toasters September 2005

toasters@lists.teaparty.net

65 participants
61 discussions

NFS access problem going from 6.4.4 to 7.0.1R1
by Steve Losen 06 Sep '05

06 Sep '05

We recently replaced our F820c pair running 6.4.4 with a FAS3050c pair running 7.0.1R1. Formerly we were doing something admittedly questionable to protect unauthorized NFS mounts from networks where we do not have complete physical control. We have a public lab of Unix workstations that NFS mount home directories from our filers. This is insecure because someone can bring in a Unix laptop configured with the same IP address as a workstation and move the network cable from the workstation to the laptop, and thereby get NFS access on the laptop. The laptop owner has root so he can su to any UID that he wants, thereby getting access to any user's files. Our solution was to write a "netgroup server" that temporarily added a NFS client to a netgroup just long enough for the client to mount and then removed the client from the netgroup. Only root on the NFS client had access to the shared secret that authenticated the client to the netgroup server. While not perfect, this made the laptop attack much more difficult. This worked fine under 6.4.4. Once the NFS client had its mounts, it did not seem to matter to the filer that the client disappeared from the netgroup. However, this is not the case under 7.0.1R1. We have found that certain NFS operations cause the filer to recheck the netgroup information and when it discovers that the client is no longer in the netgroup, it denies further access. I realize that we need to be looking at a "real" solution (NFSv4 ? NFS over IPsec ?). But I was wondering if there was something simple that I could do in the meantime, perhaps an obscure NFS option on the filer. Steve Losen scl(a)virginia.edu phone: 434-924-0640 University of Virginia ITC Unix Support

3 2

HOW DO I UN SUBSCRIBE?
by Joe Everett 06 Sep '05

06 Sep '05

--- Steve Losen <scl(a)sasha.acc.virginia.edu> wrote: > To: toasters(a)mathworks.com > Subject: NFS access problem going from 6.4.4 to 7.0.1R1 > Date: Sun, 04 Sep 2005 10:02:55 -0400 > From: Steve Losen <scl(a)sasha.acc.virginia.edu> > > > We recently replaced our F820c pair running 6.4.4 with a > FAS3050c pair running 7.0.1R1. > > Formerly we were doing something admittedly questionable to > protect unauthorized NFS mounts from networks where we do > not have complete physical control. We have a public lab > of Unix workstations that NFS mount home directories from > our filers. This is insecure because someone can bring in > a Unix laptop configured with the same IP address as a > workstation and move the network cable from the workstation > to the laptop, and thereby get NFS access on the laptop. > The laptop owner has root so he can su to any UID that he > wants, thereby getting access to any user's files. > > Our solution was to write a "netgroup server" that temporarily > added a NFS client to a netgroup just long enough for the client > to mount and then removed the client from the netgroup. Only > root on the NFS client had access to the shared secret that > authenticated the client to the netgroup server. While > not perfect, this made the laptop attack much more difficult. > > This worked fine under 6.4.4. Once the NFS client had its mounts, > it did not seem to matter to the filer that the client disappeared > from the netgroup. However, this is not the case under 7.0.1R1. > We have found that certain NFS operations cause the filer to > recheck > the netgroup information and when it discovers that the client is > no longer in the netgroup, it denies further access. > > I realize that we need to be looking at a "real" solution (NFSv4 ? > NFS over IPsec ?). But I was wondering if there was something > simple that I could do in the meantime, perhaps an obscure NFS > option on the filer. > > Steve Losen scl(a)virginia.edu phone: 434-924-0640 > > University of Virginia ITC Unix Support > > >

1 0

Unix dot-files on Windows
by Adrian Gschwend 06 Sep '05

06 Sep '05

Hi guys, As written before we use NetApp on Linux with NFS and CIFS for Windows, so far so good. One remaining problem is that Windows-Users keep seeing the dot-files (.gnome or whatever), which is a bit disturbing for the normal user. I thought there are some flags I can set that those files are shown as hidden files on Windows, but I couldn't find anything useful in the docs. Anyone knows how I can do that (if at all)? Again, OnTap at the moment is 6.5.4 cu Adrian -- Adrian Gschwend System Administrator Berne University of Applied Sciences Biel, Switzerland

2 2

Index
by Alex Soo 06 Sep '05

06 Sep '05

Hi, Can any body help on this? I am trying to index a folder on F740 so that all user can search the folder with their window default search tools. I have a window 2003 server and a bunch of XP work station. Regards, Alex Soo CONFIDENTIAL NOTE: The information contained in this email is intended only for the use of the individual or entity named above and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this message in error, please immediately notify the sender and delete the mail. Thank you.

1 0

Kerberos & sys security on the same export
by Adrian Gschwend 06 Sep '05

06 Sep '05

Hi all, At our university we just used NFS exports for our old Solaris 8 clients so far, now we have Linux in place on all clients and thus a lot more machines that connect to the filers with NFS. Because we are an academic environment sys-security is too weak. Some students would find out pretty fast that it is easy to boot Knoppix or connect their laptops on the same cable and try to access home directories from our professors. So we decided to use Kerberos on Linux as well (via AD Kerberos services which is connected to the filer), that works just fine with one exception: If I mix sys & krb5 security *every* client can still do sys, not just the /24 IP block I would need for the old Solaris setup. On a test-environment running on Linux I can do two exports for the exact same share, like one with sys, the second one with krb5 security. Thus I can do one sys export for the /24 IP block and a krb5 one for the rest. Unfortunately this seems not to work on NetApp, if I do two shares, the first one gets overwritten by the second one. I also tried something like this: /vol/sugus -sec=sys,rw=147.87.64.0/24,sec=krb5,rw=147.87.0.0/16 I don't get any special error messages with this export but it doesn't work as expected. Is this possible after all with OnTap? I'm running V6.5.4 on the filers. Thanks Adrian -- Adrian Gschwend System Administrator Berne University of Applied Sciences Biel, Switzerland

2 3

rescan without reboot to locate DLT library ?
by Frank Bonnet 05 Sep '05

05 Sep '05

Hello I'am in trouble with a DLT library which is not "seen" by the filer because the DLT was not powered when the filer boot up. Is there a command to rescan the SCSI but to let the filer discover the library without reboot the toaster ? Thanks PS : the box is a F87 running 6.5.5 -- Cordialement/Regards Frank Bonnet

2 1

�j weboldal
by Hotv�th Zolt�n 05 Sep '05

05 Sep '05

1 0

Say goodbye to insane gas prices
by Titor 03 Sep '05

03 Sep '05

1 0

Indus Pencil Industries (pvt) Ltd. presents new product.
by Indus Pencil Industries (pvt) Ltd. 03 Sep '05

03 Sep '05

For Queries contact: email: sales(a)induspencil.com Phone: 0092-21-111-910-910, 2573214 Fax 0092-21-2564931, 2566096

1 0

RE: Mail System Error - Returned Mail
by Zabetakis, George 01 Sep '05

01 Sep '05

Df -----Original Message----- From: toasters(a)mathworks.com [mailto:toasters@mathworks.com] Sent: Thu Sep 01 00:57:18 2005 To: marc.romero(a)ibpc.fr Subject: Mail System Error - Returned Mail Français : Ce message a été vérifié par un filtre sur le serveur de courrier. L'original du message a été remplacé pour la raison suivante : English : This message was verified by the filtering system of our mail server. The original message was replaced for this one by the following reason : Deutsch: Diese Nachricht wurde durch den Filter unseres Mail-Servers überprüft. Die Ursprungsnachricht wurde aus folgendem Grund ausgetauscht : Italiano: Questo messaggio e' stato verificato dal sistema di filtraggio del nostro mail server. Il messaggio originale e' stato sostituito da questo per la seguente ragione : Polski : Ta wiadomoæ zosta³a sprawdzona prze system filtruj¹cy naszego serwera pocztowego. Wiadomoæ oryginalna zosta³a zast¹piona z natêpuj¹cych powodów : Turque: Bu e-posta dagiticimiz tarafindan kontrol edilmistir. Orijinal e-posta bu mesaj ile degistirilmistir. Degisrtirilme nedeni: *** A suspicious file (executable code) was found in the message ! Le message original possédait un fichier attaché : Original message had the following attached files : Die Ursprungsnachricht besass folgende Attachments : Il messaggio originale possiede i seguenti file allegati : Wiadomoæ oryginalna zawiera³a nastêpuj¹ce za³¹czniki Orijinal e-postada asagidaki ek vardi: **** (X-FILE ??? ) : Message.scr TYPE : application/octet-stream **** SUSPECT FILES : 1 Il était envoyé par Original message was sent by Sie wurde gesendet von Messaggio originale mandato da Wiadomoæ zosta³a przes³ana przez Orijinal e-posta asagidaki kisi tarafindan gonderilmistir: **** From : <toasters(a)mathworks.com> Si vous pensez que c'est une erreur et que le message n'aurait pas du être remplacé par le filtre du serveur, merci de prendre contact avec l'administrateur système. If you think this is an error and the message should not be rejected by the filtering system, you may contact your system administrator for instructions. Falls Sie der Meinung sind, es handelt sich um einen Fehler, und diese Nachricht hätte nicht durch das Filtersystem des Servers ausgetauscht werden sollen, wenden Sie sich bitte an den Systemadministrator. Se pensate che questo sia un errore e che il messaggio non dovrebbe essere respinto dal sistema di filtraggio, puo' contattare l'amministratore sistema per istruzioni. Jeli uwa¿a Pan/Pani, ¿e pope³niono b³¹d i wiadomoæ nie powinna byæ odrzucona proszê skontaktowaæ siê z Administratorem. Orijinal e-postanin reddedilmesinin bir yanlislik oldugunu dusunuyorsaniz, ne yapilmasi gerektigi hakkinda sistem yoneticisiyle baglanti kurunuz. Si vous avez des questions vous pouvez contacter : If you have any questions, you can contact us : Bei weiteren Fragen wenden Sie sich bitte an : Inviare quesiti eventuali a : Jeli ma Pan/Pani pytania mo¿e Pan/Pani skontaktowaæ siê z : Sorulariniz icin Marc.Romero(a)ibpc.fr ile baglanti kurabilirsiniz. Marc.Romero(a)ibpc.fr Cordialement, Sincerely, Mit freundlichen Grüssen, Cordiali saluti, Z powa¿aniem Saygilarimla, Marc ROMERO ---------------------------------------------------------------- j-chkmail - (c) Ecole des Mines de Paris 2002, 2003

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters September 2005