What type of system are you exporting from? Is it another iSeries? If so you can user iSeries Navigator or the new web navigator depending on your release to see and set permissions. Also you will need to make sure the UID 's match from one system to another if you have not implemented single signon. The actual User ID is not passed just the UID /GUID is passed. If they match a profile on the remote system, then normal user authority is used else it defaults to public authority. That is if what I was reading I interpreted correctly
https://www-304.ibm.com/support/docview.wss?uid=nas8N1016376


--
Chris Bipes
Director of Information Services
CrossCheck, Inc.

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Rob Berendt
Sent: Wednesday, August 03, 2016 11:46 AM
To: midrange-l@xxxxxxxxxxxx
Subject: Security on NFS mounts.

I've set up some NFS mounts using the following

Source system:
md '/tgtsystem/tgtdirectory
MOUNT TYPE(*NFS)
MFS('tgtsystem:/tgtdirectory')
MNTOVRDIR('/tgtsystem/tgtdirectory')
OPTIONS('rw,suid,retry=5,rsize=32768,wsize=32768,timeo=20,
retrans=5,acregmin=30,acregmax=60,acdirmin=30,
acdirmax=60,soft,async,sec=sys,vers=3:2,nocache')

Target system:
EXPORTFS OPTIONS('-I -O') DIR('/tgtdirectory')

This worked well on several 'target directories'. However I'm running
into a security issue with one. Let's call it PAYROLL.
After doing the above I ran the following on the source system
WRKLNK '/tgtsystem/tgtdirectory/*'
and I received
CPFA09C - Not authorized to object. Object is /tgtsystem/tgtdirectory

So I ran the following on the target system:
CPYAUDJRNE ENTTYP(AF) FROMTIME(080316 1415)
RUNQRY QRYFILE(QTEMP/QAUDITAF)
and I am seeing
Job Job User
name user profile
QNFSNFSD QUSER QNFSANON

So apparently it's using anonymous NFS (QNFSANON). And this directory is
rather sensitive. How do I tell it not to use that but to use the user
profile from the remote system (the user doing the WRKLNK for example)? Is
there some option on EXPORTFS or on the MOUNT itself that I am missing?


This thread ...

Replies:

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2019 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].