Changing and displaying a share-level ACL

Reason for changing a share-level ACL

After you create a share, by default, the share-level ACL gives Full Control to the special group named Everyone. That is, all users in the domain and all trusted domains have full access to the share; their access to the share contents is restricted only by file- and directory-level ACLs. You would change the share-level ACL if you want to use a more restrictive set of permissions for the share.

Methods of changing a share-level ACL

To change a share-level ACL, use one of the following methods:

From a Windows client, use Server Manager. Remember these guidelines if you use this method:
- You can specify only Windows permissions.
- The user and group names specified must be Windows names.
- The share-level ACL must not have UNIX-style permissions; otherwise, Server Manager displays an error message.
From the Data ONTAP command line, you can use the cifs access command. Remember these guidelines if you use this method:
- You can specify either Windows permissions or UNIX-style permissions.
- The user and group names can be Windows or UNIX names.
  If the filer is authenticated by the /etc/passwd file, the user or group name in the ACL is assumed to be a UNIX name. If the filer is authenticated by a domain controller, the name is assumed to be a Windows name, unless the name is not found on the domain controller. In that case, the filer tries to look up the name in the UNIX name database.

Displaying and changing an ACL with Server Manager

To display and change an ACL with Server Manager, complete the following steps.

Step	Action
1	Select your filer from Server Manager.
2	Display and change the permissions for a selected share as you would on a Windows NT server. Example of changing an existing ACL The following figure illustrates how to display and then change the permissions for the specs share so that the Everyone group can read it.

Step

Action

Select your filer from Server Manager.

Display and change the permissions for a selected share as you would on a Windows NT server.

Example of changing an existing ACL

The following figure illustrates how to display and then change the permissions for the specs share so that the Everyone group can read it.

Adding an entry to an ACL with Server Manager

To add an entry to an ACL with Server Manager, complete the following steps.

Step	Action
1	Select your filer from Server Manager.
2	Add a user or group to the ACL as you would on a Windows NT server. Example of adding an entry to an ACL The following figure illustrates how to add a user named LAB\aimee to the ACL for the specs share.

Step

Action

Select your filer from Server Manager.

Add a user or group to the ACL as you would on a Windows NT server.

Example of adding an entry to an ACL

The following figure illustrates how to add a user named LAB\aimee to the ACL for the specs share.

Removing an entry from an ACL with Server Manager

To remove an entry from an ACL with Server Manager, complete the following steps.

Step	Action
1	Select your filer from Server Manager.
2	Remove a user or group from the ACL as you would on a Windows NT server. Example of removing an entry from an ACL The following figure illustrates how to remove a user named LAB\aimee from the ACL for the specs share.

Step

Action

Select your filer from Server Manager.

Remove a user or group from the ACL as you would on a Windows NT server.

Example of removing an entry from an ACL

The following figure illustrates how to remove a user named LAB\aimee from the ACL for the specs share.

Changing an ACL from the Data ONTAP command line

To change an ACL from the Data ONTAP command line, complete the following step.

Step	Action
1	Enter the following command: cifs access share [ -g ] { user \| group } rights The `-g` argument specifies that the permissions are defined for a UNIX group. Do not include the `-g` argument if the permissions are for a Windows group. The command syntax does not provide a mechanism to differentiate between a Windows user name and a Windows group name. user is a UNIX user name or a Windows user name. group is a UNIX group name or a Windows group name. If the group is a local group, specify the filer name as the domain name (for example, toaster\writers). rights is a set of UNIX-style permissions or Windows permissions. Examples The following examples assign access rights to the share named library: `cifs access library -g engineering rwx` `cifs access library marketing\joed Change`

Step

Action

Enter the following command:

cifs access share [ -g ] { user | group } rights

The -g argument specifies that the permissions are defined for a UNIX group. Do not include the -g argument if the permissions are for a Windows group. The command syntax does not provide a mechanism to differentiate between a Windows user name and a Windows group name.

user is a UNIX user name or a Windows user name.

group is a UNIX group name or a Windows group name. If the group is a local group, specify the filer name as the domain name (for example, toaster\writers).

rights is a set of UNIX-style permissions or Windows permissions.

Examples

The following examples assign access rights to the share named library:

cifs access library -g engineering rwx
cifs access library marketing\joed Change

Removing an entry from an ACL with the Data ONTAP command line

To remove an entry from an ACL with the Data ONTAP command line, complete the following step.

Step	Action
1	Enter the following command: *cifs access -delete share* { user \| group }** Examples The following command removes the engineering group from the ACL for the library share: cifs access -delete library engineering The following command removes the user marketing\joed from the ACL for the library share. cifs access -delete library marketing\joed

Step

Action

Enter the following command:

cifs access -delete share { user | group }

Examples

The following command removes the engineering group from the ACL for the library share:

cifs access -delete library engineering

The following command removes the user marketing\joed from the ACL for the library share.

cifs access -delete library marketing\joed

Displaying share-level ACLs from the Data ONTAP command line

To display share-level ACLs, complete the following step.

Step	Action
1	Enter the following command: *cifs shares [ share_name* ]** Result If the filer uses password authentication, the permission style displayed in share-level ACLs is UNIX style. If the filer uses domain controller authentication, the permission style is identical to the style you used when specifying the ACLs, with the following exceptions: If you specified rwx as the UNIX-style permissions, the permissions are displayed as Full Control in the ACL. If you specified --- as the UNIX-style permissions, the permissions are displayed as No Access in the ACL. If you specified r-x as the UNIX-style permissions, the permissions are displayed as Read in the ACL.

Step

Action

Enter the following command:

cifs shares [ share_name ]

Result

If the filer uses password authentication, the permission style displayed in share-level ACLs is UNIX style. If the filer uses domain controller authentication, the permission style is identical to the style you used when specifying the ACLs, with the following exceptions:

If you specified rwx as the UNIX-style permissions, the permissions are displayed as Full Control in the ACL.
If you specified --- as the UNIX-style permissions, the permissions are displayed as No Access in the ACL.
If you specified r-x as the UNIX-style permissions, the permissions are displayed as Read in the ACL.