X-Envelope-to: Novell@SUVM.BITNET
X-Mailer: Pegasus Mail v2.2 (R4).
Newsgroups: bit.listserv.novell
Date:         Wed, 8 Apr 1992 17:29:08 MET-1METDST
Reply-To:     bovenlander@coh.fgg.eur.nl
From:         John Bovenlander <bovenlander@COH.FGG.EUR.NL>
Subject:      Re: NW NFS assist?

Gary,

> Is anyone successfully using NetWare NFS who can help me ove a
conceptual
> hurdle that the documentation isn't doing me any good on?

I agree the Netware NFS doc is a bit hard to read...

>
> I'm having a hard time getting the rights mapped correctly so that the NFS
> client users' uid maps to a netware username, and then provides the user the
> correct priveleges on the mounted volume.

NFSADMIN lets you bind a NFS-client-uid to a Netware username; in
order for a NFS-client to access a directory this client should at
least have read- (I think even file-scan) access to all its parent
directories up to the root. As a Netware user you will find this a
bit unusual. However, that's the way Unix works...

>
> For some reason, if I don't set File Access to nearly every directory, the
> unix user can't traverse the tree.  NFS says that netware rights should
> govern, but simply granting priveleges doesn't work, unless I also use
> NFSADMIN to setup File Access, which tends to shotgun trustee rights all
> over the place.  NFSADMIN also seems to be keeping a secret log of rights
> granted, irrespective of Netware trusteeships.  Does anyone know where
> that's kept?
>

The problem of mapping Netware privileges to the Unix environment is
is bit complicated; I'm not sure I already understand this to its
full extend (I'm using Netware NFS only a few days now) but this is
how I think about it:

General rule is:

A NFS user will get access rights only as long as it
does not violate any of his Netware rights; in many cases multiple
Netware rights are needed to provide one NFS right.

example:
A NFS user having simply Write access to a directory would be able to
delete, create and modify (rename) files in that directory; so this
user should at least have the Netware rights ERASE, CREATE and MODIFY.
If one is missing the NFS use will not be granted write access.

example2:
Setting a Netware File "Read Only" implies that a NFS user will not
be granted Write-access to this files parent directory; if he would
he could otherwise delete this "read only" file.

Using NFSADMIN to setup security for a NFS user will therefore be
much easier because it will automatically set all the corresponding
Netware privileges, which in many cases will be multiple file- and
or directory access rights.

> If you're able to assist, please respond via mail...  Thanks.
>
I hope I was....

JohnB



----------------------------------------------------------------------
|                         John Bovenlander                           |
|                     System/Network Specialist                      |
|                                                                    |
| Erasmus University Rotterdam                                       |
| Dept. ERC/COH                                                      |
| P.O. Box 1738                    E-mail: bovenlander@coh.fgg.eur.nl|
| 3000 DR  Rotterdam               Fax:    +31-(0)10-4362719         |
| The Netherlands                  Phone:  +31-(0)10-4087403         |
----------------------------------------------------------------------
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU