Adaptec 5325301507 Administration Guide - Page 121

Configuring Share Access, Share Access Behaviors

Get Adaptec 5325301507 - Snap Server 4400 NAS PDF manuals and user guides
UPC - 753253015740
View all Adaptec 5325301507 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 121 highlights

Configuring Share Access Configuring Share Access The GuardianOS supports share-level as well as file- and directory-level permissions (see "Windows ACLs" on page 107) for all local and Windows domain users and groups. Share Access Behaviors Administrators tasked with devising security policies for the SnapServer will find the following share access behaviors of interest: • Share access defaults to full control - The default permission granted to users and groups when they are granted access to the share is full control. You may restrict selected users and groups to read-only access. • User-based share access permissions are cumulative - An SMB, AFP, HTTP, or FTP user's effective permissions for a resource are the sum of the permissions that you assign to the individual user account and to all of the groups to which the user belongs in the Share Access page. For example, if a user has read-only permission to the share, but is also a member of a group that has been given fullaccess permission to the share, the user gets full access to the share. • NFS access permissions are not cumulative - an NFS user's access level is based on the permission in the NFS access list that most specifically applies. For example, if a user connects to a share over NFS from IP address 192.168.0.1, and the NFS access for the share gives read-write access to * (All NFS clients) and read-only access to 192.168.0.1, the user will get read-only access. • Interaction between share-level and file-level access permissions - When both share-level and file-level permissions apply to a user action, the more restrictive of the two applies. Consider the following examples: Example A: More restrictive file-level access trumps more permissive share-level access. Share Level File Level Result Full control Read-only to FileA Full control over all directories and files in SHARE1 except where a more restrictive file-level permission applies. The user has read-only access to FileA. Chapter 6 Share and File Access 105

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
  • 231
  • 232
  • 233
  • 234
  • 235
  • 236
  • 237
  • 238
  • 239
  • 240
  • 241
  • 242
  • 243
  • 244
  • 245
  • 246
  • 247
  • 248
  • 249
  • 250
Configuring Share Access
Chapter 6
Share and File Access
105
Configuring Share Access
The GuardianOS supports share-level as well as file- and directory-level
permissions (see “Windows ACLs” on page 107) for all local and Windows domain
users and groups.
Share Access Behaviors
Administrators tasked with devising security policies for the SnapServer will find
the following share access behaviors of interest:
•
Share access defaults to full control —
The default permission granted to users
and groups when they are granted access to the share is full control. You may
restrict selected users and groups to read-only access.
•
User-based share access permissions are cumulative —
An SMB, AFP, HTTP, or
FTP user's effective permissions for a resource are the sum of the permissions
that you assign to the individual user account and to all of the groups to which
the user belongs in the Share Access page. For example, if a user has read-only
permission to the share, but is also a member of a group that has been given full-
access permission to the share, the user gets full access to the share.
•
NFS access permissions are not cumulative —
an NFS user's access level is based
on the permission in the NFS access list that most specifically applies. For
example, if a user connects to a share over NFS from IP address 192.168.0.1, and
the NFS access for the share gives read-write access to
*
(All NFS clients) and
read-only access to 192.168.0.1, the user will get read-only access.
•
Interaction between share-level and file-level access permissions —
When both
share-level and file-level permissions apply to a user action, the more restrictive
of the two applies. Consider the following examples:
Example A:
More restrictive file-level access trumps more permissive share-level
access.
Share Level
File Level
Result
Full control
Read-only to FileA
Full control over all directories and files in
SHARE1
except
where a more restrictive file-level
permission applies. The user has read-only
access to FileA.