Messages in this thread | | | From | (G.W. Wettstein) | Date | Tue, 21 Sep 1999 18:05:31 -0500 | Subject | Re: ACLs (was: Ext3 filesystem info?) |
| |
On Sep 20, 9:39pm, Benjamin Scott wrote: } Subject: ACLs (was: Ext3 filesystem info?)
Good afternoon to everyone on the kernel list. I hope that the approaching mid-week finds things going well.
> On Mon, 20 Sep 1999, Oliver Xymoron wrote: > > Not to mention that auditing a system using ACLs for security is much* > > more difficult. And that such a system would break all mature UNIX > > tools' notions of what is secure. ACLs tend to be an answer for people who > > are asking the wrong question anyway.
> I strongly disagree with that last sentence. There are a number of things > that ACLs let you do, that standard UNIX security does not. I would even > argue that ACLs can lead to better security, as it allows you to specify > combinations which would be difficult or impossible with traditional UNIX > mechanisms. Like most anything, it depends on the application.
I would have to agree with the general course that this thread is taking.
I am in the process of architecting a new service infrastructure for our local university. It is predicated on a Category of Service model and as such defines different classes of service as well as QOS type things for the services.
One of the big issues that I am dealing with right now is file and print services. We have a reasonably substantial Novell presence and I am looking at providing file services through a Linux based Samba solution. I have already integrated our Kerberos/LDAP authentication/authorization mechanisms into the Samba sources and I am now looking at issues that will affect a more general roll-out.
One of the things that quickly becomes apparent is that the standard UNIX permission model becomes a serious limitation when attempting to replicate Novell file services with an SMB based solution. At least in a university setting there is a general tendency for groups of users to want to share files and/or a common workplace. We have jumped through a number of hoops with groups and somewhat exotic permission structures to implement desired accessibility models.
I am tracking ACL's under Linux right now to develop a more generically useful file sharing model with SMB. I think that LDAP driven ACL support for Samba offers some promise for an intrigueing set of solutions.
> Benjamin Scott
Greg
}-- End of excerpt from Benjamin Scott
As always, Dr. G.W. Wettstein Enjellic Systems Development - Specializing 4206 N. 19th Ave. in information infra-structure solutions. Fargo, ND 58102 WWW: http://www.enjellic.com Phone: 701-281-1686 EMAIL: greg@enjellic.com ------------------------------------------------------------------------------ "I am returning this otherwise good typing paper to you because someone has printed gibberish all over it and put your name at the top. -- English Professor, Ohio University
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |