PP's ncpfs contributed code

1. Mounting netware resources (ncpmount; ncplogin, ncpmap):
   • Mounting of Netware resources fails with 'permission denied':
     Check that $HOME is not NFS mounted, if yes use -l with ncplogin/ncmap or PAM . No solution with ncpmount except mounting to a local dir /tmp/... or /mnt/...
   • Do these utilities works in a "pure Netware IP" environnement ?
     ncpmount yes (use -A NetWareName and -S IPName), ncplogin : I think (untested)

2. PAM module
   • Does the PAM module works in a "pure Netware IP" environnement ?
     Authentication yes. To automount Netware home don't forget adding -A to the pam's command line .
   • I get error xxx with PAM using tree=treeName or ncplogin -T treeName.
     check that the answering (nearest) server has a read replica (ncpfs requirment). If not, use ndsserver=ServerName with PAM or -S server with ncplogin to force NDS connection to a server with replica.
     
   • Does the PAM module works to access samba shares ?
     Yes. Add pam_ncp_auth to the /etc/pam.d/samba if you do not have the global system-auth file.
     Authorize samba access for users (using pam snapin) or the S zenflag. Now your Windows or Linux workstations can access samba shares on your Linux box using Netware credentials. You may consider using a Netware control group to restrict access to some users.
   • Can you give me a sample /etc/pam.d/system-auth file (Redhat 7.x or 8.x)
     Here is mine for RedHat 7.3 ( pam_ncp and pam_ldap)
   • KDE/Gnome, ssh... login works OK with PAM, but not a simple console login
     bug started in RedHat 7.3 console login (no problem in 7.2) .Login is granted, session starts but is immediatly closed (see /var/log/secure with -d flag of pam_ncp) ... This problem do no happen with Redhat 8.0 or 9.0 !.so it must be something specific to RedHat 7.3.
   • With PAM automatic creation of some NDS groups in /etc/group fails
     NDS common name (CN) is too long (>16) or with Unix illegal characters (such as ':') ; use N:aliasName in pam snapin or NWAdmin to give the NDS group a shorter/legal Unix alias name
   • can I turn off automatic group creation ?
     Currently no (TODO). But you may give to NDS groups you do not want to see in Unix local machine an alias name identical to an existing one (eg N:users). PAM module takes care of duplicate group names, so this group will not be created (feature).
   • Can I use the Netware home as the Linux home ?
     yes force Netware home automounting (-zA) and use -m with no argument to pam module. Don't use -n -l , so a local /home/user will first be created and used as the mounting point. This is a feature of the -m option that normally is used to specify another name for the default mounting point (nwhome).
     If the name is empty, mounting of Netware home with be done in /home/user... and this directory will also be used as the Linux home
     Caveats : Not exact mapping of rights between Linux/Netware, Quotas , loss of connection during the session...
   • Automounting of Netware home fails with 'permission denied or file not found' in /etc/secure
     Yours users' home are NFS mounted, and I think they should be if you want them to have the very same Linux home regardless of the workstation they are using. So the suid command ncpmount that is spawned by the pam module fails immedialty when checking for the existence of the passed mount point ($HOME/ncp/SERVER/VOLUME), since local root has normally no rights to even peek in remote NFS directories.
     You must use -l option ( together with -n to instruct pam not to create homes ). This will force mounting in a local directory /mnt/ncp/$USER/nwhome (chowned to $USER and chmoded 700).
     I personnally think that you should always use -l even if homes are local on some workstations, and create in every home a symbolic link named nwhome to /mnt/ncp/$USER/nwhome.
     So if user deletes his $HOME/nwhome, he will only remove the symbolic link, not destroy all his Netware home.
     Creation of the link can be done by a zenscript or by modifying the /usr/sbin/useradd script that is spawned by pam_ncp at user's creation.
   • Can the permanent connection consumed by pam_ncp when automounting Netware home be reused with other ncp utilities
     Yes. Most ncpfs utilities accept a -S parameter with a mount point (starting with a '/') instead of a servername.
     Starting at release 2.2.4, all utilities in ncpfs/util directory (nprint, nsend,pqlist... will also support the "mount point" -S parameter.
     If you have release 2.2.3, you can get here the modified version of lib/ncplib.c rev 1.19 So calling these utilities with -S $HOME/ncp/nwhome or -S /mnt/ncp/$USER/nwhome should do the trick.
     And since this connection is authenticated, its credentials may be reused by the called ncpfs command, if needed
     If you use the Zenflag I (create a $HOME/.nwinfos file) you can automate the process in some /usr/local/bin scripts by adding at the top the following snippet:

     #!/bin/sh
     source $HOME/.nwinfos
     #variable $NDS_HOME_MNT_PNT contains the mount point used for Netware home for that user
     
     my_ncp_command -S $NDS_HOME_MNT_PNT [ others options]
     ...
     

Vous êtes notre eme visiteur