Re: UNIX Disk Quote Control w/LDAP

[Terry Lambert <terry@whistle.com>]

Samson Luk wrote:
> 
> Hi Terry,
> 
> Thank you VERY MUCH for the available input and suggestion.
> 
> > It sounds like you are saying that you want quotas enforced
> > on LDAP credentials alone, and that the LDAP credentials
> > would not map to real UNIX UIDs.
> 
> Yes, this is exactly what we want to do.  As you mentioned,
> we have no problem in mail by making use of an LDAP enabled
> "deliver" program.  What we are trying to do is to provide
> a http server for user home page storage, we have found
> Apache and ftp to speak "LDAP".  However, the LDAP enabled
> ftp doesn't control disk quota, when user ftp upload their
> home page to a http server without /etc/passwd, we can not
> think of a way to keep the disk user disk quota under control
> within this server.  Do you know if there is "anything"
> already available instead of writing our own wrapper?

Well, as before, you could have UNIX UIDs that don't have
passwd file entries.  You would have to be careful to pick
the range so that you would _never_ get one that was the
same as a passwd file UID.

Try this (as "root"):

	cd /tmp
	touch foo
	chown 11367 foo
	ls -l foo
	rm foo

You can create files with non-existant owners, and you can
enforce file system quotas on a per UID basis.  For the
example above, a quota enforced on UID 11367 would apply
to the file "foo", even id there were no passwd file entry
for UID 11367.

The point is that an SUID root program can call seteuid()
with any number it chooses.  If your FTP program calls
seteuid() after verifying authentication via LDAP to the
UID field also stored in the LDAP entry for the user being
authenticated, then it can become any UID that it wants,
regardless of whether or not there is a UNIX user with
that UID.


-- Terry Lambert
-- Whistle Communications, Inc., an I.B.M. Company
-- terry@whistle.com
-------------------------------------------------------------------
This is formal notice under California Assembly Bill 1629, enacted
9/26/98 that any UCE sent to my email address will be billed $50
per incident to the legally allowed maximum of $25,000.