[comp.sys.sgi] NFS access list problems

shaginaw@NEUMANN.SQUIBB.COM (02/28/91)

In response to Steve Reszutek's problem with NFS access:

     Although the machines are in one another's host tables, if you're
running the name server, you have to be careful to use the correct
form of the other machines' names.  Specifically, when authenticating
potential clients for access, NFS receives the IP address of the potential
client who is doing the mount; the server part of NFS has to be able to do a
reverse hostname lookup to obtain the name of the potential client and
then compare in against the access list in /etc/exports.  If named is running,
the host table is ignored.

     If you are running name service, try this.  Run nslookup interactively,
and type "set query PTR".  Then supply the IP address of one of the
potential clients.  The hostname that comes back must be the one you use
in the access list.  

     If all of this checks out and you still have the problem, let me
know.  We've been through a number of problems in this category.

     Hope this helps.

                                                            -- Rich

-------------------------------------------------------------------------------
   .-----.
  / \-_-/ \      Bristol-Myers Squibb Pharmaceutical Research Institute   
 /_-_\ /_-_\     ------------------------------------------------------
 ----- -----       Richard J. Shaginaw   Internet Address: shaginaw@squibb.com
 \-_-/ \-_-/    Principal Systems Engineer      Telephone: 609-921-5184
  \ /_-_\ / Macromolecular Modeling Department        FAX: 609-683-6607
   `-----'
===============================================================================

vjs@rhyolite.wpd.sgi.com (Vernon Schryver) (03/01/91)

>      Although the machines are in one another's host tables, if you're
> running the name server, you have to be careful to use the correct
> form of the other machines' names.  Specifically, when authenticating
> potential clients for access, NFS receives the IP address of the potential
> client who is doing the mount; the server part of NFS has to be able to do a
> reverse hostname lookup to obtain the name of the potential client and
> then compare in against the access list in /etc/exports.

Good point, except that the NFS server, running in the kernel does not
do reverse hostname lookups.  You do have to ensure that the hostnames
in your access list are converted by mount into the IP number you want.

>                                                       If named is running,
> the host table is ignored.

With IRIX 3.3, you can have the system look at any or all of YP/NIS,
DNS/named, and /etc/hosts.  Check `man 4 resolver`.

>      If you are running name service, try this.  Run nslookup interactively,
> and type "set query PTR".  Then supply the IP address of one of the
> potential clients.  The hostname that comes back must be the one you use
> in the access list.  

Another, probably easier way to determine what the remote machine thinks
of you is:
	rsh remote env | grep REMOTE
or
	rsh remote 'echo $REMOTEHOST'

This is also useful for getting the right name for .rhosts or hosts.equiv.


Vernon Schryver,  vjs@sgi.com

arc@kaibab.wpd.sgi.com (Andrew Cherenson) (03/01/91)

In article <9102281424.AA23149@neumann> shaginaw@NEUMANN.SQUIBB.COM writes:
>     If you are running name service, try this.  Run nslookup interactively,
>and type "set query PTR".  Then supply the IP address of one of the
>potential clients.  The hostname that comes back must be the one you use
>in the access list.  

That should be "set query=PTR". As of IRIX 3.3, this step is not needed to
show the hostname corresponding to an IP address. For example,

% nslookup 140.176.0.89
Server:  sgi
Address:  0.0.0.0

Name:    neumann.squibb.com
Address:  140.176.0.89