🚀 go-pugleaf

In article <1k3lgmINNq80@menudo.uh.edu> sears@uh.edu writes:
>If there is not a "root" account on a level in the Netinfo structure, then  
>that level can only be modified on the machine that serves it.

True.  The problem turned out to be many uid 0 accounts (a field account set
up for class use, and somehow sundiag and sysdiag got there too....).
Getting rid of all the other uid 0 accounts solved the problem.  Jeff Kight
suggested the fix.

>The root users in these domains can have different passwords if  
>you like and can make for added security since you will have to supply a  
>password to make any changes to that particular domain.  This would me  
>that if someone got root on your server, they would only be able to screw  
>with the local netinfo domain on that server (unless all your root  
>passwords in Netinfo are the same!)...

Um, not quite.  Root on the local machine can modify whatever it wishes on
that machine.  NetInfo checks the incoming port number, and if it's less than
1024, it's considered trusted.  If you are not root, yes, you need to enter
the appropriate root password (with niutil -p or the NetInfo authentication
panel with the GUIs).

>I would suggest that you use trusted_networks.  Otherwise anyone can snarf  
>any of your netinfo data by using tags.

Normally I would but these are on their own network, with no connection to
anything else.

>Paul S. Sears
------
Mike Matthews, matthews@oberon.umd.edu (NeXTmail accepted)
------
"A fractal is by definition a set for which the Hausdorff Besicovitch
dimension strictly exceeds the topological dimension."
-- Mandelbrot, _The Fractal Geometry of Nature_