Dell Unity XT 480F EMC Unity Family Configuring Multiprotocol File Sharing - Page 11

Deep dive: File system security and access in a multiprotocol environment

Get Dell Unity XT 480F PDF manuals and user guides View all Dell Unity XT 480F manuals
Add to My Manuals
Save this manual to your list of manuals

Page 11 highlights

2 Deep dive: File system security and access in a multiprotocol environment Topics: • Security on file system objects • File system access • User mapping • Access policies for NFS, SMB, and FTP • Credentials for file level security • Multiprotocol file system security settings Security on file system objects In a multiprotocol environment, security policy is set at the file system level, and is independent for each file system. Each file system uses its access policy to determine how to reconcile the differences between NFS and SMB access control semantics. Selecting an access policy determines which mechanism is used to enforce file security on the particular file system. NOTE: If the older SMB1 protocol does not need to be supported in your environment, it can be disabled by using the svc_nas service command. For more information about this service command, see the Service Commands Technical Notes. UNIX security model When the UNIX policy is selected, any attempt to change file level security from the SMB protocol, such as changes to access control lists (ACLs), is ignored. UNIX access rights are referred to as the mode bits or NFSv4 ACL of a file system object. Mode bits are represented by a bit string. Each bit represents an access mode or privilege that is granted to the user owning the file, the group associated with the file system object, and all other users. UNIX mode bits are represented as three sets of concatenated rwx (read, write, and execute) triplets for each category of users (user, group, or other). An ACL is a list of users and groups of users by which access to, and denial of, services is controlled. Windows security model The Windows security model is based primarily on object rights, which involve the use of a security descriptor (SD) and its ACL. When SMB policy is selected, changes to the mode bits from NFS protocol are ignored. Access to a file system object is based on whether permissions have been set to Allow or Deny through the use of a security descriptor. The SD describes the owner of the object and group SIDs for the object along with its ACLs. An ACL is part of the security descriptor for each object. Each ACL contains access control entries (ACEs). Each ACE in turn, contains a single SID that identifies a user, group, or computer and a list of rights that are denied or allowed for that SID. File system access File access is provided through NAS servers, which contain a set of file systems where data is stored. The NAS server provides access to this data for NFS and SMB file protocols by sharing file systems through SMB shares and NFS shares. The NAS server mode for multiprotocol sharing allows the sharing of the same data between SMB and NFS. Because the multiprotocol sharing mode provides simultaneous SMB and NFS access to a file system, the mapping of Windows users to Unix users and defining the security rules to use (mode bits, ACL, and user credentials) must be considered and configured properly for multiprotocol sharing. Deep dive: File system security and access in a multiprotocol environment 11

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
Deep dive: File system security and access in
a multiprotocol environment
Topics:
•
Security on file system objects
•
File system access
•
User mapping
•
Access policies for NFS, SMB, and FTP
•
Credentials for file level security
•
Multiprotocol file system security settings
Security on file system objects
In a multiprotocol environment, security policy is set at the file system level, and is independent for each file system. Each file
system uses its access policy to determine how to reconcile the differences between NFS and SMB access control semantics.
Selecting an access policy determines which mechanism is used to enforce file security on the particular file system.
NOTE:
If the older SMB1 protocol does not need to be supported in your environment, it can be disabled by using the
svc_nas
service command. For more information about this service command, see the
Service Commands Technical
Notes
.
UNIX security model
When the UNIX policy is selected, any attempt to change file level security from the SMB protocol, such as changes to access
control lists (ACLs), is ignored. UNIX access rights are referred to as the mode bits or NFSv4 ACL of a file system object.
Mode bits are represented by a bit string. Each bit represents an access mode or privilege that is granted to the user owning
the file, the group associated with the file system object, and all other users. UNIX mode bits are represented as three sets of
concatenated rwx (read, write, and execute) triplets for each category of users (user, group, or other). An ACL is a list of users
and groups of users by which access to, and denial of, services is controlled.
Windows security model
The Windows security model is based primarily on object rights, which involve the use of a security descriptor (SD) and its ACL.
When SMB policy is selected, changes to the mode bits from NFS protocol are ignored.
Access to a file system object is based on whether permissions have been set to Allow or Deny through the use of a security
descriptor. The SD describes the owner of the object and group SIDs for the object along with its ACLs. An ACL is part of the
security descriptor for each object. Each ACL contains access control entries (ACEs). Each ACE in turn, contains a single SID
that identifies a user, group, or computer and a list of rights that are denied or allowed for that SID.
File system access
File access is provided through NAS servers, which contain a set of file systems where data is stored. The NAS server provides
access to this data for NFS and SMB file protocols by sharing file systems through SMB shares and NFS shares. The NAS
server mode for multiprotocol sharing allows the sharing of the same data between SMB and NFS. Because the multiprotocol
sharing mode provides simultaneous SMB and NFS access to a file system, the mapping of Windows users to Unix users
and defining the security rules to use (mode bits, ACL, and user credentials) must be considered and configured properly for
multiprotocol sharing.
2
Deep dive: File system security and access in a multiprotocol environment
11