On Mon, Oct 24, 2011 at 05:00:36PM -0400, Jeffrey Hutzelman wrote:
> > Services other than NFS and login do not need mapping to host-local names
> > anyway.
>
> Yes and no. Certainly there are services other than NFS and login which
> result in access to files, processes, or other resources belonging to a
> particular user. For example, ssh and FTP both fall into that class.
Sure. From my point of view ssh belongs to the "login" class of services,
allowing to start processes with the desired local identity on a host,
as well as telnet, rsh, xdm and others serving the same purpose.
Ftp (most often) provides access to files residing on a local unix file
system and thus has a function corresponding to NFS.
So, you are totally correct and even though I meant the same,
I should have said "remote file service" instead of "NFS".
> Conversely, a file server does not necessarily need such a mapping; what
> it needs is a mapping to whatever it uses to track file ownership and
> access controls. It just happens that a common NFS implementation model
> is to track such things using small integers in the same namespace used
> for tracking ownership of files and processes on the machine on which
> the server runs. Of course, this is a terribly convenient model if the
> NFS server in question happens to simply export the contents of some
> local filesystem as-is. But not all fileservers, nor even all NFS
> servers, work that way.
Exactly.
(e.g. Ganesha is a nice example of a "generalized NFS service"
implementation).
[Also the FTP protocol may be used to export a resource other than a
local file system - then it quite probably would need a mapping (from
Kerberos principals used for authentication) to identities other than
the unix ones. Then the Kerberos library could of course not "guess"
a suitable mapping. Even if we'd rely on _explicit_ configuration of the
mapping to be done by the Kerberos library, the mapping would have to be
configurable per service instance not per host. There can be more than
one file service on a host, serving different kind of data and needing
different mappings.]
Regards,
Rune
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.