Slashdot Mirror

← Back to Stories (view on slashdot.org)

NFS/NIS Recommendations for Windows?

Posted by Cliff on from the playing-nicely-on-the-network dept.

Fembot asks: "The Samba team are doing a great job, but I can't help but feel that making Unix machines serve Windows-based protocols is the wrong approach. Back in the days of Windows95 it shipped with an NFS client on the CD which could be installed optionaly. Are there open source (or even just free as in beer) NFS clients for Windows 2000/XP, and is it possible to authenticate users on Windows desktops via NIS?"

48 comments

  1. Linux Interaction Kit by Speedy8 · · Score: 5, Interesting

    Think of how cool it would be if HP, DELL, Alien Ware, etc. shipped all of their computers with a Linux interaction kit full of programs that would allow windows users to interact with Linux boxes using opensource protocals. The computers would still interact with windows boxes int he normal way but could use the open source methodes to.

    1. Re:Linux Interaction Kit by lexarius · · Score: 1

      Probably against one of Microsoft's OEM agreements with those companies.

      (Maybe)

    2. Re:Linux Interaction Kit by nbvb · · Score: 2

      Sure, we could install the Linux Interaction Connection Kit and the Proprietary Unix System Services Yeoman.

      Now _that_'s good software!

      As long as you include the System Universal Connection Kit with the Central Online Controller Kit.

      --DM

    3. Re:Linux Interaction Kit by 0x0d0a · · Score: 2

      Think of how cool it would be if HP, DELL, Alien Ware, etc. shipped all of their computers with a Linux interaction kit full of programs that would allow windows users to interact with Linux boxes

      Yeah. That would be cool. Then they'd get their OEM licences revoked by MS and every Windows user out their would be stuck buying...uh...

      Hmm. Now that Compaq is gone, who makes overpriced, crummy computers? I don't think Gateway charges quite enough to qualify...

      --
      May we never see th
  2. No by joto · · Score: 5, Informative
    There are no free software, open source, or non-crippled NFS clients for Windows (at least that has been the story for quite some time...)

    Your options are to either

    1. write one :-)
    2. buy a client for each machine from one of these vendors: 1 2 3 4 5 6 7.
    3. Buy a NFS/SMB gateway from one of the vendors above (or make one with Samba)
    4. Use both samba and NFS on the server
    5. Simply use samba
    When using both NFS and Samba there might be some tricky locking issues. At least it used to be recommended against. I don't know if that's true anymore, but you should be aware of it. If you only share disks readonly, then you will of course be safe.
    1. Re:No by Jeremy+Allison+-+Sam · · Score: 5, Insightful

      It's interesting to understand the reasons for this.
      It isn't because no one wants it, or no Free Software
      authors are interested, it's because "the Monopoly" (tm:-)
      ie. Microsoft doesn't want you to be able to do this, so
      they don't openly release the internal interfaces you need to
      use to write such a thing.

      They're available under NDA (at least the NFS parts) but
      the authentication parts are controlled with an iron fist
      (I don't think there are any replacement LSA modules that
      will allow NT/W2K/XP to use a NIS or NIS+ server as the
      sole authentication source). You see, if you could authenticate
      to a NIS or NIS+ server then you wouldn't need to buy those
      Windows server licenses and the strategy of leveraging a
      desktop monopoly into a server one would be in danger...

      This is why people are *really interested* in a Samba PDC.

      Regards,

      Jeremy Allison,
      Samba Team.

    2. Re:No by Anonymous Coward · · Score: 0

      Haha, I find it somewhat amusing that the Microsoft product is called S[t]FU.

    3. Re:No by 0x0d0a · · Score: 2

      I've seen Alan Cox, Bruce Perens, Sam Lantinga and a ton of other people, plus now Jeremy Allison, posting to Slashdot.

      Are there any Open Source luminaries that *don't* read Slashdot?

      --
      May we never see th
    4. Re:No by red_dragon · · Score: 3, Funny

      Are there any Open Source luminaries that *don't* read Slashdot?

      You mean, besides the Slashdot editors? ;)

      --
      In Soviet Russia, Jesus asks: "What Would You Do?"
    5. Re:No by Anonymous Coward · · Score: 1, Informative

      I don't know if this is what you mean by LSA but there is a cool looking project called pGina [plu.edu]. The about page shows:

      For instance, should an administrator wish to use an existing Unix server, and its existing base of users, to authenticate access to Windows 2000 machines there are few options. The methods employed may range from using a Windows 2000 server for authentication and having the administrator maintain identical lists of usernames/ passwords on each server, to using Samba to emulate a Windows NT 4 Server. However, each method has its drawbacks and limitations. Ideally the administrator should be able to setup a standard naming service, such as NIS (Network Information Services) or LDAP (Lightweight Directory Access Protocol), on ANY type of server and have all clients, regardless of OS revision, access that single repository.

      Sorry for the flood but it looks interesting to anybody wanting to do this sort of stuff.

      Thanks for Samba too :)

    6. Re:No by psychosis · · Score: 2

      Are there any Open Source luminaries that *don't* read Slashdot?

      More encouraging is that these folks CONTRIBUTE to the disussions! It's one thing to read a site like this, but another to lend expertise and foster a more valuable discussion.

    7. Re:No by Anonymous Coward · · Score: 0

      I would hardly call the slashdot janitors "lunimaries."

      Hell, they are an insult to janitors.

  3. Re:In Soviet Russia by moncyb · · Score: 1, Offtopic

    I hate to tell you this, but the Canadian guy was asking how to put more memory into his mp3 player, not how to install a hard drive in it. Some stupid people just assumed that's what he asked. He didn't want to buy a new one because he would have to pay a tax to the RIAA terrorists. Sounded like a good question to me.

    I don't see why this NFS question is stupid either. Maybe you're one of the regulars from comp.os.linux.*? ;-)

    The obligatory joke: In Soviet Russia...you screw Microsoft!

    Have a nice day. ;-)

  4. Do the smart thing. by Wakko+Warner · · Score: 3, Insightful

    Use Kerberos or LDAP for authentication. There are plenty of payware NFS clients for windows, but why would you use the same server to serve both UNIX and Windows filesystems? Unless you're simply sharing data that can be accessed and modified by both types of client, there's really no point, is there?

    - A.P.

    --
    "Remember when the U.S. had a drug problem, and then we declared a War On Drugs, and now you can't buy drugs anymore?"
  5. Because it's not secure by Isao · · Score: 1
    NIS/NIS+ is a security nightmare.

    Frankly, so is SMB, but if you have to dance with the devil, make it the devil with 95% market penetration.

    1. Re:Because it's not secure by SN74S181 · · Score: 1

      Yeah.

      Dance with the devil that's not based on a written accredited standard, and that's likely to change significantly any time it gets to be too well understood by non-Microsoft developers.

  6. Security considerations by plsuh · · Score: 3, Interesting

    Another factor involved in using NFS with Windows clients is the security model involved. To expand on Jeremy Allison's excellent comment, the NFS security model relies totally on the UID at the client. Since there is no native concept of a UID in Windows (plus the fact that the Win9x branch doesn't have good user privileges separation in any case), this means that you need a separate login from the Windows PC to the NFS server, using a system known as PC-NFS originally created by Sun. There is an open source pcnfsd daemon that will handle this at the server end, but the client piece is not free, and the whole thing is a PITA to set up, and is one more thing that can go wrong on a fragile Windows client system. Much better to use Samba on the server and not have to rely on yet another skanky layer. (Been there, done that, have the therapist bills to prove it :-P)

    FWIW, the Mac OS up through version 9.2 has pretty much the same set of issues. Mac OS X, being Unix-based, has NFS server and client support natively.

    --Paul

    1. Re:Security considerations by duffbeer703 · · Score: 2

      Windows users do have uids that are referred to as SIDs...

      For example, the local administrator on NT machines is always user -500.

      --
      Conformity is the jailer of freedom and enemy of growth. -JFK
    2. Re:Security considerations by mjstrom · · Score: 2, Interesting

      Yes, the do have SIDs. However, mapping SIDs to UIDs is not an easy job especially since SIDS are really a GUID (like {0000002F-0000-0000-C000-000000000046}) which are too long to be cleanly mapped in a UID. Take a look at the Samba's Winbind project here for some more details about the problems involved.

      The end result is that there isn't a clean mapping between the two domains. And the implementations of NFS for windows that I have seen have been hackish at best and disfunctional at worst.

      Using the windows protocols (CIFS or whatever it is being called these days) may be the best option.

    3. Re:Security considerations by 0x0d0a · · Score: 3, Interesting

      To expand on Jeremy Allison's excellent comment, the NFS security model relies totally on the UID at the client.

      Might this have changed when they moved to NFSv4? It uses GSSAPI, which presumably means it uses Kerberos principals instead of UIDs to identify users on a client machine.

      --
      May we never see th
    4. Re:Security considerations by SN74S181 · · Score: 2, Interesting

      I ran into some interesting 'UID at the client security' issues at a place I recently worked. I had an NT box, and I threw a copy of Microsoft's Interix POSIX subsystem on the machine. Through coincidence I discovered that I could rsh into any of the Solaris boxes at the company. What I noticed most significantly was that it wasn't asking for a password at all. So, as an experiment (I had the admin password on the NT box, which was my desktop machine) I created an NT account on the machine with a co-worker's UID. *poof* I could rsh into any Solaris box, and I had their account privledges.

      I quietly backed out without doing a thing, but it made me a little nervous. The company in question makes implantable medical devices, and it would have taken me a minute or two longer to make changes to firmware code in development for said.

    5. Re:Security considerations by photon317 · · Score: 2


      That had nothing to do with NT, that was just plain poor security on the unix admins' part.

      --
      11*43+456^2
    6. Re:Security considerations by Anonymous Coward · · Score: 0

      I wouldn't blame the admins as much as I would the Unix culture that dreamt up that crap.

      NFS+Local Auth is still The Right Way in many Unix installations.

    7. Re:Security considerations by larien · · Score: 2

      Moved? AFAIK, Solaris 9 is still only uses NFSv3 (or optionally v2) so we haven't "moved" to NFSv4 yet. Dunno about any GSSAPI stuff in there, but here is Secure NFS (generally considered an oxymoron) which can use Diffie-Helman or Kerberos.

    8. Re:Security considerations by SN74S181 · · Score: 1

      Hey, let's not forget that part of the historical Unix culture was the days at MIT when they first imposed passwords on the accounts, and a bunch of the hackers including Richard Stallman protested and refused to put passwords on their accounts.

  7. Good reason for this.... by duffbeer703 · · Score: 2

    NFS really sucks in general and it is hard to add new filesystem support to Windows w/o expensive developer support and licensing... which also comes with an NDA.

    --
    Conformity is the jailer of freedom and enemy of growth. -JFK
    1. Re:Good reason for this.... by SN74S181 · · Score: 2, Interesting

      People are always saying 'NFS really sucks in general' and it's hard to tell why they say so. It might have to do with poor implementations of NFS on Linux that I've heard mentioned. I have an NFS server here on the home network that's rock steady and serves as a primary 'waypoint' for all the Unix boxes. They're all NetBSD and Solaris boxes, so maybe that's why I haven't had any problem.

      Is there a short digest version of what's so bad about NFS on Linux that someone can reiterate?

    2. Re:Good reason for this.... by duffbeer703 · · Score: 3, Informative

      I'll bite...

      1. NFS file-locking is pitiful
      2. Stale mounts.
      3. Poor host-based security vs. SMB
      4. Inferior performance

      --
      Conformity is the jailer of freedom and enemy of growth. -JFK
  8. Don't use NFS, then by 0x0d0a · · Score: 5, Informative

    There are no free software, open source, or non-crippled NFS clients for Windows

    Yup. But if you're willing to use AFS instead of NFS, there's OpenAFS , an AFS client that's available for Windows, MacOS X, Linux, and just about every platform out there. It's free and open source, plus pretty well designed. IBM pushes and supports it, and MIT and CMU (plus a lot of other places, but it gives you an idea of how much approval it gets from people in the know) both use it for their storage system.

    AFS will also buy you a seriously secure system and better performance (thanks to leases and other good design features) than you'll get from CIFS (Windows filesharing). I'm pretty sure that NFS, despite the large number of changes in recent versions, is still outperformed by AFS.

    It can be more a bear to set up, since you'll probably want to also set up a dedicated KDC, but at least you're doing things the Right Way.

    Coda is supposed to be the successor to AFS, but I really haven't heard of people using it much, and Intermezzo doesn't have the backing that AFS does.

    Oh, yes. AFS can do distributed storage, so it can (magic boss-exciting word approaching) *scale* really well. :-)

    --
    May we never see th
    1. Re:Don't use NFS, then by TilJ · · Score: 2

      I'd love to switch one of my networks over to AFS and ditch the current Samba/NFS-combo setup[1]. Unfortunately, the OpenAFS site has this to say about the FreeBSD port: "Server ported. Cache manager support is not yet complete."

      Has anyone tried a different client (arla, maybe?) against an OpenAFS server on FreeBSD? I'd /love/ to get pointers on how to make the OpenAFS server on FreeBSD work :-)

      1. I love Samba, and NFS is a nice standard. But for heterogenous networks the seperate administration required to configure tools that access the same data is a drag.

      --
      "The purpose of argument is to change the nature of truth." -- Bene Gesserit Precept
    2. Re:Don't use NFS, then by Kludge · · Score: 1

      I'm pretty sure that NFS, despite the large number of changes in recent versions, is still outperformed by AFS.

      Not unless AFS transfers data faster than the network can. I get about 90 Mbits per second through my 100 Mbit network with linux NFS. On to gigabit I guess.

    3. Re:Don't use NFS, then by 0x0d0a · · Score: 2

      Not unless AFS transfers data faster than the network can. I get about 90 Mbits per second through my 100 Mbit network with linux NFS. On to gigabit I guess.

      Most things'll work well when you have them sitting near each other on an unsaturated network link, though. :-)

      AFS works more nicely if you've got a heavily utilized or higher latency connection, because it doesn't have to hit the server as much.

      --
      May we never see th
    4. Re:Don't use NFS, then by leandrod · · Score: 2
      > Cache manager support is not yet complete.

      Do you already use cache in NFS or SMB? I don't even know if it exists in SMB.

      If you don't use caching already, and if its lack doesn't affect the functionality of AFS, no loss in trying.

      --
      Leandro Guimarães Faria Corcete DUTRA
      DA, DBA, SysAdmin, Data Modeller
      GNU Project, Debian GNU/Lin
  9. pGina for authentication by Anonymous Coward · · Score: 0

    http://pgina.cs.plu.edu - does authentication via any number of means via plugins. Currently it just has LDAP, but if someone was willing to spend a little time, an NIS plugin should be cake. Combined with samba (http://www.samba.org) for file sharing, we have used this quite successfully in our labs/offices/servers.

  10. Re:In Soviet Russia by Anonymous Coward · · Score: 0

    Actually, in Canada it's not the RIAA, but SOCAN. Don't worry, they both suck equally.

    Actually, SOCAN sucks worse than the RIAA, because they've already removed the right of freedom of association with non-Canadians from us.

    Oh well.

  11. nfs for win32 [opensource, freeware, commerical] by develop · · Score: 4, Informative

    [1] http://opensource.franz.com/nfs/
    nfs is an NFS server for Windows written in Allegro Common Lisp.
    [2] War NFS Daemon written by Jarle Aase (freeware)
    [3] http://www.labtam-inc.com/
    commerical

  12. Take a look at Hummingbird NFS Maestro Solo by draziw · · Score: 1

    Or if you need to server, NFS Maestro Server. No, it isn't free. But if you have to buy one - take a look at NFS Maestro By Hummingbird.
    These are the same people that make Exceed. - Though instead of Exceed, I bought Xmanager by NetSarang (lot less $ and did SSH tunnel, etc)

    Good luck on your search.

  13. mod parent up by LittleBigLui · · Score: 1

    very sweet, yet a bit too subtle maybe?

    --
    Free as in mason.
    1. Re:mod parent up by Wolfrider · · Score: 1

      --OMG I just got it... LMAO

      --
      .
      == WolfriderV6 == I'm willing to admit that *I just might* be wrong... Are you??
  14. NIS/YP Win2k/XP Authentication by Anonymous Coward · · Score: 0

    pGina [plu.edu] is a replacement authentication layer for Windows. In theory, I understand, a NIS/YP plugin could be written although as of now there isn't one. An LDAP module does exist though.

  15. Unix Services for Windows by metoc · · Score: 1

    MS has Unix Services for Unix. It is a set of server based utilities that allows a server to act as a gateway between both worlds. Best thing is you only install and configure the server. Supports NT Shares, NFS, & NIS. Also allows password changes to propogate back and forth.

  16. In Soviet Russia... by I'm+not+a+script,+da · · Score: 0

    Linux interact with you!

  17. Re:nfs for win32 [opensource, freeware, commerical by CaptCanuk · · Score: 2

    Anyone looking for the War NFS Daemon will notice that it was discontinued. You can still find the download here though http://download.jgaa.com/ftp/pub/products/Windows/ WarNfsDaemon/i386/ .

    From the guys who brought you War FTPD ... Jgaa.

    --
    ---- The geek shall inherit the Earth.
  18. Re:nfs for win32 [opensource, freeware, commerical by cyb97 · · Score: 1

    Last time I tried the War NFSDaemon it barfed at random intervals leaving the clients in a state of well-fscked...
    It also mangled the files/dirs it was supposed to share (from the clients-pov, not physically)..

    disclaimer: but this was way back

  19. Which is harder? by bill_mcgonigle · · Score: 2

    Getting Microsoft to bundle your NFS client or writing a unix server to talk to their client?

    It's not like you can express better ownership/permission semantics than Windows supports anyhow.

    If you have to go around installing software it's always a harder sell.

    Personally, I'd love to see an ssh-based windows filesystem, though.

    --
    My God, it's Full of Source!
    OUTSIDE_IP=$(dig +short my.ip @outsideip.net)