Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #229639

Re: Permissions on NFS mounts

Show all headers | View raw

On Thu, Dec 10, 2020 at 10:42:36AM -0500, Greg Wooledge wrote:
>In the context of the original question, having a consistent set of
>local user accounts (name/UID pairs) across all of your systems in
>an NFS environment is useful for making sure all files have consistent
>ownership.  Even on the systems where, say, charlie will never log in,
>seeing that the files in /home/charlie are owned by user "charlie" is
>helpful.

It's practically impossible to sync everything on a modern system in the 
presence of dynamically allocated IDs. The best you can hope for is sync 
a certain *range* of IDs and by convention only use IDs in that range 
within NFS exports. If something outside that range happens to sneak 
into the export it'll look weird, but has no real effect on security. 
(If you're using sec=sys on an NFS mount you have no security outside of 
what the client chooses to implement.)

Historically this could be done by being diligent in manually creating 
passwd entries, via yp/nis to distribute a common passwd file, or via 
various configuration management schemes to automate local passwd file 
management. In most normal (heterogenous) environments these did only 
manage a certain range, and trying to sync system users was simply not 
done because it was harder than it was worth.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Permissions on NFS mounts Paul M Foster <paulf@quillandmouse.com> - 2020-12-09 21:40 +0100
  Re: Permissions on NFS mounts Dan Ritter <dsr@randomstring.org> - 2020-12-09 22:00 +0100
    Re: Permissions on NFS mounts Mark Fletcher <mark27q1@gmail.com> - 2020-12-10 10:20 +0100
      Re: Permissions on NFS mounts Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-10 10:50 +0100
        Re: Permissions on NFS mounts Reco <recoverym4n@enotuniq.net> - 2020-12-10 11:00 +0100
          Re: Permissions on NFS mounts Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-10 11:10 +0100
            Re: Permissions on NFS mounts Reco <recoverym4n@enotuniq.net> - 2020-12-10 11:40 +0100
              Re: Permissions on NFS mounts Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-10 14:40 +0100
                Re: Permissions on NFS mounts Reco <recoverym4n@enotuniq.net> - 2020-12-10 14:50 +0100
                Re: Permissions on NFS mounts David Wright <deblis@lionunicorn.co.uk> - 2020-12-10 16:40 +0100
                Re: Permissions on NFS mounts Tixy <tixy@yxit.co.uk> - 2020-12-10 16:40 +0100
                Re: Permissions on NFS mounts Greg Wooledge <wooledg@eeg.ccf.org> - 2020-12-10 16:50 +0100
                Re: Permissions on NFS mounts Michael Stone <mstone@debian.org> - 2020-12-10 18:20 +0100
                Re: Permissions on NFS mounts Michael Stone <mstone@debian.org> - 2020-12-10 18:30 +0100
      Re: Permissions on NFS mounts Reco <recoverym4n@enotuniq.net> - 2020-12-10 11:00 +0100
      Re: Permissions on NFS mounts Darac Marjal <mailinglist@darac.org.uk> - 2020-12-10 13:00 +0100
  Re: Permissions on NFS mounts Michael Stone <mstone@debian.org> - 2020-12-10 18:00 +0100

csiph-web