Conﬁguring Gateway Server Machines | IBM NFS/DFS Secure Gateway

Chapter 2. Conﬁguring Gateway Server Machines

A Gateway Server machine provides authenticated access to the DFS ﬁlespace to users on NFS clients. You can conﬁgure any machine that is conﬁgured as a DFS client and an NFS server as a Gateway Server. Following successful conﬁguration, the machine provides authenticated access to the DFS ﬁlespace, and it exports the root of the DCE namespace, /..., via NFS.

You can conﬁgure multiple Gateway Server machines to provide DFS access from multiple sources. However, users do not randomly select Gateway Server machines from NFS clients. By default, users on an NFS client contact the Gateway Server machine that exports /... to the client. If you want to balance the load among multiple Gateway Servers, you must conﬁgure your NFS clients so that each client mounts /... on a particular Gateway Server machine. (See “Chapter 3. Conﬁguring NFS Clients to Access DFS” on page 13 for information on conﬁguring NFS clients.)

Depending on how closely you want to control access to the DFS ﬁlespace, conﬁgure your Gateway Server machines in one of the following ways:

vConﬁgure the Gateway Server machines so that users cannot issue the dfs_login command to authenticate to DCE.

This conﬁguration allows system administrators to manage all DCE authentication from the Gateway Server machines. You can allow users to issue the dfsgw add command themselves, or you can limit use of the command to administrators only. To conﬁgure a Gateway Server machine without enabling remote authentication via the dfs_login command, follow the instructions in “Conﬁguring a Gateway Server Without Enabling Remote Authentication” on page 6.

vConﬁgure the Gateway Server machines so that users can issue the dfs_login command to remotely authenticate to DCE.

This conﬁguration allows users of NFS clients to acquire their own DCE credentials from the NFS clients. To conﬁgure a Gateway Server machine and enable remote authentication via the dfs_login command, follow the instructions in “Conﬁguring a Gateway Server and Enabling Remote Authentication” on page 7.

Note: The dfs_login and dfs_logout commands are not provided with DFS; these commands can be used only if they are available from your NFS vendor and have been installed on an NFS client. If these commands are not available, use the dfsgw add and dfsgw delete commands, which work in a similar fashion. See your NFS vendor documentation for the availability and use of the dfs_login and dfs_logout commands.