Single sign-on and NAT support
Single sign-on does not support a NAT configuration. Also, NAT is not supported for
local login through Unisphere to the storage system.
Security on file system objects
In a multiprotocol environment, the storage system uses its security policies to
determine how to reconcile the differences between NFS and SMB access control
semantics.
Unix security model
UNIX access rights are referred to as the mode bits of a file system object. They are
represented by a bit string in which each bit represents an access mode or privilege
granted to the user owning the file, the group associated with the file system object,
and all other users. UNIX mode bits are represented as three sets of concatenated rwx
(read, write, and execute) triplets for each category of users (user, or group, or
other).
Windows security model
The Windows security model is based primarily on per-object rights, which involve the
use of a security descriptor (SD) and its access control list (ACL).
Access to a file system object is based on whether permissions have been set to Allow
or Deny through the use of a security descriptor. The SD describes the owner of the
object and group SIDs for the object along with its ACLs. An ACL is part of the
security descriptor for each object. Each ACL contains access control entries (ACEs).
Each ACE in turn, contains a single SID that identifies a user, group, or computer and a
list of rights that are denied or allowed for that SID.
File systems access in a multiprotocol environment
File access is provided through NAS servers. A NAS server contains a set of file
systems where data is stored. The NAS server provides access to this data for NFS,
SMB, and FTP file protocols by exporting file systems through SMB shares and NFS
shares (also known as NFS exports). The NAS server mode for multiprotocol sharing
allows the sharing of the same data between SMB and NFS. Because the
multiprotocol sharing mode provides simultaneous SMB and NFS access to a file
system, the mapping of Windows users to Unix users and defining the security rules to
use (mode bits, ACL, and user credentials) must be considered and configured
properly for multiprotocol sharing.
Note
For information about configuring and managing NAS servers with regards to
multiprotocol sharing, user mapping, access policies, and user credentials, refer to the
Unisphere online help and the
Unisphere Command Line Interface User Guide
.
User mapping
In a multiprotocol context, a Windows user needs to be matched to a UNIX user and
conversely, so file system security can be enforced, even if it is not native to the
protocol. The following components are involved in user mapping:
l
UNIX Directory Services
Access Control
22
EMC Unity All Flash, EMC Unity Hybrid, EMC UnityVSA
4.0
Security Configuration Guide
