Per-user web directory on nss volume

Is possible to use directories in nss volume as per-user web directory for apache virtual hosts ?
How I set permission for it ?
Vogl Lubomir

vogl,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://support.novell.com and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://support.novell.com/forums/

Similar Messages

Migrating Users Quotas on NSS Volumes

Hi !
We have a Netware 6.5 SP7 server with around 45000 users on it. We have a NSS volumes called USERS where must of the users have a quotas restrictions.
How can I migrate all the users quotas restrictions from a Netware server to an OES 2 Linux server ?
I tried many tools like SCMT, migfiles, tcnvlnx.nlm, ... Everything is migrating correctly EXCEPT the users quotas on the NSS volumes.
Any ideas ?
Eric

Marcel Cox wrote:
> Are your users lum enabled?
Quotas don't need LUM enabled users on OES2 Linux.
But if Eric is referring to Volume Space Restrictions and migrations
just folders, then it won't work.. directory restrictions should
migrate, haven't tried becoz we only user Volume based.
6.1.3 User Space Restrictions Only Migrated in Full Volume Copies
In consolidation projects where individual folders are dragged and
dropped, or where a volume is
copied to a folder on the destination server, user space restrictions on
the source volume are not
migrated to the destination volume.
If your consolidation project is set up to copy an entire volume, with
the contents of the source
volume being copied to the root of the destination volume, user space
restrictions are migrated to the
destination volume. If user space restrictions already exist on the
destination volume, they are
overwritten with the restrictions migrated from the source volume.
-sk

Public_html on NSS Volume

The Apache2 in the OES2 SP2 includes the mod_userdir, so public_html directories in a Linux-Users(!) homedir, f. e. under /home/user1 are working fine.
so my problem is now, how to move this to my users homedirs on the nss volume?
have the users to be lum enabled?
Thank yOu

Originally Posted by TFe
- Apache setup:
The browser URL for the home directory users will be http://server-ip-address/~username
Create a .conf file with the directives below under /etc/apache2/conf.d - it could be named "HomeDir.conf" for example.
This example uses the "UserDir" directive to set the path and directory for all of the home directory users. It is where you choose to put the user's home directory that exists on an NSS volume of the same server.
The asterisk ( * ) symbol is a place holder for any home user in that NSS volume path.
Restart apache when changes are made to the .conf file, using the command "rcapache2 restart"
UserDir /media/nss/VOL1/data/*/docs
<Directory "/media/nss/VOL1/data/*/docs">
Options Indexes Multiviews
AllowOverride None
Order deny,allow
Allow from all
</Directory>
From Configuring User Home Directories on Linux using an NSS volume on the same server.
Cheers

Strange directory behaviour on NSS volume OES11 SP1

Hi All,
A couple of months ago we installed an OES11 SP1 server with an NSS volume (VOL1:) for all our installation files.
In the root of the VOL1: volume, we created a directory named _Install (yes, underscore)
In this directory we created a lot of subdirectories with installation files for several applications, to keep things short, let's say DIR-A, DIR-B, DIR-C DIR-D DIR-E etc.
So if we opened VOL1:, we just saw the _Install direcory in the root of VOL1:, and if we opened the _Install directory, we saw the DIR-A, DIR-B etc.
But today, we opened the VOL1:, saw, the _Install directory, but also the DIR-A, DIR-B, DIR-C etc. in the folowing manner:
_Install (normal)
_Install\DIR-A
_Install\DIR-B
_Install\DIR-C
etc.
If we doubleclick on one of the directories in the root of VOL1:, we actually open the directory below the _Install directory. It's just like we have a kind of symbolic links, or shortcut's to the real directories in our root.
Never seen this before.
Anybody a clue for this?
regards,
Mark

On 29/10/2013 14:46, MarkHofland wrote:
> A couple of months ago we installed an OES11 SP1 server with an NSS
> volume (VOL1:) for all our installation files.
> In the root of the VOL1: volume, we created a directory named _Install
> (yes, underscore)
> In this directory we created a lot of subdirectories with installation
> files for several applications, to keep things short, let's say DIR-A,
> DIR-B, DIR-C DIR-D DIR-E etc.
> So if we opened VOL1:, we just saw the _Install direcory in the root of
> VOL1:, and if we opened the _Install directory, we saw the DIR-A, DIR-B
> etc.
>
> But today, we opened the VOL1:, saw, the _Install directory, but also
> the DIR-A, DIR-B, DIR-C etc. in the folowing manner:
>
> _Install (normal)
>
> _Install\DIR-A
> _Install\DIR-B
> _Install\DIR-C
>
> etc.
>
> If we doubleclick on one of the directories in the root of VOL1:, we
> actually open the directory below the _Install directory. It's just like
> we have a kind of symbolic links, or shortcut's to the real directories
> in our root.
>
> Never seen this before.
>
> Anybody a clue for this?
Having seen your other replies, you're opening VOL1: in Windows Explorer?
What do you see if you do a DIR from a Command Prompt window?
HTH.
Simon
Novell Knowledge Partner
If you find this post helpful and are logged into the web interface,
please show your appreciation and click on the star below. Thanks.

Prevent directory move on NSS volume

This issue has come up from time to time, but never annoying enough to address until now. I have a few directories on a OES 11 server running NSS volumes that are utilized as "public" folders for users and departments. The rights that are typically granted to the top-level directory are 'RWECMF' to the OU. The issue is that on occasion, a user will accidentally go mouse crazy and inadvertently move the directory to a new location, thus causing a search and find adventure to move the directory back to the proper location.
The question is, am I missing something really basic here to allow users to continue to perform what they need to do on the file system below public, but to prevent them from the ability to move the top-level directory, in this case "public?"
Any comments would be greatly appreciated.
Thanks!

On Wed, 28 Jan 2015 13:36:02 +0000, donaldsolberg wrote:
> This issue has come up from time to time, but never annoying enough to
> address until now. I have a few directories on a OES 11 server running
> NSS volumes that are utilized as "public" folders for users and
> departments. The rights that are typically granted to the top-level
> directory are 'RWECMF' to the OU. The issue is that on occasion, a user
> will accidentally go mouse crazy and inadvertently move the directory to
> a new location, thus causing a search and find adventure to move the
> directory back to the proper location.
Yup. It happens.
The usual answers are:
1. Take the rights away.
2. Shoot the offending users. Repeat until it stops happening.
3. Use something to "tune" the mouse action on the workstation to make
moving things accidently more difficult.
Pick one... But #2 is likely to lead to other problems.
> The question is, am I missing something really basic here to allow users
> to continue to perform what they need to do on the file system below
> public, but to prevent them from the ability to move the top-level
> directory, in this case "public?"
Sadly, no. If they have sufficient rights to do so, the server doesn't
know or care why they're moving stuff from "here" to "there". It's a
valid operation, and the server does what it does as quickly as possible.
David Gersic dgersic_@_niu.edu
Knowledge Partner http://forums.netiq.com
Please post questions in the forums. No support provided via email.
If you find this post helpful, please click on the star below.

How to list all directory quotas on an OES NSS Volume ??

Hi
I need to list all the directory quotas on an OES2 NSS volume, and haven't succeded yet!
I've tried to extract the info by inspecting /_admin/Manage_NSS/Volume/<volname>/DirInfo.xml, but it's always incomplete, as the file seems to have a 'fixed length' of 1024K.
Is there any way to:
a) completelly copy the file somewhere without the 1024K restriction
b) any other util that could do the job
Thanks!
IB

ibayarri,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://support.novell.com and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://forums.novell.com/

How to setup FTP to NSS Volume\directory

I need to setup an ID when it FTPs to the new OES2 server it will
automatically be in the NSS volume in the directory;
FS1\DATA:\Reports\FTPDATA
How do you do this with pure-ftp?
I setup an account (ftpuser) in edirectory and LUM enabled it to the
oes2 server but when i ftp in it ftps to the linux home directory
please help

For the migration tool:
There is a option for FTP migration, but I don't particularly recommend it. It doesn't do much. And what it does do, it doesn't do particularly well. On the positive side, getting what you had with NWFTPD out of OES "Novell FTP" is usually attainable now. But it requires getting your hands dirty and do a good review of pure-ftpd's abilities, settings, and methods.
The "Novell FTP" install pattern in OES Install & Config will lum enable pure-ftpd for you (via pam configuration), add some settings to the /etc/pure-ftpd/pure-ftpd.conf file for OES specific enhancements, and a few other things like that.
The migration tool does one thing: It looks at a small number of setting in NetWare's sys:/etc/ftpserv.cfg and sets corresponding values in /etc/pure-ftpd/pure-ftpd.conf. But there are many settings unique to each, which don't translate. And the migration tool doesn't do all that it could, and it does some things it shouldn't:
- It doesn't turn on all the remote server / ftp gateway / NCP home directory features that you're used to be always on in NWFTPD. In pure-ftpd, you have to turn those on yourself (in pure-ftpd.conf), as they are off by default. As these features are now optional, it was decided to have them default to being off. This keeps ftp server code paths much simpler for those who don't need those features.
- It tends to remove some settings from pure-ftpd.conf if they are set to the defaults. While that won't have any negative impact on functionality, it is annoying for people who like to all the settings in the file, either as examples or to remind them of the current values. If you want to accomplish what the migration tool does without risking those deletions, I recommend you see table 25-1 at the following link. That shows what setting from NetWare are carried into pure-ftpd.conf during the migration process. You can usually do it manually in just a few minutes.
Novell Documentation
And as Ketter indicated in another reply, the OES 11 online doc holds information that will help. Much of the FTP home directory features were added or enhanced in OES 11 SP1, so be sure to use the current doc.

Sa520 Web filter per user?

Is there a way in the sa520 to enable HTTP filtering per user or per group? I simply want to add a "executives" group that do not get blocked out as much as Normal users.

Hi John,
If you use the standard Content Filtering of your SA520, then you cannot segregate client access. Either all clients are blocked or all are allowed.
If you buy a license for ProtectLink Gateway, then you are able to block a group of users from viewing certain sites, while predefining a list of clients that will have access to the sites in question- in this case your Executive Group. However, they will have access to all sites. Clients will either be blocked or allowed to visit sites that are to be filtered.
Cheers,
Julio

Access forbidden when Apache is trying to use NSS volume

I'm helping a customer migrate from an OES2 SBE server to an OES2 Linux server running under VMware. The new server is up and seems to be running fine and I've migrated all of the data over, but not using the Migration Tools as I could not get them to work. (That's another thread in the forums. Could that problem be related to this problem???).
Anyway, on their old server they run Apache for their public web site and it's default directory is on an NSS volume. It's configured in default-server.conf and it works fine. There are no virtual servers configured in Apache
On the new server, I've duplicated every setting I can find in Apache and every permission in the file system to match exactly with the old server. However, all I can get from Apache is an "Error 403: You don't have permission to access the requested directory. There is either no index document or the directory is read-protected."
If I move the web folder off of the NSS volume and adjust default-server.conf, it serves the pages up just fine. So, I'm pretty sure it's NSS permissions related. The wwwrun user and www group are pre-existing in the Tree and the old server is using them and they appear to be LUM enabled. There's a Unix Workstation object in the tree for the new server, so I'm assuming it's LUM enabled. From what very little I understand about LUM, it appears to be working but I wouldn't bet much on that. I also tried configuring Apache to use a virtual host instead of the default-server and that didn't help either.
I've found several other threads and TIDS on the topic and tried them all but nothing worked. I'm at the end of my knowledge!
-Farren

farren wrote:
>
> I'm helping a customer migrate from an OES2 SBE server to an OES2 Linux
> server running under VMware. The new server is up and seems to be
> running fine and I've migrated all of the data over, but not using the
> Migration Tools as I could not get them to work. (That's another thread
> in the forums. Could that problem be related to this problem???).
>
> Anyway, on their old server they run Apache for their public web site
> and it's default directory is on an NSS volume. It's configured in
> default-server.conf and it works fine. There are no virtual servers
> configured in Apache
>
> On the new server, I've duplicated every setting I can find in Apache
> and every permission in the file system to match exactly with the old
> server. However, all I can get from Apache is an "Error 403: You don't
> have permission to access the requested directory. There is either no
> index document or the directory is read-protected."
>
> If I move the web folder off of the NSS volume and adjust
> default-server.conf, it serves the pages up just fine. So, I'm pretty
> sure it's NSS permissions related. The wwwrun user and www group are
> pre-existing in the Tree and the old server is using them and they
> appear to be LUM enabled. There's a Unix Workstation object in the tree
> for the new server, so I'm assuming it's LUM enabled. From what very
> little I understand about LUM, it appears to be working but I wouldn't
> bet much on that. I also tried configuring Apache to use a virtual host
> instead of the default-server and that didn't help either.
>
> I've found several other threads and TIDS on the topic and tried them
> all but nothing worked. I'm at the end of my knowledge!
>
> -Farren
>
>
Did you give rights to wwwrun to the volume?

"There was an error opening this document. The filename, directory name, or volume label syntax is i

"There was an error opening this document. The filename, directory name, or volume label syntax is incorrect."
I tried different versions, no avail.
I think it has to do with the password somehow, but I do not know. I can copy the files from the web folder to my desktop and they open fine (after entering the password AGAIN), but I can not open them directly form the web folder - it does not ask for the password again, just pops up the error.
Adobe's support really upset me (insert explicative here) by keeping me on the phone for 20 min, collecting all sorts of information about me (not the problem) with some lady who barely spoke English, just to tell me to go to the website. No surprise they need to charge for tech support, customer service is doing everything but "service". I hate companies that do this. I am thinking of using another PDF reader, I have heard good things about them. Check
http://en.wikipedia.org/wiki/List_of_PDF_software
Has anyone ever been able to find a fix? I can not find anything on this site.

Howdy, Moritz!
Thanks for the suggestion, but this is not an issue of filename and language conflicts, at least in my environment. I highly doubt that's the root cause of this issue.
The PDF files in my tests have all had very simple names, such as 123.pdf and test.pdf, as well as more complicated names with spaces in them. Nothing about the files contains anything outside of the English language, including the content and filenames.
From everything I've been able to determine, this is a WebDAV-related security issue that affects programs like Acrobat Reader. I know for a fact that MS's KB892211 WebDAV patch doesn't create the issue, however MS's update to that 892211 patch DOES create the issue. As I've outlined earlier in this thread, my extensive testing has proven this more than once.
At this point, I haven't been able to accurately uninstall the update to 892211 after the update has been installed. And, as far as I can tell, the update to 892211 comes down from MS as a Office and/or Windows Update component. So, everyone has it, the uninstaller doesn't work, and there's no documentation detailing what registry entries are being changed when the update to 892211 is installed.
My ultimate goal is to bring a test machine to the point just before the update to 892211 goes on, fire up the Registry, Process, and File monitors on my test box, and install the 892211 update. This should give me an accurate picture of what I need to restore in order to rid the machine of the update to 892211.
Until Microsoft officially fixes the issue, I am not totally sure how this will be resolved. I've ceased my work on the issue for now since copying the PDF file from the WebDAV share to the user's desktop gets the user what they wanted in the first place - the ability to open the PDF file!
Maybe, once some other projects slow down a bit, I might get back to creating a solution, but it's going to be a "hack" no matter which way you slice it. I'd much rather MS spend their time creating the solution. If I have to do it, my fee to MS will be quite HIGH! :*)
George B.

Invalid descriptor error when trying to access nss volums

Hi everyone,
sorry for my english, when some users try to access shared nss volumes they get this error " invalid descriptor", but other folders are accessible at the same level.
users are on windows 7 and the last novell client.
thanks

On 23/06/2014 16:06, skaii wrote:
> sorry for my english, when some users try to access shared nss volumes
> they get this error " invalid descriptor", but other folders are
> accessible at the same level.
>
> users are on windows 7 and the last novell client.
Since you reference Novell Client I'm thinking that you're not using
Novell's Dynamic File Services product[1] which is what this forum is
for. If that is the case then you should repost in a more appropriate
forum, depending on whether you're using Open Enterprise Server (OES) or
NetWare.
HTH.
[1] http://www.novell.com/products/dynamic-file-services/
Simon
Novell Knowledge Partner
If you find this post helpful and are logged into the web interface,
please show your appreciation and click on the star below. Thanks.

ASA5515X - WSE,AVC and IPS - Application block per user

Can I enable web applicaction blocking based on user or group of users with WSE license or do I need another type of license.?
Thanks,
Ivan

WSE is always packaged, at a minimum with AVC. that combination on an ASA is all the licensing you need to block web applications per user. You will of course need to implement a scheme to identify your users in order to use their identity in a policy. That can be via local database (seldom used as it doesn't scale well) or via integration with your Microsoft AD infrastructure (via active authentication or optionally using the free Context Directory Agent (CDA) server running on a VM in your environment) or via something like the Identity Services Engine (ISE - a licensed product).

Web directory permissions

would it be bad to give the user _www (uid 70) read permission to the entire web directory via ACL and also give "others" no access? i'm wondering about how to best secure the web server data.
the default seems to be 775. if we have afp filesharing enabled on this volume, then people can poke around and view other directory contents if "others" is set to 'read'... but changing "others" to "none" restricts apache.
thanks

would it be bad to give the user _www (uid 70) read permission to the entire web directory via ACL and also give "others" no access?
No. You should give at least one account full access to it so that the process of editing the pages is simpler.
(36263)

Windows Installer repair issue for per-user folders/files

Intro:
I have doubts that this is the right place to ask about this, since this issue has existed for me on many windows platforms, please suggest where this should be forwarded if this is an inappropriate place to ask.
Please do not be confused by the directory paths for XP, this issue is also true for Windows 7.
Description:
Windows Installer does not repair files in per-user directories, such as [AppDataFolder], when initial installation is performed using system account (for example - distributing the package through SCCM or using psexec) and repairing under a user with administrative
privileges (limited user repair works fine).
Example.
.msi installation installs a custom .xml configuration file to "[AppDataFolder]". We're installing .msi by using psexec /s. log output:
MSI (s) (D8:F0) [15:19:01:214]: Executing op: FileCopy(SourceName=SETTIN~2.CON|customXML,SourceCabKey=customXML,DestName=customXML,Attributes=16384,FileSize=2633,PerTick=32768,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-1992414570,HashPart2=1238809189,HashPart3=-80616146,HashPart4=146746036,,)
MSI (s) (D8:F0) [15:19:01:214]: File: c:\WINDOWS\system32\config\systemprofile\Application Data\customXML;
To be installed; Won't patch;
No existing file
MSI (s) (D8:F0) [15:19:01:214]: Source for file 'customXML' is compressed
MSI (s) (D8:F0) [15:19:01:230]: Note: 1: 2318 2: c:\WINDOWS\system32\config\systemprofile\Application Data\customXML
When a user with administrative credentials accesses the advertised shortcut repair is run on the component that has the .xml configuration file, event viewer has an entry about this.
The verbose repair log file shows the following entry:
MSI (s) (D8:E4) [15:22:27:667]: Executing op: FileCopy(SourceName=SETTIN~2.CON|customXML,SourceCabKey=customXML,DestName=customXML,Attributes=16384,FileSize=2633,PerTick=32768,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=16908288,HashOptions=0,HashPart1=-1992414570,HashPart2=1238809189,HashPart3=-80616146,HashPart4=146746036,,)
MSI (s) (D8:E4) [15:22:27:667]: File: c:\WINDOWS\system32\config\systemprofile\Application Data\customXML;
Won't Overwrite; Won't patch;
Existing file is unversioned and unmodified - hash matches source file
Limited user repair log reads:
MSI (s) (78:8C) [15:26:27:406]: Executing op: FileCopy(SourceName=SETTIN~2.CON|customXML,SourceCabKey=customXML,DestName=customXML,Attributes=16384,FileSize=2633,PerTick=32768,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=16908288,HashOptions=0,HashPart1=-1992414570,HashPart2=1238809189,HashPart3=-80616146,HashPart4=146746036,,)
MSI (s) (78:8C) [15:26:27:406]: File: c:\Documents and Settings\test\Application Data\customXML;
To be installed; Won't patch;
No existing file
Your suggestions will be very much appreciated.

Hello,
Did you ever get to the root cause of this?
I have a similar problem with a custom XML that is reported as "empty or is not a xml file." in the logs.
Wondered if you had found the root cause?
Kind regards,
Sio.

ISE 1.2 & AD & Meraki - Per User Group Policy ?

I am working on a PoC for a deployment in an MDU. We are using Meraki switches and access points. There are 250 units in the building, each unit will have it's own subnet. The goal is to have the tenant be able to connect to a common building SSID and be placed into their assigned VLAN. There will also be physical ports in each unit that will need to do the same. I am trying to figure out a way to use ISE to authorize on a per user basis and not based on groups of users. On the Meraki system there are group policies that will assign the VLAN for the user as well as any type of layer 7 firewalling and bandwidth control. So there will be 250 group policies, one for each unit. There is a deployment guide that shows how to setup ISE for use with Meraki and it is great but it assumes that there will be large groups like Employees, Contractors, etc.. that will be used. This is where I'm being tripped up, also... this is my first swing at a NAC deployment so I have a lot to learn.
1.Can I setup each user in Active Directory to have a tag that ISE can then forward on to Meraki for the group policy? Say it's unit 101 and I have a group policy called 101 in Meraki, Meraki documentation says to use the Airespace-ACL-Name attribute in ISE to indicate the group policy to use. This gives me the ability to place a group into that policy but not an individual. Or would this be better done by creating the users in ISE directly? Omit AD entirely?
2. Each unit will have devices that will need MAB because they are not 802.1x compatible. I need to do the same as above with them. I would create a separate SSID for these devices but then use the MAC address to authenticate them but will need to authorize them to go into a specific group policy.
I know this isn't a typical ISE application but I think that this will work really well in the end, just need to iron out these details and get a test system functioning. Any help would be greatly appreciated!!!
Thanks,
Nathan

Please find the Meraki_ISE integration doc. in attachment.
When VLAN tagging is configured per user, multiple users can be associated to the same SSID, but their traffic is tagged with different VLAN IDs. This configuration is achieved by authenticating wireless devices or users against a customer-premise RADIUS server, which can return RADIUS attributes that convey the VLAN ID that should be assigned to a particular user’s traffic.
In order to perform per-user VLAN tagging, a RADIUS server must be used with one of the following settings:
MAC-based access control (no encryption)
WPA2-Enterprise with 802.1x authentication
A per-user VLAN tag can be applied in 3 different ways:
The RADIUS server returns a Tunnel-Private-Group-ID attribute in the Access-Accept message, which specifies the VLAN ID that should be applied to the wireless user. This VLAN ID could override whatever may be configured in the MCC (which could be no VLAN tagging, or a per-SSID VLAN tag). To have this VLAN ID take effect, “RADIUS override” must be set to “RADIUS response can override VLAN tag” under the Configure tab on the Access Control page in the “VLAN setup” section.
The RADIUS server returns a group policy attribute (e.g., Filter-ID) in the Access-Accept message. The group policy attribute specifies a group policy that should be applied to the wireless user, overriding the policy configured on the SSID itself. If the group policy includes a VLAN ID, the group policy’s VLAN ID will be applied to the user.
On the Client Details page, a client can be manually assigned a group policy. If the group policy includes a VLAN ID, the group policy’s VLAN ID will be applied to the user.

Per-user web directory on nss volume

Similar Messages

Maybe you are looking for