Configure Secure NFS File Shares for Backups and Media

Running NFS shares on a VPS is an efficient way to centralize backups and media storage across multiple Linux servers. With a secure NFS Server on VPS infrastructure, you can share folders just for backups and media, and make sure only specific and trusted servers are allowed to access them.

In this guide from PerLod Hosting, you will learn to build a secure NFS setup, from the basic installation to hardened exports designed specifically for backups and media.

It is important to know whether NFS is actually good to use for your VPS setup or not. In this step, we want to explore the situations where NFS on a VPS works well, and the cases where you should avoid it or choose a different method.

You can use NFS when:

• You have Linux backup or media servers that need a shared network filesystem.
• You control both the VPS and the client over a VPN or a private network.

Avoid using NFS when:

• You must expose it directly to the public internet. It has a security risk.
• You need Windows sharing. You can use SMB instead.

Tip: If you need a dedicated node just for storage, you can use a Storage VPS and keep NFS traffic on a private network only.

Before starting the NFS server setup, make sure to meet these requirements:

• Server: An Ubuntu 22.04 or 24.04 VPS with root or sudo access.
• Client: A Linux system like Ubuntu, Debian, or a RHEL-based distro.
• Network: A private network or VPN connection between the VPS and the client. It is strongly recommended for NFS security.

Once you are done, proceed to the following steps to set up the NFS server on VPS.

On your Ubuntu VPS, run the system update with the command below:

Use the command below to install the NFS server:

This command installs the core NFS server tools.

At this point, you must decide what folders you actually want to share with the network. We want to create two dedicated directories on the VPS, one for backups and one for media:

• /mnt/nfs/backups: For backup jobs such as restic, borg, rsync, etc.
• /mnt/nfs/media: For media libraries such as Plex, Jellyfin, etc.

Set the correct ownership and permissions for the directories:

The chown nobody:nogroup changes ownership to a non-privileged user and group. It follows common NFS security guidelines by preventing remote root users from having full root access on the server.

At this point, you must define which directories to share, who can access them, and their permission levels.

Edit the default configuration file for the NFS server:

Add the following lines to the file and replace the CLIENT_IP with your actual client server's IP address:

Option explanations:

• rw and ro: Allows Read and Write for backups and Read-Only for media to prevent accidental deletion.
• sync: Forces changes to be written to disk before replying to the client, preventing data loss during crashes.
• no_subtree_check: Disables subtree checking to improve reliability when files are renamed while open.
• root_squash: Secures the server by mapping client root users to an unprivileged account (nobody).

Apply your configuration changes and restart NFS to apply the changes:

Also, you must restrict access to your client's IP. To do this, you can use the following UFW rule:

Once you are done with setting up the NFS server on VPS, you can log in to your client machine to set up the connection.

We assume your client machine is an Ubuntu system. Run the system update, install the NFS client, and create the local mount points:

From the client machine, you can test the connection by mounting the shares manually. To do this, you can run the commands below:

The mount -t nfs specifies the filesystem type as NFS and maps the remote server's directory to your local client directory.

In this step, you can add your NFS mounts to /etc/fstab, so they automatically mount after a reboot. This prevents your backup and media paths from disappearing when the client server restarts.

Edit the filesystem table:

Add these lines at the bottom of the file with your NFS server's IP:

Once you are done, save and close the file. Verify the fstab configuration without rebooting with the command below:

This attempts to mount all filesystems listed in /etc/fstab. If the command returns no output, your configuration is correct and active.

At this point, you have a secure NFS share setup for an NFS server on VPS, with separate exports for writable backups and safer read-only media. The key is to keep exports clean in /etc/exports and restrict access to trusted clients only.

We hope you enjoy this guide. Subscribe to our X and Facebook channels to get the latest updates and articles.

For further reading:

How to Set Up BorgBackup on a Storage VPS