Updated for 8.3.1 Clustered Data ONTAP® 8.3 File Access Management Guide for NFS NetApp, Inc. Telephone: +1 (408) 822-6000 Part number: 215-10105_A0 495 East Java Drive Fax: +1 (408) 822-4501 June 2015 Sunnyvale, CA 94089 Support telephone: +1 (888) 463-8277 U.S. Web: www.netapp.com Feedback: [email protected] Table of Contents | 3 Contents Considerations before configuring file access .......................................... 10 File protocols that Data ONTAP supports ................................................................. 10 How Data ONTAP controls access to files ................................................................ 10 Authentication-based restrictions .................................................................. 10 File-based restrictions ................................................................................... 11 LIF configuration requirements for file access management .................................... 11 How namespaces and volume junctions affect file access on SVMs with FlexVol volumes ................................................................................................................ 11 What namespaces in SVMs with FlexVol volumes are ................................. 11 Volume junction usage rules ......................................................................... 12 How volume junctions are used in SMB and NFS namespaces .................... 12 What the typical NAS namespace architectures are ...................................... 12 Creating and managing data volumes in NAS namespaces ...................................... 15 Creating data volumes with specified junction points ................................... 15 Creating data volumes without specifying junction points ........................... 16 Mounting or unmounting existing volumes in the NAS namespace ............. 17 Displaying volume mount and junction point information ........................... 18 How security styles affect data access ....................................................................... 19 What the security styles and their effects are ................................................ 19 Where and when to set security styles .......................................................... 20 How to decide on what security style to use on SVMs with FlexVol volumes .................................................................................................... 20 How security style inheritance works ........................................................... 21 How Data ONTAP preserves UNIX permissions .......................................... 21 How to manage UNIX permissions using the Windows Security tab ........... 21 Configuring security styles ........................................................................................ 22 Configuring security styles on SVM root volumes ....................................... 22 Configuring security styles on FlexVol volumes ........................................... 23 Configuring security styles on qtrees ............................................................ 23 NFS and CIFS file naming dependencies ................................................................. 24 Characters a file name can use ...................................................................... 24 Case-sensitivity of a file name ...................................................................... 24 How Data ONTAP creates file names ........................................................... 24 How Data ONTAP handles file names containing UTF-16 supplementary characters ............................................................................................................. 25 Use of hard mounts ................................................................................................... 25 How Data ONTAP supports file access using NFS .................................. 26 How Data ONTAP handles NFS client authentication .............................................. 26 How Data ONTAP uses name services ..................................................................... 26 How Data ONTAP grants CIFS file access from NFS clients .................................. 27 Supported NFS versions and clients .......................................................................... 27 4 | File Access Management Guide for NFS NFSv4.0 functionality supported by Data ONTAP ................................................... 28 Limitations of Data ONTAP support for NFSv4 ....................................................... 28 Data ONTAP support for NFSv4.1 ........................................................................... 29 Data ONTAP support for parallel NFS ..................................................................... 29 Where to find information about NFS support on Infinite Volumes ......................... 29 Process for NFS access to UNIX security style data on SVMs with FlexVol volumes ................................................................................................................ 29 Process for NFS access to NTFS security style data on SVMs with FlexVol volumes ................................................................................................................ 30 Setting up file access using NFS ................................................................ 31 Modifying protocols for SVMs ................................................................................. 31 Creating an NFS server ............................................................................................. 32 Securing NFS access using export policies ............................................................... 32 How export policies control client access to volumes or qtrees .................... 33 Default export policy for SVMs with FlexVol volumes ................................ 33 How export rules work .................................................................................. 33 How to handle clients with an unlisted security type .................................... 35 How security types determine client access levels ........................................ 36 How to handle superuser access requests ...................................................... 38 Creating an export policy .............................................................................. 40 Adding a rule to an export policy .................................................................. 40 Loading netgroups into SVMs ...................................................................... 43 Verifying the status of netgroup definitions .................................................. 44 Setting an export rule's index number ........................................................... 45 Associating an export policy to a FlexVol volume ........................................ 46 Assigning an export policy to a qtree ............................................................ 47 Removing an export policy from a qtree ....................................................... 48 Validating qtree IDs for qtree file operations ................................................ 48 Export policy restrictions and nested junctions for FlexVol volumes ........... 49 Checking client access to exports .................................................................. 49 Using Kerberos with NFS for strong security ........................................................... 50 Data ONTAP support for Kerberos ............................................................... 50 Requirements for configuring Kerberos with NFS ....................................... 50 Configuring NFS Kerberos permitted encryption types ................................ 53 Specifying the user ID domain for NFSv4 .................................................... 54 Creating an NFS Kerberos realm configuration ............................................ 55 Creating an NFS Kerberos configuration ...................................................... 56 Configuring name services ........................................................................................ 57 How Data ONTAP name service switch configuration works ...................... 57 Configuring the name service switch table ................................................... 59 Using LDAP .............................................................................................................. 60 Using LDAP over SSL/TLS to secure communication ................................. 60 Creating a new LDAP client schema ............................................................. 62 Enabling LDAP RFC2307bis support ........................................................... 63 Configuration options for LDAP directory searches ..................................... 64 Table of Contents | 5 Creating an LDAP client configuration ......................................................... 65 Improving performance of LDAP directory netgroup-by-host searches ....... 67 Enabling LDAP on SVMs ............................................................................. 68 Configuring SVMs to use LDAP .................................................................. 69 Creating a NIS domain configuration ....................................................................... 70 Configuring local UNIX users and groups ................................................................ 71 Creating a local UNIX user ........................................................................... 71 Adding