Clustered Data ONTAP® 8.3 NFS File Access Reference Guide February 2016 | 215-10877_A0 [email protected] Updated for 8.3.2 Table of Contents | 3 Contents Deciding whether to use this guide ............................................................. 8 Considerations before configuring file access ............................................ 9 File protocols that Data ONTAP supports ................................................................... 9 How Data ONTAP controls access to files .................................................................. 9 Authentication-based restrictions .................................................................... 9 File-based restrictions ................................................................................... 10 LIF configuration requirements for file access management .................................... 10 How namespaces and volume junctions affect file access on SVMs with FlexVol volumes ................................................................................................................ 10 What namespaces in SVMs with FlexVol volumes are ................................. 10 Volume junction usage rules ......................................................................... 11 How volume junctions are used in SMB and NFS namespaces .................... 11 What the typical NAS namespace architectures are ...................................... 11 Creating and managing data volumes in NAS namespaces ...................................... 14 Creating data volumes with specified junction points ................................... 14 Creating data volumes without specifying junction points ........................... 15 Mounting or unmounting existing volumes in the NAS namespace ............. 16 Displaying volume mount and junction point information ........................... 17 How security styles affect data access ....................................................................... 18 What the security styles and their effects are ................................................ 18 Where and when to set security styles .......................................................... 19 How to decide on what security style to use on SVMs with FlexVol volumes .................................................................................................... 19 How security style inheritance works ........................................................... 20 How Data ONTAP preserves UNIX permissions .......................................... 20 How to manage UNIX permissions using the Windows Security tab ........... 20 Configuring security styles ........................................................................................ 21 Configuring security styles on SVM root volumes ....................................... 21 Configuring security styles on FlexVol volumes ........................................... 22 Configuring security styles on qtrees ............................................................ 22 NFS and CIFS file naming dependencies ................................................................. 23 Characters a file name can use ...................................................................... 23 Case-sensitivity of a file name ...................................................................... 23 How Data ONTAP creates file names ........................................................... 23 How Data ONTAP handles file names containing UTF-16 supplementary characters ............................................................................................................. 24 Use of hard mounts ................................................................................................... 24 How Data ONTAP supports file access using NFS .................................. 25 How Data ONTAP handles NFS client authentication .............................................. 25 How Data ONTAP uses name services ..................................................................... 25 How Data ONTAP grants CIFS file access from NFS clients .................................. 26 4 | NFS File Access Reference Guide Supported NFS versions and clients .......................................................................... 26 NFSv4.0 functionality supported by Data ONTAP ................................................... 27 Limitations of Data ONTAP support for NFSv4 ....................................................... 27 Data ONTAP support for NFSv4.1 ........................................................................... 28 Data ONTAP support for parallel NFS ..................................................................... 28 Where to find information about NFS support on Infinite Volumes ......................... 28 Process for NFS access to UNIX security style data on SVMs with FlexVol volumes ................................................................................................................ 28 Process for NFS access to NTFS security style data on SVMs with FlexVol volumes ................................................................................................................ 29 Setting up file access using NFS ................................................................ 30 Modifying protocols for SVMs ................................................................................. 30 Creating an NFS server ............................................................................................. 31 Securing NFS access using export policies ............................................................... 33 How export policies control client access to volumes or qtrees .................... 33 Default export policy for SVMs with FlexVol volumes ................................ 33 How export rules work .................................................................................. 34 How to handle clients with an unlisted security type .................................... 35 How security types determine client access levels ........................................ 37 How to handle superuser access requests ...................................................... 38 Creating an export policy .............................................................................. 40 Adding a rule to an export policy .................................................................. 41 Loading netgroups into SVMs ...................................................................... 45 Verifying the status of netgroup definitions .................................................. 47 Setting an export rule's index number ........................................................... 47 Associating an export policy to a FlexVol volume ........................................ 48 Assigning an export policy to a qtree ............................................................ 49 Removing an export policy from a qtree ....................................................... 50 Validating qtree IDs for qtree file operations ................................................ 50 Export policy restrictions and nested junctions for FlexVol volumes ........... 51 Checking client access to exports .................................................................. 51 Using Kerberos with NFS for strong security ........................................................... 52 Data ONTAP support for Kerberos ............................................................... 52 Requirements for configuring Kerberos with NFS ....................................... 52 Configuring NFS Kerberos permitted encryption types ................................ 55 Specifying the user ID domain for NFSv4 .................................................... 56 Creating an NFS Kerberos realm configuration ............................................ 57 Creating an NFS Kerberos configuration ...................................................... 58 Configuring name services ........................................................................................ 59 How Data ONTAP name service switch configuration works ...................... 59 Configuring the name service switch table ................................................... 61 Using LDAP .............................................................................................................. 62 Using LDAP over SSL/TLS to secure communication ................................. 62 Creating a new LDAP client schema ............................................................. 65 Enabling LDAP RFC2307bis support ........................................................... 66 Table of Contents | 5 Configuration options for LDAP directory searches ..................................... 67 Creating an LDAP client configuration ......................................................... 68 Improving performance of LDAP directory netgroup-by-host searches ....... 70 Enabling LDAP on SVMs ............................................................................. 72 Configuring SVMs to use LDAP .................................................................. 73 Creating a NIS domain configuration ....................................................................... 74 Configuring local UNIX users and groups ................................................................ 75 Creating a local UNIX user ........................................................................... 75 Adding a user to a local UNIX group ..........................................................