HP DL160 HP ProLiant Storage Server User Guide (440584-004, February 2008) - Page 102

Server for NFS Authentication DLL versus Service for User for Active Directory domain controllers

Get HP DL160 - ProLiant - G5 PDF manuals and user guides
UPC - 883585847174
View all HP DL160 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 102 highlights

UNIX computers follow advisory locking for all lock requests. This means that the operating system does not enforce lock semantics on a file, and applications that check for the existence of locks can use these locks effectively. However, Server for NFS implements mandatory locks even for those locking requests that are received through NFS. This ensures that locks acquired through NFS are visible through the server message block (SMB) protocol and to applications accessing the files locally. Mandatory locks are enforced by the operating system. Server for NFS Authentication DLL versus Service for User for Active Directory domain controllers On a Windows Storage Server 2003 R2 storage server, Server for NFS depends on a domain controller feature called Service for User (S4U) to authenticate UNIX users as their corresponding Windows users. Windows Server operating systems prior to Windows Server 2003 and Windows Storage Server 2003 do not support S4U. Also, in mixed domain environments, legacy Services for UNIX (SFU), Services for NFS and Windows Storage Server 2003 NFS deployments do not use the S4U feature and still depend on the Server for NFS Authentication DLL being installed on domain controllers. Therefore, the administrator needs to install the Server for NFS Authentication DLL on Windows 2000 domain controllers when: • The NFS file serving environment uses previous NFS releases (NAS, SFU, and so on). • The Windows domain environment uses pre-2003 domain controllers. See Table 21 for guidance as to when to use NFS Authentication DLL instead of S4U legacy NFS and R2 MSNFS. Table 21 Authentication table Domain controller type Legacy NFS (pre-WSS2003 R2) MSNFS (WSS2003 R2) Legacy domain controller Requires NFS Authentication Requires NFS Authentication DLL on domain (pre-WSS2003) DLL on domain controller controller Recent domain controllers (WSS2003 and later) Requires NFS Authentication DLL on domain controller Uses the built-in S4U (on the domain controller). It is unaffected by the NFS Authentication DLL on the domain controller. The S4U set of extensions to the Kerberos protocol consists of the Service-for-User-to-Proxy (S4U2Proxy) extension and the Service-for-User-to-Self (S4U2Self) extension. For more information about the S4U2 extensions, see the Kerberos articles at the following URLs: http:// searchwindowssecurity.techtarget.com/originalContent/0,289142,sid45_gci1013484,00.html (intended for IT professionals) and http://msdn.microsoft.com/msdnmag/issues/03/04/SecurityBriefs/ default.aspx (intended for developers). Installing NFS Authentication DLL on domain controllers NOTE: If the authentication software is not installed on all domain controllers that have user name mappings, including primary domain controllers, backup domain controllers, and Active Directory domains, then domain user name mappings will not work correctly. You need to install the version of NFS Authentication included with Services for UNIX 3.5. You can download Services for UNIX 3.5 at no charge from http://go.microsoft.com/fwlink/?LinkId=44501. 102 Microsoft Services for Network File System (MSNFS)

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
UNIX computers follow advisory locking for all lock requests. This means that the operating system
does not enforce lock semantics on a file, and applications that check for the existence of locks can
use these locks effectively. However, Server for NFS implements mandatory locks even for those
locking requests that are received through NFS. This ensures that locks acquired through NFS are
visible through the server message block (SMB) protocol and to applications accessing the files locally.
Mandatory locks are enforced by the operating system.
Server for NFS Authentication DLL versus Service for User for Active Directory domain controllers
On a Windows Storage Server 2003 R2 storage server, Server for NFS depends on a domain
controller feature called Service for User (S4U) to authenticate UNIX users as their corresponding
Windows users. Windows Server operating systems prior to Windows Server 2003 and Windows
Storage Server 2003 do not support S4U. Also, in mixed domain environments, legacy Services for
UNIX (SFU), Services for NFS and Windows Storage Server 2003 NFS deployments do not use the
S4U feature and still depend on the Server for NFS Authentication DLL being installed on domain
controllers.
Therefore, the administrator needs to install the Server for NFS Authentication DLL on Windows 2000
domain controllers when:
•
The NFS file serving environment uses previous NFS releases (NAS, SFU, and so on).
•
The Windows domain environment uses pre-2003 domain controllers.
See
Table 21
for guidance as to when to use NFS Authentication DLL instead of S4U legacy NFS and
R2 MSNFS.
Table 21 Authentication table
MSNFS (WSS2003 R2)
Legacy NFS
(pre-WSS2003 R2)
Domain controller type
Requires NFS Authentication DLL on domain
controller
Requires NFS Authentication
DLL on domain controller
Legacy domain controller
(pre-WSS2003)
Uses the built-in S4U (on the domain controller). It
is unaffected by the NFS Authentication DLL on the
domain controller.
Requires NFS Authentication
DLL on domain controller
Recent domain
controllers (WSS2003
and later)
The S4U set of extensions to the Kerberos protocol consists of the Service-for-User-to-Proxy (S4U2Proxy)
extension and the Service-for-User-to-Self (S4U2Self) extension. For more information about the S4U2
extensions, see the Kerberos articles at the following URLs:
h
t
tp://
s
ear
c
h
w
indo
w
s
s
ec
ur
it
y
.t
ec
h
t
ar
ge
t
.co
m/o
r
i
ginalC
o
n
t
e
n
t/0,2
8
914
2
,si
d4
5_gc
i1013
4
8
4
,
00.h
tml
(intended for IT professionals) and
h
t
tp://msdn
.mi
c
r
o
s
o
f
t
.co
m/msdnmag/is
sue
s/0
3/0
4/S
ec
ur
it
yBr
i
e
f
s/
de
f
a
ult
.a
s
p
x
(intended for developers).
Installing NFS Authentication DLL on domain controllers
NOTE:
If the authentication software is not installed on all domain controllers that have user name mappings,
including primary domain controllers, backup domain controllers, and Active Directory domains, then
domain user name mappings will not work correctly.
You need to install the version of NFS Authentication included with Services for UNIX 3.5. You can download
Services for UNIX 3.5 at no charge from
h
t
tp://g
o
.mi
c
r
o
s
o
ft
.co
m/f
w
link/?L
inkId=4
4
5
01
.
Microsoft Services for Network File System (MSNFS)
102