What type of system are you exporting from? Is it another iSeries? If so you can user iSeries Navigator or the new web navigator depending on your release to see and set permissions. Also you will need to make sure the UID 's match from one system to another if you have not implemented single signon. The actual User ID is not passed just the UID /GUID is passed. If they match a profile on the remote system, then normal user authority is used else it defaults to public authority. That is if what I was reading I interpreted correctly
https://www-304.ibm.com/support/docview.wss?uid=nas8N1016376
--
Chris Bipes
Director of Information Services
CrossCheck, Inc.
-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Rob Berendt
Sent: Wednesday, August 03, 2016 11:46 AM
To: midrange-l@xxxxxxxxxxxx
Subject: Security on NFS mounts.
I've set up some NFS mounts using the following
Source system:
md '/tgtsystem/tgtdirectory
MOUNT TYPE(*NFS)
MFS('tgtsystem:/tgtdirectory')
MNTOVRDIR('/tgtsystem/tgtdirectory')
OPTIONS('rw,suid,retry=5,rsize=32768,wsize=32768,timeo=20,
retrans=5,acregmin=30,acregmax=60,acdirmin=30,
acdirmax=60,soft,async,sec=sys,vers=3:2,nocache')
Target system:
EXPORTFS OPTIONS('-I -O') DIR('/tgtdirectory')
This worked well on several 'target directories'. However I'm running
into a security issue with one. Let's call it PAYROLL.
After doing the above I ran the following on the source system
WRKLNK '/tgtsystem/tgtdirectory/*'
and I received
CPFA09C - Not authorized to object. Object is /tgtsystem/tgtdirectory
So I ran the following on the target system:
CPYAUDJRNE ENTTYP(AF) FROMTIME(080316 1415)
RUNQRY QRYFILE(QTEMP/QAUDITAF)
and I am seeing
Job Job User
name user profile
QNFSNFSD QUSER QNFSANON
So apparently it's using anonymous NFS (QNFSANON). And this directory is
rather sensitive. How do I tell it not to use that but to use the user
profile from the remote system (the user doing the WRKLNK for example)? Is
there some option on EXPORTFS or on the MOUNT itself that I am missing?
midrange.com
