[1875] in Moira
computers on ACLs?
daemon@ATHENA.MIT.EDU (Paul B. Hill)
Thu Oct 11 22:01:55 2001
From: "Paul B. Hill" <pbh@MIT.EDU>
To: "Pismere-Team@Mit. Edu" <pismere-team@mit.edu>
Cc: <moiradev@mit.edu>
Date: Thu, 11 Oct 2001 22:01:50 -0400
Message-ID: <JDEEIOCIIGMKDNGJMBLJAENICIAA.pbh@mit.edu>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Hi,
In a Windows 2000 Domain every member computer has an account and a SID
(think UID). The Pismere development team would like to be able to put
computers on ACLs, and have groups that can contain computers. This is a
normal feature available in a Windows 2000 Domain.
In the Athena environment, we don't usually provide a mechanism to put
computers in ACLs. Nor do we provide a method to add them to Moira groups
and lists. There are some valid reasons.
First, not all computers in the Athena environment have an account. Second,
we have no current restrictions on the recycability of hostnames. As soon as
a host has been deleted from Moira, someone else can create a new host using
the same name. If the hostname was a member of a group or list which is used
as an ACL there would be a chance that inappropriate access could be
granted.
Although each computer has a SID, and the SID is what is actually used to
identify the machine, you might think that hostname reuse is not an issue
for Win2k but it is. Suppose a hostname is added to a Moira group. On
propagation to Win2k the group membership will really contain the SID of the
computer. If the computer account is deleted, and then a new account of the
same name is added, it will have a different SID. Therefore we won't have a
problem, yet.
But when any group membership is changed in Moira, we re-propagate the
entire group membership to AD. So as soon as someone modifies the group
membership in Moira, the new computer account will be added to the group in
AD (and the old computer will be removed). At that point we may be granting
inappropriate access.
If we can resolve this problem we could at least start the discussion about
if it would be appropriate to add a new type to Moira. Until we can figure
how to addres this problem there is no reason to consider the implications
of adding a COMPUTER type to Moira.
Comments welcome.
Paul
