From Jordan.Brown@Sun.COM Mon Mar 9 11:38:01 2009 Received: from dm-sfbay-02.sfbay.sun.com (dm-sfbay-02.SFBay.Sun.COM [129.146.11.31]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n29Ic0T6008463 for ; Mon, 9 Mar 2009 11:38:00 -0700 (PDT) Received: from sca-es-mail-2.sun.com (sca-es-mail-2.Sun.COM [192.18.43.133]) by dm-sfbay-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n29Ic0p1032210 for ; Mon, 9 Mar 2009 11:38:00 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n29Ibtxa012109 for ; Mon, 9 Mar 2009 11:37:55 -0700 (PDT) MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: text/plain; format=flowed; charset=UTF-8 Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7.0-3.01 64bit (built Dec 23 2008)) id <0KG900C004R2HY00@fe-sfbay-09.sun.com> for PSARC-ext@sac.sfbay.sun.com; Mon, 09 Mar 2009 11:37:55 -0700 (PDT) Received: from [129.145.155.183] ([unknown] [129.145.155.183]) by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7.0-3.01 64bit (built Dec 23 2008)) with ESMTPSA id <0KG900JOH537ZGC0@fe-sfbay-09.sun.com> for PSARC-ext@sac.sfbay.sun.com; Mon, 09 Mar 2009 11:37:55 -0700 (PDT) Date: Mon, 09 Mar 2009 11:37:55 -0700 From: Jordan Brown Subject: 2009/164 Support for guest access to CIFS/SMB shares Sender: Jordan.Brown@Sun.COM To: PSARC-ext@sac.sfbay.sun.com Message-id: <49B56203.2060009@sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080505) Status: RO Content-Length: 4024 [ Sorry if this is a duplicate. sac_nextcase appears to have eaten the first attempt, but maybe it's in some queue. ] I am sponsoring the following for fast track approval. The timer expires 16 March 2009. Template Version: @(#)onepager.txt 1.35 07/11/07 SMI Copyright 2009 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: Support for guest access to CIFS/SMB shares 1.2. Name of Document Author/Supplier: Author: Afshin Salek 1.3. Date of This Document: 03/06/09 1.4. Name of Major Document Customer(s)/Consumer(s): PSARC CIFS team 1.5. Email Aliases: 1.5.1. Responsible Manager: Barry.Greenberg@Sun.COM 1.5.2. Responsible Engineer: Afshin.Ardakani@Sun.COM 1.5.3. Marketing Manager: 1.5.4. Interest List: cifs-team@sun.com A patch binding is requested for this change. 4. Technical Description: 4.1. Details: This fast track proposes a new share property to support guest access to CIFS/SMB shares, as requested in RFE 6775827. A new share property, guestok, will be added to control whether or not guest access is allowed on the share. If guestok is set to true, guest access will be allowed on the specified share. If the guestok share property is not defined or is set to false, guest access will not be permitted on that share. By default, the guestok property is not defined, i.e. guest access is disabled by default. When a user attempts to connect to an SMB server, the request is interpreted as a guest connection if an account name is not specified or the specified user account does not exist. Guest connections are not authenticated except when the guest account has a password (more details below). Windows systems typically use a predefined local account called Guest to represent guest connections, although this account can be renamed. On Solaris, the system administrator can define an idmap name-based rule to map Guest to any local Solaris username, such as guest or nobody. For example: # idmap add winname:Guest unixuser:guest If the local account has a password in /var/smb/smbpasswd the guest connection will be authenticated against that password. Any connection made using an account that maps to the local guest account will be designated as a guest connection. 4.2. Bug/RFE Number(s): 6775827 4.5. Interface Stability: Committed 4.6. Doc Impact: Solaris CIFS Administration Guide Modifications to sharemgr(1M) man page: ------------------------------------------------------------------- The general properties supported for SMB are: + guestok=boolean + + Set the guest access policy for the share. + When set to true guest access is allowed on this share. + When set to false or not defined guest access is not + not allowed on this share. This property is not defined + by default. + + An idmap name-based rule can be used to map guest to any + local username, such as guest or nobody. If the local + account has a password in /var/smb/smbpasswd the guest + connection will be authenticated against that password. Any + connection made using an account that maps to the local + guest account will be treated as a guest connection. + + Example name-based rule: + + # idmap add winname:Guest unixuser:guest 6. Resources and Schedule: 6.4. Product Approval Committee requested information: 6.4.1. Consolidation or Component Name: ON 6.5. ARC review type: FastTrack From Joep.Vesseur@Sun.COM Tue Mar 10 01:29:18 2009 Received: from dm-sfbay-01.sfbay.sun.com (dm-sfbay-01.SFBay.Sun.COM [129.145.155.118]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n2A8TIJo020127 for ; Tue, 10 Mar 2009 01:29:18 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com (gmp-eb-inf-2.EU.Sun.COM [192.18.6.24]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n2A8TH7Y025006 for ; Tue, 10 Mar 2009 01:29:17 -0700 (PDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-1-fe3.eu.sun.com [192.18.6.10]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n2A8TBJx027361 for ; Tue, 10 Mar 2009 08:29:11 GMT MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: text/plain; charset=UTF-8 Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7.0-3.01 64bit (built Dec 23 2008)) id <0KGA0030062H0G00@fe-emea-10.sun.com> for PSARC-ext@sac.sfbay.sun.com; Tue, 10 Mar 2009 08:29:11 +0000 (GMT) Received: from [10.16.117.32] ([unknown] [10.16.117.32]) by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7.0-3.01 64bit (built Dec 23 2008)) with ESMTPSA id <0KGA009KK7JUG960@fe-emea-10.sun.com> for PSARC-ext@sac.sfbay.sun.com; Tue, 10 Mar 2009 08:28:43 +0000 (GMT) Date: Tue, 10 Mar 2009 09:29:10 +0100 From: Joep Vesseur Subject: Re: 2009/164 Support for guest access to CIFS/SMB shares In-reply-to: <49B56203.2060009@sun.com> Sender: Joep.Vesseur@Sun.COM To: Jordan Brown Cc: PSARC-ext@sac.sfbay.sun.com Message-id: <49B624D6.6050307@Sun.COM> X-Enigmail-Version: 0.95.1 References: <49B56203.2060009@sun.com> User-Agent: Thunderbird 2.0.0.18 (X11/20090209) Status: RO Content-Length: 659 On 03/09/09 19:37, Jordan Brown wrote: > [...] Windows systems typically > use a predefined local account called Guest to represent guest > connections, although this account can be renamed. On Solaris, > the system administrator can define an idmap name-based rule to > map Guest to any local Solaris username, such as guest or > nobody. For example: > > # idmap add winname:Guest unixuser:guest What mapping occurs when no explicit name-based rule is created? i.e. what permissions are used by default for guest access? Or will guest access fail if no explicit name-based rule is created? Joep From amw@Sun.COM Tue Mar 10 02:08:08 2009 Received: from dm-sfbay-01.sfbay.sun.com (dm-sfbay-01.SFBay.Sun.COM [129.145.155.118]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n2A988I8021808 for ; Tue, 10 Mar 2009 02:08:08 -0700 (PDT) Received: from brmea-mail-2.sun.com (brmea-mail-2.Sun.COM [192.18.98.43]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n2A988Xa030965 for ; Tue, 10 Mar 2009 02:08:08 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n2A988mB015492 for ; Tue, 10 Mar 2009 09:08:08 GMT MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: text/plain; reply-type=original; charset=UTF-8; format=flowed Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7.0-3.01 64bit (built Dec 23 2008)) id <0KGA0000098S7W00@mail-amer.sun.com> for PSARC-ext@sac.sfbay.sun.com; Tue, 10 Mar 2009 03:08:08 -0600 (MDT) Received: from TOSHIBA ([unknown] [68.228.88.55]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7.0-3.01 64bit (built Dec 23 2008)) with ESMTPSA id <0KGA00GKD9DIOM30@mail-amer.sun.com> for PSARC-ext@sac.sfbay.sun.com; Tue, 10 Mar 2009 03:08:07 -0600 (MDT) Date: Tue, 10 Mar 2009 02:08:01 -0700 From: "Alan.M.Wright" Subject: Re: 2009/164 Support for guest access to CIFS/SMB shares Sender: Alan.M.Wright@Sun.COM To: Joep Vesseur , Jordan Brown Cc: PSARC-ext@sac.sfbay.sun.com Message-id: <358DDCFA3F3945598F633EC28722D0C7@TOSHIBA> X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 X-Mailer: Microsoft Outlook Express 6.00.2900.5512 X-Priority: 3 X-MSMail-priority: Normal References: <49B56203.2060009@sun.com> <49B624D6.6050307@Sun.COM> Status: RO Content-Length: 931 Joep Vesseur wrote: > On 03/09/09 19:37, Jordan Brown wrote: >> [...] Windows systems typically >> use a predefined local account called Guest to represent guest >> connections, although this account can be renamed. On Solaris, >> the system administrator can define an idmap name-based rule to >> map Guest to any local Solaris username, such as guest or >> nobody. For example: >> >> # idmap add winname:Guest unixuser:guest > > > What mapping occurs when no explicit name-based rule is created? i.e. what > permissions are used by default for guest access? > Or will guest access fail if no explicit name-based rule is created? > > Joep An ephemeral ID will be allocated - exactly the same as for any CIFS user for whom there is no applicable mapping. In terms of file access control, it is no different from any other user account. Alan From Darren.Moffat@Sun.COM Tue Mar 10 03:12:21 2009 Received: from dm-sfbay-02.sfbay.sun.com (dm-sfbay-02.SFBay.Sun.COM [129.146.11.31]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n2AACLxC028958 for ; Tue, 10 Mar 2009 03:12:21 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com (gmp-eb-inf-2.EU.Sun.COM [192.18.6.24]) by dm-sfbay-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n2AACLo8000961 for ; Tue, 10 Mar 2009 03:12:21 -0700 (PDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-2-fe2.eu.sun.com [192.18.6.11]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n2AACFDH016537 for ; Tue, 10 Mar 2009 10:12:15 GMT MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: text/plain; format=flowed; charset=ISO-8859-1 Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7.0-3.01 64bit (built Dec 23 2008)) id <0KGA00900BLOBF00@fe-emea-10.sun.com> for PSARC-ext@sac.sfbay.sun.com; Tue, 10 Mar 2009 10:12:15 +0000 (GMT) Received: from [129.156.173.21] ([unknown] [129.156.173.21]) by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7.0-3.01 64bit (built Dec 23 2008)) with ESMTPSA id <0KGA000RYCCE33D0@fe-emea-10.sun.com> for PSARC-ext@sac.sfbay.sun.com; Tue, 10 Mar 2009 10:12:15 +0000 (GMT) Date: Tue, 10 Mar 2009 10:12:14 +0000 From: Darren J Moffat Subject: Re: 2009/164 Support for guest access to CIFS/SMB shares In-reply-to: <49B56203.2060009@sun.com> Sender: Darren.Moffat@Sun.COM To: Jordan Brown Cc: PSARC-ext@sac.sfbay.sun.com Message-id: <49B63CFE.8000404@Sun.COM> References: <49B56203.2060009@sun.com> User-Agent: Thunderbird 2.0.0.18 (X11/20081201) Status: RO Content-Length: 459 I'm happy with the case as specified. A few small things though: I think a mapping of guest to the Solaris nobody account would be a useful default configuration, it would then match what NFS does with unknown users - which is the closest NFS equivalent to CIFS guest access. The property name of "guestok" feels clunky to me I'd have expected just "guest" but given NFS already has "aclok,nosub,nosuid" it seems to fit that model. -- Darren J Moffat From Jordan.Brown@Sun.COM Tue Mar 10 08:56:24 2009 Received: from dm-sfbay-01.sfbay.sun.com (dm-sfbay-01.SFBay.Sun.COM [129.145.155.118]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n2AFuOa2015490 for ; Tue, 10 Mar 2009 08:56:24 -0700 (PDT) Received: from sca-es-mail-1.sun.com (sca-es-mail-1.Sun.COM [192.18.43.132]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n2AFuOiM059150 for ; Tue, 10 Mar 2009 08:56:24 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n2AFuJdN021638 for ; Tue, 10 Mar 2009 08:56:19 -0700 (PDT) MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: text/plain; format=flowed; charset=UTF-8 Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7.0-3.01 64bit (built Dec 23 2008)) id <0KGA00G00RSI6F00@fe-sfbay-09.sun.com> for PSARC-ext@sac.sfbay.sun.com; Tue, 10 Mar 2009 08:56:19 -0700 (PDT) Received: from [129.145.155.183] ([unknown] [129.145.155.183]) by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7.0-3.01 64bit (built Dec 23 2008)) with ESMTPSA id <0KGA00LY4S9U5O30@fe-sfbay-09.sun.com> for PSARC-ext@sac.sfbay.sun.com; Tue, 10 Mar 2009 08:56:19 -0700 (PDT) Date: Tue, 10 Mar 2009 08:56:18 -0700 From: Jordan Brown Subject: Re: 2009/164 Support for guest access to CIFS/SMB shares In-reply-to: <49B63CFE.8000404@Sun.COM> Sender: Jordan.Brown@Sun.COM To: Darren J Moffat Cc: PSARC-ext@sac.sfbay.sun.com Message-id: <49B68DA2.8000804@sun.com> References: <49B56203.2060009@sun.com> <49B63CFE.8000404@Sun.COM> User-Agent: Thunderbird 2.0.0.14 (X11/20080505) Status: RO Content-Length: 733 Darren J Moffat wrote: > I think a mapping of guest to the Solaris > nobody account would be a useful default configuration, it would then > match what NFS does with unknown users - which is the closest NFS > equivalent to CIFS guest access. We looked at that. It's all software, so anything is possible, but the current structure of the idmap processing doesn't lend itself to providing such a default. The "well-known name" processing either doesn't yield a UID, or yields a UID that is used regardless of any other processing. There's no simple way to have it produce a default that can be overridden. That's an implementation detail, of course, and so if the ARC wants it to default to nobody we'll make it happen. From Jordan.Brown@Sun.COM Wed Mar 11 16:11:29 2009 Received: from dm-sfbay-02.sfbay.sun.com (dm-sfbay-02.SFBay.Sun.COM [129.146.11.31]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n2BNBT8q028605 for ; Wed, 11 Mar 2009 16:11:29 -0700 (PDT) Received: from sca-es-mail-2.sun.com (sca-es-mail-2.Sun.COM [192.18.43.133]) by dm-sfbay-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n2BNBTcm044959 for ; Wed, 11 Mar 2009 16:11:29 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n2BNBOAH007674 for ; Wed, 11 Mar 2009 16:11:24 -0700 (PDT) MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: text/plain; format=flowed; charset=UTF-8 Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) id <0KGD00I006V3IH00@fe-sfbay-09.sun.com> for PSARC-ext@sac.sfbay.sun.com; Wed, 11 Mar 2009 16:11:24 -0700 (PDT) Received: from [129.145.155.183] ([unknown] [129.145.155.183]) by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7.0-5.01 64bit (built Feb 19 2009)) with ESMTPSA id <0KGD00GSR72Z9I20@fe-sfbay-09.sun.com> for PSARC-ext@sac.sfbay.sun.com; Wed, 11 Mar 2009 16:11:24 -0700 (PDT) Date: Wed, 11 Mar 2009 16:11:23 -0700 From: Jordan Brown Subject: 2009/164 CIFS guest access - approved Sender: Jordan.Brown@Sun.COM To: PSARC-ext@sac.sfbay.sun.com Message-id: <49B8451B.6050904@sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080505) Status: RO Content-Length: 43 This case was approved at today's meeting.