Novell OPEN ENTERPRISE SERVER 2 SP2 - ADMINISTRATION, Implementation Manual, Page: 195 / 288

File Services 195
n
ov
do
cx (e
n)
22
Ju
n
e 20
09
17.4 Aligning NCP and POSIX File Access Rights
NetWare administrators have certain expectations regarding directory and file security. For example,
they expect that home directories are private and that only the directory owners can see directory
contents. However, because of the differences in the NetWare Core Protocol (NCP) and POSIX file
security models (see
Section 21.2.1, “Comparing the Linux and the Novell Trustee File Security
Models,” on page 219 ) that is not the case by default on POSIX file systems.
Fortunately, when you install Linux User Management (LUM) in OES 2, there is an option to make
home directories private. This option automatically provides the privacy that NetWare
administrators are used to seeing. Unfortunately, the option only applies to newly created home
directories, so there is more to understand and do if aligning access rights is an issue for you.
Use the information in this section to understand how you can configure POSIX directories to more
closely align with the NCP model.
Š
Section 17.4.1, “Managing Access Rights,” on page 195
Š
Section 17.4.2, “Providing a Private Work Directory,” on page 196
Š
Section 17.4.3, “Providing a Group Work Area,” on page 197
Š
Section 17.4.4, “Providing a Public Work Area,” on page 197
Š
Section 17.4.5, “Setting Up Rights Inheritance,” on page 198
17.4.1 Managing Access Rights
NCP directories are, by default, private. When you assign a user or a group as a trustee of a directory
or file, those trustees can automatically navigate to the assigned area and exercise whatever access
privileges you have assigned at that level and below. You can assign as many trustees with different
access privileges as you need.
On the other hand, Linux POSIX directories can be accessed through three sets of permissions
defined for each file object on a Linux system. These sets include the read (r), write (w), and execute
(x) permissions for each of three types of users: the file owner, the group, and other users. The Linux
kernel in OES 2 also supports access control lists (ACLs) to expand this capability. However, ACLs
are outside the scope of this discussion. For more information on ACLs, see
“Access Control Lists”
(http://www.novell.com/documentation/sles10/sles_admin/data/cha_acls.html) in the SLES 10 SP3:
Installation and Administration Guid e (http://www.novell.com/documentation/sles10/sles_admin/
data/sles_admin.html) .
The Linux
chown
command lets you change the file owner and/or group to a LUM user or a LUM-
enabled group. For example,
chown -R user1 /home/user1
changes the owner of the
user1
home directory and all its subdirectories and files to user1. For more information, see the chown
man page on your OES 2 server.
The Linux
chmod
command provides a very simple and fast way of adjusting directory and file
access privileges for the three user types: owner, group, and other (all users). In its simplest form,
the command uses three numbers, ranging from 0 through 7, to represent the rights for each of the
three user types. The first number sets the rights for the owner, the second number sets the rights for
the group, and the third number sets the rights for all others. Each number represents a single
grouping of rights, as follows: