X-Envelope-to: Banyan-L@AkronVM.UAkron.Edu
Newsgroups: bit.listserv.banyan-l
Date:         Wed, 22 Jul 1992 10:54:56 AES
From:         Ian=Brabham%CC%Monash@BANYAN.CC.MONASH.EDU.AU
Subject:      re: Help with Vines 5.0 ARL's?
X-To:         Tom=Greenaway%Toronto%banyan@MAGNOLIA.BANYAN.COM
X-cc:         Banyan-L@AkronVM.UAkron.Edu

Tom Greenaway,

 I wish more Banyan employees like your good self would take an active
 interest in this list.  I thank you for taking the time to contribute
 to this discussion.

>	    In the "Extended List"  you can enter a full Streettalk
>	    Name or a StreetTalk List.  You CANNOT use a WildCard
>	    in the Extended list as the *@*@* world will always over
>	    ride it.  Not only will it override the Extended list
>	    wildcard, but if you try to test a user while you have
>	    a wildcard in the extended list you will HANG your
>	    PC!  This is because of the *@whatever in the Extended
>	    list.  We like to call it a KNOWN ANOMALY!
>	    (bug is such a dirty word!)

 Work Around for the WORK AROUND!     Reread.T.F.M.

 From page 6-19, Managing VINES Security :-

 VERIFYING ACCESS
	When a user attempt to access a directory or file, VFS checks the
	ARL of the directory or file.  The order in which VFS checks the ARL
	is as follows:

	1. Owner (Primary List)
	2. Item@Group@Organization
	   (An individual name in the Extended List)
	3. Group (Primary List)
	4. *@Group@Organization
	   (A group name or a StreetTalk list in the Extended List)
	5. *@*@Organization
	   (All individuals in an Organization in the Extended List)
	6. World (Primary List)

	Note that the order of entries in the Extended List becomes important
	when a user's name is in two different StreetTalk lists, in two
	different groups, or in a group and a list.  The user has ..^^^
	^^^^^^^^^ ^^^^^^
 (I wonder how a user's name can be in 2 Different Groups?  Must be a KNOWN
  ANOMALY in the manual <Grin>.)

 I have personally extensively tested the above definition and found it to
 be quite accurate.  Setarl does choke when trying to test the ARL but VFS
 does implement it correctly.

 Tom, do you know why it was decided that the extended list be constrained to
 only 5 entries?  It had been a long time gripe of many Vines Administrators
 that the old ARL structures only allowed 5 entries.  The standard answer was
 that it would be a lot of work to change and what other enhancements did
 everybody want to give up to allow it to happen.  So now VFS was written
 effectivly from scratch and somebody decided again 5 was the number.  I am
 just interested in why 5 and not 3 or 8 or 15 or 42 (Ah! The meaning of life
 the universe and everything. HHGTTG).


>	What you need to do is create a streettalk list

 On page 6-11, Managing VINES Security it states :-

	Be careful when selecting a StreetTalk list for this field.  For best
	performance, do NOT select lists that contain either templates (entries
	that use wildcards) or other StreetTalk lists.


>	  As far as the comment regarding Beta Test Sites:
>			I think they did a BANG UP JOB!!!!

 Yes my comment was a little unfair, but for the KNOWN ANOMALIES in the
 SETARL program to be so glareing, I think something must not be quite
 right with the QA process.  I found my first problem with SETARL within
 about an hour of setting up my first rev 5 server.  Also I should say
 that most of the difficulties I have experienced have been only to do
 with some of the new VFS utilities.  The rest of the Vines product I
 have found to quite stable.

Ian Brabham                 email: ian@banyan.cc.monash.edu.au
Micro Support Group         phone: +61 3 565 4742
Monash University           fax:   +61 3 565 4746
Melbourne Australia
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU