NFS permissions

[Gene Horodecki]

We have two servers, A and B. We control server B. On this server we want to share a few filesystems via NFS with server A. The customer has full control of server A and we do not have access to it. The user has access to server B but only to regulay user accounts. We control root on B.

How do we do the following with HP-UX NFS:
- create a filesystem on B that is exported to A, but control what user/group on B owns the files. All files shared on B should always be owned by a specific user/group that we control.

Thanks.

[Dennis Handly]

>but control what user/group on B owns the files. All files shared on B should always be owned by a specific user/group that we control.

The customer on A can/will have full access to every file on the exported filesystem, provided he has root to create matching UIDs. If mounted R/W, then he can do that too.

So who/what are you trying to protect? Is the customer working with or against you?

[Gene Horodecki]

The customer has been known to 'cut corners' I will say. We do not want the customer to be able to create files on server B with an arbitrary UID ownership.

Let's say they have access to UID 500 and 501 on server B. We do not want them to be able to create a user with UID 500 on server A and be able to write it, which would technically give ownership to the ID they control on server B.

We want to force all files in the export on server B to be owned by UID 499, lets say.

I believe on Linux one would use the 'all_squash' option which would force all files to be handled as if the user is anonymous, and NFS would set file ownership to a configured value. How would this be done on HP-UX?

[Tingli]

Create the directory in B owned by 499, then have it exported. Then in A, the mounted file system will be owned by 499 user too.

[Dennis Handly]

>We do not want the customer to be able to create files on server B with an arbitrary UID ownership.

They can't. They can create it with a specific UID, limited by user and group security.

>I believe on Linux one would use the 'all_squash' option which would force all files to be handled as if the user is anonymous, and NFS would set file ownership to a configured value.

HP-UX exportfs has: anon=uid