vb.net ean 13 reader Figure 2.4: NFS client to server interface in Software

Creation ANSI/AIM Code 39 in Software Figure 2.4: NFS client to server interface

- 28 -

NFS server daemon NFS block I/O daemon RPC program to port manager NFS mount manager RPC status manager NFS lock manager

Each file system or directory available for remote mounting is identified with an entry in the server's /etc/exports file (Example 2.8). Along with the directory path name, the /etc/exports entry controls which machine names are allowed to mount the directory, operate on it with root permissions whether there is read-only or write access. If NFS root access is not enabled for a remote NFS client, the root UID of the server is mapped to a default UID of 2 (4294967294), user name nobody. This restricts compromises by unknown superuser UIDs on remote machines. Example 2.8 /etc/exports entry /usr/lpp/info/En_US -ro,access=alph,lisa /home -rw,root=alph,access=alph,lisa,armada

Printing is fairly straightforward under UNIX given the file I/O abstraction for interoperating with devices. In the simplest form an ASCII character file can be printed by piping the file into the device file representing a local printer. # cat myfile | /dev/lp. To facilitate print queuing for local and remote printers, the lpd daemon comes into play. When started, lpd digests printer and queue definitions listed in the /etc/printcap file (Example 2.9). The printcap file specifies all the attributes associated with each printer and queue. This includes whether banner and/or trailer pages are printed, if special back-end drivers or filters are required for the device, what access controls are in force, and whether accounting information should be logged. In the case of a remote queue, the remote site is identified. Example 2.9 /etc/printcap # Sample printcamp

- 29 -

lp|Sample Printer Entry:\ :lp=/dev/null:\ :sd=/var/spool/lpd/lp0:\ :if=/usr/local/lib/your-input-filter:\ :rm=host.your.domain.com:\ :mx#0:

The /etc/passwd and /etc/group files form the foundation of access control in UNIX. In general the right to operate on an object is governed by ownership or membership in a group associated with the object. Newer versions of UNIX have augmented access control mechanisms by including support for Access Control Lists (ACL). ACLs allow finer granularity than do operations allowed on an object and permit the end-user to set up and control custom groups. On the downside, ACLs are not easily mapped between environments and may not work over remote file shares.

The UNIX password file, /etc/passwd, is a table which identifies all users permitted to log-in to the system (Example 2.10). Each user account is assigned a text string Account Name and a numeric identifier, called a UID, which is unique to the individual computer. Another numeric identifier associated with the user is a default group identifier, GID. Basically the UID and GID tags are used by the system in managing access control. The password file may or may not include the encrypted password for the user population. Because the password file is visible to all users, some systems have moved the encrypted passwords into a restricted access file called the shadow password file. This defeats the ability to use the visible password file easily by password cracking programs. When shadow passwords are in effect a place holder character, !, is inserted into the password field in /etc/passwd indicating that the associated encrypted password can be found in the shadow password file. Other information in the password file may include personal name and address data in the gecos field, the user's home directory, and the default shell. Each field in the password file is separated by a colon. Accout Name:!:UID:GID:<Gecos strings>:<Home Directory>:<Shell> Example 2.10 /etc/passwd root:!:0:0:System Overseer:/:/bin/ksh daemon:!:1:1::/etc: bin:!:2:2::/bin: sys:!:3:3::/usr/sys: adm:!:4:4::/usr/adm: uucp:!:5:5::/usr/lib/uucp: stimpy:!:4084:30:Stimpson Cat:/u1/stimpy:/bin/ksh Parsing large password files can cause significant delays in command response time. To improve response time some UNIX implementations support mirroring /etc/passwd information in an indexed set of dbm databases. The mkpasswd command reads /etc/passwd and creates the keyed directory file, /etc/passwd.dir, and a data file, /etc/passwd.pag. Password dbm support is not required, but is provided as an option

- 30 -