Using configuration files to maintain user information

Understanding configuration files

Configuration files available

Data ONTAP stores user information in the following four configuration files:

/etc/passwd
/etc/group
/etc/netgroup
/etc/shadow

Location of configuration files

When Data ONTAP is first installed on the filer, the passwd and group files are automatically created in the /etc directory. If you want to use the shadow and netgroup files, you need to create them in the /etc directory.

Purpose of the passwd and group files

Data ONTAP uses passwd and group files for the following purposes:

To authenticate (PC)NFS access
To translate user and group names in the /etc/quotas file to UIDs and GIDs
To authenticate CIFS users
If, during setup, you configure Data ONTAP to use the passwd file to authenticate CIFS users, Data ONTAP uses the encrypted passwords in the passwd file to verify the user login names and passwords.
To obtain UNIX credentials of CIFS users
If, during setup, you configure the filer to be a member of a domain or a Windows NT workgroup, Data ONTAP uses the domain controller or local user accounts to authenticate users. Data ONTAP, however, uses the passwd file for obtaining UNIX credentials of CIFS users. For more information about UNIX credentials, see the section on how CIFS users obtain UNIX credentials in the CIFS chapter in the File Access Management Guide.

Purpose of the netgroup file

Data ONTAP uses the netgroup file only to check access permission for remote mounting requests. For more information about the netgroup file, see the na_netgroup(5) man page.

Purpose of the shadow file

Data ONTAP uses the shadow file to securely store the user passwords that would otherwise be in a passwd file.

Generally, the passwd file contains the user names and encrypted passwords of users who are authorized to access a filer. However, sometimes it is required to have the passwd file readable by everyone, thus making the password information vulnerable. To overcome this vulnerability, you can use a shadow file. The password field in the passwd file is left blank if you use a shadow file. The shadow file contains encrypted passwords for all users in the passwd file. For more information about the shadow file, see the na_shadow(5) man page.

Default entry in the passwd file

The following illustration shows the default entry in the passwd file.

The following table describes the fields in an entry.

Field	Description
User name	Contains a user name for the user.
Encrypted password	Contains a password for the user. Data ONTAP disregards this field if NIS or a Windows NT domain controller is used to authenticate user names and passwords. This field is blank if you are using the shadow file.
UID	Contains a unique integer that is the UID.
GID	Contains a unique integer that is the user's primary GID.
User's full name	Contains the user's full name. Data ONTAP ignores this field.
UNIX home directory	Contains the path of the user's home directory. Data ONTAP ignores this field.
Default shell	Contains the path of the user's default shell. Data ONTAP ignores this field.

Default entry in the group file

The following illustration shows the default entry in the group file.

Field	Description
Group name	Contains a unique group name.
Encrypted password	Contains a password. Data ONTAP ignores this field.
GID	Contains a unique integer that is the GID.
User names	Contains a comma-separated list of user names that belong to the group.