[CentOS] NFS issue

[Ross S. W. Walker]

James A. Peltier wrote:
> 
> Peter Arremann wrote:
> > On Monday 24 September 2007, Steven Haigh wrote:
> >   
> >> Quoting Dan <likuidkewl at gmail.com>:
> >> NFS uses the user ID of the user (UID) for permissions. 
> You will need
> >> to have the correct permissions on each system, and the correct
> >> username associated with the same UID on each machine.
> >>
> >> If you are running multiple systems, I would suggest 
> looking into NIS.
> >> This will allow you to create the accounts in NIS and have them use
> >> the same details on each machine.
> >>     
> >
> > Good answer but I can't agree on the NIS part.. NIS is 
> plain text over the 
> > network and is deprecated for a long time. Sun is talking 
> about dropping 
> > support, HP the same and even in the Linux camp there is 
> some talk about 
> > taking NIS support out of the standard distributions. 
> > Add to that the fact that ldap is becoming easier and 
> easier to set up, you 
> > should probably look that way...
> >
> > Peter.
> > _______________________________________________
> > CentOS mailing list
> > CentOS at centos.org
> > http://lists.centos.org/mailman/listinfo/centos
> >   
> There are many alternatives to NIS that are more secure, 
> Kerberos, LDAP, 
> 411, etc that you should investigate.  RHEL 5 includes RedHat 
> Directory 
> Server (IIRC) which makes it easy to setup a LDAP server and 
> administer it.

Kerberos only does authentication and not authorization, so it
only provides 1/2 (or 1/3) of the AAA puzzle. You still need
some authorization service such as LDAP or NIS or 411 to provide
the authorization information and it is not secure to house or
provide authentication information in NIS or LDAP or 411, though
a lot of people use LDAP to house Heimdal Kerberos secrets it
is not considered a fully secure implementation.

-Ross

______________________________________________________________________
This e-mail, and any attachments thereto, is intended only for use by
the addressee(s) named herein and may contain legally privileged
and/or confidential information. If you are not the intended recipient
of this e-mail, you are hereby notified that any dissemination,
distribution or copying of this e-mail, and any attachments thereto,
is strictly prohibited. If you have received this e-mail in error,
please immediately notify the sender and permanently delete the
original and any copy or printout thereof.