[28157] in Kerberos
Re: AFS and kerberos
daemon@ATHENA.MIT.EDU (Russ Allbery)
Mon Jul 30 22:29:17 2007
From: Russ Allbery <rra@stanford.edu>
To: kerberos@mit.edu
In-Reply-To: <b35ta3hhiqgb3i9ljq1jii555bog3aio32@4ax.com>
(mr_castalot@yahoo.com's message of "Tue, 31 Jul 2007 01:54:58 GMT")
Date: Mon, 30 Jul 2007 19:28:54 -0700
Message-ID: <87wswhtift.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Faeandar <mr_castalot@yahoo.com> writes:
> Russ Allbery <rra@stanford.edu> wrote:
>> What 16-group limit is that?
> The one is Solaris and Linux. Maybe Linux is 32, I don't know for sure.
> I hear that a system change on Solaris will allow for 32 but unless your
> NFS servers are Solaris you break NFS.
Oh, that. I think that's 64K with current versions of Linux. How well
that works with all NFS servers, I don't know.
> I'm looking into increasing file system security over NFS and was
> initially leaning towards kerb5 with LDAP to allow for a greater number
> of unix groups, and therefore greater access control (beyond 16 groups)
> even if it is still ugo. But so far I'm doubtful that will work.
Well, AFS doesn't use groups in the same way that NFS does and if you use
AFS, you won't have this problem. AFS accounts can be in as many groups
as you want (well, practically speaking). But that would mean moving your
files from NFS to AFS and using AFS's different ACL scheme.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
