All links of one day
in a single page.
<Previous day - Next day>

rss_feedDaily RSS Feed
floral_left The Daily Shaarli floral_right
——————————— June 12, 2017 - Monday 12, June 2017 ———————————
nfs - mount -

Il faut utiliser l'option noresvport de mount pour que mount n'utilise pas des ports sources inférieur à 1024

Why do you have to? Tradition, mostly. Once upon a time, restricting NFS to privileged ports (<1023) was considered a security measure. Back when people were using mainframe computers, this made sure that the NFS software on the client side was part of the OS/approved by the administrator, since a program can only use a privileged port if it's run by the root user. Today, this makes no sense because anyone can own a computer and have root access, so this doesn't mean anything in terms of security.

By default, many NFS servers don't allow non-privileged source ports. Some NFS clients (such as Ubuntu's), default to using a privileged source port unless otherwise specified, which is why your Linux client works without issue. Clearly, the OS X client doesn't do this. I don't know if that was an Apple design choice or something inherited from BSD. I know that Solaris also defaults to a non-privileged port.

The two ways of avoiding this problem are, telling the OS X client to use a privileged port, as you discovered, or configuring your NFS server to allow non-privileged ports (look it up in your server's documentation).

How do you get OS X to use a privileged port using a GUI? As far as I know, you can't on versions > 10.6. One used to be able to mount NFS shares in Disk Utility and type in extra options, but that was removed. (details) It was never a simple button or anything. NFS is hardly something most of the "non-techy" crowd need, so I guess it wasn't a priority and there are reasons routinely using privileged ports isn't a great idea.

I haven't tried it, but http://www.bresink.com/osx/NFSManager.html seems to allow configuration of OS X's NFS features without the command line.

s3 - cross - iam - aws - policy -
Donc pour autoriser un compte externe, on va créer une bucket policy sur notre bucket pour autoriser "arn:aws:iam::account_id:root" ou plus précis sur l'user arn:aws:iam::account_id:user/foobar ou le role

C'est le compte en face qui va décider qui a le droit de venir sur notre bucket avec des user policy standard (quand on est dans le contexte du compte en face, c'est comme si le bucket nous appartenait)

Exemple bucket policy à mettre sur le BUCKET de l'account A pour autoriser l'account xxx en RW


{
    "Version": "2012-10-17",
    "Statement": [





        {
            "Sid": "Allow account_xx on aws account xxx RW",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::OTHER_ACCOUNT_ID:root"
            },
            "Action": ["s3:GetBucketLocation", "s3:ListBucket"],
            "Resource": "arn:aws:s3:::BUCKET"
        },
        {
            "Sid": "Allow account_xx on aws account xxx RW",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::OTHER_ACCOUNT_ID:root"
            },
            "Action": [
                "s3:*"
            ],
            "Resource": "arn:aws:s3:::BUCKET/*"
        }




    ]
}

Pour Read only, remplacer action du deuxieme bloc par "Action": ["s3:Get*","s3:List*"],
-