Guidelines and recommendations for mapping user names

Guidelines for mapping user names

Follow these guidelines to keep entries simple and easy to understand:

Keep Windows user names and UNIX user names the same whenever possible. If the names are identical, you do not need to create map entries in the /etc/usermap.cfg file.
Avoid creating confusing map entries such as these:
```
"tome s" => tjs
```
```
bill <= tjs
```
Avoid using IP qualifiers to map users differently. For example, it is confusing if you map UNIX user tjs from UHOST1 to Windows user "Tom S" but UNIX user tjs from UHOST2 to Windows user Smith. Use IP qualifiers only to restrict access.

Recommended entries for increased security

The entries in the following table help prevent unauthorized users from accessing the filer. Remember that the order of entries is important when you copy these recommended entries to your file, because Data ONTAP uses the first matching entry to determine the mapping.

Map entry	Meaning
*\root => nobody	Any Windows users named root can log in, but they do not have UNIX permissions. For any instances of a Windows user named root that should map differently, you explicitly add a map entry earlier in the /etc/usermap.cfg file.
guest <= administrator guest <= root	The first entry prevents spoofing the Windows Administrator account from UNIX (if the Administrator account has not been renamed). The second entry maps the UNIX user root to the Windows guest account. Type the second entry near the end of the /etc/usermap.cfg file after any explicit map entries for root-privileged UNIX hosts or subnets.
\ => "" "" <= *	These entries, placed at the end of the file, prevent any other mapping from occurring. They defeat the default behavior that if an entry is not matched, the same name is tried.

Map entry

Meaning

*\root => nobody

Any Windows users named root can log in, but they do not have UNIX permissions. For any instances of a Windows user named root that should map differently, you explicitly add a map entry earlier in the /etc/usermap.cfg file.

guest <= administrator

guest <= root

The first entry prevents spoofing the Windows Administrator account from UNIX (if the Administrator account has not been renamed). The second entry maps the UNIX user root to the Windows guest account. Type the second entry near the end of the /etc/usermap.cfg file after any explicit map entries for root-privileged UNIX hosts or subnets.

*\* => ""

"" <= *

These entries, placed at the end of the file, prevent any other mapping from occurring. They defeat the default behavior that if an entry is not matched, the same name is tried.

Verifying NFS clients

For multiprotocol filers, you can restrict NFS access to allow only clients that have been mapped in the usermap.cfg file. This security restriction is probably most appropriate for non-Kerberos environments that primarily serve CIFS clients but want to allow connections from certain known (IP-mapped) NFS clients. See the Data ONTAP command reference description of the nfs.require_valid_mapped_uid option for more information.