Goals
- work with ACLs and RBAC
- use
sudo
POST
This exercise will be done on your box.
- what filesystems are NFS mountable on nis?
- what filesystems are NFS mountable on r118-02?
- what filesystems are NFS mountable on your own box?
- make a directory called
/day6post.
- in that directory, make a file called readme.
- change the the file to belong to the
students group.
- give the group write permission. The world should not have write perms.
- temporarily share the directory.
- mount each of the other student's /day6post directory.
- access that directory as root. Can you alter the file?
- access that directory as your normal user. Can you alter the file?
- how could you limit the boxes that could mount the directory?
advanced permissions
setuid, setgid
- generally used to elevate rights on a binary; suid scripts are deprecated and many shells and *nix distributions will go out of their way to circumvent privileged execution.
- more on setuid,
a short tutorial,
---s--s--t 7000 setuid, setgid, sticky
---s--s--- 6000 setuid, setgid
---s-----t 5000 setuid, sticky
---s------ 4000 setuid
------s--t 3000 setgid, sticky
---s------ 2000 setgid
---------t 1000 sticky
---------- 0000 none
/usr/bin/find / -user root -perm -4000 -o -perm -2000
Access Control Lists (ACLs) (Solaris only)
File Access Control Lists are a way to achieve finer permissions granularity than normal unix ownership/permissions allows. ACLs are allowed on files and dirs, and dirs can have (and should have) a default ACL.
getfacl shows the current ACL
$ getfacl examplefile
# file: examplefile
# owner: snelling
# group: snelling
user::rw-
group::r-- #effective:r--
mask:r--
other:r--
The main difference here is the presence of a mask which specifies the maximal permission for any non-user (ie, non-owner) account.
setfacl sets the ACL for a file or directory
setfacl -s acl_settings file - set the ACL. cf numerical mode chmod
setfacl -m acl_settings file - modify the ACL. cf symbolic mode chmod
u[ser]::perms
g[roup]::perms
o[ther]:perms
m[ask]:perms
u[ser]:uid:perms
g[roup]:gid:perms
d[efault]:u[ser]::perms
d[efault]:g[roup]::perms
d[efault]:o[ther]:perms
d[efault]:m[ask]:perms
d[efault]:u[ser]:uid:perms
d[efault]:g[roup]:gid:perms
getfacl bar | setfacl -f - foo
RBAC
RBAC is generally implemented via the SMC.
- some utilities are RBAC-aware; some will need to be run through SMC
- may require the creation of roles before granting privs to users
NFS permissions and security
- root allowed from other hosts
/etc/exports
- export
ro where possible
- remove
g+w perms on share dirs
- export data, not executables
- root ownership can protect files because of the anonymous remapping
- do not export dirs with world-writeable perms
- possible: use
fsirand to randomize fsID numbers.
showmount -e host probe for unnecessary shares
- problems: client/server spoofing, unencrypted traffic, unix fs security, UNIX_SECURITY rpc authentication.
- NFS client or server, not both (related: crossmounting)
- consolidate mounts onto a central server, rather than spreading them out
- check for
cd /; cd .. problems at the top of the imported fs (mainly diskless workstations)
- don't export share homedirs if possible
- pull unwanted exports with
unshare
NFS failover
Only works with ro mounts.
mount -F nfs -o ro host1:/somedir,host2:/somedir /mydir
NFS logging (solaris 8 only)
- eyeball
/etc/nfs/nfslog.conf to set paths, etc
- eyeball
/etc/default/nfslogd to see logging detail, etc
when mounting, use the -o log=global
- see if
/usr/lib/nfs/nfslogd is running; start.
Cached NFS
Can mount remote (or even local) FSs, to improve "throughput"."Read Mostly".
some definitions:
- backfstype: nfs
- backfs system:
host:/path
- cache: the cached data
- cache dir: the dir containing the cache
Setting up a cachefs
- set up a cache directory
- create the cache:
cfsadmin -c directory (all cachefs mounts share same cache)
- mount the fs like this:
mount -F cachefs -o backfstype=nfs,cachedir=/path host1:/path /mypath
- check
cachefsstat /mypath
Deleting a cachefs
- unmount the fs
cfsadmin -l to get IDs
cfsadmin -d cache-id /dir
fsck -F cachefs /path/cache1 to reset resource info
autofs/automounter
- client-side; the remote fs is always exported
- allows user-enabled mounting
- speeds up boot
- minimizes memory overhead
- minimizes network traffic
- falls off after 10m or so.
- easier to shutdown/reboot an exporting box
- do not mix manually and auto mounting for the same mount!
- autofs behaviour controlled by maps.
- auto_master:
/net -hosts -nosuid,nobrowse sets up default automounts of /export
setting up an automount
automount -t interval in seconds -v. 10-30 mins is most efficient time.
Homework
http://www.mousetrap.net/syllabus/solaris8-nfs/day6.html
$Id: day6.orb,v 1.5 2002/11/20 00:14:58 mouse Exp $
