Hi Harry,
On Tue, Oct 11, 2011 at 09:50:53PM -0500, Harry Coin wrote:
> >How does a user logged in as root with authenticated credential
> >'root/[email protected]' create a file owned by 0:0 nfs
I am afraid you may be mixing different namespaces / domains of
applicabililty.
1. The numeric "owner" of a file is a local matter for every host, the
mapping between a number and a local account name string happens via nss_*
(say /etc/passwd)
2. A principal name is a string in a certain KDC.
3. Whatever is the uid of the process on some host having a principal's
credentials has no direct connection to the above two.
NFS is fundamentally broken from the beginning, which NFSv4 with sec=krb5*
tries to somehow address (while nfs4 with sec=sys is no better than nfs3).
One vital difference with nfs4+krb5 is that the numerical uids are no
loger synchronized between different computers.
My impression is that you are trying to use a broken tool (diskless
hosts with numerical-uid-based NFS), at the same time expecting that it
can work properly. I don't think so.
It may look like a "practically appealing" solution but you will face
problems which can not be solved, quite possibly not even worked around.
> P.S. of interest, same behaviour NFSv4 or v3. Normal ownership on new
> files created on the server by clients with any principal other than
> those formatted user/<fqfn>@REALM.
There are two mapping daemons involved, at the server (local uids <-> strings)
and at the client (strings <-> local uids) according to passwd. I guess
none of the daemons is aware of a local account name "user/<fqdn>" with
some numeric uid, or do you have corresponding entries in /etc/passwd?
Unknown entities are mapped to the string "nobody" and its local uid respectively.
Regards,
Rune
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.