to disk before confirming to the client (safer, slightly slower)
  • no_root_squash: allows the root user on the client to access files as root on the server. Use carefully in production.
    • The safer alternative for most production use is root_squash (the default), which maps client root to the anonymous user
  • *: allows any client to connect. Replace with a specific IP or subnet like 192.168.1.0/24 in production.

Step 3: Configure the Firewall for NFS

# Add the NFS service to the firewall permanently
firewall-cmd --permanent --add-service=nfs

# For NFSv3 compatibility, also add rpcbind and mountd
firewall-cmd --permanent --add-service=rpc-bind
firewall-cmd --permanent --add-service=mountd

# Reload firewalld to apply the rules
firewall-cmd --reload

# Verify NFS is allowed
firewall-cmd --list-services

If you are using NFSv4 only (recommended on RHEL 9 and 10), the nfs service alone is sufficient. Port 2049 TCP is all NFSv4 needs. The rpc-bind and mountd services are only required for NFSv3 compatibility.

Step 4: Configure the SELinux Boolean for NFS

# Check the current state of the NFS export boolean
getsebool -a | grep nfs_export

# Enable read-write NFS exports persistently
setsebool -P nfs_export_all_rw on

# Also enable if you need to export home directories
setsebool -P use_nfs_home_dirs on

# Verify the boolean is now on
getsebool nfs_export_all_rw

Without the nfs_export_all_rw boolean, SELinux will block write operations to the exported directory even if the NFS export itself is configured correctly. This is one of the most common reasons NFS appears to work but clients cannot write files.

Part 2: Verify with a Manual Mount

Always verify the NFS export works with a manual mount before configuring AutoFS. This confirms that the server, firewall, and SELinux are all correct before adding the AutoFS layer.

# On the client: install NFS client utilities
dnf install nfs-utils -y

# Check what the server is exporting
showmount -e nfsserver.example.com

# Create a temporary mount point
mkdir -p /mnt/testnfs

# Mount the NFS share manually
mount -t nfs nfsserver.example.com:/srv/nfsshare /mnt/testnfs

# Verify the mount
df -hT /mnt/testnfs

# Test read and write access
echo "NFS test write" > /mnt/testnfs/testfile.txt
cat /mnt/testnfs/testfile.txt

# Unmount when done testing
umount /mnt/testnfs

If the manual mount succeeds and you can read and write files, everything on the server side is correct. If it fails here, fix the NFS server, firewall, or SELinux before proceeding to AutoFS configuration.

Part 3: Configure AutoFS

Install and Enable AutoFS

# Install AutoFS
dnf install autofs -y

# Enable and start the AutoFS service
systemctl enable --now autofs

# Verify it is running
systemctl status autofs

AutoFS Configuration Files

File Purpose Format
/etc/auto.master Master map file: lists mount points and their map files mount-point map-file [options]
/etc/auto.nfs (example) Indirect map: defines keys and their NFS sources below a parent directory key [options] location
/etc/auto.direct (example) Direct map: defines absolute mount paths and their NFS sources /full/path [options] location

Indirect Map: Mounting Below a Parent Directory

An indirect map mounts NFS shares below a common parent directory. When you access /mnt/nfs/share1, AutoFS automatically mounts the NFS share that share1 maps to.

# Step 1: Add an entry to /etc/auto.master pointing to the indirect map
echo "/mnt/nfs  /etc/auto.nfs  --timeout=300" >> /etc/auto.master

# Step 2: Create the indirect map file
cat > /etc/auto.nfs << EOF
share1  -rw,sync  nfsserver.example.com:/srv/nfsshare
data    -rw,sync  nfsserver.example.com:/srv/data
EOF

# Step 3: Reload AutoFS to pick up the new configuration
systemctl reload autofs

# Step 4: Test by accessing the mount point
ls /mnt/nfs/share1

# Verify the mount was created on demand
df -hT /mnt/nfs/share1

How the indirect map works:

  • The /etc/auto.master entry tells AutoFS: "watch the /mnt/nfs directory, and when something inside it is accessed, look in /etc/auto.nfs for what to mount"
  • The /etc/auto.nfs file maps keys (like share1) to NFS locations
  • Accessing /mnt/nfs/share1 triggers AutoFS to mount nfsserver.example.com:/srv/nfsshare at that path
  • After 300 seconds of inactivity (the --timeout value), AutoFS unmounts it automatically
  • The /mnt/nfs directory itself does not need to exist as a real directory. AutoFS manages it.

Direct Map: Mounting at Absolute Paths

A direct map mounts NFS shares at specific absolute paths that you define. Unlike indirect maps, the full mount path is written directly in the map file. Direct maps are registered in /etc/auto.master using the special /- entry.

# Step 1: Add a direct map entry to /etc/auto.master
# The /- entry tells AutoFS this is a direct map
echo "/-  /etc/auto.direct  --timeout=300" >> /etc/auto.master

# Step 2: Create the direct map file with absolute paths
cat > /etc/auto.direct << EOF
/data/shared    -rw,sync  nfsserver.example.com:/srv/nfsshare
/backups/remote -ro,sync  nfsserver.example.com:/srv/backups
EOF

# Step 3: Create the mount point directories (required for direct maps)
mkdir -p /data/shared
mkdir -p /backups/remote

# Step 4: Reload AutoFS
systemctl reload autofs

# Step 5: Test by accessing the direct mount path
ls /data/shared

# Verify the mount
df -hT /data/shared

Key differences between indirect and direct maps:

  • Indirect map: mount points are created automatically below the parent directory. The parent directory must not be a real directory.
    • Good for: home directories, user shares, groups of related shares under one path
  • Direct map: mount points are absolute paths you specify. The directories must exist before AutoFS can mount to them.
    • Good for: specific paths that applications expect at fixed locations

Wildcard Keys in Indirect Maps

AutoFS supports a wildcard key * in indirect maps that matches any subdirectory name. This is useful for home directories where each user has their own share on the NFS server:

# /etc/auto.master entry for home directories
/home/nfsusers  /etc/auto.home  --timeout=600

# /etc/auto.home - wildcard key maps each username to their NFS home
# The & substitutes the matched key (username) in the location
*  -rw,sync  nfsserver.example.com:/srv/home/&

When a user accesses /home/nfsusers/alice, AutoFS mounts nfsserver.example.com:/srv/home/alice at that path. The & substitutes the matched key. This means one map entry handles all users without listing each one individually.

Verifying and Troubleshooting AutoFS

# Check the AutoFS service status
systemctl status autofs

# View AutoFS activity in the system journal
journalctl -u autofs -f

# List currently active AutoFS mounts
automount -m

# Check what is currently mounted (including AutoFS mounts)
mount | grep autofs

# Force AutoFS to re-read its configuration without restarting
systemctl reload autofs

# Check that the NFS server is exporting correctly
showmount -e nfsserver.example.com

# Verify NFS RPC services are registered (useful for NFSv3 troubleshooting)
rpcinfo -p nfsserver.example.com

Common Mistakes

  • Not verifying the manual mount before setting up AutoFS. AutoFS wraps around a working NFS mount. If the NFS itself doesn't work (wrong firewall, wrong SELinux boolean, wrong export path), AutoFS will fail silently and the mount point will appear empty.
    • Always confirm mount -t nfs server:/path /mnt/test works before configuring AutoFS
  • Creating the indirect map parent directory as a real directory. AutoFS manages the parent directory for indirect maps itself. If /mnt/nfs already exists as a real directory with content, AutoFS may not work correctly.
    • For indirect maps: do not pre-create the parent directory
    • For direct maps: you must pre-create the specific mount point directories
  • Forgetting to reload AutoFS after editing map files. AutoFS reads configuration at startup and on reload. Changes to /etc/auto.master or map files are not picked up automatically.
    • Always run systemctl reload autofs after any configuration change
  • Missing the SELinux boolean for read-write exports. A correctly configured NFS export that passes all other tests but blocks writes is almost always a missing nfs_export_all_rw boolean. Check with getsebool nfs_export_all_rw before assuming the export configuration is wrong.
  • Using the wrong syntax in the master map for direct maps. Direct maps use /- as the mount point in /etc/auto.master, not a real directory path.
    • Correct: /- /etc/auto.direct
    • Incorrect: /data /etc/auto.direct (this creates an indirect map under /data)
  • Forgetting to enable AutoFS at boot. systemctl start autofs runs it now. systemctl enable autofs makes it start at boot. Both commands are always required.

NFS Mount Options Reference

Option Meaning Default
rw Read and write access ro (read-only)
ro Read-only access Yes (default)
sync Write data to disk before confirming to client async
soft Return an error if the server doesn't respond after retries hard
hard Keep retrying indefinitely if server doesn't respond Yes (default)
timeo=n Timeout in tenths of a second before retry 600 (60 seconds)
vers=4 Force NFSv4 (recommended on modern RHEL) Negotiated

AutoFS and the RHCSA Exam

NFS and AutoFS are explicit RHCSA exam objectives. Exam tasks in this area typically require:

  • Configuring an NFS export on a server with the correct /etc/exports entry
  • Opening the NFS service in firewalld on the server
  • Setting the correct SELinux boolean for the export type
  • Configuring an indirect AutoFS map on a client so that accessing a directory path triggers an automatic NFS mount
  • The AutoFS service must be enabled so it starts at boot
  • The mount must survive a reboot of the client system

The most common exam failure pattern: the candidate configures AutoFS correctly but forgets to enable the service, or configures the NFS export correctly but misses the firewall or SELinux step. Each layer needs to be complete for the full task to pass.

Quick Reference

# NFS Server
dnf install nfs-utils -y
systemctl enable --now nfs-server
echo "/srv/nfsshare  *(rw,sync,no_root_squash)" >> /etc/exports
exportfs -rav
firewall-cmd --permanent --add-service=nfs && firewall-cmd --reload
setsebool -P nfs_export_all_rw on

# Manual mount verification (client)
showmount -e server
mount -t nfs server:/srv/nfsshare /mnt/test
umount /mnt/test

# AutoFS (client)
dnf install autofs -y
systemctl enable --now autofs

# Indirect map
echo "/mnt/nfs  /etc/auto.nfs  --timeout=300" >> /etc/auto.master
echo "share1  -rw,sync  server:/srv/nfsshare" > /etc/auto.nfs
systemctl reload autofs

# Direct map
echo "/-  /etc/auto.direct  --timeout=300" >> /etc/auto.master
echo "/data/shared  -rw,sync  server:/srv/nfsshare" > /etc/auto.direct
mkdir -p /data/shared
systemctl reload autofs

Practice This in a Real Environment

NFS and AutoFS involve multiple layers: the export, the firewall, SELinux, and the AutoFS configuration itself. A mistake at any layer produces symptoms that look similar from the client side, an empty directory or a timeout. The only way to get fast at diagnosing this is to build the full stack from scratch, break it deliberately at each layer, and practice identifying which layer is wrong from the error output.

LinuxCert.Guru has a dedicated hands-on lab for this topic: AutoFS and NFS Client Mounts. It covers NFS server configuration, firewall and SELinux setup, manual mount verification, indirect and direct AutoFS maps, and troubleshooting, all on real RHEL hosts with auto-graded tasks.

Practice the AutoFS and NFS Client Mounts lab at LinuxCert.Guru → https://linuxcert.guru/?name=rh134-autofs-nfs-client-mounts

Conclusion

AutoFS and NFS work as a team. NFS provides the network file sharing. AutoFS provides the on-demand mounting that makes it efficient. Getting the full stack right requires attention to all four layers: the server export, the firewall, SELinux, and the AutoFS maps on the client.

  • Configure the NFS export in /etc/exports and run exportfs -rav to activate it
  • Add the nfs service to firewalld and reload before testing from the client
  • Set nfs_export_all_rw boolean persistently with setsebool -P for read-write exports
  • Always verify with a manual mount before configuring AutoFS
  • Indirect maps mount below a parent directory: use /parent /etc/auto.mapfile in auto.master
  • Direct maps mount at absolute paths: use /- /etc/auto.direct in auto.master, pre-create the directories
  • Always run systemctl reload autofs after editing any map file
  • Always use both systemctl start and systemctl enable for AutoFS on the exam

 

$_
Ready to go beyond reading?Practice with free, auto-graded RHCSA labs.
Start free →