Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two machines:

  1. Linux with AD authentication and running NFS server
  2. Linux with NIS authentication

Problem:

When I try to mount any share from first machine (AD authentication) to second (NIS authentication) I always get somehing like this drwxrws---+ 13 16777260 16777222 4096 Sep 21 09:42 software

In fact I can't access to this folder because on NIS machine I don't have the user with such UID/GID

Question:

May somebody know how resolve this problem?

share|improve this question

2 Answers 2

The NFS Server on the windows machine is translating the AD Users to *nix user ID's. You will need to reconfigure the NFS Server on windows for proper translation of the *nix users.

This document should be your starting point to configure the NFS server. http://technet.microsoft.com/en-us/library/cc782783%28v=ws.10%29.aspx

share|improve this answer
    
Thanks a lot. I will look at but my NFS server based on Linux –  user137862 Sep 25 '12 at 5:52

The nfsd man page states:

nfsd bases its access control to files on the server machine on the uid and gid provided in each NFS RPC request. The normal behavior a user would expect is that she can access her files on the server just as she would on a normal file system. This requires that the same uids and gids are used on the client and the server machine.

Unfortunately, NFS can't map users (except to anonymous/nobody with options root_squash/all_squash, that is).

I see two possible ways to get around this problem:

1) Create a NIS group with GID 16777222 and add the NIS users who need access to the NFS filesystem to that NIS group.

2) Or, if the GID of the NIS group isn't in use on the NFS server and NFS supports ACLs, you could use ACLs to give the requested access to the NIS group (I assume readwrite access, for read-only access drop the 'w' in setfacl below). Assuming a directory called "software", do this on the NFS server:

# Back up current ACLs to /tmp/acls
getfacl -R -p --access /full/path/to/software > /tmp/acls
# Set default ACL rwx for new created directories
find /full/path/to/software -type d -exec setfacl -m d:g:<gid nis group>:rwx {} \;
# Set ACL rwx recursively in existing directories
find /full/path/to/software -type d -exec setfacl -m g:<gid nis group>:rwx {} \;
# Set ACL rwx recursively in existing files
find /full/path/to/software ! -type d -exec setfacl -m g:<gid nis group>:rw {} \;

[I recommend you to test the above procedure first. Create a directory, set ACLs, export it and test it.]

<gid nis group> is the GID of the NIS group. You don't need to add the NIS GID to /etc/groups on the NFS server. Obviously, if not added then you must specify the GID above as a numeric value.

Notice that setfacl can also recursively apply ACLs with the option -R. I prefer to use find and specifically set rwx for directories and rw for files.

If anything goes wrong:

# Flush ACLs
setfacl -R -b /full/path/to/software
# Restore ACLs
setfacl --restore=/tmp/acls
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.