Symptoms
NFS mount opens but a specific set of files shows permission denied.
Use the following observations to establish that this is the specific failure described here, rather than an unrelated outage or different account:
- Failing behavior: NFS mount opens but a specific set of files shows permission denied.
- Comparison to run: Compare file numeric UID/GID and export options for two clients.
- Pass condition: Intended user can open only the authorized test files.
Why It Happens
Shares, backup jobs and replication paths each have their own permissions, destination rules and histories; a successful connection is not proof of complete content.
Treat these as competing hypotheses, not confirmed diagnoses. Their implications are different:
- Root squashing maps privileged user — investigate this first only if the local state or controlled comparison supports it.
- UID/GID mismatch — a second layer that may survive a simple restart and requires a targeted check.
- Export path permissions differ across clients — investigate when the first two paths do not account for the observed behavior.
Before Making Changes
Do not use `no_root_squash` as a shortcut or expose NFS to untrusted networks. NAS interfaces may report job-level success while individual file operations, permissions, path mapping or remote copies still differ. Verify at the file level and distinguish the original from a restored copy. Write down the working configuration and, if available, export settings or create a test-only copy before changing account permissions, routes or file locations.
Make one change at a time, note the original value, and repeat the exact same test after each change. If the new outcome is worse, restore that single setting; a full reset would erase evidence and can create additional problems.
Problem-Specific Diagnosis
Begin with this controlled observation: Compare file numeric UID/GID and export options for two clients. Record the result and time; a vague report such as “sometimes fails” cannot distinguish the three hypotheses.
| Check | What to do | What the result tells you |
|---|---|---|
| Compare a working path | Compare file numeric UID/GID and export options for two clients. | If one controlled route works, the failed route is probably specific to a setting, permission, device, or service rather than a total outage. |
| Check the local state | Open the folder using a normal authorized user identity. | This can expose or rule out root squashing maps privileged user without changing several settings together. |
| Inspect the deeper layer | Compare numeric IDs and `root_squash` behavior with NAS documentation. | Use the evidence to separate uid/gid mismatch from export path permissions differ across clients; do not assume either is proven. |
If the local comparison is inconclusive, keep the current system unchanged while checking whether uid/gid mismatch is consistent with the evidence. If not, investigate export path permissions differ across clients rather than applying every possible fix.
Use Beginner for reversible checks; use Advanced only when the comparison indicates a deeper fault. NFS mount opens but a specific set of files shows permission denied. Run a harmless test and write down the time, device/account, current status indicators and the exact difference from normal behavior. Compare file numeric UID/GID and export options for two clients. Do not erase logs or reset the device yet. Open the folder using a normal authorized user identity. Confirm the relevant account, cable, selected output, permission or status before saving changes. If it is already correct, leave it alone and proceed; do not force a change just to try something. Confirm NFS export permissions for the exact client subnet. Change only this one condition after recording the old value. If it does not improve the result, restore the former value rather than layering additional guesses on top. Intended user can open only the authorized test files. Repeat the same comparison used in step one. Record what improved, what remains unchanged and whether a reconnect or normal app restart changes the result. Stop here if the expected outcome is stable. Consider root squashing maps privileged user, uid/gid mismatch and export path permissions differ across clients separately. Compare evidence from the working and failing paths, and avoid interpreting a green status indicator as end-to-end proof. Compare file numeric UID/GID and export options for two clients. Compare numeric IDs and `root_squash` behavior with NAS documentation. Focus on logs, state, permissions, protocol negotiation or version support relevant to this failure. Do not collect or share credentials, account tokens or unrelated private content. Test a dedicated nonprivileged service account with correct folder ACLs. Use an isolated or test-only configuration where possible. Keep an explicit rollback path; do not weaken security, replace backup originals or bypass equipment protection to make one test pass. Intended user can open only the authorized test files. Observe the behavior through the original trigger again. If the change does not produce this measurable result, undo that change and escalate with the recorded facts, rather than repeating disruptive reset attempts.Step-by-Step Troubleshooting
Capture the failing state
Check the first reversible condition
Apply the lowest-risk targeted fix
Retest and document
Distinguish the competing root causes
Inspect the deeper system layer
Run a second independent isolation test
Validate stability and rollback readiness
Solution Checklist
Common Mistakes to Avoid
- Treating root squashing maps privileged user as certain before running the comparison: Compare file numeric UID/GID and export options for two clients.
- Trying several changes at once, such as modifying uid/gid mismatch and export path permissions differ across clients simultaneously, which makes the successful change impossible to identify.
- Ignoring the safety boundary: Do not use `no_root_squash` as a shortcut or expose NFS to untrusted networks.
- Assuming that a status label or progress indicator guarantees the actual action completed; verify the outcome independently.
How to Verify the Fix
Intended user can open only the authorized test files.
- Repeat the original failing action under equivalent conditions: NFS mount opens but a specific set of files shows permission denied.
- Run the control again: Compare file numeric UID/GID and export options for two clients.
- Check the positive pass condition: Intended user can open only the authorized test files.
- Recheck after a normal restart, reconnection or scheduled cycle only when it is safe and relevant.
A single passing attempt is useful but may conceal intermittent failures. Record whether the fix survives the triggering condition without requiring a daily workaround.
If the Problem Continues
Use the deeper comparison rather than repeating the first steps: Compare numeric IDs and `root_squash` behavior with NAS documentation. Test a dedicated nonprivileged service account with correct folder ACLs.
Collect job ID, anonymized path, protocol, client version and relevant error excerpts without uploading private file contents or exposing NAS management to the public internet.
If the issue affects money, alarms, shared business records, or protective power equipment, stop risky experiments and use the official administrator, provider or manufacturer channel.
Prevent Recurrence
- Keep a record of the previously failing condition: Compare file numeric UID/GID and export options for two clients.
- Preserve the corrected behavior: Intended user can open only the authorized test files.
- Keep tested offline or immutable copies of critical data, record job exclusions, and periodically restore a small sample into a separate test location.
- Review configuration or hardware changes that could reintroduce root squashing maps privileged user.
Frequently Asked Questions
Does this symptom prove root squashing maps privileged user?
No. Start with the controlled comparison: Compare file numeric UID/GID and export options for two clients. Only treat root squashing maps privileged user as a candidate until the evidence supports it.
What if the first two checks do not change anything?
Move to a different layer rather than repeating the same action: Compare numeric IDs and `root_squash` behavior with NAS documentation. That helps determine whether uid/gid mismatch or export path permissions differ across clients fits the symptoms.
How do I know the repair actually worked?
Use this outcome, not just an on-screen status message: Intended user can open only the authorized test files. Keep a record of the working state for future troubleshooting.