Run rpc.rquotad Safely for NFS Remote Quotas

NFS clients expect quota to show real numbers, and rpc.rquotad is the daemon that answers those requests without you having to log into the server. This guide gets you to a read-only rpc.rquotad configuration, a version check and a short verification plan. The examples match quota 4.06-1build6 and its installed rpc.rquotad(8) manual on this machine.

Allow about twenty minutes, plus time to check the host's NFS service manager and access-control files. You need root access on the NFS server, an exported filesystem with quotas already configured, and a client that mounts that export. This guide does not create quota files, edit an NFS export, or start a service automatically.

1. Confirm the installed daemon

Run these read-only checks as an ordinary user. They identify the binary and package version before you go near a service configuration:

$ command -v rpc.rquotad
/usr/sbin/rpc.rquotad
$ dpkg-query -W -f='${Package} ${Version}\n' quota
quota 4.06-1build6
$ rpc.rquotad --version
Quota utilities version 4.06.
Compiled with: USE_LDAP_MAIL_LOOKUP EXT2_DIRECT HOSTS_ACCESS RPC RPC_SETQUOTA BSD_BEHAVIOUR

The exact package version will differ on another distribution. Record it with your change notes, because option availability and service integration are package-specific.

2. Understand the safe default

rpc.rquotad answers RPC requests for quotas on local filesystems that a remote machine reaches over NFS. The quota client uses the results to display usage, while edquota can use the service for remote quota changes when the daemon and build support allow it.

The default is --no-setquota, also written -s. Keep it for ordinary reporting: it stops remote requests from setting quotas. This binary was compiled with RPC_SETQUOTA, so the enabling option exists here, but that is not a reason to touch it.

3. Check the local quota data before starting anything

On the NFS server, inspect mounted filesystems and quota files as root. None of this enables or alters quotas:

# findmnt -t ext4,xfs,btrfs
# find / -maxdepth 3 \( -name aquota.user -o -name aquota.group -o -name quota.user -o -name quota.group \) -print 2>/dev/null

The manual names aquota.user and aquota.group for version 2 quota files on non-XFS filesystems, and quota.user and quota.group for version 1. It also names /etc/mtab as the default filesystems source. A quota filename existing does not mean quotas are active: check the filesystem and your distribution's quota status tools too.

Stop here if the exported filesystem has no working quota configuration. Starting rpc.rquotad will not create quota files or repair filesystem quota accounting for you.

4. Keep the daemon in read-only mode

When you need the daemon under a service manager, use its normal unit or startup integration and pass only the read-only option if an explicit setting is required. The shape is:

# /usr/sbin/rpc.rquotad --no-setquota

Do not paste that into a production shell while troubleshooting unless you know exactly how your host registers RPC services. A foreground process can conflict with an existing instance, and a manually started daemon can slip past boot recovery and monitoring. Inspect the service definition first:

# systemctl status rpc-rquotad.service
# systemctl cat rpc-rquotad.service

Unit name does not exist? Find the package's actual installed service integration rather than guessing a replacement:

# systemctl list-unit-files | grep -i quota
# ps -ef | grep '[r]pc.rquotad'

The service name and unit name are not specified by rpc.rquotad(8); they depend on the distribution. Preserve any existing administrator-approved arguments, and make sure the final command still contains --no-setquota or -s.

5. Restrict who can call it

This build uses TCP wrappers. The daemon uses service name rquotad, so the host access files can allow or deny clients. Review the current files before editing them:

# grep -nE '(^|[[:space:]])rquotad([[:space:]]|:|$)' /etc/hosts.allow /etc/hosts.deny 2>/dev/null || true

Apply the narrowest rule that matches your NFS management network. An existing policy might look like this, but treat the network as a placeholder, not a value to copy:

rquotad: 192.0.2.0/24

Confirm your distribution's hosts.allow(5) syntax and the addresses your NFS clients actually use. A wrapper rule is an extra boundary, not a replacement for firewall rules, NFS export restrictions, or authentication.

# cp --preserve=mode,ownership,timestamps /etc/hosts.allow /etc/hosts.allow.bak
# cp --preserve=mode,ownership,timestamps /etc/hosts.deny /etc/hosts.deny.bak

To undo only this backup step, restore the relevant file after confirming no other administrator has changed it since:

# cp --preserve=mode,ownership,timestamps /etc/hosts.allow.bak /etc/hosts.allow

6. Handle NFSv4 paths deliberately

Serving NFSv4 exports, the daemon may need the same export-table view the NFS server itself uses. --xtab PATH or -x PATH selects an alternative NFSD export table, used to determine the NFSv4 pseudoroot prepended to relative paths in quota requests.

Never invent a path for this option. Inspect the NFS service configuration and its running arguments, then use the path your distribution actually manages. A wrong export table can make valid client requests resolve to the wrong filesystem, or fail to resolve at all.

Use --autofs or -I only when your deployment genuinely needs automounted filesystems included; normal behaviour ignores autofs mountpoints. Adding this option can cause quota lookups to trigger mounts, so test it outside a busy production window.

7. Choose a fixed port only when required

--port PORT or -p PORT makes the daemon listen on an alternate port. Leave the default alone unless your firewall, RPC registration or deployment design requires a fixed alternative; the port must be numeric and valid, and the installed command rejects anything else.

Changing the port means updating the firewall and any RPC client or service-discovery configuration as one planned change. Verify the port from the service manager's effective command line and from the host's listening-socket tools. Do not expose a newly chosen port to the whole network while testing.

8. Verify from the client

Once the service manager has started the daemon, check its status on the server, then mount the NFS export from an approved client and ask the quota client to report it:

# systemctl status rpc-rquotad.service
$ quota -s

The unit name and quota output are host-specific. A successful client report shows the mounted NFS filesystem and its quota figures, not merely a clean exit from the daemon. Failure: check the NFS mount, the client address allowed by TCP wrappers, the server's export table, and the daemon logs, in that order.

For a read-only deployment, a useful negative check is confirming the effective service command contains --no-setquota or -s and does not contain --setquota or -S:

# systemctl show rpc-rquotad.service --property=ExecStart
# ps -ef | grep '[r]pc.rquotad'

Do not test quota writes against a production filesystem just to prove they are disabled. If remote quota administration is genuinely required, design and test that change separately with explicit approvals.