NFS group limit of 16

Just as an important reminder for myself. Apparently NFS has a limit of 16 groups you can be a member of. I was just investigating why I couldn't write to certain files no more only to discover this nasty limitation.

Luckily there's a new option which can work around that:

1.g  or  --manage-gids
              Accept requests from the kernel to map user id numbers into  lists of  group  numbers
              for  use  in access control.  An NFS request will normally (except when using Kerberos or
              other cryptographic authentication) contains a user-id and a list of group-ids.  Due to a
              limitation  in  the NFS protocol, at most 16 groups ids can be listed.  If you use the -g
              flag, then the list of group ids received from the client will be replaced by a  list  of
              group  ids  determined  by  an  appropriate lookup on the server. Note that the ’primary’
              group id is not affected so a newgroup command on the client  will  still  be  effective.
              This function requires a Linux Kernel with version at least 2.6.21.

So setting this option in /etc/default/nfs-kernel-server

Linux shiva 2.6.26-2-amd64 #1 SMP Wed Sep 21 03:36:44 UTC 2011 x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Apr 11 16:42:13 2012 from smtp.z25.org
arnaud@shiva:~$ man rpc.mountd
arnaud@shiva:~$ cat /etc/default/nfs-kernel-server
# Number of servers to start up
RPCNFSDCOUNT=8

# Runtime priority of server (see nice(1))
RPCNFSDPRIORITY=0

# Options for rpc.mountd.
# If you have a port-based firewall, you might want to set up
# a fixed port here using the --port option. For more information,
# see rpc.mountd(8) or http://wiki.debian.org/?SecuringNFS
RPCMOUNTDOPTS=--manage-gids

# Do you want to start the svcgssd daemon? It is only required for Kerberos
# exports. Valid alternatives are "yes" and "no"; the default is "no".
NEED_SVCGSSD=

# Options for rpc.svcgssd.
RPCSVCGSSDOPTS=

resolves my problem :-)