Individual Paper
Jose Castro Lopez
POS355
March 27, 2014
Vinod Kandanchathanpilli

Individual Paper
Given that you need to support 5000 users, that means that it is most likely a big company or an enterprise you are working for, is doing very well or is well off that it has that many employees. Although most of the UNIX systems depend on the file access control (FAC) scheme that it was originally introduced with, each person who had a login name has a different user identification name or aka user id. Lets take the user name jrcas872 for example. This user name is a member of a primary group, and may also be associated with other groups within the operating system when a file is created within one of the users account, it stamps the users name on that file. So let us say that jrcas872 created a file named “Suicide Prevention”, and jrcas872 was the master account on this system. He only wants a certain 4,990 individuals to access the account, there are two ways someone can go about this. Lets say that jrcas872 has 5000 people in his system, and only wants all but ten to be able to access his file.
Jrcas872 might want to begin by creating a list of names of the 4,990 people he want them to have access to his file. A name list is what it sounds like, a list of names that are authorized to enter and see that one file, make changes and save it. Sort of like a share drive. That is basically the same thing, you have a file that you place on a drive that anyone can access, but only a certain amount of designated people are allowed to use that one file from certain computers that are programmed to be able to use that file. The list of names is called an access control list, and within this list you have a master account that can take a name off or put a name on the list. If your name is not on the access control list, you will not be able to open the file. No matter how many times you try or different ways.
A second method that you can have 4,990 of the users access one single file is to set the users into one giant group, and once you have that you can set the group access. This method is not always a reliable or a recommended way because most systems will not allow them. But if you have a custom system that you can do whatever you want to it, it will be a good second choice for the protection scheme that can be used more effectively for the purpose you need, like securing a file from peeping eyes, than the schemes provided by UNIX.
If jrcas872 wants to give access to the suicide prevention folder to users A, and user B, and also wants to give access to a different file to users B, and user C. First off, we would need two lists and user B would be in both because we want him to have read access to both file A, “Suicide Prevention”, and also file B, “File B”. However, if there is a large amount of users like what we are trying to achieve here, then we would need a large amount of groups. Why? Because users from 1-5000 will all have access to certain files and only 4990 of them have access to “Suicide Prevention”, not including all the lists we would have to make for the thousands of other files that those 5000 users might need access to. Managing these lists can become very difficult and almost near impossible. But to get rid of most of these problems, UNIX uses user access control lists.
I Would suggest that a universal access should be given to all users unless their name is on an access control list with different permissions that the ones needed to access the file they are trying to view. This is a simple, yet safe scheme to use. You put the names of the remaining ten users on an access control list the rest of the 4990, but you do not give the ten privilege to access the files that the other 4990 can.