Possibly the easiest way to give users the same UID would be to set up the generic account option like this:
options cifs.generic_account pcuser
where "pcuser" is an entry in the /etc/passwd file with a UID:GID pair like this:
pcuser::65534:65534::
With this scenario, the filer checks the domain-authenticated user "X" against /etc/passwd to see if "X" is known locally, and if not the filer assigns the generic account "pcuser" to the unknown user "X". All unknown users receive UID 65534 and as far as the filer is concerned, are the same user.
At 10:34 AM 6/11/98 -0700, agy wrote:
Is there a way to force CVTUSER to create the user list export both alphabetically AND with ascending UID's? This way, as we add users to the filer, we don't have to check for "free UIDs"? Or if we're not even USING NFS (which we are not) and all we're using is the "cifs.home_dir" option and nothing else, couldn't eveyone have the SAME UID???
There is a new version of cvtusers scheduled for July which will do what you want, as well as giving you the ability to edit the stuff before it's written to file. Check the NOW site toward mid-July in the Tools and Utilities section. The name of the new version is SecureShare Account Migrator. It is perfectly legal to give all users the same UID. Doing this results in FAT-style security, i.e. none. If that's what you want, go for it.
This will be a security issue with the current software (5.0.1 and earlier), but with the 5.1 release due soon you will be able to apply an ACL to the file or directory for Windows security. If you need UNIX security on the file as well, better stick with real (and unique) UIDs.
Actually, since you're an NT shop, let me ask you, do you use a Domain Controller? If you do, the filer will be happy to use that for authentication as well, eliminating the conversion problem altogether.
Having a DC doesn't eliminate the problem completely, because you still need to map the user name to a UID:GID pair somewhere. Using NIS, a DC and maintaining the same user naming conventions across platform is the only sure way I've found to eliminate having to maintain the local /etc/passwd file.
Arnie
Run cvtusers in your filer's /etc directory - otherwise, you do not get a root user, and logging into your filer is sort of...difficult...
When running cvtusers, use the -m3 option. This will not necessarily "sort" the users in the passwd file - but why would it need to? It will, however, merge with the existing password file and elect to use the NT UIDs over the Unix ones. The NT UIDs are allocated sequentially based upon creation order of the user accounts.
Now, each time you run cvtusers against your filer's /etc/passwd file, it will only add new users. A batch file that runs on a schedule on your DC will keep your NT user database up-to-date with the /etc/passwd file on the filer.
-A
-----Original Message----- From: Arnie Thompson [mailto:arnie@netapp.com] Sent: Thursday, June 11, 1998 5:28 PM To: agy Cc: toasters@mathworks.com Subject: Re: cvtusers question
Possibly the easiest way to give users the same UID would be to set up the generic account option like this:
options cifs.generic_account pcuserwhere "pcuser" is an entry in the /etc/passwd file with a UID:GID pair like this:
pcuser::65534:65534::With this scenario, the filer checks the domain-authenticated user "X" against /etc/passwd to see if "X" is known locally, and if not the filer assigns the generic account "pcuser" to the unknown user "X". All unknown users receive UID 65534 and as far as the filer is concerned, are the same user.
At 10:34 AM 6/11/98 -0700, agy wrote:
Is there a way to force CVTUSER to create the user list export both alphabetically AND with ascending UID's? This way, as we add users to the filer, we don't have to check for "free UIDs"? Or if we're not even USING NFS (which we are not) and all we're using is the "cifs.home_dir" option and nothing else, couldn't eveyone have the SAME UID???
There is a new version of cvtusers scheduled for July which will do what you want, as well as giving you the ability to edit the stuff before it's written to file. Check the NOW site toward mid-July in the Tools and Utilities section. The name of the new version is SecureShare Account Migrator. It is perfectly legal to give all users the same UID. Doing this results in FAT-style security, i.e. none. If that's what you want, go for it.
This will be a security issue with the current software (5.0.1 and earlier), but with the 5.1 release due soon you will be able to apply an ACL to the file or directory for Windows security. If you need UNIX security on the file as well, better stick with real (and unique) UIDs.
Actually, since you're an NT shop, let me ask you, do you use a Domain Controller? If you do, the filer will be happy to use that for authentication as well, eliminating the conversion problem altogether.
Having a DC doesn't eliminate the problem completely, because you still need to map the user name to a UID:GID pair somewhere. Using NIS, a DC and maintaining the same user naming conventions across platform is the only sure way I've found to eliminate having to maintain the local /etc/passwd file.
Arnie
-
Allan Burrington -
Arnie Thompson