The spinaccess command node includes the following subnode commands:
cifs
cifs-nfs
exportrule
kerb-nis
kerberos
nfs
superuser
Each of the subnode commands, and the leaf-node commands attached to them, is described in detail, with parameters and arguments listed for each command.
Examples of command usage are included in the discussions.
The spinaccess cifs domains subnode command includes the following leaf-node commands:
delete
modify
new
removebdc
removewins
show
CLI:
spinaccess cifs domains delete -domainname CIFS_domain_name
GUI: Navigate to the SpinAccess → CIFS → Domains node, then select the appropriate domain from the table and run the Delete command from the drop-down menu of the action pane.
To remove a CIFS domain, use the spinaccess cifs domains delete command. A CIFS domain cannot be deleted if there are any CIFS servers within the CIFS domain (that is, CIFS virtual servers that were created by specifying the CIFS domain) or if a CIFS server lists the domain as visible.
-domainname CIFS_domain_name
This is the NetBIOS name of the CIFS domain.
Note: The SpinServer supports only pre-Windows 2000 domain names.
The following command removes a CIFS domain named ENG from the system.
spinserver::> spinaccess cifs domains delete -domainname ENG
CLI:
spinaccess cifs domains modify -domainname CIFS_domain_name [-winsip WINS_IP_address] -pdcname primary_domain_controller_name -pdcip primary_domain_controller_IP_address [-kerbconf Kerberos_configuration_name] [-bdcname1 backup_domain_controller_name] [-bdcip1 backup_domain_controller_IP_address] [-bdcname2 backup_domain_controller_name] [-bdcip2 backup_domain_controller_IP_address] [-bdcname3 backup_domain_controller_name] [-bdcip3 backup_domain_controller_IP_address] [-bdcname4 backup_domain_controller_name] [-bdcip4 backup_domain_controller_IP_address]
GUI: Navigate to the SpinAccess → CIFS → Domains node, then select the appropriate domain from the table and run the Show command from the drop-down menu of the action pane. Make the appropriate modifications in the table that is displayed, then run the Modify command from the drop-down menu.
To modify a CIFS domain, use the spinaccess cifs domains modify command. The -domainname option specifies the domain that is to be modified, and the other options specify the new values for that domain.
-domainname CIFS_domain_name
This is the NetBIOS name of the CIFS domain.
Note: The SpinServer supports only pre-Windows 2000 domain names.
[-winsip WINS_IP_address]
This is the WINS IP address. This parameter is optional. When a virtual server is added to the domain, it must be of type B if the domain does not have a WINS IP address. If you create a CIFS domain with a WINS IP address and add a virtual server with a node type that is not B (that is, it is M, P, or H), the domain must have a WINS IP address.
-pdcname primary_domain_controller_name
This is the NetBIOS name of the primary domain controller (PDC).
-pdcip primary_domain_controller_IP_address
This is the IP address of the primary domain controller.
[-kerbconf Kerberos_configuration_name]
This is the name of the Kerberos configuration to be associated with the CIFS domain. The name of the Kerberos configuration is specified by the -configname parameter of the spinaccess kerberos realm new command.
[-bdcname1 backup_domain_controller_name]
This is the NetBIOS name of the backup domain controller (BDC).
[-bdcip1 backup_domain_controller_IP_address]
This is the IP address of the backup domain controller.
[-bdcname2 backup_domain_controller_name]
This is the NetBIOS name of the second BDC.
[-bdcip2 backup_domain_controller_IP_address]
This is the IP address of the second BDC.
[-bdcname3 backup_domain_controller_name]
This is the NetBIOS name of the third BDC.
[-bdcip3 backup_domain_controller_IP_address]
This is the IP address of the third BDC.
[-bdcname4 backup_domain_controller_name]
This is the NetBIOS name of the fourth BDC.
[-bdcip4 backup_domain_controller_IP_address]
This is the IP address of the fourth BDC.
The following command example modifies a CIFS domain named ENG. The WINS IP address is 10.1.1.11. The PDC name is STORM and its IP address is 10.1.1.11. The BDC name is RAIN and its IP address is 10.1.1.117.
spinserver::> spinaccess cifs domains modify -domainname ENG -winsip 10.1.1.11 -pdcname STORM -pdcip 10.1.1.11 -bdcname1 RAIN -bdcip1 10.1.1.117
CLI:
spinaccess cifs domains new -domainname CIFS_domain_name [-winsip WINS_IP_address] -pdcname primary_domain_controller_name -pdcip primary_domain_controller_IP_address [-kerbconf Kerberos_configuration_name] [-bdcname1 backup_domain_controller_name] [-bdcip1 backup_domain_controller_IP_address] [-bdcname2 backup_domain_controller_name] [-bdcip2 backup_domain_controller_IP_address] [-bdcname3 backup_domain_controller_name] [-bdcip3 backup_domain_controller_IP_address] [-bdcname4 backup_domain_controller_name] [-bdcip4 backup_domain_controller_IP_address]
GUI: Navigate to the SpinAccess → CIFS → Domains node, then click New in the top bar of the action pane. Enter the appropriate values into the table that is displayed and click Create.
The spinaccess cifs domains new command creates and configures a CIFS domain. A CIFS server must exist within a configured domain. By configuring the CIFS domains, you inform the SpinServer of the Windows NT and Windows 2000 domains that exist on the network. You must enter every CIFS domain on the network that users use to access the SpinServer.
Note: Domain names, domain controller names, and NetBIOS names can be up to 15 characters long. The SpinServer does not accept the fully qualified DNS name style that Windows 2000 supports.
Note: To successfully register a new domain with the SpinServer, the SpinServer must be able to contact the primary domain controller (PDC) that is specified by the -pdcname and -pdcip parameters in the command. The virtual interface that is bound to the virtual server that you plan to add to the new domain must already be running and have access to the primary domain controller.
-domainname CIFS_domain_name
This is the NetBIOS name of the CIFS domain.
[-winsip WINS_IP_address]
This is the WINS IP address.
-pdcname primary_domain_controller_name
This is the NetBIOS name of the primary domain controller (PDC).
-pdcip primary_domain_controller_IP_address
This is the IP address of the primary domain controller.
[-kerbconf Kerberos_configuration_name]
This is the name of the Kerberos configuration to be associated with the CIFS domain. The name of the Kerberos configuration is specified by the -configname parameter of the spinaccess kerberos realm new command.
[-bdcname1 backup_domain_controller_name]
This is the NetBIOS name of the first backup domain controller (BDC). This parameter is optional; however, if it is used, the -bdcip1 parameter must also be specified.
[-bdcip1 backup_domain_controller_IP_address]
This is the IP address of the first BDC. This parameter is optional; however, if it is used, the -bdcname1 parameter must also be specified.
[-bdcname2 backup_domain_controller_name]
This is the NetBIOS name of the second BDC. This parameter is optional; however, if it is used, the -bdcip2 parameter must also be specified.
[-bdcip2 backup_domain_controller_IP_address]
This is the IP address of the second BDC. This parameter is optional; however, if it is used, the -bdcname2 parameter must also be specified.
[-bdcname3 backup_domain_controller_name]
This is the NetBIOS name of the third BDC. This parameter is optional; however, if it is used, the -bdcip3 parameter must also be specified.
[-bdcip3 backup_domain_controller_IP_address]
This is the IP address of the third BDC. This parameter is optional; however, if it is used, the -bdcname3 parameter must also be specified.
[-bdcname4 backup_domain_controller_name]
This is the NetBIOS name of the fourth BDC. This parameter is optional; however, if it is used, the -bdcip4 parameter must also be specified.
[-bdcip4 backup_domain_controller_IP_address]
This is the IP address of the fourth BDC. This parameter is optional; however, if it is used, the -bdcname4 parameter must also be specified.
The following command example creates a CIFS domain named ENG. The WINS IP address is 10.1.1.116. The PDC name is STORM and its IP address is 10.1.1.116. The BDC name is RAIN and its IP address is 10.1.1.118. No Kerberos configuration is specified.
spinserver::> spinaccess cifs domains new -domainname ENG -winsip 10.1.1.116 -pdcname STORM -pdcip 10.1.1.116 -bdcname1 RAIN -bdcip1 10.1.1.118
CLI:
spinaccess cifs domains removebdc -domainname CIFS_domain_name -bdcs backup_domain_controller
GUI: Navigate to the SpinAccess → CIFS → Domains node, then select the appropriate domain from the table and run the Remove Backup Domain Controller(s) command from the drop-down menu of the action pane. Enter the appropriate information into the table that is displayed and click Remove Backup Domain Controller(s).
The spinaccess cifs domains removebdc command removes one or more BDCs from a CIFS domain configuration.
-domainname CIFS_domain_name
This is the NetBIOS name of the CIFS domain.
-bdcs [backup_domain_controllers]
This specifies the BDC or BDCs to be removed from the CIFS domain. If more than one BDC is to be removed, specify the BDCs as a square-bracketed, comma-separated list.
The following example removes a BDC named HAIL from a CIFS domain named ENG:
spinserver::> spinaccess cifs domains removebdc -domainname ENG -bdcs HAIL
CLI:
spinaccess cifs domains removewins -domainname CIFS_domain_name
GUI: Navigate to the SpinAccess → CIFS → Domains node, then select the appropriate domain from the table and run the Remove WINS command from the drop-down menu of the action pane.
The spinaccess cifs domains removewins command removes the WINS server from a CIFS domain configuration.
-domainname CIFS_domain_name
This is the NetBIOS name of the CIFS domain whose WINS server is to be removed.
The following example removes the WINS server from a CIFS domain named ENG:
spinserver::> spinaccess cifs domains removewins -domainname ENG
CLI:
spinaccess cifs domains show [-domainname CIFS_domain_name]
GUI: Navigate to the SpinAccess → CIFS → Domains node. To display information about a specific domain, select it from the table and run the Show command from the drop-down menu of the action pane.
The spinaccess cifs domains show command, without the parameter, displays summary configuration information about all currently defined CIFS domains within the system. To display information about a specific CIFS domain, use the command with the -domainname parameter. When you specify a domain, the following information is displayed:
WINS
PDC
IP address
All BDCs
Kerberos configuration names
The following example displays information about all CIFS domains.
spinserver::> spinaccess cifs domains show Domain PDC Name Kerberos Config CIFSLAND STORM ENG XAVIER example.com SLAB STPDC SUPPORT SUPPORT-W2K
The following command example displays information about a CIFS domain named ENG.
spinserver::> spinaccess cifs domains show -domainname ENG Domain ENG Windows SID S-1-5-21-393965755-660102513-868425949 WINS 10.1.1.41 PDC Name XAVIER PDC IP 10.1.1.41 Kerberos Configuration Name example.com BDC 1 Name MAGNETO BDC 1 IP 10.1.1.42 BDC 2 Name BDC 2 IP BDC 3 Name BDC 3 IP BDC 4 Name BDC 4 IP
The spinaccess cifs servers subnode command includes the following leaf-node commands:
delete
forcepasswordchange
modify
new
resetpassword
show
CLI:
spinaccess cifs servers delete -vsname virtual_server_name
GUI: Navigate to the SpinAccess → CIFS → Servers node, then select the appropriate server from the table and run the Delete command from the drop-down node of the action pane.
To remove a CIFS server, use the spinaccess cifs servers delete command, where virtual_server_name is the name of the virtual server. This name must already exist as a CIFS server that was created by using the spinaccess cifs servers new command.
Note: If you delete a virtual server, the CIFS server and any shares defined on the CIFS server are automatically deleted. Also, any CIFS-to-NFS user name mappings defined for the virtual server are removed because they require both the CIFS and NFS servers. If a CIFS server is deleted, the virtual server remains, but without CIFS support.
The following command example deletes a CIFS virtual server named VS1 from a system.
spinserver::> spinaccess cifs servers delete -vsname VS1
CLI:
spinaccess cifs servers forcepasswordchange -vsname virtual_server_name
GUI: Navigate to the SpinAccess → CIFS → Servers node, then select the appropriate server from the table and run the Force account password change command from the drop-down menu of the action pane.
CIFS virtual servers must be members of a domain. They have Machine Trust Accounts on the primary domain controller (PDC). As with normal user accounts, Machine Trust Accounts have passwords that only the machine using the account knows. For enhanced security, the password for the machine is randomly generated and cannot be specified by the system administrator.
The SpinServer system automatically changes the Machine Trust Account passwords once a week. However, you have the option to force an immediate password change for a virtual server if you suspect a security breach or are trying to diagnose a problem. When issuing the spinaccess cifs servers forcepasswordchange command, you must specify a virtual server, which contacts its primary domain controller and changes its Machine Trust Account password.
The following command example forces a change in the Machine Trust Account password for a CIFS server named VS1.
spinserver::> spinaccess cifs servers forcepasswordchange -vsname VS1
CLI:
spinaccess cifs servers modify -vsname virtual_server_name -visibledomains domain_list [-nodetype { H | M | P | B }] [-kerbprivuser Kerberos_user_name -kerbprivpass Kerberos_password]
GUI: Navigate to the SpinAccess → CIFS → Servers node, then select the appropriate server from the table and run the Show command from the drop-down menu of the action pane. Make the appropriate modifications in the table that is displayed, then run the Modify command from the drop-down menu.
To add a domain to the list of domains visible to a virtual server or to remove a domain from the list, use the spinaccess cifs servers modify command.
If you remove a domain from the list of visible domains for a virtual server, any access control list (ACL) entry that specifies a user (or group) from the removed domain no longer has access to the files. The entry is not removed from the ACL, but it is not considered during the access check.
-vsname virtual_server_name
This is the name of the virtual server. This name must already exist as a virtual server that was created by using the vservers servers new command.
-visibledomains domain_list
The list of visible domains contains the names of the domains that are visible to the virtual server. The virtual server's own domain is always listed in the visible domain list that is displayed. By default, the visible domain list includes all domains that are defined for the virtual server.
[-nodetype { H | M | P | B }]
This specifies the NetBIOS node type for the virtual server. Valid values are H, M, P, and B. Use M unless you do not have a WINS server, in which case, use B.
Note: See RFC 1001 and 1002 for information about NetBIOS node types.
[-kerbprivuser Kerberos_user_name]
This specifies the name of an account that has sufficient privileges to create Service Principal Accounts in the Active Directory for the domain. This is typically, but not necessarily, the Administrator account for the domain. The value specified by this parameter is used only for the command and is then discarded; no record of the account name is kept.
[-kerbprivpass Kerberos_password]
This specifies the password for the account specified by the -kerbprivuser parameter. The value specified by this parameter is used only for the command and is then discarded; no record of the password is kept. The password is echoed to the console if you use the CLI; however, the password is masked if you use the GUI.
The following example adds a domain named MARKETING to the list of domains visible to the virtual server VS1 or removes it from the list.
spinserver::> spinaccess cifs servers modify -vsname VS1 -visibledomains MARKETING
CLI:
spinaccess cifs servers new -vsname virtual_server_name -nbname NetBIOS_name -visibledomains [domain_list] -domainname domain_name -nodetype { H | M | P | B } -usekerberos {Yes | No} [-kerbprivuser Kerberos_user_name -kerbprivpass Kerberos_password]
GUI: Navigate to the SpinAccess → CIFS → Servers node, then click New in the top bar of the action pane. Enter the appropriate values into the table that is displayed and click Create.
A CIFS server consists of a virtual server, one or more virtual interfaces, information about the domain that the server belongs to, and NetBIOS name information. You must specify the NetBIOS node type, which determines how the server registers itself in the Windows network. Up to eight CIFS servers can be created on a cluster.
-vsname virtual_server_name
This is the virtual server name. This name must already exist as a virtual server that was created by using the vservers servers new command.
-nbname NetBIOS_name
This is the NetBIOS name given to the virtual server. The server will be available within the Windows network as this name. There must be an account with this name in the domain.
Note: If the account that exists has been used by another machine, the account must be reset prior to use by the SpinServer.
-visibledomains [domain_list]
This is a square-bracketed, comma-separated list of domains that are visible to the virtual server.
-domainname domain_name
This is the name of the CIFS domain for this server. This must be the name of a domain created by using the spinaccess cifs domains new command.
-nodetype { H | M | P | B }
This specifies the NetBIOS node type for the virtual server. Valid values are H, M, P, and B. Use M unless you do not have a WINS server, in which case, use B.
Note: See RFC 1001 and 1002 for information about NetBIOS node types.
-usekerberos {Yes | No}
This specifies whether or not to use Kerberos authentication.
[-kerbprivuser Kerberos_user_name]
This specifies the name of an account that has sufficient privileges to create Service Principal Accounts in the Active Directory for the domain. This is typically, but not necessarily, the Administrator account for the domain. The value specified by this parameter is used only for the command and is then discarded; no record of the account name is kept.
[-kerbprivpass Kerberos_password]
This specifies the password for the account specified by the -kerbprivuser parameter. The value specified by this parameter is used only for the command and is then discarded; no record of the password is kept. The password is echoed to the console if you use the CLI; however, the password is masked if you use the GUI.
This command example creates a CIFS virtual server named VS1 with a NetBIOS name of NB1. The virtual server is visible to domains MARKETING and ENG and is included in the CIFS domain named ENG. Its NetBIOS node type is M. No Kerberos configuration is specified.
spinserver::> spinaccess cifs servers new -vsname VS1 -nbname NB1 -visibledomains [MARKETING, ENG] -domainname ENG -nodetype M
CLI:
spinaccess cifs servers resetpassword -vsname virtual_server_name -uname admin_user_name -passwd admin_password
GUI: Navigate to the SpinAccess → CIFS → Servers node, then select the appropriate server from the table and run the Reset Kerberos Password command from the drop-down menu of the action pane. Enter the appropriate values into the table that is displayed, then click Reset Kerberos Password.
The spinaccess cifs servers resetpassword command resets the Kerberos password for a specified CIFS virtual server. Use this command if the CIFS Kerberos configuration becomes corrupted.
The command requires the user name and password of an administrator with sufficient permissions to reset the Kerberos password.
Note: The administrator's password appears in clear text on the CLI; however, the GUI masks the password. It is recommended that you use the GUI to issue this command to protect the security of the password.
-vsname virtual_server_name
This is the name given to the virtual server.
-uname admin_user_name
This is the user name of an administrator who has permissions to reset the Kerberos password.
-passwd admin_password
This is the password of the user specified by the -uname parameter.
The following command example resets the Kerberos password for a CIFS server named VS1. The administrative user's name is admin, with password S3cr3t.
spinserver::> spinaccess cifs servers resetpassword -vsname VS1 -uname admin -passwd S3cr3t
CLI:
spinaccess cifs servers show [-vsname virtual_server_name]
GUI: Navigate to the SpinAccess → CIFS → Servers node. To display information about a specific server, select it from the table and run the Show command from the drop-down menu of the action pane.
The spinaccess cifs servers show command displays information about one or more CIFS servers. To display configuration information about all CIFS servers, issue the command without the -vsname parameter. To display information about a specific CIFS server, issue the command with the -vsname parameter. The name of the virtual server must already exist as a virtual server that was created by using the spinaccess cifs servers new command. The following information about the CIFS server is displayed by the system:
Virtual server name
NetBIOS name
Domain name
Visible domains (specific server only)
Virtual interface name or names (specific server only)
NetBIOS type (specific server only)
Whether or not Kerberos is enabled
Kerberos configuration name (specific server only)
Service Principal Name for Kerberos (specific server only)
[-vsname virtual_server_name]
This is the name given to the virtual server. This name must already exist as a virtual server that was created by using the spinaccess cifs servers new command.
The following example displays information about a CIFS server named VS1.
spinserver::> spinaccess cifs servers show -vsname VS1 Virtual Server VS1 NetBios Name VS1 Domain ENG Visible Domains CIFSLAND, ENG, SLAB, SUPPORT Interfaces Server2:Data, Server1:Data Type P Kerberos Enabled Yes Kerberos Configuration Name example.com Service Principal Name HOST/SERVER1@EXAMPLE.COM
The spinaccess cifs shares subnode command includes the following leaf-node commands:
delete
modify
new
show
A CIFS share is an export point for the SpinServer to enable CIFS clients to gain access to the virtual file system. Any path accessible from the virtual server can be exported via a share.
CLI:
spinaccess cifs shares delete -vsname virtual_server_name -sharename share_name
GUI: Navigate to the SpinAccess → CIFS → Shares node, then select the appropriate share from the table and run the Delete command from the drop-down menu of the action pane.
The spinaccess cifs shares delete command deletes a CIFS share.
Note: If you delete a virtual server, the CIFS server and any shares defined on the CIFS server are automatically deleted. Also, any CIFS-to-NFS user-name mappings defined for the virtual server are removed because they require both the CIFS and NFS servers. If a CIFS server is deleted, the virtual server remains, but without CIFS support.
-vsname virtual_server_name
This is the name given to the virtual server to which the share is attached.
-sharename share_name
This is the name given to the share to be deleted.
The following example removes a CIFS share named ENG_BILL from a virtual server named VS1.
spinserver::> spinaccess cifs shares delete -vsname VS1 -sharename ENG_BILL
CLI:
spinaccess cifs shares modify -vsname virtual_server_name -sharename share_name [-shareprops share_properties] [-dirmodebits directory_mode_bits] [-filemodebits file_mode_bits] [-remark description]
GUI: Navigate to the SpinAccess → CIFS → Shares node, then select the appropriate share from the table and run the Show command from the drop-down menu of the action pane. Make the appropriate modifications in the table that is displayed, then run the Modify command from the drop-down menu.
You can change the attributes of a CIFS share by using the spinaccess cifs shares modify command.
-vsname virtual_server_name
This is the name of the virtual server on which the share is located.
-sharename share_name
This is the name of the share that is to be modified. A share name can be up to 32 characters long. If this is a dynamic share as specified by the values of dynshare and dynpath on the -shareprops parameter, you can make the share name dynamic by specifying the %u (user name) or %d (domain name) variables as the value of this parameter.
[-shareprops share_properties]
This specifies any special properties for the share. Multiple properties can be specified for a share. Possible values include the following:
dynpath—This specifies that the path name is dynamic. Specify this value with the dynshare option for a dynamic share. In a dynamic share, the share's name and path can be generated by substituting the user's name and domain with the %u and %d variables, respectively, as the value of the -path parameter on the spinaccess cifs shares new command when the share is created. For instance, if a dynamic share is defined as /user/%u, a user logged on as bill sees the path as /user/bill.
dynshare—This specifies that the share name is dynamic. Specify this value with the dynpath option for a dynamic share. In a dynamic share, the share's name and path can be generated by substituting the user's name and domain with the %u and %d variables, respectively, specified as the value of the -sharename and -path parameters on the spinaccess cifs shares new command when the share is created. For instance, if a dynamic share is defined with a name of %d_%u, a user logged on as barbara from a domain named FIN sees the share as FIN_barbara. Using the dynshare value specifies that the share name is dynamically expanded but the path name is not. For a full dynamic share, specify both the dynpath and the dynshare values.
mbinherit—This specifies that new files and directories inherit the mode bits of the parent directory. For instance, if a new file is created in a directory that has a mode-bit setting of 777, then the new file automatically receives a mode-bit setting of 777. On a single CIFS share, you can specify either mode-bit inheritance with this setting or explicit mode-bit setting with the -dirmodebits and -filemodebits parameters. You cannot specify both types of mode-bit setting on the same share.
oplocks—This specifies whether the share uses opportunistic locks, also known as client-side caching. Oplocks are enabled on shares by default; however, some applications do not work well when oplocks are enabled. In particular, database applications such as Microsoft Access are vulnerable to corruption when oplocks are enabled. An advantage of shares is that a single path can be shared multiple times, with each share having different properties. For instance, if a path named /dept/finance contains both a database and other types of files, you can create two shares to it, one with oplocks disabled for safe database access and one with oplocks enabled for client-side caching.
[-dirmodebits directory_mode_bits]
This specifies the UNIX mode bits for new directories on the share. If this parameter is not specified, directory mode bits default to 755 unless the value of the -shareprops parameter is set to mbinherit.
This parameter cannot be used if the value of the -shareprops parameter is set to mbinherit.
[-filemodebits file_mode_bits]
This specifies the UNIX mode bits for new files on the share. If this parameter is not specified, directory mode bits default to 755 unless the value of the -shareprops parameter is set to mbinherit.
This parameter cannot be used if the value of the -shareprops parameter is set to mbinherit.
[-remark description]
This is the remark description for the share that is to be made available to Windows clients. The descriptive remark can be up to 255 characters long. If there is a space in the descriptive remark or the path, the entire string must be quoted (for example, "This is a share.").
The following example modifies a CIFS share named SHARE1 on a virtual server named vs1. Mode bits are explicitly set as 755 on directories and 644 on files.
spinserver::> spinaccess cifs shares modify -vsname vs1 -sharename SHARE1 -dirmodebits 755 -filemodebits 644
CLI:
spinaccess cifs shares new -vsname virtual_server_name -sharename share_name -path directory_path [-shareprops share_properties] [-dirmodebits directory_mode_bits] [-filemodebits file_mode_bits] [-remark description]
GUI: Navigate to the SpinAccess → CIFS → Shares node, then click New in the top bar of the action pane. Enter the appropriate values into the table that is displayed and click Create.
The spinaccess cifs shares new command creates a CIFS share, which enables the sharing of data over the CIFS protocol. Defining a share determines the directory within the file system that is accessible to Windows clients. Up to 128 shares can be created on a single virtual server.
-vsname virtual_server_name
This is the name of the virtual server to which the share is added.
-sharename share_name
This is the name of the share to be added. A share name can be up to 32 characters long. If this is a dynamic share as specified by the values of dynshare and dynpath on the -shareprops parameter, you can make the share name dynamic by specifying the %u (user name) or %d (domain name) variables as the value of this parameter.
-path directory_path
This is the directory path that is to be shared. This path must exist in the virtual file system. A directory path name can be up to 255 characters long. If there is a space in the path name, the entire string must be quoted (for example, "/new VFS/mount here"). If this is a dynamic share as specified by values of dynshare and dynpath on the -shareprops parameter, you can make the path name dynamic by specifying the %u (user name) or %d (domain name) variables as the value of this parameter.
[-shareprops share_properties]
This specifies any special properties for the share. Multiple properties can be specified for a share. Possible values include the following:
dynpath—This specifies that the path name is dynamic. Specify this value with the dynshare option for a dynamic share. In a dynamic share, the share's name and path can be generated by substituting the user's name and domain with the %u and %d variables, respectively, specified as the value of the -path parameter. For instance, if a dynamic share is defined as /user/%u, a user logged on as bill sees the path as /user/bill.
dynshare—This specifies that the share name is dynamic. Specify this value with the dynpath option for a dynamic share. In a dynamic share, the share's name and path can be generated by substituting the user's name and domain with the %u and %d variables, respectively, specified as the value of the -sharename and -path parameters. For instance, if a dynamic share is defined with a name of %d_%u, a user logged on as barbara from a domain named FIN sees the share as FIN_barbara. Using the dynshare value specifies that the share name is dynamically expanded but the path name is not. For a full dynamic share, specify both the dynpath and the dynshare values.
mbinherit—This specifies that new files and directories inherit the mode bits of the parent directory. For instance, if a new file is created in a directory that has a mode-bit setting of 777, then the new file automatically receives a mode-bit setting of 777. On a single CIFS share, you can specify either mode-bit inheritance with this setting or explicit mode-bit setting with the -dirmodebits and -filemodebits parameters. You cannot specify both types of mode-bit setting on the same share.
oplocks—This specifies whether the share uses opportunistic locks, also known as client-side caching. Oplocks are enabled on shares by default; however, some applications do not work well when oplocks are enabled. In particular, database applications such as Microsoft Access are vulnerable to corruption when oplocks are enabled. An advantage of shares is that a single path can be shared multiple times, with each share having different properties. For instance, if a path named /dept/finance contains both a database and other types of files, you can create two shares to it, one with oplocks disabled for safe database access and one with oplocks enabled for client-side caching.
[-dirmodebits directory_mode_bits]
This specifies the UNIX mode bits for new directories on the share. If this parameter is not specified, directory mode bits default to 755 unless the value of the -shareprops parameter is set to mbinherit.
This parameter cannot be used if the value of the -shareprops parameter is set to mbinherit.
[-filemodebits file_mode_bits]
This specifies the UNIX mode bits for new files on the share. If this parameter is not specified, directory mode bits default to 755 unless the value of the -shareprops parameter is set to mbinherit.
This parameter cannot be used if the value of the -shareprops parameter is set to mbinherit.
[-remark description]
This is the remark description for the share that is to be made available to Windows clients. The descriptive remark can be up to 255 characters long. If there is a space in the descriptive remark or the path, the entire string must be quoted (for example, "This is a share.").
The following example creates a CIFS share named SHARE1 on a virtual server named vs1. Its directory path is /development/engineering. Opportunistic locks are specified on the share, and mode bits are explicitly set as 777 on directories and 775 on files.
spinserver::> spinaccess cifs shares new -vsname vs1 -sharename SHARE1 -path /development/engineering -shareprops oplocks -dirmodebits 777 -filemodebits 775
The following example creates a CIFS share named SHARE2 on a virtual server named vs1. Its directory path is /dept/system, and mode-bit inheritance is set.
spinserver::> spinaccess cifs shares new -vsname vs1 -sharename SHARE2 -path /dept/system -shareprops mbinherit
CLI:
spinaccess cifs shares show [-vsname virtual_server_name -sharename share_name]
GUI: Navigate to the SpinAccess → CIFS → Shares node. To display information about a specific share, select it from the table and run the Show command from the drop-down menu of the action pane.
The spinaccess cifs shares show command displays information about one or more CIFS shares. To display configuration information about all CIFS shares, issue the command without any parameters. To display information about a specific CIFS share, issue the command with the -vsname and -sharename parameters. If you use one parameter, the other is required. The command displays the following information:
Virtual server name
Share name
NetBIOS name of the virtual server
Directory path
Share properties
Directory mode bits, if any
File mode bits, if any
Share remark, if any
Share status
[-vsname virtual_server_name]
This is the name of the virtual server to which the share is attached. This parameter is optional; however, if it is used, the -sharename parameter must also be specified.
[-sharename share_name]
This is the name of the share to be displayed. This parameter is optional; however, if it is used, the -vsname parameter must also be specified.
The following example displays a list of CIFS shares.
spinserver::> spinaccess cifs shares show Virtual Server Share Name Path Status VS1 SYSTEM /system OK VS1 HOME / OK VS1 SPIN / OK
The following example displays the configuration information for a share named SYSTEM on a virtual server named VS1.
spinserver::> spinaccess cifs shares show -vsname VS1 -sharename SYSTEM Virtual Server VS1 Share Name SYSTEM Server NetBios Name VS1 Path /system Share Properties oplocks Dir Mode Bits 755 File Mode Bits 755 Remark Status OK
The spinaccess cifs-nfs subnode command includes the following leaf-node commands:
decreaseposition
delete
increaseposition
modify
movefirst
movelast
new
show
Note: For further information about regular expressions, see Mastering Regular Expressions published by O'Reilly and Associates, Inc. at http://www.oreilly.com/catalog/regex. Additional information can be obtained from a UNIX prompt by running info regex. For further information and examples, see the UNIX reference page for regex(7).
CLI:
spinaccess cifs-nfs decreaseposition -position mapping_position
GUI: Navigate to the SpinAccess → CIFS-NFS Mapping node, then select the appropriate mapping from the table and run the Decrease the position command from the drop-down menu of the action pane.
CIFS-to-NFS mappings are processed in the order of their positions, with the lowest-numbered position (position 1) being processed first. If the pattern is not matched fully, the next mapping (position 2) is processed, and so on. When a pattern matches fully, no more mappings are processed. To decrease the position of the mapping, use the spinaccess cifs-nfs decreaseposition command.
The following example decreases the position of the mapping currently at position 6; that is, moves it closer to the top of the list.
spinserver::> spinaccess cifs-nfs decreaseposition -position 6
CLI:
spinaccess cifs-nfs delete -position mapping_position
GUI: Navigate to the SpinAccess → CIFS-NFS Mapping node, then select the appropriate mapping from the table and run the Delete command from the drop-down menu of the action pane.
Use the spinaccess cifs-nfs delete command to delete a CIFS-to-NFS mapping from the system.
The following example deletes the CIFS-to-NFS mapping at position 6.
spinserver::> spinaccess cifs-nfs delete -position 6
CLI:
spinaccess cifs-nfs increaseposition -position mapping_position
GUI: Navigate to the SpinAccess → CIFS-NFS Mapping node, then select the appropriate mapping from the table and run the Increase the position command from the drop-down menu of the action pane.
CIFS-to-NFS mappings are processed in the order of their positions, with the lowest-numbered position (position 1) being processed first. If the pattern is not matched fully, the next mapping (position 2) is processed, and so on. When a pattern matches fully, no more mappings are processed. To increase the position of the mapping, use the spinaccess cifs-nfs increaseposition command.
-position mapping_position
This is the current position of the mapping you want to move in the list of mappings.
The following example increases the position of the mapping at position 6; that is, moves it closer to the bottom of the list.
spinserver::> spinaccess cifs-nfs increaseposition -position 6
CLI:
spinaccess cifs-nfs modify -position mapping_position -type {USER | GROUP} -cifspattern CIFS_pattern -cifspatternreplacement CIFS_pattern_replacement -nfspattern NFS_pattern -nfspatternreplacement NFS_pattern_replacement
GUI: Navigate to the SpinAccess → CIFS-NFS Mapping node, then select the appropriate mapping from the table and run the Show command from the drop-down menu of the action pane. Make the appropriate modifications in the table that is displayed, then run the Modify command from the drop-down menu.
The spinaccess cifs-nfs modify command changes the configuration of a CIFS-to-NFS mapping.
Note: The command modifies the mapping at the position you specify and modifies only the parameters you pass in.
Note: If you are using the CLI, you must delimit all regular expressions with double quotation marks ("). For instance, to enter the regular expression (.+) in the CLI, type "(.+)" at the command prompt. Quotation marks are not required in the GUI.
Note: To enter a question mark ( ? ) in the CLI, you must first escape the character by pressing Ctrl-V. The question mark is used in regular expressions in the spinaccess cifs-nfs commands. You do not need to use the Ctrl-V sequence before entering a question mark in the GUI.
-position mapping_position
This is the current position of the mapping you want to modify.
-type {USER | GROUP}
This specifies the type of the mapping, USER or GROUP.
-cifspattern CIFS_pattern
This is the regular-expression search pattern that is used to match against incoming CIFS user or group names.
-cifspatternreplacement CIFS_pattern_replacement
This is the replacement to use when the CIFS pattern matches the user name. It is recommended that this replacement be the equivalent user name for NFS. Regular-expression back references can be used to reference matched subexpressions in the CIFS pattern.
-nfspattern NFS_pattern
This is the regular-expression search pattern that is used to match against incoming NFS user or groups names. It is recommended that this NFS mapping correlate directly to the CIFS-to-NFS mapping.
-nfspatternreplacement NFS_pattern_replacement
This is the replacement to use when the NFS pattern matches the user name. It is recommended that this replacement be the equivalent user name for CIFS. Regular-expression back references can be used to reference matched subexpressions in the NFS pattern. It is recommended that this NFS mapping correlate directly to the CIFS-to-NFS mapping.
The following example modifies the entire entry, using all parameters.
spinserver::> spinaccess cifs-nfs modify -position 4 -type USER -cifspattern "ENG\\(.*)" -cifspatternreplacement "\1" -nfspattern "(.*)" -nfspatternreplacement "ENG\\\1"
The following example modifies only the domain name of a search pattern.
spinserver::> spinaccess cifs-nfs modify -position 6 -cifspattern "ENG\\(.*)" -nfspatternreplacement "ENG\\\1"
The following example modifies only the NFS user name tom.
spinserver::> spinaccess cifs-nfs modify -position 3 -nfspattern "tom" -cifspatternreplacement "tom"
CLI:
spinaccess cifs-nfs movefirst -position mapping_position
GUI: Navigate to the SpinAccess → CIFS-NFS Mapping node, then select the appropriate mapping from the table and run the Make the mapping first (lowest position) command from the drop-down menu of the action pane.
CIFS-to-NFS mappings are processed in the order of their positions, with the lowest- numbered position (position 1) being processed first. If the pattern is not matched fully, the next mapping (position 2) is processed, and so on. When a pattern matches fully, no more mappings are processed. To change the position of the mapping to the top of the list (position 1), use the spinaccess cifs-nfs movefirst command.
-position mapping_position
This is the current position of the mapping you want to move in the list of mappings.
To change the position of the mapping at position 6 to the top of the list (position 1), use the following command.
spinserver::> spinaccess cifs-nfs movefirst -position 6
CLI:
spinaccess cifs-nfs movelast -position mapping_position
GUI: Navigate to the SpinAccess → CIFS-NFS Mapping node, then select the appropriate mapping from the table and run the Make the mapping last (highest position) command from the drop-down menu of the action pane.
CIFS-to-NFS mappings are processed in the order of their positions, with the lowest- numbered position (position 1) being processed first. If the pattern is not matched fully, the next mapping (position 2) is processed, and so on. When a pattern matches fully, no more mappings are processed. To change the position of the mapping to the bottom of the list, use the spinaccess cifs-nfs movelast command.
-position mapping_position
This is the current position of the mapping you want to move in the list of mappings.
To change the position of the mapping at position 6 to the bottom of the list, use the following command.
spinserver::> spinaccess cifs-nfs movelast -position 6
CLI:
spinaccess cifs-nfs new -vsname virtual_server_name -type {USER | GROUP} -cifspattern CIFS_pattern -cifspatternreplacement CIFS_pattern_replacement -nfspattern NFS_pattern -nfspatternreplacement NFS_pattern_replacement
GUI: Navigate to the SpinAccess → CIFS-NFS Mapping node, then click New in the top bar of the action pane. Enter the appropriate values into the table that is displayed and click Create.
When a new mapping is added, it is added at the top of the list of mappings. The CIFS and NFS patterns must match the entire user or group name for the system to match the pattern.
Note: If you are using the CLI, you must delimit all regular expressions with double quotation marks ("). For instance, to enter the regular expression (.+) in the CLI, type "(.+)" at the command prompt. Quotation marks are not required in the GUI.
Note: When CIFS-to-NFS mappings are created, those CIFS clients that have open connections at the time the new mappings are created must log out and log back in to see the new mappings.
Note: If there are spaces used in the name of the pattern or the pattern replacement, the names must be enclosed in quotation marks (for example, -nfspattern "tom curtis").
Note: For further information about regular expressions, see Mastering Regular Expressions published by O'Reilly and Associates, Inc. at http://www.oreilly.com/catalog/regex. Additional information can be obtained from a UNIX prompt by running info regex. For further information and examples, see the UNIX reference page for regex(7).
Note: To enter a question mark ( ? ) in the CLI, you must first escape the character by pressing Ctrl-V. The question mark is used in regular expressions in the spinaccess cifs-nfs commands. You do not need to use the Ctrl-V sequence before entering a question mark in the GUI.
-vsname virtual_server_name
This is the name of the virtual server on which the mapping occurs.
-type {USER | GROUP}
This specifies the type of mapping, USER or GROUP.
-cifspattern CIFS_pattern
This is the regular-expression search pattern that is used to match against incoming CIFS user or group names.
-cifspatternreplacement CIFS_pattern_replacement
This is the replacement when the CIFS pattern matches the user name. It is recommended that this replacement be the equivalent user name for NFS. Regular-expression back references can be used to reference matched subexpressions in the CIFS pattern.
-nfspattern NFS_pattern
This is the regular-expression search pattern that is used to match against incoming NFS user or group names. It is recommended that this NFS mapping correlate directly to the CIFS-to-NFS mapping.
-nfspatternreplacement NFS_pattern_replacement
This is the replacement when the NFS pattern matches the user name. It is recommended that this replacement be the equivalent user name for CIFS. Regular-expression back references can be used to reference matched subexpressions in the NFS pattern. It is recommended that this NFS mapping correlate directly to the CIFS-to-NFS mapping.
The following example maps every CIFS user in the domain ENG to users in the NIS domain bound on the virtual server VS1.
spinserver::> spinaccess cifs-nfs new -vsname VS1 -type USER -cifspattern ENG\\(.*) -cifspatternreplacement \1 -nfspattern (.*) -nfspatternreplacement ENG\\\1
The following example maps the CIFS group Domain Users to the NFS group named cifs.
spinserver::> spinaccess cifs-nfs new -vsname VS1 -type GROUP -cifspattern "ENG\\Domain Users" -cifspatternreplacement "cifs" -nfspattern "cifs" -nfspatternreplacement "ENG\\Domain Users"
The following example maps CIFS user chris to NFS user dan.
spinserver::> spinaccess cifs-nfs new -vsname VS1 -type USER -cifspattern "ENG\\chris" -cifspatternreplacement "dan" -nfspattern "dan" -nfspatternreplacement "ENG\\chris"
CLI:
spinaccess cifs-nfs show [-position mapping_position]
GUI: Navigate to the SpinAccess → CIFS-NFS Mapping node. To display information about a specific mapping, select it from the table and run the Show command from the drop-down menu of the action pane.
After setting up the CIFS-to-NFS mappings for a network, use the spinaccess cifs-nfs show command to display and review the configuration information for the mappings. The command displays the following information about the CIFS-to-NFS mappings when no parameters are given:
Position
Virtual server name
Group mapping
CIFS pattern
NFS pattern
The replacements are displayed by the system when the -position parameter is provided. To display configuration information about all mappings, issue the command without the parameter. To display information about a specific mapping, issue the command with the parameter.
[-position mapping_position]
This is the position of the mapping you want to show in the list of mappings.
The following example displays information about all CIFS-to-NFS mappings.
spinserver::> spinaccess cifs-nfs show Pos Virtual Server Group? CIFS pattern NFS pattern 1 vserver1 false ENG\\(.+) (.+) 2 vserver1 true ENG\\Domain Users cifs_user 3 vserver1 true ENG\\Systest systest
The following command example displays information about the CIFS-to-NFS mapping at position 1.
spinserver::> spinaccess cifs-nfs show -position 1 Position 1 Virtual Server vserver1 Group Mapping? false CIFS pattern ENG\\(.+) CIFS pattern replacement 1 NFS pattern (.+) NFS pattern replacement ENG\\\1
The spinaccess exportrule subnode includes the following leaf-node commands:
addrule
copy
decreaseposition
delete
deleterule
increaseposition
listrules
movefirst
movelast
new
rename
show
CLI:
spinaccess exportrule addrule -rulesetname rule_set_name -clientmatch {client_IP_address | @netgroup_name} [-netmask network_mask] -rorule {any | cifs-ntlm | cifs-kerberos | nfs-kerberos | never} -rwrule {any | cifs-ntlm | cifs-kerberos | nfs-kerberos | never}
GUI: Navigate to the SpinAccess → Export Rules node, then select the appropriate export rule set from the table and run the Add rule command from the drop-down menu of the action pane. Enter the appropriate information into the table that is displayed, then click Add rule.
Use export rule sets to restrict access to VFSs based on the IP addresses of specific clients. The spinaccess exportrule addrule command adds a rule to a rule set. When creating a rule, specify the name of the rule set, a client IP address or netgroup name, the network mask that the rule must match (if a client IP address is specified), and the read-only and read-write settings for the rule.
-rulesetname rule_set_name
This is the name of the rule set to which a new rule is to be added.
-clientmatch {client_IP_address | @netgroup_name}
This is the base client IP address that matches the export rule. If you specify a netgroup as the value of this parameter, it must be in the form @netgroup_name For instance, to specify a netgroup named group1, specify the parameter and its value as -clientmatch @group1.
[-netmask network_mask]
This is the network mask that is used to match the export rule. The default is 0.0.0.0. Do not specify this parameter if a netgroup name is specified as the value of the -clientmatch parameter.
-rorule {any | cifs-ntlm | cifs-kerberos | nfs-kerberos | never}
This specifies the minimum authentication strength necessary for matching clients to gain read-only access to VFSs that use this rule set. Possible values, listed in order of increasing strength, are as follows:
any—A matching client can access the VFS regardless of authentication strength.
cifs-ntlm—A matching client can access the VFS if it is authenticated by CIFS NTLM or a stronger mechanism.
cifs-kerberosmdash;A matching client can access the VFS if it is authenticated by CIFS Kerberos or a stronger mechanism.
nfs-kerberos—A matching client can access the VFS if it is authenticated by NFS Kerberos or a stronger mechanism.
never—Matching clients cannot access the VFS.
-rwrule {any | cifs-ntlm | cifs-kerberos | nfs-kerberos | never}
This specifies the minimum authentication strength necessary for matching clients to gain write access to VFSs that use this rule set. Possible values, listed in order of increasing strength, are the same as those for the -rorule parameter, as follows:
any—A matching client can write to the VFS regardless of authentication strength.
cifs-ntlm—A matching client can write to the VFS if it is authenticated by CIFS NTLM or a stronger mechanism.
cifs-kerberos—A matching client can write to the VFS if it is authenticated by CIFS Kerberos or a stronger mechanism.
nfs-kerberos—A matching client can write to the VFS if it is authenticated by NFS Kerberos or a stronger mechanism.
never–Matching clients cannot write to the VFS.
Note: Write access is contingent upon read-only access, so specifying a value for the -rwrule parameter that is not as strong as the value of the -rorule parameter has no effect. For example, if you give the settings -rorule nfs-kerberos -rwrule any, CIFS clients cannot access the VFS in any way, even though the value of the -rwrule parameter is any.
The following example adds an export rule to the rule set named rs0. The rule applies to all clients whose IP addresses match the network mask 255.255.128.0. The rule permits read-only access to any matching clients, but requires that matching clients have nfs-kerberos authentication to write files.
spinserver::> spinaccess exportrule addrule -rulesetname rs1 -clientmatch 192.55.0.0 -netmask 255.255.128.0 -rorule any -rwrule nfs-kerberos
CLI:
spinaccess exportrule copy -rulesetname rule_set_name -newrulesetname new_rule_set_name
GUI: Navigate to the SpinAccess → Export Rules node, then select the appropriate export rule set from the table and run the Copy command from the drop-down menu of the action pane. Enter the appropriate information into the table that is displayed, then click Copy.
The spinaccess exportrule copy command enables you to make a copy of an export rule set.
The rule-set names inherit and none are reserved; you cannot use either of these names for a copy of a rule set.
-rulesetname rule_set_name
This is the name of the rule set that is to be copied.
-newrulesetname new_rule_set_name
This is the name of the new rule set.
The following example makes a copy of an export rule set named rs1. The copy of the rule set is named rs1copy.
spinserver::> spinaccess exportrule copy -rulesetname rs1 -newrulesetname rs1copy
CLI:
spinaccess exportrule decreaseposition -rulesetname rule_set_name -ruleindex index_number
GUI: Navigate to the SpinAccess → Export Rules node, then select the appropriate rule from the table and run the Move rule toward beginning command from the drop-down menu of the action pane.
The spinaccess exportrule decreaseposition command decreases the position of a rule in an export rule set; that is, moves the rule closer to the top of the list. Rules must be ordered according to the following guidelines:
You cannot reorder IP address-based rules such that a less-specific rule precedes a more-specific rule.
If you have an IP address-based rule with netmask 0.0.0.0 (that is, it matches all clients), it cannot be moved from the last position in the rule set, nor can any other rule, either IP address-based or netgroup-based, be placed after it.
If you attempt to move a rule and the move cannot be performed, the SpinServer issues the error message Unable to move rule at position N. If you use the spinaccess exportrule movelast command to move a rule to the last position and there is an IP address-based 0.0.0.0 rule present, the rule is moved to the next-to-last position unless it is already in the next-to-last position, in which case the preceding error message is issued.
-rulesetname rule_set_name
This is the rule set in which the rule is to be reordered.
-ruleindex index_number
This is the index number of the rule that is to be reordered.
The following example decreases the position (that is, moves it closer to the top of the list) of the rule that has index number 10 in a rule set named eng_rules.
spinserver::> spinaccess exportrule decreaseposition -rulesetname eng_rules -ruleindex 10
CLI:
spinaccess exportrule delete -rulesetname rule_set_name
GUI: Navigate to the SpinAccess → Export Rules node, then select the appropriate export rule set from the table and run the Delete command from the drop-down menu of the action pane.
The spinaccess exportrule delete command deletes an export rule set.
You cannot delete the default export rule set, which has an ID of 0 (zero).
The following example deletes an export rule set named rs1.
spinserver::> spinaccess exportrule delete -rulesetname rs1
CLI:
spinaccess exportrule deleterule -rulesetname rule_set_name -ruleindex rule_index
GUI: Navigate to the SpinAccess → Export Rules node, then select the appropriate export rule set from the table and run the List Rules command from the drop-down menu of the action pane. Select the appropriate rule from the list that is displayed, and run the Delete command from the drop-down menu.
The spinaccess exportrule deleterule command deletes a rule from an export rule set. Use the spinaccess exportrule listrules command to display a list of rules for a rule set.
-rulesetname rule_set_name
This is the name of the rule set from which a rule is to be deleted.
-ruleindex rule_index
This is the index number of the rule that is to be deleted from the rule set.
The following example deletes a rule with index 3 from the export rule set named rs1.
spinserver::> spinaccess exportrule deleterule -rulesetname rs1 -ruleindex 3
CLI:
spinaccess exportrule increaseposition -rulesetname rule_set_name -ruleindex index_number
GUI: Navigate to the SpinAccess → Export Rules node, then select the appropriate rule from the table and run the Move rule toward end command from the drop-down menu of the action pane.
The spinaccess exportrule increaseposition command increases the position of a rule in an export rule set; that is, moves the rule closer to the bottom of the list. Rules must be ordered according to the following guidelines:
You cannot reorder IP address-based rules such that a less-specific rule precedes a more-specific rule.
If you have an IP address-based rule with netmask 0.0.0.0 (that is, it matches all clients), it cannot be moved from the last position in the rule set, nor can any other rule, either IP address-based or netgroup-based, be placed after it.
If you attempt to move a rule and the move cannot be performed, the SpinServer issues the error message Unable to move rule at position N. If you use the spinaccess exportrule movelast command to move a rule to the last position and there is an IP address-based 0.0.0.0 rule present, the rule is moved to the next-to-last position unless it is already in the next-to-last position, in which case the preceding error message is issued.
-rulesetname rule_set_name
This is the rule set in which the rule is to be reordered.
-ruleindex index_number
This is the index number of the rule that is to be reordered.
The following example increases the position (that is, moves it closer to the bottom of the list) of the rule that has index number 8 in a rule set named eng_rules.
spinserver::> spinaccess exportrule increaseposition -rulesetname eng_rules -ruleindex 8
CLI:
spinaccess exportrule listrules -rulesetname rule_set_name
GUI: Navigate to the SpinAccess → Export Rules node, then select the appropriate export rule set from the table and run the List Rules command from the drop-down menu of the action pane.
The spinaccess exportrule listrules command displays a list of rules for a rule set. The following information is displayed:
Rule set name
Rule index number
Client IP address
Significant bits in the IP address
Read strength
Write strength
-rulesetname rule_set_name
This is the name of the rule set whose rules are to be displayed.
The following example displays information about the rules in an export rule set named rs1.
spinserver::> spinaccess exportrule listrules -rulesetname rs1
Ruleset Name Index Client IP Mask Read Strength Write
Bits Strength
rs1 0 192.55.0.0 16 any nfs-kerberos
rs1 1 192.56.0.0 16 cifs-ntlm cifs-kerberos
rs1 2 192.27.0.0 16 any any
CLI:
spinaccess exportrule movefirst -rulesetname rule_set_name -ruleindex index_number
GUI: Navigate to the SpinAccess → Export Rules node, then select the appropriate rule from the table and run the Make the rule first command from the drop-down menu of the action pane.
The spinaccess exportrule movefirst command moves a rule to the top of an export rule set. Rules must be ordered according to the following guidelines:
You cannot reorder IP address-based rules such that a less-specific rule precedes a more-specific rule.
If you have an IP address-based rule with netmask 0.0.0.0 (that is, it matches all clients), it cannot be moved from the last position in the rule set, nor can any other rule, either IP address-based or netgroup-based, be moved after it.
If you attempt to move a rule and the move cannot be performed, the SpinServer issues the error message Unable to move rule at position N. If you use the spinaccess exportrule movelast command to move a rule to the last position and there is an IP address-based 0.0.0.0 rule present, the rule is moved to the next-to-last position unless it is already in the next-to-last position, in which case the preceding error message is issued.
-rulesetname rule_set_name
This is the rule set in which the rule is to be reordered.
-ruleindex index_number
This is the index number of the rule that is to be reordered.
The following example moves the rule that has index number 12 to the top of a rule set named eng_rules.
spinserver::> spinaccess exportrule movefirst -rulesetname eng_rules -ruleindex 12
CLI:
spinaccess exportrule movelast -rulesetname rule_set_name -ruleindex index_number
GUI: Navigate to the SpinAccess → Export Rules node, then select the appropriate rule from the table and run the Make the rule last command from the drop-down menu of the action pane.
The spinaccess exportrule movelast command moves a rule to the top of an export rule set. Rules must be ordered according to the following guidelines:
You cannot reorder IP address-based rules such that a less-specific rule precedes a more-specific rule.
If you have an IP address-based rule with netmask 0.0.0.0 (that is, it matches all clients), it cannot be moved from the last position in the rule set, nor can any other rule, either IP address-based or netgroup-based, be moved after it.
If you attempt to move a rule and the move cannot be performed, the SpinServer issues the error message Unable to move rule at position N. If you use the spinaccess exportrule movelast command to move a rule to the last position and there is an IP address-based 0.0.0.0 rule present, the rule is moved to the next-to-last position unless it is already in the next-to-last position, in which case the preceding error message is issued.
-rulesetname rule_set_name
This is the rule set in which the rule is to be reordered.
-ruleindex index_number
This is the index number of the rule that is to be reordered.
The following example moves the rule that has index number 2 to the bottom of a rule set named eng_rules.
spinserver::> spinaccess exportrule movelast -rulesetname eng_rules -ruleindex 2
CLI:
spinaccess exportrule new -rulesetname rule_set_name
GUI: Navigate to the SpinAccess → Export Rules node, then click New in the top bar of the action pane. Enter the appropriate information into the table that is displayed, and then click Create.
The spinaccess exportrule new command creates an export rule set. After you create the export rule set, use the spinaccess exportrule addrule command to add rules to it.
The rule-set names inherit and none are reserved; you cannot create a new rule set with either of these names.
The following example creates an export rule set named rs1.
spinserver::> spinaccess exportrule new -rulesetname rs1
CLI:
spinaccess exportrule rename -rulesetname rule_set_name -newrulesetname new_rule_set_name
GUI: Navigate to the SpinAccess → Export Rules node, then select the appropriate export rule set from the table and run the Rename command from the drop-down menu of the action pane. Enter the appropriate information into the table that is displayed, and then click Rename.
The spinaccess exportrule rename command renames an export rule set.
The rule-set names inherit and none are reserved; you cannot rename a rule set with either of these names.
-rulesetname rule_set_name
This is the name of the rule set that is to be renamed.
-newrulesetname new_rule_set_name
This is the new name of the rule set.
The following example renames an export rule set named rs1 to the name ruleset1.
spinserver::> spinaccess exportrule rename -rulesetname rs1 -newrulesetname ruleset1
CLI:
spinaccess exportrule show [-rulesetname rule_set_name]
GUI: Navigate to the SpinAccess → Export Rules node. To display information about a particular export rule set, select it from the table and run the Show command from the drop-down menu of the action pane.
The spinaccess exportrule show command displays information about one or more export rule sets. The command displays the following information:
Rule set name
Rule set ID
[-rulesetname rule_set_name]
This is the name of the rule set about which information is to be displayed.
The following example displays information about all export rule sets.
spinserver::> spinaccess exportrule show
Ruleset Name Ruleset ID
default_ruleset 0
rs1 1
rs2 2
The spinaccess kerb-nis command includes the following leaf-node commands:
decreaseposition
delete
increaseposition
modify
movefirst
movelast
new
show
Note: For further information about regular expressions, see Mastering Regular Expressions published by O'Reilly and Associates, Inc. at http://www.oreilly.com/catalog/regex. Additional information can be obtained from a UNIX prompt by running info regex. For further information and examples, see the UNIX reference page for regex(7).
CLI:
spinaccess kerb-nis decreaseposition -position mapping_position
GUI: Navigate to the SpinAccess → Kerberos-NIS Mapping node, then select the appropriate mapping from the table and run the Decrease the position command from the drop-down menu of the action pane.
Kerberos-to-NIS mappings are processed in the order of their positions, with the lowest-numbered position (position 1) being processed first. If the pattern is not matched fully, the next mapping (position 2) is processed, and so on. When a pattern matches fully, no more mappings are processed. To decrease the position of the mapping, use the spinaccess kerb-nis decreaseposition command.
-position mapping_position
This is the current position of the mapping you want to move in the list of mappings.
The following example decreases the position of the mapping currently at position 6; that is, moves it closer to the top of the list.
spinserver::> spinaccess kerb-nis decreaseposition -position 6
CLI:
spinaccess kerb-nis delete -position mapping_position
GUI: Navigate to the SpinAccess → Kerberos-NIS Mapping node, then select the appropriate mapping from the table and run the Delete command from the drop-down menu of the action pane.
Use the spinaccess kerb-nis delete command to delete a Kerberos-to-NIS mapping from the system.
The following example deletes the Kerberos-to-NIS mapping at position 6:
spinserver::> spinaccess kerb-nis delete -position 6
CLI:
spinaccess kerb-nis increaseposition -position mapping_position
GUI: Navigate to the SpinAccess → Kerberos-NIS Mapping node, then select the appropriate mapping from the table and run the Increase the position command from the drop-down menu of the action pane.
Kerberos-to-NIS mappings are processed in the order of their positions, with the lowest-numbered position (position 1) being processed first. If the pattern is not matched fully, the next mapping (position 2) is processed, and so on. When a pattern matches fully, no more mappings are processed. To increase the position of the mapping, use the spinaccess kerb-nis increaseposition command.
-position mapping_position
This is the current position of the mapping you want to move in the list of mappings.
The following command example increases the position of the mapping at position 6; that is, moves it closer to the bottom of the list.
spinserver::> spinaccess kerb-nis increaseposition -position 6
CLI:
spinaccess kerb-nis modify -position mapping_position -clientpattern client_pattern -clientpatternreplace client_pattern_replacement
GUI: Navigate to the SpinAccess → Kerberos-NIS Mapping node, then select the appropriate mapping from the table and run the Show command from the drop-down menu of the action pane. Make the appropriate modifications in the table that is displayed, then run the Modify command from the drop-down menu.
To change the configuration of a Kerberos-to-NIS mapping, use the spinaccess kerb-nis modify command.
Note: The command modifies the entry at the -position value you specify and modifies only the parameters you pass in.
Note: If you are using the CLI, you must delimit all regular expressions with double quotation marks ("). For instance, to enter the regular expression (.+) in the CLI, type "(.+)" at the command prompt. Quotation marks are not required in the GUI.
Note: To enter a question mark ( ? ) in the CLI, you must first escape the character by pressing Ctrl-V. The question mark is used in regular expressions in the spinaccess kerb-nis commands. You do not need to use the Ctrl-V sequence before entering a question mark in the GUI.
-position mapping_position
This specifies the current position of the mapping you want to modify.
-clientpattern client_pattern
This specifies the Kerberos principal name that is to be matched.
-clientpatternreplace client_pattern_replacement
This specifies the NIS user name that is to replace the Kerberos principal name.
The following command example modifies the Kerberos-NIS mapping at position 1:
spinserver::> spinaccess kerb-nis modify -position 1 -clientpattern "[^@]+@ENG.EXAMPLE.COM" -clientpatternreplace "eng_guest"
CLI:
spinaccess kerb-nis movefirst -position mapping_position
GUI: Navigate to the SpinAccess → Kerberos-NIS Mappings node, then select the appropriate mapping from the table and run the Make the mapping first (lowest position) command from the drop-down menu of the action pane.
Kerberos-to-NIS mappings are processed in the order of their positions, with the lowest- numbered position (position 1) being processed first. If the pattern is not matched fully, the next mapping (position 2) is processed, and so on. When a pattern matches fully, no more mappings are processed. To change the position of the mapping to the top of the list (position 1), use the spinaccess kerb-nis movefirst command.
-position mapping_position
This is the current position of the mapping you want to move in the list of mappings.
The following example changes the position of the mapping at position 6 to the top of the list (position 1).
spinserver::> spinaccess kerb-nis movefirst -position 6
CLI:
spinaccess kerb-nis movelast -position mapping_position
GUI: Navigate to the SpinAccess → Kerberos-NIS Mappings node, then select the appropriate mapping from the table and run the Make the mapping last (highest position) command from the drop-down menu of the action pane.
Kerberos-to-NIS mappings are processed in the order of their positions, with the lowest-numbered position (position 1) being processed first. If the pattern is not matched fully, the next mapping (position 2) is processed, and so on. When a pattern matches fully, no more mappings are processed. To change the position of the mapping to the bottom of the list, use the spinaccess kerb-nis movelast command.
-position mapping_position
This is the current position of the mapping you want to move in the list of mappings.
The following example changes the position of the mapping at position 6 to the bottom of the list:
spinserver::> spinaccess kerb-nis movelast -position 6
CLI:
spinaccess kerb-nis new -vsname virtual_server_name -clientpattern client_pattern -clientpatternreplace client_pattern_replacement
GUI: Navigate to the SpinAccess → Kerberos-NIS Mappings node, then click New in the top bar of the action pane. Enter the appropriate values into the table that is displayed, then click Create.
When a new mapping is added, it is added at the top of the list of mappings. The Kerberos and NIS patterns must match the entire user or group name for the system to match the pattern.
Note: If you are using the CLI, you must delimit all regular expressions with double quotation marks ("). For instance, to enter the regular expression (.+) in the CLI, type "(.+)" at the command prompt. Quotation marks are not required in the GUI.
Note: If there are spaces used in the name of the pattern or the pattern replacement, the names must be enclosed in quotation marks (for example, -clientpattern "tom curtis").
Note: For further information about regular expressions, please see Mastering Regular Expressions published by O'Reilly and Associates, Inc. at http://www.oreilly.com/catalog/regex. Additional information can be obtained from a UNIX prompt by running info regex. Also, for further information and examples, see the UNIX man page for regex(7).
Note: To enter a question mark ( ? ) in the CLI, you must first escape the character by pressing Ctrl-V. The question mark is used in regular expressions in the spinaccess kerb-nis commands. You do not need to use the Ctrl-V sequence before entering a question mark in the GUI.
-vsname virtual_server_name
This specifies the name of the virtual server on which the mapping is to be located.
-clientpattern client_pattern
This specifies the Kerberos principal name that is to be matched.
-clientpatternreplace client_pattern_replacement
This specifies the NIS user name that is to replace the Kerberos principal name.
The following command example creates a mapping on the virtual server named VS1 from any principal in the Kerberos realm ENG.EXAMPLE.COM to the NIS user name corresponding to the principal's base name with any instance names removed; for example, tom/admin@ENG.EXAMPLE.COM is mapped to tom.
spinserver::> spinaccess kerb-nis new -vsname VS1 -clientpattern "([^@/]+)(/[^@]+)?@ENG.EXAMPLE.COM" -clientpatternreplacement "\1"
CLI:
spinaccess kerb-nis show [-position mapping_position]
GUI: Navigate to the SpinAccess → Kerberos-NIS Mapping node. To display information about a specific mapping, select it from the table and run the Show command from the drop-down menu of the action pane.
After setting up the Kerberos-to-NIS mappings for a network, use the spinaccess cifs-nfs show command to display and review the configuration information for the mappings. The following information about the Kerberos-to-NIS mappings is displayed by the command when no parameters are given:
Position
Virtual server name
Kerberos client pattern
The replacements are displayed by the system when the -position parameter is provided. To display configuration information about all mappings, issue the command without the parameter. To display information about one specific mapping, issue the command with the parameter.
[-position mapping_position]
This is the position of the mapping you want to show in the list of mappings.
The following command example displays information about the Kerberos-to-NIS mapping at position 6.
spinserver::> spinaccess kerb-nis show -position 6
The spinaccess kerberos subnode provides commands for working with Kerberos authentication. It includes the following leaf nodes:
ifconfig
realm
The spinaccess kerberos ifconfig leaf node provides the following commands:
disablekerberos
enablekerberos
show
CLI:
spinaccess kerberos ifconfig disablekerberos -ssid spinserver -ifname interface_name
GUI: Navigate to the SpinAccess → Kerberos → Interfaces node, select the appropriate interface from the table, and run the Disable Kerberos For NFS command from the drop-down menu of the action pane.
The spinaccess kerberos ifconfig disablekerberos command disables Kerberos for an NFS interface.
-ssid spinserver
This specifies a SpinServer with an NFS interface for which Kerberos is to be disabled.
-ifname interface_name
This specifies the name of the NFS interface for which Kerberos is to be disabled.
The following example disables Kerberos for an NFS interface called NFS1 on a SpinServer named Server1.
spinserver::> spinaccess kerberos ifconfig disablekerberos -ssid Server1 -ifname NFS1
CLI:
spinaccess kerberos ifconfig enablekerberos -ssid spinserver -ifname interface_name -spn service_principal_name [-uname admin_user_name] [-passwd admin_password]
GUI: Navigate to the SpinAccess → Kerberos → Interfaces node, select an interface from the table, and run the Enable Kerberos For NFS command from the drop-down menu of the action pane. Enter the appropriate values into the table that is displayed and click Enable Kerberos for NFS.
The spinaccess kerberos ifconfig enablekerberos command enables Kerberos for an NFS interface.
-ssid spinserver
This specifies a SpinServer with an NFS interface for which Kerberos is to be enabled.
-ifname interface_name
This specifies the name of the NFS interface for which Kerberos is to be enabled.
-spn service_principal_name
This specifies the Kerberos service principal name (SPN). This value must be in the form nfs/host_name@REALM, where host_name is the fully qualified host name of the Kerberos server and REALM is the name of the Kerberos realm (for instance, EXAMPLE.COM). Kerberos realm names are in uppercase.
[-uname admin_user_name]
This specifies an administrative user name for the Kerberos realm. This must be a Kerberos principal in the same realm as the principal specified by the -spn parameter; this principal must have permission to create or modify the principal specified by the -spn parameter. The value specified by this parameter is used only for the command and is then discarded; no record of the user name is kept. Specify this parameter only if this interface is the first interface using the SPN specified by the -spn parameter.
[-passwd admin_password]
This specifies the password for the Kerberos administrative user given in the -uname parameter. The value specified by this parameter is used only for the command and is then discarded; no record of the password is kept. Specify this parameter only if this interface is the first interface using the SPN specified by the -spn parameter.
The following example enables Kerberos for an NFS interface called NFS1 on a SpinServer named Server1. The Kerberos service principal name is nfs/foo.data.example.com@ENG.EXAMPLE.COM. The administrative user name is jones/admin, which has a password of z1ppy.
spinserver::> spinaccess kerberos ifconfig enablekerberos -ssid Server1 -ifname NFS1 -spn nfs/foo.data.example.com@ENG.EXAMPLE.COM -uname jones/admin -passwd z1ppy
CLI:
spinaccess kerberos ifconfig show [-ssid spinserver -ifname interface_name]
GUI: Navigate to the SpinAccess → Kerberos → Interfaces node. To display information about a specific interface, select it from the table and run the Show command from the drop-down menu of the action pane.
The spinaccess kerberos ifconfig show command displays the following information about one or more interfaces:
SpinServer ID
Interface name
Port name (GUI only)
IP address (GUI only)
Netmask (GUI only)
Failover port (GUI only)
Service principal name
If information about a single interface is displayed, the following information is also included:
Virtual interface ID
Role
[-ssid spinserver]
This specifies the SpinServer on which the interface is located.
[-ifname interface_name]
This specifies the name of the interface about which information is to be displayed.
The following example displays information about an interface named vif1 on a SpinServer named Server1:
spinserver::> spinaccess kerberos ifconfig show -ssid Server1 -ifname vif1 SpinServer ID Server1 Name vif1 Port serv0 IP Address 10.5.5.1 Netmask 255.255.0.0 Failover Port VIF ID 2 Role Server Service Principal Name nfs/foo.data.example.com@EXAMPLE.COM
CLI:
spinaccess kerberos realm delete -configname configuration_name
GUI: Navigate to the SpinAccess → Kerberos → Realms node, then select the appropriate realm from the table and run the Delete command from the drop-down menu of the action pane.
The spinaccess kerberos realm delete command deletes a Kerberos realm configuration from a SpinServer.
-configname configuration_name
This specifies the name of the Kerberos realm configuration that is to be deleted.
The following example deletes a Kerberos realm configuration named nfs-config1:
spinaccess::> spinaccess kerberos realm delete -configname nfs-config1
CLI:
spinaccess kerberos realm modify -configname configuration_name [-adaddr Active_Directory_address] [-clockskew clock_skew] -kdc KDC_address -kdcport KDC_port -kdcvendor {Microsoft | Other} [-adminaddr admin_server_address] [-adminport admin_server_port] -passwdaddr password_server_address -passwdport password_server_port -realm Kerberos_realm
GUI: Navigate to the SpinAccess → Kerberos → Realms node, then select a realm from the table and run the Show command from the drop-down menu of the action pane. Make the appropriate modifications in the table that is displayed, then run the Modify command from the drop-down menu.
-configname configuration_name
This specifies the configuration name of the realm that is to be modified.
[-adaddr Active_Directory_address]
This specifies the IP address of the Active Directory server. This needs to be specified only if the KDC vendor is specified as Microsoft.
-clockskew clock_skew
This specifies, in seconds, the permitted clock skew between clients and the server. The recommended default is 300 seconds (five minutes).
-kdc KDC_address
This specifies the IP address of the Kerberos Distribution Center (KDC) server.
-kdcport KDC_port
This specifies the port of the KDC server. The recommended default is 88.
-kdcvendor {Microsoft | Other}
This specifies the KDC vendor. Possible values include Microsoft and Other. If Microsoft is specified, the -adaddr parameter must be specified; if Other is specified, the -adminaddr and -adminport parameters must be specified.
[-adminaddr admin_server_address]
This specifies the IP address of the administrative server. This needs to be specified only if the KDC vendor is specified as Other.
[-adminport admin_server_port]
This specifies the port of the administrative server. The recommended default is 749. This needs to be specified only if the KDC vendor is specified as Other.
-passwdaddr password_server_address
This specifies the IP address of the password server.
-passwdport password_server_port
This specifies the port of the password server. The recommended default is 464.
-realm Kerberos_realm
This specifies the name of the Kerberos realm.
The following example modifies a Kerberos configuration named nfs-config1.
spinserver::> spinaccess kerberos realm modify -configname nfs-config1 -clockskew 180 -kdc 10.2.127.0 -kdcport 88 -kdcvendor Other -adminaddr 10.10.0.1 -adminport 749 -passwdaddr 10.10.0.1 -passwdport 464 -realm SECURITY.EXAMPLE.COM
CLI:
spinaccess kerberos realm new -configname configuration_name [-adaddr Active_Directory_address] -clockskew clock_skew -kdc KDC_address -kdcport KDC_port -kdcvendor {Microsoft | Other} [-adminaddr admin_server_address] [-adminport admin_server_port] -passwdaddr password_server_address -passwdport password_server_port -realm Kerberos_realm
GUI: Navigate to the SpinAccess → Kerberos → Realms node, then click New in the top bar of the action pane. Enter the appropriate values into the table that is displayed, then click Create.
-configname configuration_name
This specifies the configuration name of the new realm.
[-adaddr Active_Directory_address]
This specifies the IP address of the Active Directory server. This needs to be specified only if the KDC vendor is specified as Microsoft.
-clockskew clock_skew
This specifies, in seconds, the permitted clock skew between clients and the server. The recommended default is 300 seconds (five minutes).
-kdc KDC_address
This specifies the IP address of the Kerberos Distribution Center (KDC) server.
-kdcport KDC_port
This specifies the port of the KDC server. The recommended default is 88.
-kdcvendor {Microsoft | Other}
This specifies the KDC vendor. Possible values include Microsoft and Other. If Microsoft is specified, the -adaddr parameter must be specified; if Other is specified, the -adminaddr and -adminport parameters must be specified.
[-adminaddr admin_server_address]
This specifies the IP address of the administrative server. This needs to be specified only if the KDC vendor is specified as Other.
[-adminport admin_server_port]
This specifies the port of the administrative server. The recommended default is 749. This needs to be specified only if the KDC vendor is specified as Other.
-passwdaddr password_server_address
This specifies the IP address of the password server.
-passwdport password_server_port
This specifies the port of the password server. The recommended default is 464.
-realm Kerberos_realm
This specifies the name of the Kerberos realm.
The following example creates a Kerberos configuration named nfs-config1. A clock skew of 300 seconds (five minutes) is permitted. The KDC server's address is 10.2.127.0, the KDC port is 88, and the KDC vendor is Other. The address of the administrative server is 10.10.0.1 and the administrative port is 749. The password server's address is 10.10.0.1 and the password port is 464. The Kerberos realm is named SECURITY.EXAMPLE.COM.
spinserver::> spinaccess kerberos realm new -configname nfs-config1 -clockskew 300 -kdc 10.2.127.0 -kdcport 88 -kdcvendor Other -adminaddr 10.10.0.1 -adminport 749 -passwdaddr 10.10.0.1 -passwdport 464 -realm SECURITY.EXAMPLE.COM
CLI:
spinaccess kerberos realm show [-configname configuration_name]
GUI: Navigate to the SpinAccess → Kerberos → Realms node. To display information about a specific configuration, select it from the table and run the Show command from the drop-down menu of the action pane.
Use the spinaccess kerberos realm show command to display information about a Kerberos realm.
[-configname configuration_name]
This specifies the name of the configuration about which information is to be displayed.
The following example displays information about a Kerberos configuration named nfs-config1.
spinserver::> spinaccess kerberos realm show -configname nfs-config1 Configuration Name nfs-config1 Active Directory IP Address Clock Skew 300 KDC Address 10.2.127.0 KDC Port 88 KDC Vendor Other Admin Server Address 10.10.0.1 Admin Server Port 749 Password Server Address 10.10.0.1 Password Server Port 464 Kerberos Realm SECURITY.EXAMPLE.COM
The spinaccess nfs domains subnode includes the following leaf-node commands:
delete
modify
new
show
CLI:
spinaccess nfs domains delete -domainname NIS_domain_name
GUI: Navigate to the SpinAccess → NFS → NIS Domains node, then select the appropriate domain from the table and run the Delete command from the drop-down menu of the action pane.
The following example removes an NIS domain named engineering@acmebricks.com from the system.
spinserver::> spinaccess nfs domains delete -domainname engineering@acmebricks.com
CLI:
spinaccess nfs domains modify -domainname NIS_domain_name -nisservers [NIS_IP_addresses]
GUI: Navigate to the SpinAccess → NFS → NIS Domains node, then select the appropriate domain from the table and run the Show command from the drop-down menu of the action pane. Make the appropriate modifications in the table that is displayed, then run the Modify command from the drop-down menu.
-domainname NIS_domain_name
This is the name of the NIS domain.
-nisservers [NIS_IP_addresses]
This is the IP address or addresses for the NIS server or servers. If multiple addresses are specified, they must be listed in a square-bracketed, comma-separated list.
The following example modifies an NIS domain named acmebricks.com so that it uses NIS servers at the IP addresses 10.2.2.1 and 10.3.3.1.
spinserver::> spinaccess nfs domains modify -domainname acmebricks.com -nisservers [10.2.2.1, 10.3.3.1]
CLI:
spinaccess nfs domains new -domainname NIS_domain_name -nisservers [NIS_IP_addresses]
GUI: Navigate to the SpinAccess → NFS → NIS Domains node, then click New in the top bar of the action pane. Enter the appropriate values into the table that is displayed, then click Create.
Use the spinaccess nfs domains new command to specify the NIS domain to be used by identifying their domain names and NIS servers. The -nisservers parameter for this command specifies a square-bracketed, comma-separated list of NIS servers that handle NIS requests for the specified domain. If the option is omitted, a broadcast search is used to look for NIS servers for the domain.
-domainname NIS_domain_name
This is the NIS domain name.
-nisservers [NIS_IP_addresses]
This is the IP address or addresses for the NIS server or servers. If multiple addresses are specified, they must be listed in a square-bracketed, comma-separated list.
The following example specifies a NIS domain named acmebricks.com that uses NIS servers at the IP addresses 10.2.2.1 and 10.3.3.1.
spinserver::> spinaccess nfs domains new -domainname acmebricks.com -nisservers [10.2.2.1, 10.3.3.1]
CLI:
spinaccess nfs domains show [-domainname NIS_domain_name]
GUI: Navigate to the SpinAccess → NFS → NIS Domains node. To display information about a specific domain, select it from the table and run the Show command from the drop-down menu of the action pane.
The spinaccess nfs domains show command, without the -domainname parameter, displays configuration information about all currently defined NFS domains within the system. To display information about a specific NFS domain, use the command with the -domainname parameter. When you specify a domain, the following information is displayed:
NIS domain name
Communication type
NIS domain server name or names.
The following command example displays the configuration information for an NIS domain named acmebricks.com.
spinserver::> spinaccess nfs domains show -domainname acmebricks.com NIS Domain Name acmebricks.com Communication Type Server Domain Servers 10.1.1.10
The spinaccess nfs servers subnode command includes the following leaf-node commands:
delete
modify
new
show
CLI:
spinaccess nfs servers delete -vsname virtual_server_name
GUI: Navigate to the SpinAccess → NFS → Servers node, then select the appropriate server from the table and run the Delete command from the drop-down menu of the action pane.
The spinaccess nfs servers delete command removes the associations between a virtual server and NIS domains and Kerberos realms.
The following command example removes an NFS server named VS1 from the system.
spinserver::> spinaccess nfs servers delete -vsname VS1
CLI:
spinaccess nfs servers modify -vsname virtual_server_name -domainname NIS_domain_name -kerbrealms [Kerberos_realms]
GUI: Navigate to the SpinAccess → NFS → Servers node, then select the appropriate server from the table and run the Delete command from the drop-down menu of the action pane.
To modify the associations between a virtual server and its NIS domains and Kerberos realms, use the spinaccess nfs servers modify command.
-vsname virtual_server_name
This is the name given to the virtual server.
-domainname NIS_domain_name
This is the name of the NIS domain.
-kerbrealms [Kerberos_realms]
This is the list of Kerberos realms that is visible to the virtual server. If multiple values are specified, they must be listed in a square-bracketed, comma-separated list.
The following command example modifies a NIS domain named acmebricks.com that is attached to a virtual server named VS1. Kerberos realms named ENG and MARKETING are visible to the virtual server.
spinserver::> spinaccess nfs servers modify -vsname VS1 -domainname acmebricks.com -kerbrealms [ENG,MARKETING]
CLI:
spinaccess nfs servers new -vsname virtual_server_name -domainname NIS_domain_name -kerbrealms [Kerberos_realms]
GUI: Navigate to the SpinAccess → NFS → Servers node, then click New in the top bar of the action pane. Enter the appropriate values into the table that is displayed, then click Create.
To attach an NIS domain and a set of Kerberos realms to a virtual server, use the spinaccess nfs servers new command.
Note: Only one NIS domain can be bound to a virtual server at a time.
-vsname virtual_server_name
This is the virtual server name. This name must already exist as a virtual server that was created by using the vservers servers new command.
-domainname NIS_domain_name
This is the NIS domain name.
-kerbrealms [Kerberos_realms]
This is the list of Kerberos realms that is visible to the virtual server. If multiple values are specified, they must be listed in a square-bracketed, comma-separated list.
The following command example attaches an NIS domain named acmebricks.com to a virtual server named VS1. Kerberos realms named ENG and FINANCE are visible to the virtual server.
spinserver::> spinaccess nfs servers new -vsname VS1 -domainname acmebricks.com -kerbrealms [ENG,FINANCE]
CLI:
spinaccess nfs servers show [-vsname virtual_server_name]
GUI: Navigate to the SpinAccess → NFS → Servers node. To display information about a specific server, select it from the table and run the Show command from the drop-down menu of the action pane.
The spinaccess nfs servers show displays information about one or more NIS domains and Kerberos realms attached to virtual servers. To display configuration information about all NIS domains and Kerberos realms attached to virtual servers, do not use the -vsname parameter. To display information about a specific NIS domain, use the command with the -vsname parameter. The following information is displayed:
Virtual server name
NIS domain name
Kerberos realms
The following command example displays information about an NFS server named VS1.
spinserver::> spinaccess nfs servers show -vsname VS1 Virtual Server VS1 NIS Domain Name acmebricks.com Kerberos Realms ENG, FINANCE
CLI:
spinaccess status show [-ssid spinserver -stream stream_number]
GUI: Navigate to the SpinAccess → Status node. To display information about the status of a particular stream, select it from the table and run the Show command from the drop-down menu of the action pane.
The spinaccess status show command displays the following information about SpinAccess usage:
SpinServer ID
Stream number
Stream aggregation status. Possible values are Full, indicating that the stream is ready to serve both NFS and CIFS requests; Partial, indicating that the stream is partially ready to serve client requests (for instance, to serve NFS requests but not CIFS requests); and None, indicating that the stream is not ready to serve client requests.
If you specify the -ssid and -stream parameters, the command displays the following additional information about the specified SpinServer and stream:
Number of privileged IP addresses
Number of security ID (SID) mappings
Number of server NIS domains
Number of CIFS-to-NFS mappings
Number of Kerberos-to-NFS mappings
Number of CIFS servers
Number of superusers
Number of CIFS shares
Number of NIS domains
Number of Kerberos service principal names
Number of Kerberos keys
[-ssid spinserver]
This specifies the ID of the SpinServer.
[-stream stream_number]
This specifies the number of the stream for which SpinAccess information is to be displayed.
The following example displays information about stream 0 on a SpinServer named Server1:
spinserver::> spinaccess status show -ssid Server1 -stream 0 SpinServer ID Server1 Stream 1 Status Full Privileged IPs 10 SID Mappings 10 NIS Domains 10 CIFS-NFS Mappings 10 KERB-NFS Mappings 10 CIFS Servers 10 Super Users 10 CIFS Shares 10 NIS Domains 10 Kerberos SPNs 10 Kerberos Keys 10
CLI:
spinaccess superuser cifs delete -vsname virtual_server_name -domainname domain_name -username user_name
GUI: Navigate to the SpinAccess → Super User → CIFS node, then select the appropriate user from the table and run the Delete command from the drop-down menu of the action pane.
To remove a CIFS user from the list of CIFS users that are eligible for superuser access, use the spinaccess superuser cifs delete command.
-vsname virtual_server_name
This is the name given to the virtual server.
-domainname domain_name
This is the domain name for the CIFS user.
-username user_name
This is the name of the CIFS user in the specified domain to be removed from the list of CIFS users that are eligible for superuser access for the specified virtual server.
The following command example removes a CIFS user named tom from the list of eligibility for superuser access to the domain named MARKETING that is attached to the virtual server named VS1.
spinserver::> spinaccess superuser cifs delete -vsname VS1 -domainname MARKETING -username tom
CLI:
spinaccess superuser cifs new -vsname virtual_server_name -domainname domain_name -username user_name
GUI: Navigate to the SpinAccess → Super User → CIFS node, then click New in the top bar of the action pane. Enter the appropriate values into the table that is displayed, then click Create.
To add a CIFS user to the list of CIFS users that are eligible for superuser access, use the spinaccess superuser cifs new command.
-vsname virtual_server_name
This is the name given to the virtual server.
-domainname domain_name
This is the domain name for the CIFS user. This domain must be configured by using the spinaccess cifs domains new command and must be one of the visible domains for the virtual server.
-username user_name
This is the name of the CIFS user in the specified domain to be added to the list of CIFS users that are eligible for superuser access for the specified virtual server.
The following example adds a CIFS user named joe to the list of eligibility for superuser access to the domain named MARKETING that is attached to the virtual server named VS1.
spinserver::> spinaccess superuser cifs new -vsname VS1 -domainname MARKETING -username joe
CLI:
spinaccess superuser cifs show
GUI: Navigate to the SpinAccess → Super User → CIFS node. The information is displayed in a table in the action pane.
To display the list of CIFS users that are eligible for superuser access, use the spinaccess superuser cifs show command. The command displays the following information:
Virtual server name
Domain name
User name
The following example displays the list of eligible superusers for all virtual servers.
spinserver::> spinaccess superuser cifs show Virtual Server Domain Name User Name VS1 ENG louise VS1 ENG myrtle VS1 ENG joe
CLI:
spinaccess superuser privilegedips delete -vsname virtual_server_name -address IP_address -netmask netmask
GUI: Navigate to the SpinAccess → Super User → Privileged IPs node, then select the appropriate IP address from the table and run the Delete command from the drop-down menu of the action pane.
To remove an IP address block from the list of network addresses that are eligible for superuser access, use the spinaccess superuser privilegedips delete command.
-vsname virtual_server_name
This is the name given to the virtual server. Each privileged IP block applies to one and only one virtual server. This parameter specifies the virtual server to which the specified privileged IP address block applies.
-address IP_address
For the user to be eligible for superuser access, this network address must be matched.
-netmask netmask
This is the network mask that is applied to the client's IP address before it is compared to the network address that determines superuser eligibility.
The following command example removes the IP address block 192.168.0.0, with netmask 255.255.0.0, from the list of network addresses that are eligible for superuser access to virtual server VS1.
spinserver::> spinaccess superuser privilegedips delete -vsname VS1 -address 192.168.0.0 -netmask 255.255.0.0
CLI:
spinaccess superuser privilegedips new -vsname virtual_server_name -address IP_address -netmask netmask
GUI: Navigate to the SpinAccess → Super User → Privileged IPs node, then click New in the top bar of the action pane. Enter the appropriate values into the table that is displayed, then click Create.
To create an IP address block for superuser access, use the spinaccess superuser privilegedips new command. The client must connect from this IP address block to be eligible for superuser access.
-vsname virtual_server_name
This is the name of the virtual server. Each privileged IP block applies to one and only one virtual server. This parameter specifies the virtual server to which the specified privileged IP address block applies.
-address IP_address
For the user to eligible for superuser access, this network address must be matched.
-netmask netmask
This is the network mask that is applied to the client's IP address before it is compared to the network address that determines superuser eligibility.
The following example creates a superuser IP address block for the IP address 192.168.0.0, with netmask 255.255.0.0, for a virtual server named VS1.
spinserver::> spinaccess superuser privilegedips new -vsname VS1 -address 192.168.0.0 -netmask 255.255.0.0
CLI:
spinaccess superuser privilegedips show
GUI: Navigate to the SpinAccess → Super User → Privileged IPs node. The information is displayed in a table in the action pane.
Copyright © 2004 Network Appliance, Inc.; copyright © 2003, 2004 Spinnaker Networks, LLC. All rights reserved. Specifications subject to change without notice.