Avoiding Posix And Edirectory Duplications; The Problem; Three Examples - Novell OPEN ENTERPRISE SERVER - PLANNING AND IMPLEMENTATION GUIDE 12-2010 Implementation Manual

6.2 Avoiding POSIX and eDirectory Duplications

OES 2 servers can be accessed by

Local (POSIX) users that are created on the server itself.

eDirectory users that are given local access through Linux User Manager (LUM).
However, there are some issues you need to consider:

Section 6.2.1, "The Problem," on page 60

Section 6.2.2, "Three Examples," on page 60

Section 6.2.3, "Avoiding Duplication," on page 61

6.2.1 The Problem

There is no cross-checking between POSIX and eDirectory to prevent the creation of users or groups
with duplicate names.
When duplicate names occur, the resulting problems are very difficult to troubleshoot because
everything on both the eDirectory side and the POSIX side appears to be configured correctly. The
most common problem is that LUM-enabled users can't access data and services as expected but
other errors could surface as well.
Unless you are aware of the users and groups in both systems, especially those that are system-
created, you might easily create an invalid configuration on an OES 2 server.

6.2.2 Three Examples

The following examples illustrate the issue.

"The shadow Group" on page 60

"The users Group" on page 61

"Other Non-System Groups" on page 61
The shadow Group
There is a default
including the OES 2 QuickFinder server, but it has no relationship with Dynamic Storage
Technology (DST) and shadow volumes.
Because
shadow
enabled second group in eDirectory that is also named
choice for many administrators in conjunction with setting up shadow volume access for Samba/
CIFS users.
However, using this group name results in LUM-enabled users being denied access by POSIX,
which looks first to the local
eDirectory for a group named
60 OES 2 SP3: Planning and Implementation Guide
system-created group named
is a local POSIX group, there is nothing to prevent you from creating a LUM-
group when determining access rights and only checks
shadow
if no local group is found.
shadow
that is used by certain Web-related services,
shadow
. In fact, this could be a logical name
shadow