HP NetStorage 6000, Руководство пользователя

Страница: 104 / 192

Securing Data
Security Mapping in a Heterogeneous Environment
8-9
Security Mapping in a Heterogeneous Environment
The HP NetStorage 6000 works in a heterogeneous environment and
supports remote file access protocols for both UNIX-based and NT-based
clients. A major difficulty in sharing data across these two environments is
that the file system security is different. NT systems that use user-level
security use ACLs to identify both themselves and the permissions for each
data object, whereas UNIX systems use traditional UNIX permissions that
define explicit permissions for the user, group, and other. A reasonable
level of access can be provided for cross-environment requests (i.e., UNIX
requesting NT files) without compromising the security set by the creator
of the object. The rule is that a client can never be granted greater access
than the client would have been granted in the environment where the
object was created.
With the HP NetStorage 6000 in User-Level security, you can enable a
mapping function that allows clients to access file resources in either UNIX
or Windows environments with the same security permissions. An NT
client, when attaching to the HP NetStorage 6000 for the first time where
user-level security is being used, has a UID and GID automatically
generated and stored in the users map file. The UID and GID values
uniquely identify the user as a member of a specific domain. Any objects
that are created or modified have a security descriptor attached to them that
contains information about their unique identity. If you explicitly provide a
security descriptor when creating an object, that is associated with the
object. If you do not specify security for the object, then the directory in
which the object resides is consulted for inheritable ACLs to form the new
security descriptor. If neither of the conditions applies, then the object has
a default ACL.