After you create an export rule set by using the protocol exportruleset new command, you create one or more export rules for the rule set by using the protocol exportruleset rule new command. When you create an export rule, you specify the following information:
A virtual server name.
The name of the export rule set to which the new rule is to be added. The rule set must already exist.
Optionally, an index number for the rule. Rules are evaluated according to their order in the list of index numbers; rules with lower index numbers are evaluated first (for instance, the rule with index number 1 is evaluated before the rule with index number 2).
Optionally, one or more access protocols for the rule. Possible values include the following:
any—Any current or future access protocol
nfs2—The NFSv2 protocol
nfs3—The NFSv3 protocol
nfs—Any current or future version of NFS
cifs—The CIFS protocol
You can specify a comma-separated list of multiple access protocols for an export rule. If you specify the protocol as any, do not specify any other protocols in the list. If you do not specify an access protocol, the default value of any is used.
The client or clients to which the rule applies. You can specify the match in any of the following formats:
As a hostname; for instance, host1
As an IPv4 address; for instance, 10.1.12.24
As an IPv4 address with a subnet mask expressed as a number of bits; for instance, 10.1.12.10/4
As an IPv4 address with a network mask; for instance, 10.1.16.0/255.255.255.0
As a netgroup, with the netgroup name preceded by the @ character; for instance, @netgroup
As a network name from files, NIS, or LDAP preceded by the = character; for instance, =networkname
As a domain name preceded by the . character; for instance, .example.com
The security type or types for read-only access. Valid security types are provided in the following paragraph.
The security type or types for read-write access.
Optionally, a UNIX user ID or user name that is mapped to client requests that arrive with a user ID of 0 (zero), which is normally associated with the user name root. The default value is 65534, which is normally associated with the user name nobody. The following notes apply to the use of this parameter:
To disable access by any client with a user ID of 0, specify a value of 65535.
To provide a client with a user ID of 0 with access to files and directories owned by the user ID 0, but no special access to files and directories not owned by the user ID 0, specify the anonymous user as 0 (zero) and superuser access as never.
If you specify a value of 0 for the anonymous user, you must also specify a value for superuser access. Conversely, do not specify a value for superuser access unless you specify a value of 0 for the anonymous user.
If you have specified a value of 0 for the anonymous user, the security type or types for superuser access.
Optionally, whether set user ID (suid) and set group ID (sgid) access is enabled by the rule.
Optionally, whether the creation of devices is enabled by the rule.
Valid security types are as follows. You can specify a comma-separated list of multiple security types for a rule. If you specify the security type as any or never, do not specify any other security types.
any—A matching client can access the volume regardless of security type.
never—A matching client cannot access the volume regardless of security type.
none—A matching client can access the volume as an anonymous user if it uses any security type not already listed. For instance, a read-only rule that specifies the security types ntlm and none provides read-only access to clients that use NTLM and anonymous read-only access to clients that use other security types.
If a read-write rule is specified only as none, then only unauthenticated clients can write to the volume. If you want to make the volume writable by any user, specify a security type of any.
krb5—A matching client can access the volume if it is authenticated by Kerberos 5.
ntlm—A matching clients can access the volume if it is authenticated by CIFS NTLM.
sys—A matching client can access the volume if it is authenticated by NFS AUTH_SYS.
spinauth—A matching client can access the volume if it is authenticated by SpinAuth. See XREF for information about SpinAuth.
The following example creates an export rule on a virtual server named vs0 in an export rule set named rs1. The rule has the index number 1. The rule matches all clients. The rule enables all NFS access. It enables read-only access by all clients and requires Kerberos authentication for read-write access. Clients with the UNIX user ID 0 (zero) are mapped to user ID 65534 (which normally maps to the user name nobody). The rule enables suid and sgid access but does not enable the creation of devices.
node::>protocol exportruleset rule new -vserver vs0 -rulesetname rs1 -ruleindex 1 -protocol nfs -clientmatch 0.0.0.0 -rorule any -rwrule krb5 -anon 65534 -allow-suid true -allow-dev false
The protocol exportruleset rule show command, by default, displays the following information about export rules:
Virtual server name
Export rule set name
Export rule index number
Access protocol
Client match
Read-only access rule
Read-write access rule
Other information is displayed in a detailed view and if other parameters are specified. See the reference page for the command for details.
The following example displays information about all export rules.
node::>protocol exportruleset rule showVirtual Ruleset Rule Access Client RO RW Server Name Index Protocol Match Rule Rule vs0 rs1 1 nfs 0.0.0.0 any krb5 vs0 rs1 2 any 10.98.40.0/12 any any vs0 rs1 3 any .example.com ntlm, ntlm, krb5 krb5
To modify the attributes of an export rule, use the protocol exportruleset rule modify command. The command cannot modify the index number of a rule in its rule set; to do this, use the protocol exportruleset rule setindex command.
The following example modifies the export rule with index number 2 in an export rule set named rs1 on a virtual server named vs0. The client match is changed to a netgroup named group1, and NTLM or Kerberos authentication is required for read-write access.
node::>protocol exportruleset rule modify -vserver vs0 -rulesetname rs1 -ruleindex 2 -clientmatch @group1 -rwrule ntlm,krb5
The protocol exportruleset rule setindex command enables you to modify the index number of a specified export rule. If the new index number is already in use, the command reorders the list to accommodate it. If the existing index is given a higher index number (that is, later in the list), the command decrements the index numbers of rules between the moved rule and moved-to rule; otherwise, the command increments the index numbers between the moved-to rule and the existing rule.
The following example changes the index number of an export rule at index number 3 to index number 2 in an export rule set named rs1 on a virtual server named vs0.
node::>protocol exportruleset rule setindex -vserver vs0 -rulesetname rs1 -ruleindex 3 -newruleindex 2
To delete an export rule from a rule set, use the protocol exportruleset rule delete command. When you delete a rule, the other rules in the rule set are not automatically renumbered or reordered. To reorder the rules in a rule set, use the protocol exportruleset rule setindex command.
The following example deletes an export rule set with the index number 3 from an export rule set named rs1 on a virtual server named vs0.
node::>protocol exportruleset rule delete -vserver vs0 -rulesetname rs1 -ruleindex 3