Hi,

  I need to grant access to NFS clients based on hostnames. The way I
know of to do this is via NIS netgroups. However, I do not have NIS
setup in my environment. How can I achieve this ?

  I am aware of things such as blocking access via ip address etc but
need to block access based on hostnames. Since the number of hosts are
numerous, something like netgroup would be ideal for me.

  Thanks,
  Subho.

>   I need to grant access to NFS clients based on hostnames. The way I
> know of to do this is via NIS netgroups. However, I do not have NIS
> setup in my environment. How can I achieve this ?
> 
>   I am aware of things such as blocking access via ip address etc but
> need to block access based on hostnames. Since the number of hosts are
> numerous, something like netgroup would be ideal for me.

If DNS is configured on your NFS server, you can base your access lists
on DNS hostnames. The relevant files for configuring the DNS resolver
are /etc/nsswitch.conf and /etc/resolv.conf.

Steve

subhfern@yahoo.com (Subhodini Fernandes) writes in comp.sys.sun.admin:
|  I need to grant access to NFS clients based on hostnames. The way I
|know of to do this is via NIS netgroups. However, I do not have NIS
|setup in my environment. How can I achieve this ?

List all the hostnames individually in dfstab - use shortcuts for
subnets or subdomains if possible.  See the access_list section
in 'man share_nfs'

-- 
________________________________________________________________________
Alan Coopersmith                              alanc@alum.calberkeley.org
http://www.CSUA.Berkeley.EDU/~alanc/       aka: Alan.Coopersmith@Sun.COM
  Working for, but definitely not speaking for, Sun Microsystems, Inc.

Alan Coopersmith <alanc@alum.calberkeley.org> wrote in message news:<bfbt8m$2705$2@agate.berkeley.edu>...
> subhfern@yahoo.com (Subhodini Fernandes) writes in comp.sys.sun.admin:
> |  I need to grant access to NFS clients based on hostnames. The way I
> |know of to do this is via NIS netgroups. However, I do not have NIS
> |setup in my environment. How can I achieve this ?
> 
> List all the hostnames individually in dfstab - use shortcuts for
> subnets or subdomains if possible.  See the access_list section
> in 'man share_nfs'

My problem is that I have around 50 Solaris boxes which I need to add
to that list. All are in a subnet with around 200 other workstations.
If I include the subnet then the access list is to large. However, I
do not see how I can add 50 workstations in the dfstab file either.
Hence I wanted to setup netgroup - but then I do not want to setup NIS
!

Thanks,
Subho.

In comp.unix.solaris Subhodini Fernandes <subhfern@yahoo.com> wrote:
> My problem is that I have around 50 Solaris boxes which I need to add
> to that list. All are in a subnet with around 200 other workstations.
> If I include the subnet then the access list is to large. However, I
> do not see how I can add 50 workstations in the dfstab file either.
> Hence I wanted to setup netgroup - but then I do not want to setup NIS
> !

Netgroups do not work outside of a nameservice.  You must have either
NIS, NIS+, or LDAP to use them.  Just having a /etc/netgroups file
doesn't work.

-- 
Darren Dunham                                           ddunham@taos.com
Unix System Administrator                    Taos - The SysAdmin Company
Got some Dr Pepper?                           San Francisco, CA bay area
         < This line left intentionally blank to confuse you. >

Darren Dunham <ddunham@redwood.taos.com> wrote in message news:<TKWSa.252$_81.25160835@newssvr14.news.prodigy.com>...
> In comp.unix.solaris Subhodini Fernandes <subhfern@yahoo.com> wrote:
> > My problem is that I have around 50 Solaris boxes which I need to add
> > to that list. All are in a subnet with around 200 other workstations.
> > If I include the subnet then the access list is to large. However, I
> > do not see how I can add 50 workstations in the dfstab file either.
> > Hence I wanted to setup netgroup - but then I do not want to setup NIS
> > !
> 
> Netgroups do not work outside of a nameservice.  You must have either
> NIS, NIS+, or LDAP to use them.  Just having a /etc/netgroups file
> doesn't work.

Exactly my point ! How do I overcome it ??

Kevin.

Darren Dunham <ddunham@redwood.taos.com> wrote in message news:<TKWSa.252$_81.25160835@newssvr14.news.prodigy.com>...
> In comp.unix.solaris Subhodini Fernandes <subhfern@yahoo.com> wrote:
> > My problem is that I have around 50 Solaris boxes which I need to add
> > to that list. All are in a subnet with around 200 other workstations.
> > If I include the subnet then the access list is to large. However, I
> > do not see how I can add 50 workstations in the dfstab file either.
> > Hence I wanted to setup netgroup - but then I do not want to setup NIS
> > !
> 
> Netgroups do not work outside of a nameservice.  You must have either
> NIS, NIS+, or LDAP to use them.  Just having a /etc/netgroups file
> doesn't work.

Exactly my point. How do I overcome it.

Subho.

In comp.unix.solaris Subhodini Fernandes <subhfern@yahoo.com> wrote:
> Darren Dunham <ddunham@redwood.taos.com> wrote in message news:<TKWSa.252$_81.25160835@newssvr14.news.prodigy.com>...
>> In comp.unix.solaris Subhodini Fernandes <subhfern@yahoo.com> wrote:
>> > My problem is that I have around 50 Solaris boxes which I need to add
>> > to that list. All are in a subnet with around 200 other workstations.
>> > If I include the subnet then the access list is to large. However, I
>> > do not see how I can add 50 workstations in the dfstab file either.
>> > Hence I wanted to setup netgroup - but then I do not want to setup NIS
>> > !
>> 
>> Netgroups do not work outside of a nameservice.  You must have either
>> NIS, NIS+, or LDAP to use them.  Just having a /etc/netgroups file
>> doesn't work.

> Exactly my point ! How do I overcome it ??

You appear to have already read all the possible ways to specify an
access list with Solaris share_nfs.  There is no magic button.

*) Setup a name service and use netgroups.
*) Group the machines so that you can use one or more subnet/mask
   specifications. 
*) Put the machines in a subdomain so you can use domain
   specifications.  CNAMES would not help.  It needs to be the PTR
   records that list the subdomain.
*) List all the machines individually in the access list.

If you choose the last one, I do not know what the size limitations are.

I'm not sure if you can do multiple shares of a share point, either via
links or loopback mounts.  If you can, then you might be able to split
the access list by using multiple share lines.  

-- 
Darren Dunham                                           ddunham@taos.com
Unix System Administrator                    Taos - The SysAdmin Company
Got some Dr Pepper?                           San Francisco, CA bay area
         < This line left intentionally blank to confuse you. >

In article <49c0d836.0307212051.11c40055@posting.google.com>,
	subhfern@yahoo.com (Subhodini Fernandes) writes:
> Darren Dunham <ddunham@redwood.taos.com> wrote in message news:<TKWSa.252$_81.25160835@newssvr14.news.prodigy.com>...
>> In comp.unix.solaris Subhodini Fernandes <subhfern@yahoo.com> wrote:
>> > My problem is that I have around 50 Solaris boxes which I need to add
>> > to that list. All are in a subnet with around 200 other workstations.
>> > If I include the subnet then the access list is to large. However, I
>> > do not see how I can add 50 workstations in the dfstab file either.
>> > Hence I wanted to setup netgroup - but then I do not want to setup NIS
>> > !
>> 
>> Netgroups do not work outside of a nameservice.  You must have either
>> NIS, NIS+, or LDAP to use them.  Just having a /etc/netgroups file
>> doesn't work.
> 
> Exactly my point. How do I overcome it.

You don't.  Period.  End of subject.  If you can't do it with a subnet or
a subdomain and won't use any name service but files, there's no supported
way to do it.

Having said that, see
http://groups.google.com/groups?selm=98Jul3.184149edt.45652-3339%40jane.cs.toronto.edu&oe=UTF-8&output=gplain

but read it carefully, because it doesn't use /etc/netgroup, rather it
uses an /etc/netgroups (note "s" on end) directory with files for
individual netgroups.

You could also set up NIS for the server only, edit /var/yp/Makefile so it
only built the netgroup map (save a copy of the original, in case you ever
need to set up full NIS on there), and edit /etc/nsswitch.conf so it only
used the "nis" source for netgroup.  That would probably be a more normal
way to do it, and in one sense easier, since there wouldn't be anything to
compile, and it would use the normal /etc/netgroup file as the source for
the NIS map rather than the different file structure used by the freeware
solution quoted above.

That's it.  That's all the choices you have that I've ever heard of, and
I rather think I've heard of them all.

Actually, there's one more choice, _if_ you spend a lot of money with Sun:
file an RFE for them to do what they should've done all along, namely
write a proper files backend for netgroup, which should automatically
digest /etc/netgroup into a binary file similar to an NIS map for speed of
access whenever /etc/netgroup was newer, except that they should
preferably use something like Berkeley DB, which doesn't have the stupid
limitation that NIS suffers from (and that can be a real problem with
large netgroups; (quoting now from from dbm_clearerr(3c)):

     The sum of the sizes of a key/content pair must  not  exceed
     the internal block size (currently 1024 bytes). Moreover all
     key/content pairs that hash together must fit  on  a  single
     block.  dbm_store() will return an error in the event that a
     disk block fills with inseparable data.

Or if you don't have the influence to do that, you could do us all a
favor and rewrite the freeware code into something a bit more friendly,
such as what I suggested you as Sun to create.

-- 
mailto:rlhamil@mindwarp.smart.net  http://www.smart.net/~rlhamil

> >> > Hence I wanted to setup netgroup - but then I do not want to setup NIS
> >> > !
> >> 
> >> Netgroups do not work outside of a nameservice.  You must have either
> >> NIS, NIS+, or LDAP to use them.  Just having a /etc/netgroups file
> >> doesn't work.
> > 
> > Exactly my point. How do I overcome it.
> 
> You don't.  Period.  End of subject.  If you can't do it with a subnet or
> a subdomain and won't use any name service but files, there's no supported
> way to do it.
> 

Why not set up NIS, it's easy to set up and would make life alot easier!

Sharona

On 26 Jul 2003 04:30:28 -0700, sharona <sallan1055@aol.com> wrote:
  
>  Why not set up NIS, it's easy to set up and would make life alot easier!

Apart from the fact that it's insecure as hell?

-- 
Devin L. Ganger <devin@thecabal.org>
"Aikido is based around the central precept of letting an attack take its
natural course.  You, of course, don't want to impede that natural flow
by being in its way." -- overheard on the PyraMOO

On 21 Jul 2003 21:51:43 -0700, subhfern@yahoo.com wrote:
>Darren Dunham <ddunham@redwood.taos.com> wrote in message news:<TKWSa.252$_81.25160835@newssvr14.news.prodigy.com>...
>> Netgroups do not work outside of a nameservice.  You must have either
>> NIS, NIS+, or LDAP to use them.  Just having a /etc/netgroups file
>> doesn't work.
>
>Exactly my point. How do I overcome it.

Possibly, write a custom PAM or NSS module to deal with it.
you would have a lot of research and work ahead ofyou to get this working.
but if you released it, it would probably make quite a few people very
happy


-- 
  http://www.blastwave.org/ for solaris pre-packaged binaries with pkg-get
    Organized by the author of pkg-get
[Trim the no-bots from my address to reply to me by email!]
         S.1618 http://thomas.loc.gov/cgi-bin/bdquery/z?d105:SN01618:@@@D
                            http://www.spamlaws.com/state/ca1.html