4 ms·
And the permissions problem? My experience with NFS is that permissions fall over the moment you've got root on a box that is allowed to connect. You're essent
by denkmoon 5y ago
And the permissions problem?
My experience with NFS is that permissions fall over the moment you've got root on a box that is allowed to connect. You're essentially relying on network level access control to prevent naughtyness. If I can create a user that has the same UID as someone's files I want on a remote NFS, I can just go do that?
Maybe I've always misconfigured NFS, but as far as I know outside of kerberos there is no way to have independent authorisation of users.
- yrro 5y agoYeah, you need kerberos. OTOH it's not as difficult as people seem to think. Maybe if you insist on DIY rather than getting started with FreeIPA or even whisper it Active Directory...
- chasil 5y agoI wrote the article on stunnel encryption. NFSv3 was strictly numeric uid/gid, but this is not the case with NFSv4. It is still best to keep uid/gid values synchronized, but there are idmapd processes that negotiate permissions between client and server. Examine the output of "man idmapd.conf" for details. It even does LDAP.
- dheera 5y ago> It is still best to keep uid/gid values synchronized That's impractical in a large organization. They really should have used a username@domain or UUID.