Shyh-Wei,
you wrote:
> You wrote:
> > Which principal do you use to backup DFS? We have been using root so far,
> > but root is considered harmfull by DCE experts because of its property of
> > not having to obey ACLs (it's a leftover from NFS). I heard rumours, that
> > it might vanish from future DCE releases.
>
> Here I am not particularly arguing for or against the value/problem of giving
> the DCE root principal this privilege. But don't file/backup system admin's
> virtually always have (and need to have) the privilege of accessing all
> files?
I don't want to argue either. But an alternative is thinkable to me:
You might define a special account doing the backups. This account should
have access to all files, which could be initialized using the initial
container and object ACLs. Users must be informed then to not change the
ACLs to this regard, unless they actually do not want a file to be backed
up. You might sell that as a goody (beeing able to control, what is backed
up and what not). I did not try this approach, so perhaps there are
drawbacks I do not see at the moment.
>
> Let's focus on the rumor your heard about the DCE root principal's (or its
> privilege?) going away. I checked with Craig Everhart (the DFS team lead
> at Transarc), and here is some excerpts from his response.
>
> "FYI, I know of no truth to that statement. Currently in Solaris and
> maybe in AIX, there is a patchable kernel variable that allows server
> admins to control whether DCE root is granted permissions.
>
> Of course, every manufacturer is different, so that's why it's important
> to go to the source for rumors. How can you help me do that?"
>
> Can you provide Craig the source(s) of this rumor?
Hm, I heard a remark in this sense on a DCE workshop we had here in
January, but I do not remember, who said it. Anyway, the remark was,
as far as I remember, not based on actual plans, but merely on the fact,
that the special properties of DCE root are not documented in the DCE
documentation.
Sorry for the confusion.
--
Reinhard Mersch Westfaelische Wilhelms-Universitaet
Reinhard Mersch Westfaelische Wilhelms-Universitaet
Universitaetsrechenzentrum, Roentgenstrasse 13, 48149 Muenster, Germany
E-Mail: mersch AT uni-muenster DOT de Phone: +49(251)83-31583
|
