DSM-G600, DNS-3xx and NSA-220 Hack Forum

Unfortunately no one can be told what fun_plug is - you have to see it for yourself.

You are not logged in.

Announcement

#1 2009-04-04 16:33:35

sbE
Member
Registered: 2009-04-04
Posts: 6

nfs problem with group rights

hi,

i've a dns 323 and unfs3 configured.

on the NAS i've a directory called "transfer". a group called "rocky" has rw-rights to "transfer".  member of this group are sven & stefanie. the client (ubuntu intrepid) and the NAS have the same user/group-structure (uid, gid, membership).

the problem is that on the client user A (for instance sven)  cannot write to files, created by user b (for instance stefanie). BUT I CAN DELETE IT!! i don't know why i cannot write to these files...group-membership is ok, grouprights also!?!?

the configuration in detail....

SERVER:

root@nas:/mnt/HD_a2/shared# ls -al
drwxrwsr-x    6 root     rocky        4096 Apr  4 15:02 transfer

/etc/group:
rocky:x:1100:sven,stefanie,

/etc/export:
/mnt/HD_a2/shared/transfer 192.168.111.0/24(rw,no_root_squash)


CLIENT:

/etc/group:
rocky:x:1100:sven,stefanie

/etc/fstab:
192.168.111.222:/mnt/HD_a2/shared/transfer /nas/transfer nfs rw 0 0

ls -al /nas/     
drwxrwsr-x  6 root     rocky    4096 2009-04-04 15:02 transfer


PROBLEM:

$ ls -al /nas/transfer/test
-rw-rw-r-- 1 stefanie rocky    0 2009-04-04 15:27 testfile

...i cannot write to this file via vi or any other editor (but i can read it, delete it or write to a complete new file). error "permission denied"

WHY??

Last edited by sbE (2009-04-04 16:35:03)

Offline

 

#2 2009-04-05 22:25:22

sbE
Member
Registered: 2009-04-04
Posts: 6

Re: nfs problem with group rights

13 views, but no answer. sad

i've news. in vi i can write to the file with a "force write" (:w!). but (for instance) in gedit under gnome i have no chance to write to this file.

i'm new on nfs...but can it be that this "problem" is normal...or it's bug? is there a global switch in the nfs export-file that enables writing to files thats owner is a another user in the same group?????

okay...hoping someone point me to the right direction.

Offline

 

#3 2009-04-06 01:52:23

mig
Member
From: Seattle, WA
Registered: 2006-12-21
Posts: 532

Re: nfs problem with group rights

sbE wrote:

i'm new on nfs...but can it be that this "problem" is normal...or it's bug? is there a global switch in the nfs export-file that enables writing to files thats owner is a another user in the same group?????

No, this problem is not normal.  But, I don't see any obvious problems with your NFS setup.
Possibly, (just guessing) that group rocky is not the primary group of user sven on the NFS client.

What is the output of 'id' on the NFS client for user sven?

Last edited by mig (2009-04-06 01:52:54)


DNS-323 • 2x Seagate Barracuda ES 7200.10 ST3250620NS 250GB SATAII (3.0Gb/s) 7200RPM 16MB • RAID1 • FW1.03 • ext2 
Fonz's v0.3 fun_plug http://www.inreto.de/dns323/fun-plug

Offline

 

#4 2009-04-06 22:07:49

sbE
Member
Registered: 2009-04-04
Posts: 6

Re: nfs problem with group rights

mig wrote:

Possibly, (just guessing) that group rocky is not the primary group of user sven on the NFS client.

What is the output of 'id' on the NFS client for user sven?

thanks...your question about 'id' shows a little problem(?):

Client:

root@suckup:/# id sven
uid=1000(sven) gid=1000(sven) Gruppen=1000(sven),4(adm),20(dialout),24(cdrom),46(plugdev),108(lpadmin),123(admin),124(sambashare),1100(rocky),1101(og2)


NAS:

root@nas:~# id sven
uid=1000(sven) gid=1000(sven)

.../etc/group shows a more detailed configuaration...

sven:x:1000:sven
rocky:x:1100:sven,stefanie
og2:x:1101:sven,steanie

on the nas i've added the user to several groups via "usermod -G group1,group2,group3 sven"


then i've changed via "usermod -g rocky sven" the primary group on both nas & client. but nothing's changed. sad

Offline

 

#5 2009-04-09 00:48:08

driemar
Member
Registered: 2009-02-02
Posts: 5

Re: nfs problem with group rights

I know it is not what you ultimately want, but it might be interesting to see what happens if when exporting the directory you specify both root_squash (the default, I think) and user_squash (or all_squash), and then use either or both of anonuid and anongid in the exports file. Setting the anonuid or anonguid equal to the appropriate values as per your passwd and groups files on the DNS-323.

/home/joe        joes_pc(anonuid=1100,anongid=1100,rw,all_squash)       ...as per man unfsd

I do something like this, and also use the password= option (on both the exports file of the DNS and on the Ubuntu side as well), and everythings  seems to work as expected between Ubuntu and the DNS-323 on my LAN. I have two users each with a directory share, and all restrictions and  permissions seem to work appropriately. From both the terminal window and when using Ubuntu apps!

It is not possible that the application in Ubuntu is contacting the NAS's UNFS daemon under a different userid, is it? That doesn't make any sense, does it?

Last edited by driemar (2009-04-09 00:48:47)

Offline

 

#6 2009-04-09 03:59:38

mig
Member
From: Seattle, WA
Registered: 2006-12-21
Posts: 532

Re: nfs problem with group rights

@sbE you should check the contents of the /etc/passwd file (on both DNS-323 and client)
to make sure that 'rocky' is the primary group of 'sven'

Last edited by mig (2009-04-09 04:00:44)


DNS-323 • 2x Seagate Barracuda ES 7200.10 ST3250620NS 250GB SATAII (3.0Gb/s) 7200RPM 16MB • RAID1 • FW1.03 • ext2 
Fonz's v0.3 fun_plug http://www.inreto.de/dns323/fun-plug

Offline

 

#7 2009-04-09 11:33:36

sbE
Member
Registered: 2009-04-04
Posts: 6

Re: nfs problem with group rights

driemar wrote:

I know it is not what you ultimately want, but it might be interesting to see what happens if when exporting the directory you specify both root_squash (the default, I think) and user_squash (or all_squash), and then use either or both of anonuid and anongid in the exports file. Setting the anonuid or anonguid equal to the appropriate values as per your passwd and groups files on the DNS-323.

/home/joe        joes_pc(anonuid=1100,anongid=1100,rw,all_squash)       ...as per man unfsd

I do something like this, and also use the password= option (on both the exports file of the DNS and on the Ubuntu side as well), and everythings  seems to work as expected between Ubuntu and the DNS-323 on my LAN. I have two users each with a directory share, and all restrictions and  permissions seem to work appropriately. From both the terminal window and when using Ubuntu apps!

It is not possible that the application in Ubuntu is contacting the NAS's UNFS daemon under a different userid, is it? That doesn't make any sense, does it?

hi,

tonight i will give the anongid a try. meanwhile i've another frustrating problem. to the transfer-directory i set the sgid-bit to force the group "rocky" to all files inside this folder. this works only for new files, not for copied files. sad sad so i think i must deal with the anongid-option.

you talk about a "password-option" for exports file on server side and fstab (?) on the client side. in several nfs-guides i dont find this option. it would be very nice if you post the contents of your exports-file an fstab!

@mig

tonight i will also take a look @ passwd to be safe that primary group is rocky (before i set the anongid).

Offline

 

#8 2009-04-09 21:41:03

sbE
Member
Registered: 2009-04-04
Posts: 6

Re: nfs problem with group rights

mig wrote:

@sbE you should check the contents of the /etc/passwd file (on both DNS-323 and client)
to make sure that 'rocky' is the primary group of 'sven'

ok, i've tested it and i'm completely sure that on both machines user sven has rocky as primary group. but this doesn't help. with :w vi reports error "E212: Can't open file for writing"...only :w! helps.

Offline

 

#9 2009-04-09 22:57:20

sbE
Member
Registered: 2009-04-04
Posts: 6

Re: nfs problem with group rights

driemar wrote:

I know it is not what you ultimately want, but it might be interesting to see what happens if when exporting the directory you specify both root_squash (the default, I think) and user_squash (or all_squash), and then use either or both of anonuid and anongid in the exports file. Setting the anonuid or anonguid equal to the appropriate values as per your passwd and groups files on the DNS-323.

/home/joe        joes_pc(anonuid=1100,anongid=1100,rw,all_squash)       ...as per man unfsd

I do something like this, and also use the password= option (on both the exports file of the DNS and on the Ubuntu side as well), and everythings  seems to work as expected between Ubuntu and the DNS-323 on my LAN. I have two users each with a directory share, and all restrictions and  permissions seem to work appropriately. From both the terminal window and when using Ubuntu apps!

It is not possible that the application in Ubuntu is contacting the NAS's UNFS daemon under a different userid, is it? That doesn't make any sense, does it?

setting anonuid & anongid helps to solve my problem. no write-problems with files created by other users. but now every user can read and write in the transfer-folder.

i think i have no luck with nfs...samba seems a little bit better for my network (better to configure).... but slower. sad

Offline

 

#10 2009-04-10 01:36:21

driemar
Member
Registered: 2009-02-02
Posts: 5

Re: nfs problem with group rights

sbE wrote:

driemar wrote:

I know it is not what you ultimately want, but it might be interesting to see what happens if when exporting the directory you specify both root_squash (the default, I think) and user_squash (or all_squash), and then use either or both of anonuid and anongid in the exports file. Setting the anonuid or anonguid equal to the appropriate values as per your passwd and groups files on the DNS-323.

/home/joe        joes_pc(anonuid=1100,anongid=1100,rw,all_squash)       ...as per man unfsd

I do something like this, and also use the password= option (on both the exports file of the DNS and on the Ubuntu side as well), and everythings  seems to work as expected between Ubuntu and the DNS-323 on my LAN. I have two users each with a directory share, and all restrictions and  permissions seem to work appropriately. From both the terminal window and when using Ubuntu apps!

It is not possible that the application in Ubuntu is contacting the NAS's UNFS daemon under a different userid, is it? That doesn't make any sense, does it?

setting anonuid & anongid helps to solve my problem. no write-problems with files created by other users. but now every user can read and write in the transfer-folder.

i think i have no luck with nfs...samba seems a little bit better for my network (better to configure).... but slower. sad

Did you try "man unfsd" or "man nfs". Remember, your in the user space, so it should be unfsd...on the second page:

"password=<password>
              To be able to mount this export, the specified password is required.  The  pass-
              word  needs  be  given  in  the  mount  request,  as  in  "mount yourhost:@pass-
              word:gazonk/tmp /mnt". One time passwords are also supported. When  using  pass-
              words,  the file handles will include a hash of the password. This means that if
              you change the password, all clients will need to remount this export.  See  the
              file "doc/passwords.txt" in the source for more information.

I read that one should not export directories under each other but I did it anyway (as per the example given in "man unfsd") and it seems to be working just fine for me.

Here is my export file on the NAS:

(root)>cat /ffp/etc/exports
/mnt/usb1                                    192.168.0.0/24(ro,root_squash)
/mnt/usb2                                    192.168.0.0/24(ro,root_squash)
/mnt/HD_a2/                                192.168.0.0/24(ro,root_squash)
/mnt/HD_a2/Root/My_Files            192.168.0.0/24(rw,all_squash,anonuid=501,anongid=501)
/mnt/HD_a2/Root/home/driemar   192.168.0.0/24(rw,all_squash,anonuid=1004,anongid=0,password=slkdfjdsdsfdj)
/mnt/HD_a2/Root/home/gina         192.168.0.0/24(rw,all_squash,anonuid=1003,anongid=0,password=dsflksdfjlffsdkjlds)

Passwords have been changed (for the mods).

On each of my Ubuntu computer I have the following:

    # To mount the drive from the  NAS (must mount with NFS3)
    192.168.0.189:/mnt/HD_a2                               /mnt/NAS               nfs          ro,auto,bg,_netdev                             0       0
    192.168.0.189:/mnt/HD_a2/Root/My_Files          /mnt/Files               nfs          rw,auto,bg,_netdev                             0       0
    192.168.0.189:/mnt/usb1                                 /mnt/NAS_Usb1       nfs          ro,auto,bg,_netdev                             0       0
    192.168.0.189:/mnt/usb2                                 /mnt/NAS_Usb2       nfs          ro,auto,bg,_netdev                             0       0

    # Command line equivilent: mount -t nfs -o  rw,timeo=30,retry=10000  192.168.0.189:@password:slkdfjdsdsfdj/mnt/HD_a2/Root/home/driemar /home/driemar/Stuff
    192.168.0.189:@password:slkdfjdsdsfdj/mnt/HD_a2/Root/home/driemar /home/driemar/Stuff  nfs   rw,auto,bg,_netdev,timeo=30,retry=10000  0 0

    # Command line equivilent: mount -t nfs -o  rw,timeo=30,retry=10000  192.168.0.189:@password:dsflksdfjlffsdkjlds/mnt/HD_a2/Root/home/gina /home/gina/Stuff
    192.168.0.189:@password:dsflksdfjlffsdkjlds/mnt/HD_a2/Root/home/gina    /home/gina/Stuff     nfs   rw,auto,bg,_netdev,timeo=30,retry=10000     0 0

As you can see, there is some extra stuff (just having some fun). I think I need to move the last two commands out of the /etc/fstab file and into each user's start-up script. That is why I have what I think is the command-line equivilent "mount" commands in comments above. That is, each user should onlyy have the one mount performed and not have access to each others mounted folder. Oh well, there's probably a much better way of doing this, but anyway, if you were partially successful, then the above might help you get the rest of the way there. It works well on all four of my other computers--even the exported folders under the main export (i.e., the /mnt/HD_a2/Root/home/driemar, which is rw, under the /mnt/HD_2, which is ro)

Or, you could go samba.

Later.

Offline

 

Board footer

Powered by PunBB
© Copyright 2002–2010 PunBB