F5 ARX-VE, Planning Manual

Page: 39 / 64

Planning for a Multi-Protocol Namespace
ARX Site Planning Guide 1 - 33
Non-Native File Permissions (and Qtree Configuration)
Each NetApp qtree can support UNIX-based permissions or NTFS-based
ACLs. The client’s identity is mapped as discussed above, then their identity
is applied to the file’s native permissions. For example, consider an NFS
client who accesses a file on an NTFS qtree: the client’s UNIX username is
mapped to an NT username, then the NT identity is applied to the file’s
ACLs.
Note
NetApp mixed-mode qtrees are not currently qualified.
A multi-protocol namespace passes all permissions checks back to the
qtrees, which permit or deny access to each file or directory. All NetApp
shares behind a multi-protocol volume must be configured with the same
permissions type (UNIX, or NTFS).
F5 recommends that you use NTFS qtrees, which offer the richest set of
file-access permissions.
Timestamp Skew in a Unix Qtree
A NetApp share with a Unix Qtree can create a unique timestamp skew:
some files may show different timestamps to Unix clients than to CIFS
clients. The timestamps differ by one hour. This is an indication that the
timestamp was set before daylight savings time started or ended; it is a
known issue on NetApp filers. We recommend that you follow NetApp’s
best practices and set the filer to GMT.
Mapping the Proxy User
As mentioned earlier, the configured proxy user must have full read/write
privileges from both NFS and CIFS. The NetApp’s NT/UNIX user map
must equate the proxy-user credentials on the NT side with
root on the
UNIX side. The user map is in /etc/usermap.cfg, which you can access from
an NFS client by mounting /vol/vol0. For example, this command sequence
mounts the NetApp filer at 192.168.25.21 and lists the usermap.cfg file:
rh1:/mnt# mount 192.168.25.21:/vol/vol0/etc netapp/
rh1:/mnt# ls ‐ l netapp/usermap.cfg
‐ rwxrwx ‐‐‐ 1 root root 1385 Apr 25 2005 netapp/usermap.cfg
rh1:/mnt#
One line maps the Windows proxy user to root . Follow this syntax:
DOMAIN
\
proxy-username
== root
where
DOMAIN is the Windows domain for the proxy user (use the short
version; for example, MYDOMAIN instead of
MYDOMAIN.MYCOMPANY),
proxy-username is the Windows username, and
the spaces before and after == are required.