Very Computer

One week ago I started to reinstall Solaris 2.6 with NIS+ on our
network. I created a NIS+ master server and then I installed the
clients.

Everything seemed to work fine, but as I setup the first NFS server I
encountered a big problem:

group access rights do not work over NFS!!!

1) telnet or rlogin to the NFS server -> group acces O.K. (I am not the
owner of the file!)

2) directory mounted from NFS server

  a) if I am the owner of the directory everything is ok; 'cd test'
works.
  b) if I am not the owner, but my primary group has access rights rwx
'cd test' does not work.
     The error message is: 'Permission denied'

3) Everything else seems to work fine, too.

'ls -l' shows:

drwxrwx---   3 root     javasec      512 Feb 24 14:58 test

'niscat group.org_dir' shows:

uucp:*:5:root,uucp
nogroup:*:65534:
daemon::12:root,daemon
other:*:1:
root:*:0:root
staff:*:10:
javasec:*:103:wplatzer
nobody::60001:
noaccess::60002:

'nisdefaults' shows:

Principal Name : wplatzer.iaik.tu-graz.ac.at.
Domain Name    : iaik.tu-graz.ac.at.
Host Name      : kierkegaard.iaik.tu-graz.ac.at.
Group Name     :
Access Rights  : ----rmcdr---r---
Time to live   : 12:00:00
Search Path    : iaik.tu-graz.ac.at.
                 tu-graz.ac.at.
                 ac.at.

and 'cd test' results in:

test/: Permission denied.

/etc/dfs/dfstab looks like:

share -F nfs -o sec=dh,rw -d "TEST_NFS" /test_nfs

Has anyone an idea what could be wrong?
Is there a log file or something?

Wolfgang Platzer

--
Dipl.-Ing. Wolfgang Platzer
Technische Universitaet Graz - University of Technology Graz
Institut fr Angewandte Informationsverarbeitung
und Kommunikationstechnologien
Inffeldgasse 16a, A-8010 Graz,
Tel: ++43 316 873-5527,Fax: ++43 316 873-5520
URL <http://www.iaik.tu-graz.ac.at/index.html>

If you use secure nfs, then group access works differently.

If you use insecure nfs, then group access works as in ordinary unix
usage.

For secure nfs, group permissions are not based on the contents of
'/etc/group', nor on the nis+ groups database.  Rather, they are base
on the list of groups in a user's local credentials.  If you recreate
the local credentials of a user (with 'nisaddcred'), this will
probably have the effect of updating that user credential to reflect
current group membership.

This was the trick!

Wolfgang