× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.



Hi Rob

Short answer - NFS security has nothing to do with users - it uses the UID and/or GID settings of a user. Not sure if it's either or only one.

Beyond that I'm not much help - I do know that the GID, let's say, of an IBM i user has to be the same as a GID on the target system, a GID that has sufficient authority.

Hope that gets you started!
Vern

On 8/3/2016 1:45 PM, Rob Berendt wrote:
I've set up some NFS mounts using the following

Source system:
md '/tgtsystem/tgtdirectory
MOUNT TYPE(*NFS)
MFS('tgtsystem:/tgtdirectory')
MNTOVRDIR('/tgtsystem/tgtdirectory')
OPTIONS('rw,suid,retry=5,rsize=32768,wsize=32768,timeo=20,
retrans=5,acregmin=30,acregmax=60,acdirmin=30,
acdirmax=60,soft,async,sec=sys,vers=3:2,nocache')

Target system:
EXPORTFS OPTIONS('-I -O') DIR('/tgtdirectory')

This worked well on several 'target directories'. However I'm running
into a security issue with one. Let's call it PAYROLL.
After doing the above I ran the following on the source system
WRKLNK '/tgtsystem/tgtdirectory/*'
and I received
CPFA09C - Not authorized to object. Object is /tgtsystem/tgtdirectory

So I ran the following on the target system:
CPYAUDJRNE ENTTYP(AF) FROMTIME(080316 1415)
RUNQRY QRYFILE(QTEMP/QAUDITAF)
and I am seeing
Job Job User
name user profile
QNFSNFSD QUSER QNFSANON

So apparently it's using anonymous NFS (QNFSANON). And this directory is
rather sensitive. How do I tell it not to use that but to use the user
profile from the remote system (the user doing the WRKLNK for example)? Is
there some option on EXPORTFS or on the MOUNT itself that I am missing?


Target


Rob Berendt


As an Amazon Associate we earn from qualifying purchases.

This thread ...

Follow-Ups:
Replies:

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.