F5 ARX-VE, Planning Manual

Page: 27 / 64

Manually Preparing the Back-End File Servers
ARX Site Planning Guide 1 - 21
As root, edit the /etc/exports file to accomplish all of these goals. To allow
mounts below the root of the share, you must use the
-alldirs
flag. For
security reasons, BSD only allows this flag for shares that map to block
devices. On the BSD machine, use the
df
command for a list of block
devices.
Consider the following example:
BSD2 ‐ [/root]# df
Filesystem 1K ‐ blocks Used Avail Capacity Mounted on
/dev/da0s1a 495726 73274 382794 16% /
devfs 1 1 0 100% /dev
/dev/da0s1e 4058062 10390 3723028 0% /users
/dev/da0s1f 29356354 10575988 16431858 39% /usr
/dev/da0s1d 297326 11040 262500 4% /var
BSD2 ‐ [/root]#
On the above machine, you can export /, /dev, /users, /usr, and/or /var.
Consider the following example of a /etc/exports file that exports /usr to the
ARX:
# Note that in order to allow the Acopia Switch to do
# “submounting”, you must set the export with a ‐ alldirs
# flag. This means you must also set the export dir to be a
# top level filesystem found on a /dev/<slice>.
/usr ‐ alldirs ‐ maproot=0 ‐ network 192.168.25.0 ‐ mask 255.255.255.0
This limits access to IPs only in the 192.168.25.0/24 subnet, the server
subnet for the ARX. Only the ARX should be able to access this export,
except for backups or other read-only activities.
To use the edited exports file, force the mountd process to re-read the file.
As root, find the PID for mountd and then send a kill -HUP to the PID.
For example:
BSD2 ‐ [/root]# ps ax | grep mountd
347 ?? Is 0:03.21 /usr/sbin/mountd ‐ r
24817 p5 S+ 0:00.00 grep mountd
BSD2 ‐ [/root]# kill ‐ HUP 347
BSD2 ‐ [/root]#
CIFS Servers and Client Authentication
Whereas NFS uses a client’s IP address for access control, CIFS uses the
client’s user account. Each CIFS share, directory, and file has an associated
Access Control List (ACL), a list of user accounts and the access privileges
of each. The ARX passes a CIFS client’s credentials through to each
back-end server, and the server applies its ACLs to the client’s identity. The
server has the authority to deny any of the client’s actions based on its ACL
configuration, just as though the client was accessing the server directly. No
special preparation is required for CIFS client authentication.
Autonomous ARX operations, such as migrating files between back-end
CIFS shares, require a Windows user identity so that the ARX can similarly
access servers. This identity, called a
proxy user , is a valid user account in