SEO

Hi,

I need to grant access to NFS clients based on hostnames. The way I
know of to do this is via NIS netgroups. However, I do not have NIS
setup in my environment. How can I achieve this ?

I am aware of things such as blocking access via ip address etc but
need to block access based on hostnames. Since the number of hosts are
numerous, something like netgroup would be ideal for me.

Thanks,
Subho.

> I need to grant access to NFS clients based on hostnames. The way I
> know of to do this is via NIS netgroups. However, I do not have NIS
> setup in my environment. How can I achieve this ?
>
> I am aware of things such as blocking access via ip address etc but
> need to block access based on hostnames. Since the number of hosts are
> numerous, something like netgroup would be ideal for me.

If DNS is configured on your NFS server, you can base your access lists
on DNS hostnames. The relevant files for configuring the DNS resolver
are /etc/nsswitch.conf and /etc/resolv.conf.

Steve

subhfern@yahoo.com (Subhodini Fernandes) writes in comp.sys.sun.admin:
| I need to grant access to NFS clients based on hostnames. The way I
|know of to do this is via NIS netgroups. However, I do not have NIS
|setup in my environment. How can I achieve this ?

List all the hostnames individually in dfstab - use shortcuts for
subnets or subdomains if possible. See the access_list section
in 'man share_nfs'

--
__________________________________________________ ______________________
Alan Coopersmith alanc@alum.calberkeley.org
http://www.CSUA.Berkeley.EDU/~alanc/ aka: Alan.Coopersmith@Sun.COM
Working for, but definitely not speaking for, Sun Microsystems, Inc.

Alan Coopersmith <alanc@alum.calberkeley.org> wrote in message news:<bfbt8m$2705$2@agate.berkeley.edu>...
> subhfern@yahoo.com (Subhodini Fernandes) writes in comp.sys.sun.admin:
> | I need to grant access to NFS clients based on hostnames. The way I
> |know of to do this is via NIS netgroups. However, I do not have NIS
> |setup in my environment. How can I achieve this ?
>
> List all the hostnames individually in dfstab - use shortcuts for
> subnets or subdomains if possible. See the access_list section
> in 'man share_nfs'

My problem is that I have around 50 Solaris boxes which I need to add
to that list. All are in a subnet with around 200 other workstations.
If I include the subnet then the access list is to large. However, I
do not see how I can add 50 workstations in the dfstab file either.
Hence I wanted to setup netgroup - but then I do not want to setup NIS
!

Thanks,
Subho.

In comp.unix.solaris Subhodini Fernandes <subhfern@yahoo.com> wrote:
> My problem is that I have around 50 Solaris boxes which I need to add
> to that list. All are in a subnet with around 200 other workstations.
> If I include the subnet then the access list is to large. However, I
> do not see how I can add 50 workstations in the dfstab file either.
> Hence I wanted to setup netgroup - but then I do not want to setup NIS
> !

Netgroups do not work outside of a nameservice. You must have either
NIS, NIS+, or LDAP to use them. Just having a /etc/netgroups file
doesn't work.

--
Darren Dunham ddunham@taos.com
Unix System Administrator Taos - The SysAdmin Company
Got some Dr Pepper? San Francisco, CA bay area
< This line left intentionally blank to confuse you. >

Darren Dunham <ddunham@redwood.taos.com> wrote in message news:<TKWSa.252$_81.25160835@newssvr14.news.prodig y.com>...
> In comp.unix.solaris Subhodini Fernandes <subhfern@yahoo.com> wrote:
> > My problem is that I have around 50 Solaris boxes which I need to add
> > to that list. All are in a subnet with around 200 other workstations.
> > If I include the subnet then the access list is to large. However, I
> > do not see how I can add 50 workstations in the dfstab file either.
> > Hence I wanted to setup netgroup - but then I do not want to setup NIS
> > !
>
> Netgroups do not work outside of a nameservice. You must have either
> NIS, NIS+, or LDAP to use them. Just having a /etc/netgroups file
> doesn't work.

Exactly my point ! How do I overcome it ??

Kevin.

Darren Dunham <ddunham@redwood.taos.com> wrote in message news:<TKWSa.252$_81.25160835@newssvr14.news.prodig y.com>...
> In comp.unix.solaris Subhodini Fernandes <subhfern@yahoo.com> wrote:
> > My problem is that I have around 50 Solaris boxes which I need to add
> > to that list. All are in a subnet with around 200 other workstations.
> > If I include the subnet then the access list is to large. However, I
> > do not see how I can add 50 workstations in the dfstab file either.
> > Hence I wanted to setup netgroup - but then I do not want to setup NIS
> > !
>
> Netgroups do not work outside of a nameservice. You must have either
> NIS, NIS+, or LDAP to use them. Just having a /etc/netgroups file
> doesn't work.

Exactly my point. How do I overcome it.

Subho.

In comp.unix.solaris Subhodini Fernandes <subhfern@yahoo.com> wrote:
> Darren Dunham <ddunham@redwood.taos.com> wrote in message news:<TKWSa.252$_81.25160835@newssvr14.news.prodig y.com>...
>> In comp.unix.solaris Subhodini Fernandes <subhfern@yahoo.com> wrote:
>> > My problem is that I have around 50 Solaris boxes which I need to add
>> > to that list. All are in a subnet with around 200 other workstations.
>> > If I include the subnet then the access list is to large. However, I
>> > do not see how I can add 50 workstations in the dfstab file either.
>> > Hence I wanted to setup netgroup - but then I do not want to setup NIS
>> > !
>>
>> Netgroups do not work outside of a nameservice. You must have either
>> NIS, NIS+, or LDAP to use them. Just having a /etc/netgroups file
>> doesn't work.

> Exactly my point ! How do I overcome it ??

You appear to have already read all the possible ways to specify an
access list with Solaris share_nfs. There is no magic button.

*) Setup a name service and use netgroups.
*) Group the machines so that you can use one or more subnet/mask
specifications.
*) Put the machines in a subdomain so you can use domain
specifications. CNAMES would not help. It needs to be the PTR
records that list the subdomain.
*) List all the machines individually in the access list.

If you choose the last one, I do not know what the size limitations are.

I'm not sure if you can do multiple shares of a share point, either via
links or loopback mounts. If you can, then you might be able to split
the access list by using multiple share lines.

--
Darren Dunham ddunham@taos.com
Unix System Administrator Taos - The SysAdmin Company
Got some Dr Pepper? San Francisco, CA bay area
< This line left intentionally blank to confuse you. >

In article <49c0d836.0307212051.11c40055@posting.google.com >,
subhfern@yahoo.com (Subhodini Fernandes) writes:
> Darren Dunham <ddunham@redwood.taos.com> wrote in message news:<TKWSa.252$_81.25160835@newssvr14.news.prodig y.com>...
>> In comp.unix.solaris Subhodini Fernandes <subhfern@yahoo.com> wrote:
>> > My problem is that I have around 50 Solaris boxes which I need to add
>> > to that list. All are in a subnet with around 200 other workstations.
>> > If I include the subnet then the access list is to large. However, I
>> > do not see how I can add 50 workstations in the dfstab file either.
>> > Hence I wanted to setup netgroup - but then I do not want to setup NIS
>> > !
>>
>> Netgroups do not work outside of a nameservice. You must have either
>> NIS, NIS+, or LDAP to use them. Just having a /etc/netgroups file
>> doesn't work.
>
> Exactly my point. How do I overcome it.

You don't. Period. End of subject. If you can't do it with a subnet or
a subdomain and won't use any name service but files, there's no supported
way to do it.

Having said that, see
http://groups.google.com/groups?selm...&output=gplain

but read it carefully, because it doesn't use /etc/netgroup, rather it
uses an /etc/netgroups (note "s" on end) directory with files for
individual netgroups.

You could also set up NIS for the server only, edit /var/yp/Makefile so it
only built the netgroup map (save a copy of the original, in case you ever
need to set up full NIS on there), and edit /etc/nsswitch.conf so it only
used the "nis" source for netgroup. That would probably be a more normal
way to do it, and in one sense easier, since there wouldn't be anything to
compile, and it would use the normal /etc/netgroup file as the source for
the NIS map rather than the different file structure used by the freeware
solution quoted above.

That's it. That's all the choices you have that I've ever heard of, and
I rather think I've heard of them all.

Actually, there's one more choice, _if_ you spend a lot of money with Sun:
file an RFE for them to do what they should've done all along, namely
write a proper files backend for netgroup, which should automatically
digest /etc/netgroup into a binary file similar to an NIS map for speed of
access whenever /etc/netgroup was newer, except that they should
preferably use something like Berkeley DB, which doesn't have the stupid
limitation that NIS suffers from (and that can be a real problem with
large netgroups; (quoting now from from dbm_clearerr(3c)):

The sum of the sizes of a key/content pair must not exceed
the internal block size (currently 1024 bytes). Moreover all
key/content pairs that hash together must fit on a single
block. dbm_store() will return an error in the event that a
disk block fills with inseparable data.

Or if you don't have the influence to do that, you could do us all a
favor and rewrite the freeware code into something a bit more friendly,
such as what I suggested you as Sun to create.

--
mailto:rlhamil@mindwarp.smart.net http://www.smart.net/~rlhamil

> >> > Hence I wanted to setup netgroup - but then I do not want to setup NIS
> >> > !
> >>
> >> Netgroups do not work outside of a nameservice. You must have either
> >> NIS, NIS+, or LDAP to use them. Just having a /etc/netgroups file
> >> doesn't work.
> >
> > Exactly my point. How do I overcome it.
>
> You don't. Period. End of subject. If you can't do it with a subnet or
> a subdomain and won't use any name service but files, there's no supported
> way to do it.
>

Why not set up NIS, it's easy to set up and would make life alot easier!

Sharona