Subject: Reading .passwd from NFS vol

From: Peter Gutowski <[email-masked]>
Date: 09 Mar 2000 11:15:18 -0500

I'm admittedly a NFS newbie, have managed to make it work for the first time in a Long Time yesterday. From one computer (RedHat Linux 6.1, hostname: lx0) I mounted "/home/users" from similar system (hostname: lx1). Both machines have similarly configured Netatalk (1.4b2+asun2.1.4 pre37 I think). This [shared[ directory contains users home directories. I have no trouble logging on with telnet and seeing the identical contents on both machines. 

However when I log onto lx0 thru the Chooser using AppleShare I get the following message. (Logging onto lx1 behaves normally)

Mar  9 10:43:32 lx0 afpd[4877]: ASIP session:548(1) from 192.168.2.149:2063(3)
Mar  9 10:43:32 lx0 afpd[4877]: randnum/rand2num login: peterg
Mar  9 10:43:32 lx0 afpd[4877]: Failed to read from /home/users/peterg/.passwd

The /etc/exports on lx1 reads:

/home/users       192.168.2.0/255.255.255.0(rw)

The man page for exports lists a bunch of other options that I am clearly not getting a full appreciation of. Has anybody else experienced this and knows a solution, i.e., to make the shared directory work "normally"?

-- 
Peter Gutowski

[email-masked] • http://www.powervue.com/~peterg

---

From: Thierry Michalowski <[email-masked]>
Date: Thu, 09 Mar 2000 17:21:35 +0100

Hi,
looks like you're running afpd as root (which I assume is the only current option) and that your root-id process is smashed onto the exporting box to "nobody".
What you need to add as an option to your export is "root=lx0" (or equivalent for your flavor of unix).
Be aware that this way your system's security is getting worse as anyone root on lx1 is also root in a short time on lx0 without much of an effort.
Hope this helps
Thierry Michalowski

---

From: andrew morgan <[email-masked]>
Date: Thu, 9 Mar 2000 08:51:53 -0800 (PST)

On 9 Mar 2000, Peter Gutowski wrote:

> I'm admittedly a NFS newbie, have managed to make it work for the
> first time in a Long Time yesterday. From one computer (RedHat Linux
> 6.1, hostname: lx0) I mounted "/home/users" from similar system
> (hostname: lx1). Both machines have similarly configured Netatalk
> (1.4b2+asun2.1.4 pre37 I think). This [shared[ directory contains
> users home directories. I have no trouble logging on with telnet and
> seeing the identical contents on both machines.
> 
> However when I log onto lx0 thru the Chooser using AppleShare I get
> the following message. (Logging onto lx1 behaves normally)
> 
> The man page for exports lists a bunch of other options that I am
> clearly not getting a full appreciation of. Has anybody else
> experienced this and knows a solution, i.e., to make the shared
> directory work "normally"?

My bet is that the default export setting of "root_squash" is your
problem.  Most nfs servers defaults are set so that an nfs request coming
from root on a remote machine gets mapped to the "nobody" user instead.

Since afpd is running as root until it can verify the user's identity and
switch to that user, it sees all the files on the nfs partition as if it
were the "nobody" user.

There is an option you can place in /etc/exports to allow root the
priveledges you would expect: no_root_squash

	Andy

---

From: [email-masked]
Date: Thu, 09 Mar 2000 15:35:47 -0500 (EST)

This is really insecure.

I'd recommend using a solution like NIS or DCE to authenticate.
I'm working on a DCE/LDAP solution for this (Home project to
contribute to Linux)

On 09-Mar-00 Thierry Michalowski wrote:
> Hi,
> looks like you're running afpd as root (which I assume is the only current
> option) and that your root-id process is smashed onto the exporting box to
> "nobody".
> Be aware that this way your system's security is getting worse as anyone root
> on lx1 is also root in a short time on lx0 without much of an effort.
> Hope this helps
> Thierry Michalowski
> 
> Peter Gutowski wrote:
> 
>> I'm admittedly a NFS newbie, have managed to make it work for the first time
>> in a Long Time yesterday. From one computer (RedHat Linux 6.1, hostname:
>> lx0) I mounted "/home/users" from similar system (hostname: lx1). Both
>> machines have similarly configured Netatalk (1.4b2+asun2.1.4 pre37 I think).
> This [shared[ directory contains users home directories. I have no trouble
> logging on with telnet and seeing the identical contents on both machines.
>>
>> However when I log onto lx0 thru the Chooser using AppleShare I get the
>> following message. (Logging onto lx1 behaves normally)
>>
>> The man page for exports lists a bunch of other options that I am clearly
>> not getting a full appreciation of. Has anybody else experienced this and
>> knows a solution, i.e., to make the shared directory work "normally"?
>>
>> --
>> Peter Gutowski
>>

----------------------------------
E-Mail: [email-masked]
Date: 09-Mar-00
Time: 15:33:04
----------------------------------