How CIFS users obtain UNIX credentials

How to specify entries for the /etc/usermap.cfg file

Character coding of the /etc/usermap.cfg file

For information about character coding of the /etc/usermap.cfg file, see the section about the contents of the /etc directory in the Storage Management Guide.

Overview of the /etc/usermap.cfg format

Each line in the /etc/usermap.cfg file is a map entry in the following format:

[IP_qualifier:] Windows_name [direction] [IP_qualifier:]UNIX_name

The direction field determines whether the entry is for mapping from Windows to UNIX, from UNIX to Windows, or both. For information about why Data ONTAP needs to map UNIX names to Windows names, see Accessing CIFS files from NFS clients.

You can embed comments in the file by beginning the comment lines with #. Comments at the end of an entry are also allowed if preceded by #. Blank lines are ignored.

Default contents of the /etc/usermap.cfg file

When CIFS is started, if the /etc/usermap.cfg file is missing, a default file is created. It contains commented-out sample map entries that are useful for improving security.

IP_qualifier field

The IP_qualifier field is an IP address that qualifies the user name. It narrows the match.

The IP qualifier can be

An IP address in bit notation. You can specify a subnet by including the number of bits in the subnet mask. For example, 192.4.1.0/24 means the 192.4.1.0 class C subnet.
A name. Data ONTAP first considers a name to be a host name. If it cannot find a matching host name in its host name database, it considers the name to be a network name.
A subnet address that includes a network name or IP address and the subnet mask (for example, corpnet/255.255.255.0).
Note
Data ONTAP uses the IP qualifier only for matching. If an IP qualifier is present on the destination side of a map entry, Data ONTAP does not consider the login request to come from that IP qualifier.

Windows_name field

The Windows_name field consists of a Windows domain name, which is optional, and a Windows user name. For more information about the syntax, see How to specify a Windows name.

Meaning of Windows domain

On the source side of the map entry, the domain specifies the domain in which the user resides. On the destination side of the map entry, it specifies the domain used for the mapped UNIX entry. If the account name in the entry is a local user account, the Windows domain name is the filer name.

Default Windows domain

If you omit the domain name in the Windows_name field, it is assumed to be the domain in which the filer is installed. If the filer uses local user accounts for authentication, the domain name is the filer name.

Use of wildcard character in the domain name

You can use an asterisk (*) in the following ways:

You can use it on the source side to indicate that the specified name in any domain maps to the specified UNIX name.
You can use it on the destination side to indicate that the specified UNIX name maps to a Windows name in any trusted domain.
The trusted domain used for the mapping depends on where Data ONTAP finds the first matching Windows name. Data ONTAP searches only the trusted domains you specify with the cifs.search_domains option, in the order in which the trusted domains are specified. If you do not set this option, Data ONTAP searches all trusted domains in an unspecified order.

Special characters in the user name

If the user name contains spaces or a pound sign (#), enclose the name in double quotation marks, for example, "bob smith" or "eng#lab"\"#joe".

Note
Only the user name should be inside the double-quotation marks. For example, it is incorrect to specify "mktg\bob smith". The correct syntax is mktg\"bob smith".

Use of wildcard character in the user name

You can use an asterisk (*) in the Windows name. For more information about how to use the asterisk, see Guidelines for wildcard character in user name.

Use of blank as the user name

If the user name is empty or blank (specified as "") on the destination side of the map entry, the matching UNIX name is denied access. Use entries with a blank user name to deny access to some or all UNIX users. If you use these entries in conjunction with IP_qualifier, you can exclude all UNIX users except for certain hosts or subnets.

Direction field

The direction field indicates the direction of the mapping. It can be one of the values in the following table.

Value of the direction field	Meaning
==	Mapping is bidirectional. The entry maps from Windows to UNIX and from UNIX to Windows. Omitting the direction field has the same meaning as specifying ==.
<=	The entry maps from UNIX to Windows.
=>	The entry maps from Windows to UNIX.

Value of the direction field

Meaning

Mapping is bidirectional. The entry maps from Windows to UNIX and from UNIX to Windows.

Omitting the direction field has the same meaning as specifying ==.

The entry maps from UNIX to Windows.

The entry maps from Windows to UNIX.

UNIX_name field

Meaning of UNIX_name

The UNIX_name field is a UNIX name in the UNIX password database.

Use of wildcard character in the UNIX name

You can use an asterisk (*) in the UNIX name. For more information about how to use the asterisk, see Guidelines for wildcard character in user name.

Use of blank as the UNIX name

If UNIX_name is empty or blank (specified as "") on the destination side of the map entry, the specified source name is prevented from logging in. The Windows user cannot log in to the filer even if the user can see the filer while browsing the network.

Guidelines for wildcard character in user name

The asterisk is considered the wildcard character. It means any user. Remember these guidelines when including an asterisk in the Windows name or the UNIX name:

If the asterisk is on the source side of the mapping, any user maps to the specified name on the destination side.
If the destination side contains an asterisk but the source side does not, no mapping is done. Data ONTAP does not map an explicitly specified name to a name with an asterisk.
If both the source and destination sides contain an asterisk, the corresponding name is mapped.