Updated for 8.3.1 Clustered Data ONTAP® 8.3 File Access Management Guide for CIFS NetApp, Inc. Telephone: +1 (408) 822-6000 Part number: 215-10104_A0 495 East Java Drive Fax: +1 (408) 822-4501 June 2015 Sunnyvale, CA 94089 Support telephone: +1 (888) 463-8277 U.S. Web: www.netapp.com Feedback: [email protected] Table of Contents | 3 Contents Understanding SMB file access with Data ONTAP ................................. 15 How namespaces and volume junctions affect SMB access on SVMs with FlexVol volumes .................................................................................................. 15 What namespaces in SVMs with FlexVol volumes are ................................. 15 Volume junction usage rules ......................................................................... 15 How volume junctions are used in SMB and NFS namespaces .................... 16 What the typical NAS namespace architectures are ...................................... 16 LIF configuration requirements for file access management .................................... 19 How security styles affect data access ....................................................................... 20 What the security styles and their effects are ................................................ 20 Where and when to set security styles .......................................................... 21 How to decide on what security style to use on SVMs with FlexVol volumes .................................................................................................... 21 How security style inheritance works ........................................................... 21 How authentication provides SMB access security .................................................. 22 Kerberos authentication ................................................................................. 22 NTLM authentication .................................................................................... 23 How name mapping is used to secure SMB file access on SVMs with FlexVol volumes ................................................................................................................ 23 How name mapping works ............................................................................ 23 How Data ONTAP secures file and directory access ................................................ 24 Role that export policies play with SMB access ....................................................... 24 Very large CIFS configuration changes might take some time to finish ................... 25 Configuring and managing Active Directory computer accounts for SVMs (no CIFS license) ........................................................................ 26 How to choose whether to create a CIFS server or an Active Directory computer account ................................................................................................................. 26 Managing Active Directory computer accounts ........................................................ 27 Creating Active Directory computer accounts for SVMs ............................. 27 Changing the Active Directory domain to which the SVM computer account is associated ................................................................................ 28 Displaying information about Active Directory computer accounts for SVMs ....................................................................................................... 30 Deleting Active Directory computer accounts for SVMs ............................. 30 Changing or resetting Active Directory computer account passwords for SVMs ....................................................................................................... 31 Managing domain controller connections for Active Directory computer accounts ............................................................................................................... 32 Displaying information about discovered Active Directory servers for SVMs ....................................................................................................... 32 Resetting and rediscovering Active Directory servers .................................. 33 4 | File Access Management Guide for CIFS Adding or removing preferred domain controllers ....................................... 34 Displaying information about preferred domain controllers ......................... 35 Setting up CIFS servers ............................................................................. 36 How to choose whether to create a CIFS server or an Active Directory computer account ................................................................................................................. 36 Supported SMB clients and domain controllers ........................................................ 37 Unsupported Windows features ................................................................................ 37 Prerequisites for CIFS server setup ........................................................................... 37 Planning the CIFS server configuration .................................................................... 38 Information to gather before configuring time services ................................ 38 Information to gather before creating the IPspace, broadcast domain, and subnet configuration ......................................................................... 39 Information to gather before configuring the SVM ...................................... 42 Information to gather before creating data LIFs on the SVM ....................... 44 Information to gather before configuring name services .............................. 45 Information to gather before creating the CIFS server .................................. 49 Setting up the CIFS server ........................................................................................ 50 Configuring time services (cluster administrators only) ............................... 52 Creating an IPspace for the SVM (cluster administrators only) ................... 52 Determining which ports can be used for a new broadcast domain (cluster administrators only) .................................................................... 53 Removing ports from an existing broadcast domain prior to adding them to the new broadcast domain (cluster administrators only) ..................... 55 Creating a broadcast domain for the IPspace (cluster administrators only) ......................................................................................................... 56 Creating a subnet for the IPspace (cluster administrators only) .................... 57 Creating an SVM with FlexVol volumes for the CIFS server (cluster administrators only) ................................................................................. 59 Creating LIFs on the SVM (cluster administrators only) .............................. 61 Configuring DNS services for the SVM ....................................................... 63 Configuring dynamic DNS on the SVM ....................................................... 64 Creating a CIFS server .................................................................................. 65 Configuring NIS or LDAP name services on the SVM ................................ 67 Where to find information about SMB support on Infinite Volumes ........................ 69 Managing CIFS servers ............................................................................. 70 Using options to customize CIFS servers ................................................................. 70 Available CIFS server options ....................................................................... 70 Configuring CIFS server options .................................................................. 74 Configuring access restrictions for anonymous users ................................... 74 Managing how file security is presented to SMB clients for UNIX security-style data .................................................................................... 75 How to control automatic DFS advertisements in clustered Data ONTAP with a CIFS server option ........................................................................ 77 Managing whether the CIFS server automatically advertises DFS capabilities ............................................................................................... 78 Table of Contents | 5 Managing CIFS server security settings .................................................................... 79 Important considerations about CIFS server security settings in an SVM disaster recovery configuration ................................................................ 79 Displaying information about CIFS server security settings ........................ 79 Enabling or disabling required password complexity for local SMB users ......................................................................................................... 80 Modifying the CIFS server Kerberos security settings ................................. 81 Setting the CIFS server minimum authentication security level ................... 83 Configuring strong security for Kerberos-based communication by using AES encryption ....................................................................................... 83 Using SMB signing to enhance network security ......................................... 85 Configuring required SMB encryption on CIFS servers for data transfers over SMB ................................................................................................