NFS ja oikeudet...

-rw,intr,nosuid ??

L-blondi kirjoitti:

-rw,intr,nosuid ??

User ID Mapping

nfsd bases its access control to files on the server machine on the uid and gid pro-
vided in each NFS RPC request. The normal behavior a user would expect is that she
can access her files on the server just as she would on a normal file system. This
requires that the same uids and gids are used on the client and the server machine.
This is not always true, nor is it always desirable.

Very often, it is not desirable that the root user on a client machine is also
treated as root when accessing files on the NFS server. To this end, uid 0 is nor-
mally mapped to a different id: the so-called anonymous or nobody uid. This mode of
operation (called `root squashing') is the default, and can be turned off with
no_root_squash.

By default, exportfs chooses a uid and gid of -2 (i.e. 65534) for squashed access.
These values can also be overridden by the anonuid and anongid options. Finally,
you can map all user requests to the anonymous uid by specifying the all_squash
option.

Here's the complete list of mapping options:

root_squash

Map requests from uid/gid 0 to the anonymous uid/gid. Note that this does not
apply to any other uids that might be equally sensitive, such as user bin.

no_root_squash

Turn off root squashing. This option is mainly useful for diskless clients.

all_squash

Map all uids and gids to the anonymous user. Useful for NFS-exported public
FTP directories, news spool directories, etc. The opposite option is
no_all_squash, which is the default setting.

anonuid and anongid

These options explicitly set the uid and gid of the anonymous account. This
option is primarily useful for PC/NFS clients, where you might want all
requests appear to be from one user. As an example, consider the export entry
or /home/joe in the example section below, which maps all requests to uid
150 (which is supposedly that of user joe).

EXAMPLE

# sample /etc/exports file
/ master(rw) trusty(rw,no_root_squash)
/projects proj*.local.domain(rw)
/usr *.local.domain(ro) @trusted(rw)
/home/joe pc001(rw,all_squash,anonuid=150,anongid=100)
/pub (ro,insecure,all_squash)

The first line exports the entire filesystem to machines master and trusty. In
addition to write access, all uid squashing is turned off for host trusty. The sec-
ond and third entry show examples for wildcard hostnames and netgroups (this is the
entry `@trusted'). The fourth line shows the entry for the PC/NFS client discussed
above. Line 5 exports the public FTP directory to every host in the world, executing
all requests under the nobody account. The insecure option in this entry also allows
clients with NFS implementations that don't use a reserved port for NFS

zxcvbnm kirjoitti:

User ID Mapping

nfsd bases its access control to files on the server machine on the uid and gid pro-
vided in each NFS RPC request. The normal behavior a user would expect is that she
can access her files on the server just as she would on a normal file system. This
requires that the same uids and gids are used on the client and the server machine.
This is not always true, nor is it always desirable.

Very often, it is not desirable that the root user on a client machine is also
treated as root when accessing files on the NFS server. To this end, uid 0 is nor-
mally mapped to a different id: the so-called anonymous or nobody uid. This mode of
operation (called `root squashing') is the default, and can be turned off with
no_root_squash.

By default, exportfs chooses a uid and gid of -2 (i.e. 65534) for squashed access.
These values can also be overridden by the anonuid and anongid options. Finally,
you can map all user requests to the anonymous uid by specifying the all_squash
option.

Here's the complete list of mapping options:

root_squash

Map requests from uid/gid 0 to the anonymous uid/gid. Note that this does not
apply to any other uids that might be equally sensitive, such as user bin.

no_root_squash

Turn off root squashing. This option is mainly useful for diskless clients.

all_squash

Map all uids and gids to the anonymous user. Useful for NFS-exported public
FTP directories, news spool directories, etc. The opposite option is
no_all_squash, which is the default setting.

anonuid and anongid

These options explicitly set the uid and gid of the anonymous account. This
option is primarily useful for PC/NFS clients, where you might want all
requests appear to be from one user. As an example, consider the export entry
or /home/joe in the example section below, which maps all requests to uid
150 (which is supposedly that of user joe).

EXAMPLE

# sample /etc/exports file
/ master(rw) trusty(rw,no_root_squash)
/projects proj*.local.domain(rw)
/usr *.local.domain(ro) @trusted(rw)
/home/joe pc001(rw,all_squash,anonuid=150,anongid=100)
/pub (ro,insecure,all_squash)

The first line exports the entire filesystem to machines master and trusty. In
addition to write access, all uid squashing is turned off for host trusty. The sec-
ond and third entry show examples for wildcard hostnames and netgroups (this is the
entry `@trusted'). The fourth line shows the entry for the PC/NFS client discussed
above. Line 5 exports the public FTP directory to every host in the world, executing
all requests under the nobody account. The insecure option in this entry also allows
clients with NFS implementations that don't use a reserved port for NFS

siis jos laitan /etc/exports tiedostoon vaikka:

/share *.domain.com (rw,all_squash,anonuid=666,anongid=666)

Niin tiedoston omistajan tilalle tulee joku 501

ainakaan mulla kirjoitti:

siis jos laitan /etc/exports tiedostoon vaikka:

/share *.domain.com (rw,all_squash,anonuid=666,anongid=666)

Niin tiedoston omistajan tilalle tulee joku 501

käyttäjä, jonka numero on 666 ja ryhmä johon tämä kuuluu numeroltaan 666?

zxcvbnm kirjoitti:

käyttäjä, jonka numero on 666 ja ryhmä johon tämä kuuluu numeroltaan 666?

Kyllä on olemassa, juuri tätä varteen luotu oma tunnus ja ryhmä.

ainakaan mulla kirjoitti:

Kyllä on olemassa, juuri tätä varteen luotu oma tunnus ja ryhmä.

Mitä jos jättää nuo lisämääritteet pois ja antaa mäpätä nobodyksi? Entä jaettavan hakemiston oikeudet?

Ihan samaa, data on yhteinen. Kaikilla on oikeudet sekä lukea että kirjoittaa. Maija voi lukea kaisan datan ja kaisa voi kirjoittaa maijaan tiedostoon.

>Sitten valitse joku muu filepalvelinsofta kuin nfs.   

Mikä? Älä vaan sano, että samba. Verkossa ei ole yhtään WIndows koneetta ja eikö me pärjää ilman Windos ohjelmia/protokolia?