/etc/fstab is six columns of plain text, and a single typo in it can drop a server into emergency mode on the next reboot. It decides what gets mounted at boot, where, with which options, and in what order it is checked. On systemd distributions it is also the input to systemd-fstab-generator, which turns every line into a mount unit.
This reference walks through every field, the generic and filesystem-specific options you will actually use, the systemd extensions, and a way to test changes before you reboot. The format and options are the same on Debian, Ubuntu, RHEL and Fedora; where defaults differ, it is noted.
The Six Fields
Fields are separated by any amount of spaces or tabs. Lines starting with # are comments. Here is a realistic file from a server with a separate data disk, swap, an NFS share and a hardened /tmp:
# <device> <mount point> <type> <options> <dump> <pass>
UUID=3f6c1e2a-8b1d-4c7e-9a52-0d4e6b7f1a90 / ext4 errors=remount-ro 0 1
UUID=7A1C-3E9F /boot/efi vfat umask=0077 0 1
UUID=b2d9c4f1-55e0-4a3b-8f6d-2c1a9e7b3d44 /srv/data xfs defaults,noatime,nofail 0 0
UUID=9e4a2b7c-1d3f-4e8a-b6c5-7f0d2a1e9b83 none swap sw 0 0
nfs01:/export/home /home nfs4 _netdev,hard,vers=4.2 0 0
tmpfs /tmp tmpfs size=2G,mode=1777,nosuid,nodev 0 0
| # | Field | Contains |
|---|---|---|
| 1 | fs_spec | What to mount: a device, UUID=, LABEL=, PARTUUID=, a network path, or a pseudo name such as tmpfs |
| 2 | fs_file | Where to mount it. For swap, none (Debian installers write none, some older files use swap) |
| 3 | fs_vfstype | Filesystem type: ext4, xfs, btrfs, vfat, nfs, nfs4, cifs, tmpfs, swap, or auto |
| 4 | fs_mntops | Comma-separated options with no spaces; defaults if you have none |
| 5 | fs_freq | Used only by the dump backup program. Set 0 |
| 6 | fs_passno | fsck order at boot: 1 for root, 2 for other checked filesystems, 0 to skip |
Spaces in paths — a mount point with a space is written with the octal escape \040, as in /mnt/My\040Disk. A tab is \011. Quotes do not work.
Fields 5 and 6 are optional — if omitted they default to 0, but writing them explicitly makes the file easier to read and avoids surprises with older tools.
Field 1: Identifying the Device
Device names like /dev/sdb1 are assigned in discovery order and can change when a disk is added, removed or moved to another controller. On cloud VMs NVMe names shuffle between reboots more often than people expect. Use a stable identifier instead:
$ lsblk -f
NAME FSTYPE FSVER LABEL UUID FSAVAIL FSUSE% MOUNTPOINTS
sda
├─sda1 vfat FAT32 7A1C-3E9F 505.8M 1% /boot/efi
└─sda2 ext4 1.0 3f6c1e2a-8b1d-4c7e-9a52-0d4e6b7f1a90 31.2G 32% /
sdb
└─sdb1 xfs data b2d9c4f1-55e0-4a3b-8f6d-2c1a9e7b3d44 412.6G 17% /srv/data
$ blkid /dev/sdb1
/dev/sdb1: LABEL="data" UUID="b2d9c4f1-55e0-4a3b-8f6d-2c1a9e7b3d44" BLOCK_SIZE="512" TYPE="xfs" PARTUUID="5e1f0c2a-01"
| Form | Stable across | Notes |
|---|---|---|
UUID=... | Reboots, disk reordering | Filesystem UUID. Changes if you reformat. The usual default |
LABEL=... | Reboots, reordering | Human-readable, but two disks with the same label conflict |
PARTUUID=... | Reboots, reformatting | Partition-table ID; survives mkfs, useful before a filesystem exists |
/dev/disk/by-id/... | Reboots, reordering | Based on disk model and serial; good for identifying physical disks |
/dev/sdb1 | Nothing guaranteed | Avoid for anything but throwaway mounts |
server:/export | n/a | NFS source |
//server/share | n/a | SMB/CIFS source |
LVM is already stable — /dev/mapper/vg0-data and /dev/vg0/data are named by LVM, not by discovery order, so they are safe to use. RHEL installers write them this way by default.
Cloned disks share UUIDs — after dd or a VM template clone, two filesystems can carry the same UUID. Change one with tune2fs -U random (ext4) or xfs_admin -U generate (XFS, unmounted) before mounting both.
Field 4: Generic Mount Options
defaults expands to rw,suid,dev,exec,auto,nouser,async. Anything you add after it overrides the matching part, so defaults,noexec is valid and common. These options are understood by mount itself and apply to any filesystem type:
| Option | Effect |
|---|---|
ro / rw | Mount read-only or read-write |
noexec | Disallow executing binaries from this filesystem |
nosuid | Ignore SUID and SGID bits on files here |
nodev | Do not interpret device files on this filesystem |
noauto | Skip at boot and with mount -a; mount manually with mount /path |
user / users | Let a normal user mount it (user: only that user can unmount; users: anyone can). Both imply noexec,nosuid,nodev unless overridden afterwards |
nofail | Do not fail the boot if the device is missing |
_netdev | Needs the network; wait for it and unmount before the network goes down |
noatime | Never update access times. Fewer writes; breaks only tools that rely on atime |
relatime | Update atime only if it is older than mtime or ctime, or more than 24 hours old. Kernel default |
lazytime | Keep timestamp updates in memory and write them lazily; combines with relatime |
sync / async | Write synchronously or buffer writes. async is the default; sync is slow |
nofail is not optional on extra disks — without it, a detached EBS volume, a failed USB drive or a missing RAID member stops the boot in emergency mode. With it, the system boots and the mount is simply absent. Root and anything the OS cannot run without should not have nofail.
noatime is mostly safe — mutt and some old mail tools check atime to detect new mail; a few backup tools use it. For databases, build servers and container hosts, noatime is a free reduction in metadata writes.
Hardening scratch mounts — nodev,nosuid,noexec on /tmp, /var/tmp and /dev/shm is a common CIS benchmark requirement. Test package installs afterwards, as some installers execute scripts from /tmp. Our server hardening guide covers the wider checklist.
Filesystem-Specific Options
Options the generic layer does not recognise are passed to the filesystem driver. An option the driver does not know either makes the mount fail, so check man 5 ext4, man 5 xfs, man 5 nfs or man mount.cifs for the version you run.
| Type | Option | Purpose |
|---|---|---|
| ext4 | errors=remount-ro | On metadata errors, remount read-only instead of continuing. Debian and Ubuntu set it on root |
| ext4 | commit=N | Flush the journal every N seconds (default 5) |
| ext4/xfs | discard | Issue TRIM on every delete. A periodic fstrim, via fstrim.timer, is usually preferred |
| xfs | uquota / gquota / pquota | Enable user, group or project quotas at mount time |
| btrfs | subvol=@home | Mount a specific subvolume (Ubuntu and Fedora layouts use them) |
| btrfs | compress=zstd | Transparent compression for newly written data |
| vfat | umask=0077 | FAT has no Unix permissions; this sets them for every file |
| vfat | uid=1000,gid=1000 | Owner for all files on the mount |
| nfs | vers=4.2 | Pin the protocol version instead of negotiating |
| nfs | hard / soft | hard retries forever (default, safe for data); soft returns errors after retrans attempts |
| nfs | timeo=600,retrans=2 | Timeout in tenths of a second and retries before a major timeout |
| cifs | credentials=/etc/smb-cred | Read username and password from a root-only file instead of fstab |
| cifs | vers=3.1.1 | SMB dialect; avoid 1.0 |
| tmpfs | size=2G,mode=1777 | Maximum size and permissions of the mount root |
| tmpfs | nr_inodes=1m | Cap the number of files |
# Bind mount: make an existing directory appear at a second path
/srv/data/www /var/www/html none bind 0 0
# Swap file (Ubuntu's installer writes exactly this)
/swap.img none swap sw 0 0
# CIFS share with credentials kept out of the world-readable fstab
//files01/ops /mnt/ops cifs credentials=/etc/smb-cred,uid=1000,gid=1000,vers=3.1.1,_netdev,nofail 0 0
$ sudo install -m 600 /dev/null /etc/smb-cred
$ printf 'username=svc_ops\npassword=CHANGE_ME\n' | sudo tee /etc/smb-cred >/dev/null
Field 6, and the systemd Options
The pass number tells fsck which filesystems to check at boot: 1 for root, 2 for everything else that needs checking, 0 to skip. Network filesystems, tmpfs, swap and bind mounts always get 0. So do XFS and Btrfs: their fsck.xfs and fsck.btrfs helpers do nothing at boot, and RHEL installers write 0 0 for XFS for that reason. Repair them with xfs_repair or btrfs check on an unmounted filesystem when needed.
On systemd systems, options with an x-systemd. prefix are read by the fstab generator and ignored by the kernel:
| Option | Effect |
|---|---|
x-systemd.automount | Create an automount unit: mount on first access instead of at boot |
x-systemd.idle-timeout=10min | With automount, unmount again after this much inactivity |
x-systemd.device-timeout=10s | How long to wait for the device to appear (default 90s) |
x-systemd.mount-timeout=30s | How long the mount command itself may take |
x-systemd.requires=unit | Add Requires= and After= on a unit, e.g. an iSCSI or VPN service |
x-systemd.requires-mounts-for=/path | Mount only after another path is mounted |
x-systemd.growfs | Grow the filesystem to fill its partition when mounted |
# NFS that never blocks boot: mounted on first access, released when idle
nfs01:/export/archive /mnt/archive nfs4 _netdev,nofail,x-systemd.automount,x-systemd.idle-timeout=10min 0 0
# See the unit the generator produced
$ systemctl cat mnt-archive.mount
$ systemctl status mnt-archive.automount
Test Before You Reboot
A broken fstab is found at boot, when you may not have a console. Check it while you still have a shell:
$ sudo findmnt --verify --verbose # parse fstab, check devices, types and targets
$ sudo systemctl daemon-reload # regenerate mount units after editing
$ sudo mount -a # mount everything not yet mounted
$ findmnt /srv/data # confirm source, type and active options
TARGET SOURCE FSTYPE OPTIONS
/srv/data /dev/sdb1 xfs rw,noatime,attr2,inode64,logbufs=8,logbsize=32k,noquota
$ sudo mount -o remount,noexec /tmp # apply new options to a live mount
findmnt --verify — catches unknown filesystem types, missing devices, non-existent mount points and badly formed lines without mounting anything. Run it after every edit.
mount -a does not test remounts — it skips filesystems that are already mounted, so a bad option on / passes silently. Use mount -o remount on the specific path, or findmnt --verify.
If the system lands in emergency mode — log in with the root password, run mount -o remount,rw /, fix the offending line, then systemctl daemon-reload and reboot. On cloud hosts without a console, that is exactly why extra disks need nofail.
Keep a backup — cp /etc/fstab /etc/fstab.bak before editing. Our essential tools list covers the disk and filesystem utilities used above.
Frequently Asked Questions
What does defaults mean in /etc/fstab?
defaults is shorthand for rw,suid,dev,exec,auto,nouser,async. It is used when you need no special options, because the options field cannot be empty. Options listed after it override the matching default, so defaults,noatime,noexec is valid.
Should I use UUID or /dev/sdX in fstab?
Use UUID, LABEL or an LVM path. Kernel device names such as /dev/sdb are assigned in discovery order and can change when disks are added or removed, or between reboots on cloud NVMe volumes. A UUID stays the same until the filesystem is reformatted. Find it with lsblk -f or blkid.
What do the last two numbers in an fstab line mean?
The fifth field is the dump flag, which only the legacy dump backup tool reads; set it to 0. The sixth is the fsck pass: 1 for the root filesystem, 2 for other filesystems that should be checked at boot, and 0 to skip. XFS, Btrfs, network filesystems, tmpfs and swap should use 0.
How do I stop a missing disk from breaking boot?
Add nofail to the options so systemd continues booting if the device is absent, and consider x-systemd.device-timeout to shorten the default 90 second wait. For network shares also add _netdev, and x-systemd.automount if you want the mount to happen on first access.
How can I check /etc/fstab for errors without rebooting?
Run findmnt --verify --verbose, which parses the file and checks devices, filesystem types and mount points. Then run systemctl daemon-reload and mount -a to mount anything new. For filesystems that are already mounted, test changed options with mount -o remount on that path.