Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #229611

Re: Permissions on NFS mounts

Show all headers | View raw

On Wed, Dec 09, 2020 at 03:54:10PM -0500, Dan Ritter wrote:
> Paul M Foster wrote: 
> > I have two users on the client: paulf 1000 and nancyf 1001. On the
> > server, I have two users: pi 1000 and paulf 1001. I can mount the NFS
> > share from the server to /mnt on my client. But any files belonging to
> > me (user 1001 on the server) look like they belong to nancy (user 1001
> > on the client. More importantly, if I copy files to this share from the
> > client, they will look like they belong to pi (user 1000) on the server.
> > 
> > Is there some way in the /etc/exports file to adjust the parameters so
> > that files retain my ownership on the server?
> 
> You're looking for userid mapping, handled by idmapd.
> 
> Your best long-term solution is to make the userids consistent
> across machines by making a decision about who will be 1000, 
> 1001 and 1002, and then changing /etc/passwd and running
> suitable "chown -R" commands, probably followed by find
> commands.
> 
> Debian automatically starts user numbering at 1000, so it's a
> good idea to have a consistent install username, if you can
> arrange it.
> 


This brings up an interesting thought. In the situation where you align 
user IDs across a number of machines for ths purpose, you'll inevitably 
end up with situations where users are created on some of the machines 
only for the purpose of keeping the IDs in synch so they can all play 
nice with the NFS. Left alone, having unneeded users on a given machine 
could be a security threat, at least in the sense that it provides a 
greater than necessary attackable surface area. What can be done about 
that? Obviously one thing would be setting the shell to /dev/null in the 
password file of those machines that don't need a given user, to prevent 
interactive logins. What else could be done? Is there a way to put an 
account "beyond use", in any way including su, sudo etc, while still 
having the machine recognise the user for being a user and therefore not 
messing up the mapping of user IDs on shared resources like NFS? In 
other words, create the sense of "yes this user exists, but they are not 
welcome here"?

Mark

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Permissions on NFS mounts Paul M Foster <paulf@quillandmouse.com> - 2020-12-09 21:40 +0100
  Re: Permissions on NFS mounts Dan Ritter <dsr@randomstring.org> - 2020-12-09 22:00 +0100
    Re: Permissions on NFS mounts Mark Fletcher <mark27q1@gmail.com> - 2020-12-10 10:20 +0100
      Re: Permissions on NFS mounts Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-10 10:50 +0100
        Re: Permissions on NFS mounts Reco <recoverym4n@enotuniq.net> - 2020-12-10 11:00 +0100
          Re: Permissions on NFS mounts Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-10 11:10 +0100
            Re: Permissions on NFS mounts Reco <recoverym4n@enotuniq.net> - 2020-12-10 11:40 +0100
              Re: Permissions on NFS mounts Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-10 14:40 +0100
                Re: Permissions on NFS mounts Reco <recoverym4n@enotuniq.net> - 2020-12-10 14:50 +0100
                Re: Permissions on NFS mounts David Wright <deblis@lionunicorn.co.uk> - 2020-12-10 16:40 +0100
                Re: Permissions on NFS mounts Tixy <tixy@yxit.co.uk> - 2020-12-10 16:40 +0100
                Re: Permissions on NFS mounts Greg Wooledge <wooledg@eeg.ccf.org> - 2020-12-10 16:50 +0100
                Re: Permissions on NFS mounts Michael Stone <mstone@debian.org> - 2020-12-10 18:20 +0100
                Re: Permissions on NFS mounts Michael Stone <mstone@debian.org> - 2020-12-10 18:30 +0100
      Re: Permissions on NFS mounts Reco <recoverym4n@enotuniq.net> - 2020-12-10 11:00 +0100
      Re: Permissions on NFS mounts Darac Marjal <mailinglist@darac.org.uk> - 2020-12-10 13:00 +0100
  Re: Permissions on NFS mounts Michael Stone <mstone@debian.org> - 2020-12-10 18:00 +0100

csiph-web