Re: user and group id mappings

On Thu, Dec 09, 2004 at 11:19:18PM -0500, Michael Kaminsky wrote:
>   [85 lines, 599 words, 3688 characters]  Top characters: estroina
> 
> Jeff Abrahamson [[email protected]] wrote:
> > I'm a bit confused about user and group mappings in sfs.  It looks
> > like I need to edit or cause to be modified the /etc/sfs/sfs_users
> > file, but it's not entirely clear from the manual / man pages whether
> > I should edit this myself or use some program to administer them.  Nor
> > precisely how to do these things.  Probably this would be clear if I
> > were a sysadmin instead of a programmer and grad student...
> 
> Normally, you should not have to edit the sfs_users file manually.  The
> most common way that USER entries end up in that file is by running
> the "sfskey register" command on the server.  If you're interested in
> the format of the sfs_users file, try "man sfs_users".
> 
> > The issue is that user 512/512 on the server, member on the server of
> > groups 5551 and 5552, is known on the client as 1000/1000 and should
> > be members of those groups.
> > 
> > So the mappings are
> > 
> >     server	client
> >     uid 512	uid 1000
> >     gid 512	gid 1000
> >     gid 5551	gid 1003
> >     gid 5552	gid 1002
> > 
> > Currently only the first two of these work correctly, 
> 
> When you authenticate to an SFS server, your client is mapped (usually
> via public key cryptography) to a unix user on the server.  Whatever
> UID/GID and set of groups that particular unix-user-on-the-server has,
> is what you as the client effectively have when accessing the file
> server.

Thanks, it works now.  I think the action that caused it to start
working was that I did sfskey logout and login again, as the user's
membership in these groups on the server were new.

The ls problems (below) were clearly a red herring for me.


> > and even there it's only access permissions that work, ls -lg still
> > shows numbers instead of names.
> 
> The reason for this is that you're running ls on the client
> machine which doesn't know how to map the user and group IDs
> (512/5551/5552) that it receives from the server to the correct
> user and group names (from the server).  If those IDs existed in
> your client's /etc/passwd and /etc/group, you would see the local
> (incorrect) values for those user and group names.  Take a look at
> http://www.fs.net/sfswww/fileutils.html for more details (I haven't
> tried the patch recently, so I'm not sure if it works out-of-the-box
> with the current versions of SFS).

Yeah, that makes sense.  Thanks.

-- 
 Jeff

 Jeff Abrahamson  <http://www.purple.com/jeff/>    +1 215/837-2287
 GPG fingerprint: 1A1A BA95 D082 A558 A276  63C6 16BF 8C4C 0D1D AE4B

 A cool book of games, highly worth checking out:
 http://www.amazon.com/exec/obidos/ASIN/1931686963/purple-20

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBuzQyFr+MTA0drksRAlcoAJ9o0RzQF68XxJnPRH/vOFTlO4hz5QCfWnF+
i9V6mV07GJ9gvrLbDLM98yc=
=yXiX
-----END PGP SIGNATURE-----