You have completed the steps to make virtual servers available to Windows clients and have enabled CIFS file sharing. Your next step is to set up file sharing between CIFS and NFS clients.
The SpinFS architecture enables concurrent access to files via the NFS and CIFS protocols. Although both protocols' authentication models have the concept of a principal (a user or group), they use incompatible databases for storing principal information. CIFS stores user and group information on a Windows Domain Controller (PDC or BDC) by using either LanMan (NTLM) or Kerberos authentication.
NFS stores user and group information in the Network Information System (NIS), with few rules for authentication. NFS supports a single NIS domain per file server, whereas CIFS supports a network of cooperating domains. The SpinAccess CIFS-to-NIS translation provides a level of compatibility between these two models.
The NFS and CIFS internal representations of principal information are incompatible. SpinAccess bases its conversions on user and group names. A typical CIFS user name might be ENG\jones, where ENG is the domain or workgroup name and jones is the login name of a user. An NFS user name might be jones. Note that CIFS names include a domain, where NFS names do not. Because NFS supports only a single domain per file server, the domain name is implied.
SpinAccess translates CIFS principals to NIS principals. It does this by translating a CIFS principal's internal representation into a name, matching the name against a set of rules, and, if a match is found, rewriting the name using a substitution template and converting the rewritten name into NFS' internal principal representation. A similar sequence is used to convert NIS principals into CIFS principals when sending replies to CIFS clients.
Note: Only CIFS requests are subject to translation. NFS principals are the canonical representation.
The SpinServer keeps an NIS domain and a set of conversion rules for each virtual server. Each rule consists of two pieces: a pattern and a replacement. Conversions start at the beginning of the appropriate list and perform a substitution based on the first matching rule. The pattern is a UNIX-style regular expression. The replacement is a string containing escape sequences representing subexpressions from the pattern, as in the UNIX sed program.
Regular expressions are case-insensitive when mapping from CIFS to NIS. However, they are case-sensitive for NFS-Kerberos and NIS-to-CIFS mappings.
For example, the following rule converts the user named jones in the domain named ENG into the NIS user named jones.
| Pattern | Replacement |
|---|---|
| ENG\\jones | jones |
Note that the backslash is a special character in regular expressions and must be escaped with another backslash.
The ^ (caret), _ (underscore), and & (ampersand) characters can now be used as prefixes for digits in replacement patterns. These characters specify uppercase, lowercase, and initial-case transformations, respectively. For instance:
If the initial pattern is (.*) and the replacement pattern is \1, then the string jOe is mapped to jOe (no change).
If the initial pattern is (.*) and the replacement pattern is \_1, then the string jOe is mapped to joe.
If the initial pattern is (.*) and the replacement pattern is \^1, then the string jOe is mapped to JOE.
If the initial pattern is (.*) and the replacement pattern is \&1, then the string jOe is mapped to Joe.
If the character following a \_ (backslash-underscore), \^ (backslash-caret), or \& (backslash-ampersand) sequence is not a digit, then the character following the backslash is used verbatim.
The following example converts any CIFS user in the domain named ENG into a user with the same name in NIS.
| Pattern | Replacement |
|---|---|
| ENG\\(.*) | \1 |
The double backslash (\\) matches a single backslash. The parentheses denote a subexpression but do not match any characters themselves. The period matches any single character. The asterisk matches zero or more of the previous expressions. In this example, you are matching ENG\ followed by one or more of any character. In the replacement, \1 refers to whatever the first subexpression matched. Assuming the CIFS user ENG\jones, the replacement evaluates to jones; that is, the portion of the name following ENG\.
Note: If you are using the CLI, you must delimit all regular expressions with double quotation marks ("). For instance, to enter the regular expression (.+) in the CLI, type "(.+)" at the command prompt. Quotation marks are not required in the GUI.
For further information about regular expressions, see your UNIX system administration documentation, the online UNIX documentation for sed or regex, or Mastering Regular Expressions, published by O'Reilly and Associates.
For CIFS-to-NFS translation, credentials supplied by a client are subject to translation before being processed by the SpinFS file system. File attributes (file owner and group) are subject to translation going in both directions. ACL entries are subject to translation of CIFS to NFS and NFS to CIFS.
File protection decisions take place on the SpinFS file system after any translations have occurred. All SpinServer users and groups are qualified by a domain. Domain zero is defined to represent the NIS namespace for the current virtual server. Other domain values map to one of the known CIFS domains.
Each virtual server is configured with a NIS domain. When a CIFS primary group cannot be mapped, or when NFS receives the attributes of a file whose domain is nonzero, the NIS nobody user or group (UID or GID -2) is substituted.
The translation process between CIFS and NFS proceeds as follows:
When a credential is received from an NFS client, the SpinServer uses the NFS user and group, in domain 0.
When a credential is received from a CIFS client:
If both the user ID (UID) and primary group are translated, translations are used.
If only the user translates, the SpinServer uses the translated user and replaces the primary group with the NIS nobody (-2) group in the NFS domain (domain 0).
If the user does not translate, the SpinServer uses the CIFS user and group. The SpinServer uses the CIFS user and group with a nonzero domain. The nonzero domain corresponds to the appropriate CIFS domain.
For each ACL entry, the SpinServer uses a translation if one is available; otherwise it sends a CIFS principal; that is, a nonzero domain.
When file attributes are received, destined for a CIFS client:
If the file's owning domain is nonzero, the SpinServer assumes the user and group are already from a CIFS domain and does not attempt a mapping.
If the file's owning user and group map to CIFS, the SpinServer uses the mappings.
If the file's owning user or group does not have a mapping, the SpinServer translates them to local IDs that refer to the server.
For users and groups in ACLs, the SpinServer translates them if possible; otherwise it translates them to local IDs that refer to the server.
When file attributes are received, destined for an NFS client:
If the domain is zero, the SpinServer passes the user and group unchanged.
If NFS sees a domain other than zero, it sets the user to nobody (-2) and the group to nobody (-2).
The following recommendations and rules apply to CIFS-to-NFS mappings.
A file's attributes specify a single domain, shared by the owning user and group. Thus, the file's user and group must come from the same domain.
NFS credentials can never map to nonzero SpinFS domains. Thus, an NFS user can never get an untranslatable CIFS user's file access permissions.
There is no facility for adjusting file ownerships after the translation rules have been adjusted. Changes to the translation rules can cause preexisting files now owned by invalid users—that is, CIFS users that are now translated to NIS users—to be inaccessible. For this reason, it is important to set up any desired translations before users begin creating files.
Generally, all CIFS users are members of the your_domain\Domain Users group. It is convenient to create an NIS group (for instance, cifs_user) that maps to and from Domain Users.
If an NFS user is logged in as UID 0 (root) without Kerberos authentication, the user is mapped to -2/-2 (nobody/nobody). Because Kerberos-enabled clients must be explicitly set up to map to root, this does not affect Kerberos-enabled clients.
To set up file sharing between CIFS and NFS clients, you must define the following:
NIS domains and NFS servers
CIFS-to-NFS user and group mappings
NIS provides simple name network lookup service and user authentication service. Its purpose is to provide information that needs to be available to the entire network, such as login names, passwords, home directories, and group information.
The SpinServer system's virtual servers must access NIS domains so that an NFS user's name can be identified from the listed user IDs, and vice versa. This process is required to accomplish CIFS-to-NFS user mappings. Your first task is to specify the NIS domains to be used.
Use the spinaccess nfs domains new command to specify the NIS domains to be used by identifying their domain names and the NIS servers to be used for the domain. The NIS server option for this command specifies a square-bracketed, comma-separated list of NIS servers that handle NIS requests for the specified domain. If the option is omitted, a broadcast search is used to look for NIS servers for the domain. The command has the following syntax:
spinaccess nfs domains new -domainname NIS_domain_name -nisservers [NIS_IP_addresses]
The following example specifies an NIS domain named acmebricks.com with NIS servers that have the IP addresses 10.2.2.1 and 10.3.3.1.
spinserver::> spinaccess nfs domains new -domainname acmebricks.com -nisservers [10.2.2.1, 10.3.3.1]
After specifying the NIS domains for the network, use the spinaccess nfs domains show command to display and review the configuration information for the NIS domains. The command has the following syntax:
spinaccess nfs domains show [-domainname domain_name]
The following information about the NIS domains is displayed by the system: NIS domain name, communication type, and NIS domain server name or names.
To display general configuration information about all NIS domains, do not use the -domainname parameter. To display information about one specific NIS domain, use the command with the parameter.
The following example displays configuration information about an NIS domain named acmebricks.com:
spinserver::> spinaccess nfs domains show -domainname acmebricks.com NIS Domain Name acmebricks.com Communication Type Server Domain Servers 10.2.2.1, 10.3.3.1
Use the spinaccess nfs domains modify command to modify NIS domains. The command has the following syntax:
spinaccess nfs domains modify -domainname NIS_domain_name -nisservers NIS_IP_address
The following command modifies the list of NIS servers for an NIS domain named acmebricks.com.
spinserver::> spinaccess nfs domains modify -domainname acmebricks.com -nisservers [10.5.1.0, 10.5.2.0]
Use the spinaccess nfs domains delete command to delete NIS domains. The command has the following syntax:
spinaccess nfs domains delete -domainname domain_name
The following example deletes an NIS domain named acmebricks.com.
spinserver::> spinaccess nfs domains delete -domainname acmebricks.com
You have specified the NIS domains to be used by the SpinServer system's virtual servers and the NIS domains now exist in the NFS domains table. Your next task is to attach the NIS domains to the virtual servers so that an NFS user's name can be identified from the listed user IDs, and vice versa.
To attach the NIS domains to virtual servers, use the spinaccess nfs servers new command. The command has the following syntax:
spinaccess nfs servers new -vsname virtual_server_name -domainname NIS_domain_name -kerbrealms [Kerberos_realms]
Note: Only one NIS domain can be bound to a virtual server at a time.
The following example attaches an NIS domain to a virtual server:
spinserver::> spinaccess nfs servers new -vsname VS1 -domainname acmebricks.com -kerbrealms [ENG,FINANCE]
where
VS1 is the name of the virtual server.
acmebricks.com is the NIS domain name.
[ENG,FINANCE] is the list of Kerberos realms that is visible to this virtual server. Multiple values must be separated by commas and enclosed in square brackets. Kerberos realms in this list must have been previously configured by using the spinaccess kerberos realm commands. See Chapter 16 for information about Kerberos.
To display and review the configuration information for NIS domains, use the spinaccess nfs servers show command. The command has the following syntax:
spinaccess nfs servers show [-vsname virtual_server_name]
The following information is displayed by the system: virtual server name and NIS domain name. To display configuration information about all NIS domains attached to virtual servers, do not use the parameter. To display information about a specific NIS domain, use the command with the -vsname parameter.
The following example displays configuration information about the NIS domain attached to a virtual server named VS1.
spinserver::> spinaccess nfs servers show -vsname VS1 Virtual Server VS1 NIS Domain Name acmebricks.com Kerberos Realms
Use the spinaccess nfs servers modify command to modify mappings between virtual servers and their NIS servers. The command has the following syntax:
spinaccess nfs servers modify -vsname virtual_server_name -domainname NIS_domain_name -kerbrealms [Kerberos_realms]
The following example modifies the NIS domain named acmebricks.com attached to a virtual server named VS1. The list of Kerberos realms is modified to include ENG and SALES.
spinserver::> spinaccess nfs servers modify -vsname VS1 -domainname acmebricks.com -kerbrealms [ENG,SALES]
To remove a virtual server's associations with NIS servers and NFS Kerberos realms, use the spinaccess nfs servers delete command. The command has the following syntax:
spinaccess nfs servers delete -vsname virtual_server_name
The following example removes the associations of a virtual server named VS1 with all NIS servers and NFS Kerberos realms.
spinserver::> spinaccess nfs servers delete -vsname VS1
See Chapter 16 for information on NFS Kerberos realms.
You have specified the NIS domains to be used by the SpinServer system's virtual servers and the NIS domains now exist in the NFS domains' table. The NIS domains have been attached to the virtual servers and you have created CIFS servers and shares. Your last task is to map CIFS to NFS users.
CIFS-to-NFS mappings are processed in the order of their positions, with the lowest numbered position (Position 1) being processed first. If the pattern is not matched fully, the next mapping is processed (Position 2), and so on. After a pattern matches fully, no more mappings are processed.
For further information about regular expressions, see Mastering Regular Expressions published by O'Reilly and Associates, Inc. at www.oreilly.com/catalog/regex.
Additional information can be obtained from a UNIX prompt by running info regex. For further information and examples, run man 7 regex at a UNIX prompt.
Use the spinaccess cifs-nfs new command to configure new CIFS-to-NFS mappings. When a new mapping is added, it is added at the top or the last position in the list of mappings to be displayed. The CIFS and NFS patterns must match the entire user or group name for the system to match the pattern. To be fully translated, each file and directory to be translated must match both a group and a user-name mapping. The command has the following syntax:
spinaccess cifs-nfs new -vsname virtual_server_name -type {USER | GROUP} -cifspattern CIFS_pattern -cifspatternreplacement CIFS_pattern_replacement -nfspattern NFS_pattern -nfspatternreplacement NFS_pattern_replacement
Note: When you create CIFS-to-NFS mappings, those CIFS clients that have open connections at the time the new mappings are created must log out and log back in to see the new mappings.
See the Administration Reference for additional and detailed information and examples of CIFS-to-NFS mappings.
The following example maps every CIFS user in the domain ENG to users in the NIS domain bound on the virtual server VS1.
spinserver::> spinaccess cifs-nfs new -vsname VS1 -type USER -cifspattern "ENG\\(.*)" -cifspatternreplacement "\1" -nfspattern "(.*)" -nfspatternreplacement "ENG\\\1"
where
VS1 is the name of the virtual server on which the mapping occurs.
USER specifies that this is a user-name mapping.
"ENG\\(.*)" is the regular expression search pattern that is used to match against incoming CIFS user or groups names. This CIFS mapping must directly correlate to the NFS-to-CIFS mapping defined by the -nfspattern and -nfspatternreplacement parameters.
"\1" is the replacement when the CIFS pattern matches the user name. This replacement is the equivalent user name for NFS. Regular-expression back references can be used to reference matched subexpressions in the CIFS pattern.
"(.*)" is the regular expression search pattern that is used to match against incoming NFS user or groups names. This NFS mapping must directly correlate to the CIFS-to-NFS mapping defined by the -cifspattern and -cifspatternreplacement parameters.
"ENG\\\1" is the replacement when the NFS pattern matches the user name. This replacement should be the equivalent user name for CIFS. Regular-expression back references can be used to reference matched subexpressions in the NFS pattern. This NFS mapping must directly correlate to the CIFS-to-NFS mapping defined by the -cifspattern and -cifspatternreplacement parameters.
CIFS-to-NFS mappings are processed in the order of their positions, with the lowest numbered position (Position 1) being processed first. If the pattern is not matched fully, the next mapping is processed (Position 2), and so on. After a pattern matches fully, no more mappings are processed.
To change the order of the position of the mappings, use the following commands.
To decrease the position of the mapping, that is, move it closer to the top of the list, use the spinaccess cifs-nfs decreaseposition command, as in the following example:
spinserver::> spinaccess cifs-nfs decreaseposition -position 6
where
6 is the position in the list of mappings to be decreased one position, to Position 5, on the list.
To increase the position of the mapping, that is, move it closer to the bottom of the list, use the spinaccess cifs-nfs increaseposition command, as in the following example:
spinserver::> spinaccess cifs-nfs increaseposition -position 6
where
6 is the position in the list of mappings to be increased one position, to Position 7, on the list.
To move the position of the mapping to the top of the list (Position 1), use the spinaccess cifs-nfs movefirst command, as in the following example:
spinserver::> spinaccess cifs-nfs movefirst -position 6
where
6 is the position in the list of mappings to be moved to the top of the list (the first position).
To move the position of the mapping to the bottom of the list (the last position), use the spinaccess cifs-nfs movelast command, as in the following example:
spinserver::> spinaccess cifs-nfs movelast -position 6
where
6 is the position in the list of mappings to be moved to the bottom of the list (the last position).
After setting up the CIFS-to-NFS mappings for the network, use the spinaccess cifs-nfs show command to display and review the configuration information for the mappings. The command has the following syntax:
spinaccess cifs-nfs show [-position position]
The following information about the CIFS-to-NFS mappings is displayed by the system when no parameters are given:
Position
Virtual server name
Group mapping
CIFS pattern
NFS pattern
The replacements are displayed by the system when the -position parameter is provided.
To display general configuration information about all mappings, do not use the parameter. To display information about one specific mapping, use the command with the parameter.
The following example displays mapping information about all positions.
spinserver::> spinaccess cifs-nfs show Pos Virtual Server Group? CIFS pattern NFS pattern 1 VS1 false ENG\\(.+) (.+) 2 VS1 true ENG\\Domain Users cifs_user 3 VS1 true ENG\\Systest systest
The following example displays mapping information about Position 1.
spinserver::> spinaccess cifs-nfs show -position 1 Position 1 Virtual Server VS1 Group Mapping? false CIFS pattern ENG\\(.+) CIFS pattern replacement 1 NFS pattern (.+) NFS pattern replacement ENG\\\1
The following example displays mapping information about Position 2.
spinserver::> spinaccess cifs-nfs show -position 2 Position 2 Virtual Server faceoff Group Mapping? true CIFS pattern ENG\\Domain Users CIFS pattern replacement cifs_user NFS pattern cifs_user NFS pattern replacement ENG\\Domain Users
The following example displays configuration information for the CIFS-to-NFS mapping at position 6:
spinserver::> spinaccess cifs-nfs show -position 6 Position 6 Virtual Server VS1 Group Mapping? true CIFS pattern ENG\\Systest CIFS pattern replacement systest NFS pattern systest NFS pattern replacement ENG\\Systest
To change the configuration of CIFS-to-NFS mappings, use the spinaccess cifs-nfs modify command. The command has the following syntax:
spinaccess cifs-nfs modify -position mapping_position -type {USER | GROUP} -cifspattern CIFS_pattern -cifspatternreplacement CIFS_pattern_replacement -nfspattern NFS_pattern -nfspatternreplacement NFS_pattern_replacement
Note: The command modifies the entry at the position you specify and modifies only the parameters you pass in.
The CIFS and NFS patterns must match the entire user or group name for the system to match the pattern.
The following example modifies the CIFS-to-NFS mapping at position 4.
spinserver::> spinaccess cifs-nfs modify -position 4 -type USER -cifspattern "ENG\\(.*)" -cifspatternreplacement "\1" -nfspattern "(.*)" -nfspatternreplacement "ENG\\\1"
where
4 is the position to be modified.
USER specifies that this is a user-name mapping.
"ENG\\(.*)" is the regular expression search pattern that is used to match against incoming CIFS user or group names. This CIFS mapping must directly correlate to the NFS-to-CIFS mapping defined by the -nfspattern and -nfspatternreplacement parameters.
"\1" is the replacement when the CIFS pattern matches the user name. This replacement must be the equivalent user name for NFS. Regular-expression back references can be used to reference matched subexpressions in the CIFS pattern.
"(.*)" is the regular-expression search pattern that is used to match against incoming NFS user or groups names. This NFS mapping must directly correlate to the CIFS-to-NFS mapping defined by the -cifspattern and -cifspatternreplacement parameters.
"ENG\\\1" is the replacement when the NFS pattern matches the user name. This replacement must be the equivalent user name for CIFS. Regular-expression back references can be used to reference matched subexpressions in the NFS pattern. This NFS mapping must directly correlate to the CIFS-to-NFS mapping defined by the -cifspattern and -cifspatternreplacement parameters.
Use the spinaccess cifs-nfs delete command to remove CIFS-to-NFS mappings from the system. The command has the following syntax:
spinaccess cifs-nfs delete -position position
The following example deletes the CIFS-to-NFS mapping at position 6:
spinserver::> spinaccess cifs-nfs delete -position 6
Copyright © 2004 Network Appliance, Inc.; copyright © 2003, 2004 Spinnaker Networks, LLC. All rights reserved. Specifications subject to change without notice.