man1/na_dafs_access(1) manual page

Manual Pages

Table of Contents

NAME

dafs access - Manage host access for DAFS exports

SYNOPSIS

dafs access add [-n] -h host [-e export_name | -p path]

dafs access delete [-n] -h host [-e export_name | -p path]

dafs access set [-n] -h host_list [-e export_name | -p path]

dafs access get [-e export_name | -p path]

DESCRIPTION

The dafs accessc ommand manages host access to DAFS exports. Each DAFS export has an associated access control list (ACL), used to control access to the export by client hosts.

The following ACL entry types are defined:

ACCESS: Provides default read/write access to an export by all or specified hosts.

NONE: Denies access to an export by specific host(s).

If the access list for a DAFS export is empty, or contains only NONE entries, then all hosts may access that export except for those with an ACL type of NONE. If the access list is non-empty, then only DAFS sessions which are identified as originating from one of the hosts in the list with an ACL entry of type ACCESS may access the export.

Options are provided for adding and deleting individual hosts from a specific or all exports, for setting the access list for a specific or all exports, and for viewing the access list for all or specific exports.

For each option the export to use is specified by the -e argument. This is the preferred usage. For scripting purposes the -p argument may be used instead, which allows the path for the export to be specified. If the -p argument is used it must correspond to an export point directory, e.g. /vol/vol0. If no export name/path is provided then the access operation is applied to all exports.

OPTIONS

add [-n] -h host [-e export_name | -p path] Add host to the access list for export_name. If host is already in the access list then no error is returned. If no export is given then the host is added to all access lists. If -n is specified then the ACL entry for the host is of type NONE.

delete [-n] -h host [-e export_name | -p path] Delete host from the access list for export. If no export is given then the host is deleted from all access lists. If -n is specified then the ACL for the host is of type NONE.

set [-n] -h host_list [-e export_name | -p path]

Replace the access list for export_name by host_list, which is a list of hosts names delimited by colons (:). If an empty host_list is given then the access list is made empty. If no export is given then the access list is replaced for all access lists. If -n is specified then the ACL for the hosts is of type NONE.

get [-e export_name | -p path]
Display the access list for export_name. If no export is specified then the access lists for all exports is displayed.

EXAMPLES

Add host new_host to the access list for export prod1

       dafs access add -h new_host -e prod1

Do not allow host bad_host to access any exports. Remove any positive ACL ACCESS entries, then add NONE ACL entries:

       dafs access delete -h bad_host
       dafs access add -n -h bad_host

Display the access lists for all exports:

       dafs access get

Reset the host list for export database_log to the default (empty) list:

       dafs access set -h "" -e database_log

LIMITATIONS

When performing access control, client host names are determined from the remote transport address of the DAFS client, and the representation of that address on the filer in the nameservice. If the client supports multiple interfaces or has other names which may be presented to the filer these must specified in the access list as appropriate. To see the DAFS view of the host name for a client session use the dafs status -sv command.

NOTES

Host-specific access controls may be additionally restricted by export-specific configuration. Examples of this include read-only exports and disabled exports. See na_dafs_exports(1) for more information on export-specific configuration.