After you create a CIFS domain, the next step in configuring CIFS access is enabling CIFS on a virtual server by using the protocol cifs server new command. The command requires the following information:
The name of the virtual server on which CIFS is to be enabled. Only one CIFS configuration can be enabled on a given virtual server.
The CIFS domain name. This domain must already exist.
The NetBIOS name of the CIFS-enabled virtual server. This is the name that the virtual server uses to identify itself to CIFS clients. This name can be the same as or different from the virtual server name.
The method by which the CIFS-enabled virtual server registers its NetBIOS name. This is specified with the -broadcast parameter. A value of enable specifies that the virtual server uses the Microsoft NetBIOS type; that is, the virtual server broadcasts its name to the local subnet, contacts a WINS server, and negotiates for use of its NetBIOS host name. A value of disable specifies that the virtual server uses the peer NetBIOS type; that is, the virtual server is configured with the address of a WINS server and informs the WINS server of its intent to use its NetBIOS host name.
Whether the virtual server uses Kerberos authentication for CIFS clients. If you enable Kerberos authentication for CIFS clients, you must also specify the user name and password of a Kerberos administrator.
Whether the virtual server updates its Machine Trust Account password automatically.
You can optionally specify a default UNIX user for the CIFS-enabled virtual server.
The following example enables CIFS access on a virtual server named vs0. The virtual server uses the CIFS domain named ENG and uses the NetBIOS name ENG-WIN to identify itself to CIFS clients. The virtual server uses the Microsoft NetBIOS type to register its NetBIOS name, uses Kerberos authentication for CIFS clients, and automatically updates its Machine Trust Account password. The username of a Kerberos administrator is kerb1, and the password is S3cur1ty.
node::>protocol cifs server new -vserver vs0 -domain ENG -cifs-server ENG-WIN -broadcast enable -kerberos enable -password-update enable -admin-username kerb1 -admin-password S3cur1ty
The protocol cifs server show command, by default, displays the following information about CIFS-enabled virtual servers:
Virtual server name
CIFS domain name
NetBIOS name of the CIFS-enabled virtual server
Whether Kerberos is enabled
Whether NetBIOS broadcasting is enabled (that is, whether the virtual server uses the Microsoft NetBIOS type (enabled) or peer NetBIOS type (disabled) to register its NetBIOS name)
Other information is displayed in a detailed view and if other parameters are specified. See the reference page for the command for details.
The following example displays information about all CIFS-enabled virtual servers:
node::>protocol cifs server showVirtual Domain NetBIOS Kerberos Broadcast Server Name Name Enabled Enabled vs0 ENG WIN-ENG enable enable
You can use the protocol cifs server modify command to modify the NetBIOS broadcast setting, automatic password-update setting, and default UNIX user of a CIFS-enabled virtual server. The following example modifies a CIFS-enabled virtual server named vs1 to disable NetBIOS broadcasting (that is, to use the peer NetBIOS type) and to enable automatic updates of its Machine Trust Account password.
node::>protocol cifs server modify -vserver vs1 -broadcast disable -password-update enable
If the Kerberos configuration on a CIFS-enabled virtual server becomes corrupted, use the protocol cifs server resetpassword command to reset the server's Kerberos password. The command prompts you for the user name and password of a Kerberos administrator with sufficient permissions to reset the password. If the CIFS-enabled virtual server does not have Kerberos authentication enabled, this command has no effect.
The following example resets the Kerberos password on a CIFS-enabled virtual server named vs0.
node::>protocol cifs server resetpassword -vserver vs0
CIFS virtual servers must be members of a domain. They have Machine Trust Accounts on the Primary Domain Controller. Just like normal user accounts, Machine Trust Accounts have passwords that are known only to the machine using the account. For enhanced security, the password for the machine is randomly generated and cannot be specified by the system administrator.
The Data ONTAP 10.0 system automatically changes the Machine Trust Account passwords once a week. However, you have the option to force an immediate password change for a virtual server if you suspect a security breach or are trying to diagnose a problem. To do so, use the protocol cifs server forcepasswordchange command. When issuing the command, you must specify a virtual server, which contacts its primary domain controller and changes its Machine Trust Account password.
The following example forces a Machine Trust Account password change for a CIFS-enabled virtual server named vs0.
node::>protocol cifs server forcepasswordchange -vserver vs0
To delete the CIFS configuration of a virtual server, use the protocol cifs server delete command. The command does not delete the virtual server itself, just its ability to serve CIFS clients.
If you delete a virtual server, as described in “Deleting a Virtual Server”, the virtual server's CIFS configuration and any shares defined on the CIFS server are automatically deleted. Any Windows-to-UNIX or UNIX-to-Windows name mappings defined for the virtual server are also deleted because they require both the CIFS and NFS servers.
The following example deletes the CIFS configuration of a virtual server named vs1.
node::>protocol cifs server delete -vserver vs1