HP StorageWorks 8000, User Manual

Page: 38 / 268

HP NAS 8000 Concepts
38 HP StorageWorks NAS 8000 User’s Guide
HP NAS Server Security in an NT-only Environment
The security schema for NT systems is different from that of UNIX, but there are
two similarities:
■
You can set up the security model to allow user authentication at the share
level; alternatively, you use a security domain, in which authentication is
handled by a Primary Domain Controller (PDC) or Backup Domain
Controller (BDC).
■
Processes are run with an identity of a user and any groups to which that user
belongs for either that workstation or the domain. Each data object is
associated with meta-data, sometimes called a security descriptor (SD). The
security descriptor contains a list of permissions or denials in the Access
Control List (ACL), which contains an almost limitless number of
permutations that can be associated with a data object.
Note: The ACL implementation is based on Windows 2000 semantics, not Windows
NT semantics.
The NAS server lets you choose between two security models:
■
Share-level security
■
User-level (Domain) security
Additionally, host access is available in the NT environment to control which
client machines are allowed access to the NAS server, regardless of the user. The
allowed clients are specified by a list of IP addresses or hostnames representing
those machines. Host access controls access by machine, not user.
Share-Level Security
With share-level security, the server explicitly asks for permission (password)
every time a user connects to a share on the NAS server. Thus, any user on the
network who knows the name of the NAS server, the name of the resource (or
file), and the password has access to the resource. When you are using share-level
security, you can assign shares a read-only password and/or a read-write
password.