Manually specify share security options for NFS

Configure NFS share security settings directly in the Ceph NFS service configuration files when you need fine‑grained control over encryption requirements. This method is useful when managing complex deployments, custom TLS setups, or when avoiding command‑line defaults.

Before you begin

Before you begin, make sure that you have the following prerequisites in place:

Administrative privileges to modify share configurations.
The TLS backend can be OpenSSL. This is a compile-time option.
Note: To enable TLS support in NFS, you must select USE_OPENSSL for OpenSSL backend during compile time.

About this task

NFS share security settings directly in the NFS share files. It provides guidance on selecting TLS or mutual TLS (mTLS) requirements, defining TLS parameters such as certificates and cipher policies, and preparing the environment for secure NFS access.

Procedure

Specify the share security option in the EXPORT{} or EXPORT_DEFAULTS{} block.

Note: You can specify only one share security option, XprtSec = tls or mtls.
For example,
```
XprtSec = tls
```

Specify the TLS configuration parameters in the TLS_CONFIG{} block.

Enable_TLS = true
TLS_CA_File = "/etc/ganesha/tls/ca.crt"
TLS_Cert_File = "/etc/ganesha/tls/ganesha.crt"
TLS_Key_File = "/etc/ganesha/tls/ganesha.key"
TLS_Ciphers = "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
TLS_Min_Version = "TLSv1.3"
Enable_KTLS = true
Enable_debug = false

Results

After setting the TLS configuration, the Ceph command changes.

ceph nfs export create cephfs mynfs /export3 myfs --xprtsec tls