maintaining permissions.

[John Stiles]

I'm currently running 11i and had some files nfs mounted on a 10.2 system. We could always drag & drop files from one directory to another and the system would maintain the permissions of the original owner.

Now on 11i the permissions change to the user that moved the files. We get alot of CAD files from our engineering dept. and maintaining original ownership/dates/times is important. I've always tried to maintain permissions so it's easier to track what's going on with the system. I recently started using NIS, would this have anything to do with it?

[Steven E. Protter]

for the following commands:

cp
scp (Part of Secure Shell)
rcp

There is a -p command flag.

This preserves permissions.

When you refer to dragging and dropping, what tool are you using for that? CDE?

Further, I would check the umask of the users involved and the directory permissions at both ends of this connection.

SEP

[John Stiles]

Sorry.
using CDE, left mouse button to drag & drop.

umask set for all users to umask 0 in all profiles. O.K. to overwrite but want to maintain permissions when moving.

John

[John Stiles]

SEP,

I use the -p option all the time, but for some cases it's easier to manually move the files rather than use commands to do it. Some users are mouse people.

John

[Bill Hassell]

Just a note about umask. umask = 0 is a very bad situation but unfortunately it is the default for HP-UX, including root. It means that ANY user on the system can corrupt datafiles or rename, move or remove files and directories. There's no point in copying filoes with 666 or 777 permissions as they can become useless at any minute.

And for root, umask = 0 is very serious as all files and directories created by root (usually important things like device files and volume group files) can be trashed by any user (including drag-n-destroy).

Using NFS and graphics tools will not maintain ownership. NFS knows nothing about the local passwd file and this can always cause a number of mixed up owners. Permissions will be determined by umask, which is what CDE tools use. You would be much better off never using drag-and-drop and instead, run a script to use rcp or scp, figure out the owner on the local system, and thereby maintain permissions and ownership.

[John Stiles]

SEP,

I think I may have an answer, although not a good one.

I changed mounting permissions due to people overwriting and deleting files that I did not want altered. I made it so our engineering group can only store files to one lvol with full permissions. My department moves the files to our active lvol/directories for us to use, the eng. group does not have permission to write to our lvol/dirs. My system understands them as users, why can't the file permissions remain the same?

John

[Steven E. Protter]

I wasn't critisizing mouse people btw. In Windows, I am quite the mouse person.

I think you might want to create a little program with a front end that users have to log into to moves files in and out of these shared drives.

Bill is right, GUI interfaces could care less about maintaining permissions(if they were sentient).

The program can check the original permissions and after prompting the user for overwrite make sure permissions are what they need to be.

Perhaps a little perl script.

I'm assuming when you said umask for all users was 0 you excluded root.

My umask for root is 022 Thats pretty secure.

SEP

[John Stiles]

Bill,

We are not a big place with alot of users, so umask 0 has never been a problem. When needed, I lock files up with root. The default for root is the same as HP defaults, rw for root r for others. I'm not good enough to create device files manually, SAM usually puts the right permissions on system files. I then use vi as root to edit the system files, vi maintains the proper permissions.

John

[John Stiles]

SEP,

The "mouse people" crack was from me, we have some users that insist on moving all their files around with the mouse, dirs and all. I too use the mouse alot for day to day work on both unix and windows.

The files in question, ultimately go into customer dirs under job numbers, so scripting it would be tough.

I just tested a couple of "drag & drops" it seems to work fine within a given lvol, but when I go from one lvol to another, I become the new owner.

John

[John Stiles]

So is it a logical volume issue? With no easy way around it?

I could just put the files back on the same lvol, but some people just want to abuse the open system it creates.

An example of abuse:

I was given a cad file to program. I programmed it and a couple of weeks later the engineer replaced his cad file with a new one. He then insisted that I left something out of the program. With the permissions properly set, I was able to show that his file was about 2 weeks newer than mine. Why people play these games, I'll never know. Only a couple of us have the knowledge and root privilages to change the dates of files.

John

[Shannon Petry]

You really dont have a problem with UNIX or CDE then, your problem is in data management practices.

Come up with standard naming conventions for your sight, and enforce several standards. Here is an example.

At 1 site, it's strictly CAD and CAE. My file server has individual customer names, owned by a specific user in charge of that project.
I.E.
/net/honda
owner:hondadm
Under this, we have internal project numbers.
I.E.
/net/honda/1303J12
/net/honda/1211B03

Only the person in charge of the honda directory "hondadm" can manipulate files or directories under /net/honda.

When an engineer or designer needs to work on one of those files, they have read access. They copy the file to their home directory, then make changes.

Upon completion, hondadm reviews the file and rejects changes or submits to the project folder with a new rev number.
I.E.
/net/johnqpub/gasbag_beanburner.001.prt

hondadm checks the file from
/net/honda/1303J12/gasbag_beanburner.001.prt and makes sure that changes needed are complete, part verifies, etc.. etc...
hondadm then copies the file from
/net/johnqpub/gasbag_beanburner.001.prt
to
/net/honda/1303J12/gasbag_beanburner.002.prt

johnqpub never modifies original data, and if the 002.prt file is bad, I know who is at fault.

This requires a bit of work, and 022 umasks across the board.

I have worked in the automotive industry for 16 years, starting on MVS, and working on the conversion teams for GM and Ford to workstation based CAD and UNIX file servers.

I sympathise with your situation, but have been round and round with no other work arounds.

If your company had about 3M for a PDM system, my advice could go out the window. But like 8 of my current customers, your a smaller shop and probably dont have 3M to toss out.

Also, the PDM is actually more work than simple data management practices.

Feel free to ask if you have any other questions on this one. It hits home and I have done this literally hundreds of times.

Best Regards,
Shannon

[John Stiles]

Shannon and all who replied,

Thanks for the help. In all the checking and testing I did, I guess I was just hoping for a better option. I don't like getting "can't" for an answer, especially from a computer. But I suppose when there are humans involved, there are no easy answers.

Thanks again.

John

[Shannon Petry]

Well, the way you "can" instead of can not, is to look into PDM software. But this is very costly, and tends to be much more of a burdon in a small shop than simply using good practices and teaching the same to all involved. PDM just in case you didnt know is "Product Data Management".

Some PDM software that you can look at:

UG Solutions
------------
UGManager (Unigraphics only)
iMan (Any product PDM)
Metaphase (SDRC only PDM)

IBM
----
Enovia PDM (Any product PDM)
Enovia PDM (Catia only PDM)

PTC Products
-------------
Windchill (Pro-E only)

Not sure what you are currently running, but may worth investigating these products.

I'll warn you ahead of time that iMan installations require over 250K worth of hardware, and 1.2M-2.2M in Oracle and developer fees.

Hope it helps
Sincerely,
Shannon Petry

[John Stiles]

Shannon,

We currently use UG, but also use other software. There is always more to the picture than one piece of software. Like you said before, a strict set of rules is needed for all files in the system.

So it looks like a scripting method will be the most cost effective for us.

John

[Shannon Petry · Accepted solution]

I know that feeling. ;)

Attatched is a simple script, just a couple functions and rough coding to get you started as an example.

The toughest battle is usually with engineers and designers who dont want to take the time.

Owners can be very persuasive when faced with the cost of a PDM as opposed to loss of data or weeks worth of development loss though. You may want to get quotes from at least Enovia, or even UG for UG Manager, and talk with the appropriate people if you cant get a process going on your own.

I hate politics, so simply present those who play them with numbers and let them do their jobs ;)

Sincerely,
Shannon

[John Stiles]

Thanks Shannon,

You sound like you're speaking from experience, I could do without all the political stuff too. It's hard not to get stay out of it though, if certain people had their way, we would all be running PC's. When they try to take my unix away, I stomp my feet.

You also sound like you've dealt with UG before. Do you know any Unigraphics/HP-UX gurus?

Thanks again to everyone in the forums. This is a very valuable resource.

John

[Shannon Petry]

Yes, I know UG and would consider myself one of the few experts with UG in Metro/Detroit outside of EDS. Guru? not sure if I'd say that, but I know more about UG than any of the first line support staff at EDS, and have worked with UG since version 7 on HP-UX 9.05.


Sincerely,
Shannon


No points please!

[John Stiles]

Shannon,

any doc's on customizing UG in HP-UX would be appreciated. The EDS doc's appear to be very limited. It appears I'm on my own with the installation and setup.

My email address is jcs@mcafeetool.com if you wish to contact me outside the forum. I don't know how appropriate it is to discuss non-hp topics on an hp forum.

John

[John Stiles]

Shannon,

As for points, I'm going to give you some anyway. I read the points thread and I want to assign point to all that participate, it's worth the effort. Besides, if I don't, then I'll have responses show up in my profile that have no points. We can't have that now can we? :)

John