zlacker

>>chmayn+(OP)
I’ve never really understood how permissions are supposed to work with NFS - are user IDs supposed to be consistent across systems?

Is there a sane easy way to implement authentication? Last Time I tried iirc my options were LDAP or nil.

>>hsbaua+Hv
Under NFSv2 and NFSv3, the numeric user and group id is used to determine permission, and these must be aligned between the client and server. I have an oracle uid 60 on an older system that maps as elcaro on an NFS client (because I have a different oracle user there as uid 54321).

Under NFSv4, direct uid/gid is no longer used, but the RPC.idmapd process determines privilege. I'm not really sure how it works beyond continuing to work when uid/gid synchronization is in place for NFSv3 and the connection is upgraded.

There is also an NFS ACL standard, but I don't know anything about it.

>>chasil+lw
> these must be aligned between the client and server

looooool

(Seriously, though, could someone tell me why this was supposed to make sense?)

>>jjoona+4H
> (Seriously, though, could someone tell me why this was supposed to make sense?)

Think about the environment it was originally used in — large organizations, computers which cost as much as a car, LANs which aren't easily accessible (e.g. the Unix people have access but laptops are expensive oddity and the sales people are probably sitting in front of a DOS box or shelled into that Unix server), etc. It's more defensible when your unix administrator is going to configure each of the servers to use the same NIS user directory.

All of that broke down when IP networking became the default, every desk in the building had a network port, and things like WiFi and laptops completely blew away the idea that the clients were managed by a single administrative group.