Presentation on theme: "Guide to Operating Systems, 4th ed."— Presentation transcript:
1Guide to Operating Systems, 4th ed. Chapter 10: Resource Sharing over a Network
2ObjectivesExplain the principles behind sharing disks, files, and printers on a networkSet up accounts, groups, security, and disk and file sharing on network server operating systemsSet up disk and file sharing on client (workstation) operating systemsSet up printer sharing on server and client operating systemsDiscuss how network and Internet servers are used for vast information-sharing networksGuide to Operating Systems, 4th ed.2
3Sharing Disks, Files, and Printers Sharing files was one of the first reasons to network computersNetwork OSs were available at the start of the 1980’s to share files through a server. There were two methods:By downloading a file from a file server to a workstationPurchasing third-party software to create a special shared drive for other workstations to access over a networkMapping – software process that enables a client workstation to attach to a shared drive and assign it a drive letterIn UNIX/Linux and Mac OS X a mapped drive is called a mounted volumeGuide to Operating Systems, 4th ed.
4Securing Shared Resources Sharing disks, files and printers is a potential security risk (possible for non-authorized users to access a file or use a printer)All OSs discussed in this book offer security measures for protecting shared resourcesAccess to a file can be denied to unauthorized usersYou may want a user to be able to read a file but not change itSecurity privileges can be used to limit users to only those capabilitiesAccess to a shared network printer can be given only to a specific group of peoplePermission to manage print jobs can be assigned on a user by user basis (only those who are qualified to do so)Guide to Operating Systems, 4th ed.
5Sharing Disks and Files through Server Network Operating Systems Windows Server 2003/R2 and Server 2008/R2, UNIX/Linux, and Mac OS X are examples of server network operating systemsEnables the network administrator to establish security through techniques such as:Assigning accountsAccount passwordsCreating groupsAccess privilegesGuide to Operating Systems, 4th ed.
6Windows Server 2003/Server 2003 R2 and Server 2008/Server 2008 R2 The steps involved in sharing resources over a network include setting up the following:GroupsAccount policiesUser accountsPermissionsShared disks and foldersGroup – a collection of computers and usersReduce the amount of work of managing user accounts and securitySettings can be created for each group and applied to all computers and users in that group instead of applying the settings at one timeGuide to Operating Systems, 4th ed.
7Windows Server 2003/Server 2003 R2 and Server 2008/Server 2008 R2 The following types of groups can be used in all Windows Server 2003/Server 2008 OSs:Local – used on servers that are not part of a domainDomain local – used when there is a single domain or to manage resources in a particular domain so that global and universal groups can access those resourcesGlobal – used to group accounts from the same domain so that those accounts can access resources in the same and other domainsUniversal – used to provide access to resources in any domain within a forestAll of these groups are also defined as security or distribution groupsGuide to Operating Systems, 4th ed.
8Windows Server 2003/Server 2003 R2 and Server 2008/Server 2008 R2 Security groups – used to enable access to resources on a standalone server or in Active DirectoryActive Directory is a database of computers, users, shared printers, shared folders, and other network resources that are used to manage a networkDistribution groups – used for or telephone lists, to provide quick, mass distribution of informationIn a small office setting, Active Directory may not be installed so only local groups can be created to manage accessGuide to Operating Systems, 4th ed.
9Windows Server 2003/Server 2003 R2 and Server 2008/Server 2008 R2 Container object – an entity that is used to group together resources in a directory serviceDirectory service – provides 3 important functions:central listing of resourcesa way to quickly find resourcesthe ability to access and manage resourcesDomain – fundamental component or container that holds information about all network resources that are grouped within itTree – consists of one or more domainsForest – houses one or more treesGuide to Operating Systems, 4th ed.
10Windows Server 2003/Server 2003 R2 and Server 2008/Server 2008 R2 Sample Windows Server domain and tree modelsGuide to Operating Systems, 4th ed.
11Windows Server 2003/Server 2003 R2 and Server 2008/Server 2008 R2 Example of working with groups:College – has a domain for:StudentsFaculty and staffResearch organizations associated with the collegeCollege’s executive council – needs access to all 3 domainsCreate a domain local group called LocalExec in each domainGive that group access to files, folders and other resourceNext, create a GlobalExec global group in the faculty and staff domain that has the executive council as membersMake that global group a member of all LocalExec groupsSee figure on next slideGuide to Operating Systems, 4th ed.
12Windows Server 2003/Server 2003 R2 and Server 2008/Server 2008 R2 Managing security through domain local and global groupsGuide to Operating Systems, 4th ed.
13Windows Server 2003/Server 2003 R2 and Server 2008/Server 2008 R2 Guidelines to help simplify how to use groups:Use global groups to hold user accounts as membersGive members access to resources by making the global group members of domain local or universal groups (or both)Use domain local groups to provide access to resources in a specific domainAvoid placing user accounts in domain local groups – give domain local groups access to shared folders and printersUse universal groups to provide extensive access to resourcesTo simplify access when there are multiple domainsGive universal groups access to resources in any domain, tree or forestManage user account access by placing accounts in global groups and join those groups to domain local or universal groupsGuide to Operating Systems, 4th ed.
14Windows Server 2003/Server 2003 R2 and Server 2008/Server 2008 R2 Trusted domain – is given access to resources in another domainTrusting domain – allows the access to its resourcesA mutual relationship of trust between domain, managed by an Active Directory administrator or a security specialistGuide to Operating Systems, 4th ed.
15Windows Server 2003/Server 2003 R2 and Server 2008/Server 2008 R2 Account Policies – used to set restrictions and security to help ensure that only authorized users are accessing the accountsParameters you can configure through Account Policies:Password PolicyAccount Lockout PolicyKerberos PolicyAccount policies should be configured before setting up user accountsGuide to Operating Systems, 4th ed.
16Windows Server 2003/Server 2003 R2 and Server 2008/Server 2008 R2 Password security enables you to set requirements for how users set passwordsSome password security optionsEnforce password history – users must choose new passwords and cannot use previously used passwordsMaximum password age – set a maximum time allowed until a password expiresMinimum password age – password must be used a minimum amount of time before being changedMinimum password lengthPasswords must meet complexity requirements – create a filter of customized password requirementsStore password using reversible encryptionGuide to Operating Systems, 4th ed.
17Windows Server 2003/Server 2003 R2 and Server 2008/Server 2008 R2 Account lockout – ability to lock out an account after a number of unsuccessful tries to loginSome lockout parameters that can be configured:Account lockout duration – specify in minutes how long the system will keep an account locked out after reaching the specified number of unsuccessful logon attemptsAccount lockout threshold – set a limit to the number of unsuccessful attempts to log onto an accountReset account lockout count after – specify the number of minutes between two consecutive unsuccessful logon attempts to make sure that the account will not be lockout out too soonGuide to Operating Systems, 4th ed.
18Windows Server 2003/Server 2003 R2 and Server 2008/Server 2008 R2 Kerberos security – tickets are exchanged between the client who requests logon and the server that grants accessKerberos configuration options:Enforce user logon restrictions – turns on Kerberos securityMaximum lifetime for a service ticketMaximum lifetime for a user ticketMaximum lifetime for user ticket renewal – maximum # of days the same Kerberos ticket can be renewed each time a user logs onMaximum tolerance for computer clock synchronization – how long a client will wait until synchronizing its clock with that of a server or Active DirectoryGuide to Operating Systems, 4th ed.
19Windows Server 2003/Server 2003 R2 and Server 2008/Server 2008 R2 Configuring User Accounts – to be performed after account policies have been configuredWhen Active Directory is not installed:A user account is created by right-clicking My Computer, Manage, and then click on Local Users and GroupsWhen Active Directory is installed:Use the Active Directory Users and Computers tool to create a new accountHands-on Project 10-4 enables you to create an accountAfter creating users, they are typically added to global groupsGuide to Operating Systems, 4th ed.
20Windows Server 2003/Server 2003 R2 and Server 2008/Server 2008 R2 Configuring Access Privileges (Permissions) – enable you to protect the contents of files and foldersPermissions are set by clicking on Properties (Security Tab) for the file or folder you wish to set access toPermissions from a higher-level folder can be automatically inherited. This is the default setting.See Table 10-1 on the next slide for some of the permissions available for files and folders in Windows Server 2003/R2 and Server 2008/R2Guide to Operating Systems, 4th ed.
21Windows Server 2003/Server 2003 R2 and Server 2008/Server 2008 R2 Guide to Operating Systems, 4th ed.
22Windows Server 2003/Server 2003 R2 and Server 2008/Server 2008 R2 Configuring Shared Disks and FoldersA drive or folder is shared through its propertiesWhen choosing to share a driver or folder you must provide a name for the share and configure how many people can access the share at the same timeAvailable share permissions:Full Control – Provides full access to the folder including the ability to take control or change share permissionsRead – Permits groups or users to read and execute filesChange – Enables users to read, add, modify, execute, and delete filesYou can also setup Web sharing, which makes files available on a Web server for HTML or FTP accessMust have Internet Information Services (IIS) installedGuide to Operating Systems, 4th ed.
23Windows Server 2003/Server 2003 R2 and Server 2008/Server 2008 R2 Web sharing access permissionsGuide to Operating Systems, 4th ed.
24Windows Server 2003/Server 2003 R2 and Server 2008/Server 2008 R2 NTFS permission conflictsIf a user account has Read permission for a folder and belongs to a group that has Write permission, that user has both Read and Write permissionsThe exception is Deny – If a user who has Read permission of a folder but belongs to a group for which all permissions are denied to that folder, the user does not have access to the folderSummary of permission rules:NTFS permissions are cumulative with the exception that if an account or group is denied access, this overrides other permissionsWhen a folder has both NTFS and share permissions, the most restrictive permissions applyGuide to Operating Systems, 4th ed.
25Windows Server 2003/Server 2003 R2 and Server 2008/Server 2008 R2 When a file or folder is created, copied, or moved, the permissions can be affected:A newly created file inherits the permissions already set up in a folderA file that is copied from one folder to another on the same volume inherits the permissions of the folder to which it is copiedA file or folder moved from one folder to another on the same volume takes its permissions with itA file or folder that is moved/copied to a different volume inherits the permissions of the folder to which it is moved/copiedA file or folder that is moved/copied from a FAT volume to a folder in an NTFS volume inherits the permissions already assigned in the NTFS folderGuide to Operating Systems, 4th ed.
26UNIX and LinuxEach user account is associated with a user identification number (UID)Users who have common access needs can be assigned to a group via a group identification number (GID)Then permissions to access resources are assigned to the group, instead of each userWhen a user logs on to access resources, the password file is checked to permit logon authorizationGuide to Operating Systems, 4th ed.
27UNIX and Linux The password file contains: The user name An encrypted password or a reference to a shadow file (file associated with the password file that makes it difficult for intruders to determine the passwords of others)The UID, can be a number as large as 60,000The GID, which is the primary group idInformation about the user, such as a description of the user’s jobThe location of the user’s home directory (a work area for the user to store data on the server)A command that is executed as the user logs on, such as which shell to useGuide to Operating Systems, 4th ed.
28UNIX and LinuxThe shadow file (/etc/shadow) is normally only available to the system administratorContains password restriction information that includes:The minimum and maximum number of days between password changesInformation on when the password was last changedWarning information about when a password will expireAmount of time that the account can be inactive before access is prohibitedGuide to Operating Systems, 4th ed.
29UNIX and LinuxInformation about groups is stored in the etc/group fileTypically contains an entry for each group consisting of the name, an encrypted group password, the GID, and a list of group membersIn some versions of UNIX/Linux, every account is assigned to at least one groupUser accounts and groups can be created by editing the password, shadow, and group filesOr by entering UNIX/Linux commands (recommended way)Important to make sure that each group has a unique GIDGuide to Operating Systems, 4th ed.
30UNIX and Linux The useradd command enables you to create a new user See page 509 for a list of some of the parameters that can be used with this commandExample:useradd –c “Lisa Ramirez, Accounting Department, ext 221” –p green$thumb –u 700 lramirezThis command creates an account called lramirez with a comment that includes personal information, a password set to green$thumb, and a UID equal to 700Useradd, usermod, and userdel generally work in all versions of UNIX/LinuxExcept IBM’s AIX which uses mkuser, chuser, and rmuserGuide to Operating Systems, 4th ed.
31UNIX and Linux Groups are created using the groupadd command -g parameter is used to establish the GID and the group string creates a group nameExample – to create the auditors group:groupadd –g 2000 auditorsOnce a group is created, it is modified through the groupmod commandGroups are deleted using the groupdel commandGuide to Operating Systems, 4th ed.
32UNIX and Linux Files are assigned any combination of 3 permissions: Read – enables the user to display its contents (signified by the letter r)Write – ability to modify, save, and delete a file (signified by the letter w)Execute – enables a user or group of users to run a program (signified by the letter x)Permissions are granted on the basis of 4 criteria:OwnershipGroup membershipOther (or World)All (All is not used in every version of UNIX/Linux)Guide to Operating Systems, 4th ed.
33UNIX and Linux The owner of a file or directory typically has: all permissionscan assign permissionshas the designation of uGroup members (g) – users who may have a complete set of permissions, one permission, or a combination of two (such as read and execute)Other (o) – consists of non-owners who represent generic usersAll (a) – represents the combination of u + g + oGuide to Operating Systems, 4th ed.
34UNIX and Linux Permissions are set up by using the chmod In the command chmod go -r-w-x * (used on all files – signified by the * )The g signifies groups and o signifies othersThe – means to remove a permissionThe -r-w-x signifies removing the read, write, and execute permissionsIn this example, only the owner and members of the owner’s group are left with read, write, and execute permissions on the files in this directoryHands-On Project offers practice configuring permissions in UNIX/LinuxGuide to Operating Systems, 4th ed.
35Mac OS X ServerBuilt on the foundation of Mac OS X but is designed as a true serverA computer running Mac OS X Server can support up to several thousand usersMight deploy this OS Server in a company that creates publications or advertising materials or in a school laboratoryMac OS X Server includes Apache Web server softwarePermissions are similar to those for UNIX/LinuxGuide to Operating Systems, 4th ed.
36Mac OS X Server Mac OS X Server supports TCP/IP Opens door to communication with other computers that use TCP/IPCompatible with the Internet protocol Simple Mail Transfer Protocol (SMTP)Server Admin tool – used to:Create and manage accounts and groupsManage file and print sharingEstablishes share points (shared resources on the server)Log events such as login and logout, opening, creating, and deleting files and foldersMonitor/create print queuesHold, release, and delete print jobsGuide to Operating Systems, 4th ed.
37Accessing and Sharing Resources in Windows XP/Server 2003/R2 Click the Start menu, right click My Computer, and click Map Network DriveClick the Browser buttonFind the workgroup, domain, or other entity in which the computer sharing the drive resides, click itClick the folder that you want to access, click OKSet the Drive letter to which you want to map the network driveClick FinishGuide to Operating Systems, 4th ed.
38Accessing and Sharing Resources in Windows XP/Server 2003/R2 Configuring a shared folder in Windows XPGuide to Operating Systems, 4th ed.
39Accessing and Sharing Resources in Windows Vista/7/Server 2008/R2 Click the Start menu, click Computer, and click Map network driveSet the drive letter to which you want to map the network driveClick the Browse buttonFind the workgroup, domain, or other entity in which the computer sharing the drive resides, click itClick the folder you want to access, click OKCheck the Reconnect at Login box if you want the mapping to be there after a rebootClick Finished when doneGuide to Operating Systems, 4th ed.
40Accessing and Sharing Resources in Windows Vista/7/Server 2008/R2 Mapping a drive in Windows 7Guide to Operating Systems, 4th ed.
41Accessing Shared Resources via UNIX/Linux and Specialized Utilities UNIX/Linux enable resource sharing by using Network File System (NFS)NFS enables one computer to mount a partition on another computer and then access file systems on the mounted partition as if they were localTo use NFS in Red Hat Enterprise Linux, the following services must be enabled:portmap – establishes and manages the remote connections through designated User Datagram Protocol (UDP) portsrpc.mounted – handles the RPC request to mount a partitionrpc.nfsd – enables the Linux kernel to manage specific requests from a clientGuide to Operating Systems, 4th ed.
42Accessing Shared Resources via UNIX/Linux and Specialized Utilities Security that controls which clients can use NFS is handled through entries in two files:/etc/hosts.allow – contains the clients that are allowed to use NFS/etc/hosts.deny – contains computers that are not allowed to use NFSSamba – utility that uses the Server Message Block (SMB) protocol to allow access to shared Windows drivesGuide to Operating Systems, 4th ed.
43Accessing and Sharing Resources via Mac OS Uses Samba to connect to another computer that is sharing a disk or folderTo mount a shared drive:Open the Go menu, select Connect to Server, and enter the address of the server or use the Browse button to find itConnect to Server dialog box in Mac OS XGuide to Operating Systems, 4th ed.
44Accessing and Sharing Resources via Mac OS In Mac OS X – turn on file sharing through System PreferencesSome of the resources that you can configure for sharing:File Sharing – To share folders with other Mac OS X computersWeb Sharing – To share information on the WebRemote Login – To allow another computer to remotely log into your computerRemote Apple Events – So that other Mac OS X computers can send events to this computerPrinter Sharing – To enable others to use your computer’s printerGuide to Operating Systems, 4th ed.
45Sharing Printing Devices Windows Systems – once a printer is setup, it can be configured for printer sharing through PropertiesDifferent Windows versions have different steps in order to share a printerWhen you configure sharing, make sure you configure share permissions for the shared printerThe following are share permissions you will see:Print – Can send print jobs and manage your own jobsManage Documents – Can manage your print jobs or those sent by any other userManage Printers – Can access the share, change share permissions, turn off sharing, configure printer propertiesSpecial Permissions – shows whether special permissions are configured, and if they are allowed or deniedGuide to Operating Systems, 4th ed.
46Sharing Printing Devices UNIX/Linux printing is essentially the process of logging onto the UNIX/Linux server and printing to one of its printersUses Berkeley Software Distribution (BSD) spooling systemBSD uses 3 components for printinglpr print programlpd daemonThe file /etc/printcap to specify printer properties (a text file that can be modified via a text editor)In Red Hat Enterprise Linux or Fedora – use the GNOME Print Manager toolGuide to Operating Systems, 4th ed.
47Sharing Printing Devices In Mac OS X Systems there are 2 ways to set up printer sharingFirst method:Open System Preferences from the Dock or by clicking Go, clicking Applications, and double-clicking System PreferencesDouble-click SharingCheck the box for Printer SharingClose the Sharing WindowSecond method:Open System Preferences from the Dock or by clicking Go, clicking Applications, and double-click System PreferencesDouble-click Print & FaxCheck the box for Share my printers with other computers and close the windowGuide to Operating Systems, 4th ed.
48Sharing Printing Devices Accessing a shared printer via Mac OS XGuide to Operating Systems, 4th ed.
49Network and Internet Resource Servers UNIX/Linux, Windows, and Mac OS X servers can be set up as resource servers to provide network and Internet resourcesserversE-commerceVideoconferencingMultimediaInstant messagingAlerts for weather and security-related activitiesWeb serversIntranet and virtual private network (VPN) serversFTP serversGuide to Operating Systems, 4th ed.
50Chapter SummaryResource sharing is why networks exist starting with sharing files, which led to sharing disks and folders, which led to printing and program servicesWhenever network resources such as folder and printers are shared, it is important to secure these resources to make sure that only authorized users can access themWhen you configure Windows resources, the process typically involves creating security groups for easier management, establishing account policies and user accounts, setting permissions on the resources, and configuring sharing of the resourcesUNIX/Linux systems also use groups, user accounts, and permissions to enable resource access and securityGuide to Operating Systems, 4th ed.
51Chapter SummaryMac OS X Server is a server version of Mac OS X for providing more extensive access to resources through user accounts and sharing servicesClient operating systems – such as Windows, UNIX/Linux, and Mac OS X – come with utilities to enable them to access shared resources over a network and to offer resources to shareAll of the OSs discussed in this book offer the ability to share printers and to access printers that are shared through a networkNetwork server OSs continue to offer more and more ways to share resources such as , e-commerce, videoconferencing, multimedia distribution, and database accessGuide to Operating Systems, 4th ed.