[SOLVED] Is possible to mapping a remote uid to local uid using nfs and idmap?

camerabambai · 02-22-2023, 02:00 PM

With Solaris 11 I create a nfs share

Code:

    zfs set share.nfs=on rpool/public

my Linux client mount it..

Code:

    mount solaris2:/var/public /mnt/share

I want to give write access to myuser, i know three solutions

Solution 1: chmod 777

Code:

    chmod 777 /var/public #NO COMMENT

Solution 2: made the uid identical between remote and local system

change the uid of my local Solaris user to the uid on remote Linux user and then give an acl, this is ok if you have one user only, is simply awful in a multiuser system (you have to replace all old uids with the newest!)

Solution 3: Mapping the uid of remote user to a local user and then give the acl

Code:

   idmap add remoteuser@remotehost unixuser:myuser
    chmod A=user:myuser:add_file/read_data/execute/write_data/execute:allow /var/public

but doesn't work.
The local user can write data to /var/public, the remote not, why?
My idea is to map the external uid (1000) to local uid (100)
Is possible?
Thanks

camerabambai · 02-22-2023, 04:46 PM

Solution found with a workaround
I have created a group with the same gid on both client and server
and then with an acl I give write permission to users belong to the group

On client (Linux)

Code:

    groupadd -g 10093 nfs-users
    usermod -aG nfs-users myuser

on server (Solaris)

Code:

    groupadd -g 10093 nfs-users
    usermod -G nfs-users myuser

Then I add the acl to the shared zfs set (is mounted on /var/public)

Code:

    chmod A+group:nfs-users:write_data/append_data/execute/add_file/add_subdirectory:allow /var/public

Testing: works fine, all users (remote, and locals) which belong to nfs-users group can write on share.
A better solution was to use AD (or samba4) + idmap, but this workaround play fine also in local files environment.