Novell OPEN ENTERPRISE SERVER 2 SP2 - ADMINISTRATION, Руководство по внедрению, Страница: 62 / 288

62 OES 2 SP2: Planning and Implementation Guide
n
ov
do
cx (e
n)
22
Ju
n
e 20
09
6.2 Avoiding POSIX and eDirectory Duplications
OES 2 servers can be accessed by
Š
Local (POSIX) users that are created on the server itself.
Š
eDirectory users that are given local access through Linux User Manager (LUM).
However, there are some issues you need to consider:
Š
Section 6.2.1, “The Problem,” on page 62
Š
Section 6.2.2, “Three Examples,” on page 62
Š
Section 6.2.3, “Avoiding Duplication,” on page 63
6.2.1 The Problem
There is no cross-checking between POSIX and eDirectory
TM
to prevent the creation of users or
groups with duplicate names.
When duplicate names occur, the resulting problems are very difficult to troubleshoot because
everything on both the eDirectory side and the POSIX side appears to be configured correctly. The
most common problem is that LUM-enabled users can’t access data and services as expected but
other errors could surface as well.
Unless you are aware of the users and groups in both systems, especially those that are system-
created, you might easily create an invalid configuration on an OES 2 server.
6.2.2 Three Examples
The following examples illustrate the issue.
Š
“The shadow Group” on page 62
Š “The users Group” on page 63
Š
“Other Non-System Groups” on page 63
The shadow Group
There is a default system-created group named
shadow
that is used by certain Web-related services,
including the OES 2 QuickFinder
TM
server, but it has no relationship with Dynamic Storage
Technology (DST) and shadow volumes.
Because
shadow
is a local POSIX group, there is nothing to prevent you from creating a LUM-
enabled second group in eDirectory that is also named
shadow
. In fact, this could be a logical name
choice for many administrators in conjunction with setting up shadow volume access for Samba/
CIFS users.
However, using this group name results in LUM-enabled users being denied access by POSIX,
which looks first to the local
shadow
group when determining access rights and only checks
eDirectory for a group named
shadow
if no local group is found.