Sharing directories on the filer

About shared directories

As Administrator, you can create directories on the filer. These directories do not automatically become accessible to users. You must create shares that correspond to these directories so that users can share the directories.

What you must specify when creating a share

When you create a share, you must provide

The complete path name of an existing folder, qtree, or volume to be shared
The name of the share entered by users when they connect to the share

Share naming conventions

Share naming conventions for Data ONTAP are the same as for Windows. For example, share names ending with the $ character are hidden shares, and certain share names, such as ADMIN$ and IPC$, are reserved.

Share names are not case-sensitive.

What you can specify when creating a share

You can (optionally) specify these share properties when you create a share:

Description of the share
Maximum number of users who can simultaneously access the share
Share-level ACL
Note
You can specify the share-level ACL during share creation only if you create the share using Windows administrative tools. You can modify the share-level ACL of an existing share using Windows or using the filer's command line.

If you create the share from the Data ONTAP command line, you can also specify the following share properties:

Group membership for files in the share
Control of share boundary checking for symbolic links in the share
Support for wide symbolic links in the share
Umask value for the share
Disabling of virus scanning when files in the share are opened
Disabling of virus scanning when files in the share are opened for read-only access
Disallowing file caching in the share by Windows clients
Support for automatic caching of documents and programs in the share by Windows clients

You can change these attributes at any time after you create a share.

About the share description

The share description appears in the Comment field when you browse the shares on the network. The description can contain only characters that are in the current code page.

About the maximum number of users

You can specify the maximum number of users who can simultaneously access the share. If you do not specify the number, the number of users is limited by the filer memory. For more information about how filer memory affects the number of users who can connect to the filer simultaneously, see CIFS limitations.

About group membership of files in the share

When you create a share from the Data ONTAP command line, you can specify that all files created by CIFS users in that share belong to the same group, which must be a predefined group in the UNIX group database. The group you specify is called a "forcegroup."

Effects of a forcegroup on CIFS access

The following list describes what happens to files created by CIFS if the share has a forcegroup:

All files in this share created by CIFS users belong to the same forcegroup, regardless of the GID of the file owner.
CIFS users who access this share are temporarily changed to the GID of the forcegroup. This GID enables them to access files in this share that are not accessible normally with their primary GID or UID.

When CIFS users try to access a file created by NFS, the CIFS users' primary GIDs determine access rights.

Effects of a forcegroup on NFS access

The forcegroup does not affect how NFS users access files in this share. A file created by NFS acquires the GID from the file creator.

Advantages of specifying a forcegroup

Using a forcegroup makes it easier to ensure that files can be accessed by CIFS users belonging to various groups. For example, if you want to create a share to store the company's Web pages and give write access to users in Engineering and Marketing, you can create a share and give write access to a forcegroup named "web." Because of the forcegroup, all files created by CIFS users in this share are owned by the web group. In addition, users are automatically assigned the GID of the web group when accessing the share. As a result, all the users can write to this share without your managing the access rights of the Engineering and Marketing groups.

Where a forcegroup is useful

Specifying a forcegroup is meaningful only if the share is in a UNIX or mixed qtree. There is no need to use forcegroups for shares in an NTFS qtree because access to files in these shares is determined by Windows permissions, not GIDs.

About the share-level ACL

When you create a share using Server Manager, you can specify the share-level ACL. If you use the Data ONTAP command line, you can specify the share-level permissions only after a share has been created. By default, a newly created share gives everyone Full Control. For more information about share-level ACLs, see How share-level access control lists work.

About share boundary checking for symbolic links

You disable share boundary checking for symbolic links for a share if you want to allow CIFS clients to follow symbolic links in that share to destinations anywhere on the same filer. If share boundary checking is disabled, the filer checks the share permissions only of the share that has the symbolic link. By default, the filer does share boundary checking for symbolic links to prevent users from accessing files outside the share.

When you create a share from the Data ONTAP command line, you can disable share boundary checking for symbolic links by specifying the option
-nosymlink_strict_security. When you change share properties from the command line, you can specify -symlink_strict_security or
-nosymlink_strict_security to enable or disable share boundary checking for symbolic links.

For details about disabling share boundary checking for symbolic links, see About disabling share boundary checking for symbolic links.

About wide symbolic links

You enable wide symbolic links for a share if you want to allow CIFS clients to follow absolute symbolic links to destinations outside the share or outside the filer. By default, this feature is disabled.

When you create a share from the Data ONTAP command line, you can add support for wide symbolic links by specifying -widelink. When you change share properties from the command line, you can specify either
-widelink or -nowidelink to enable or disable wide symbolic links.

After you enable wide symbolic links, you need to create Widelink entries in the /etc/symlink.translations file to specify how the filer determines the destination of each wide symbolic link. For more information about how to create Widelink entries and additional requirements, see About Widelink entries. For more information about how to enable support for wide symbolic links in home directory shares, see Specifying support for wide symbolic links in home directories.

About the umask value

You can set the file mode creation umask for shares in qtrees with either UNIX or mixed security styles. The umask determines the permissions setting of newly created files. The umask must be an octal value. The default umask value is 0.

When you create a share from the Data ONTAP command line, you can specify the umask using the command -umask mask. When you change share properties from the command line, you can reset the umask value back to 0 using the command -noumask, or you can specify a different umask value using -umask mask.

Example

The following example turns off write access for "group" and "other" permissions when a file is created.

-umask 022

Note
The CIFS share umask value does not affect NFS.

About virus scanning

You can specify whether the filer performs a virus scan when clients open files on a share. You can also specify whether a virus scan is performed when clients open files for read-only access. Virus scanning for all opened files is turned on by default for new shares.

When you create a share from the Data ONTAP command line, you can turn off virus scanning as follows:

For all files opened on the share by specifying -novscan
Only for files opened for read-only access by specifying -novscanread

When you change share properties from the command line, you can turn virus scanning on or off as follows:

For all files by specifying -vscan or -novscan
Only for files opened for read-only access by specifying -vscanread or
-novscanread

For more information about specifying virus scanning for CIFS shares, see the Data Protection Guide.

About client-side caching

Client-side caching allows files to be cached for offline use on Windows 2000, XP, or 2003 clients. You can specify whether Windows clients are allowed to cache files on a share. You can also specify whether Windows user documents and programs are automatically cached on a share or whether the files must be manually selected for caching. Manual caching is enabled by default for new shares.

When you create a share from the Data ONTAP command line, you can specify the following:

-no_caching to disable client-side caching for the share
-auto_document_caching to enable user documents to be automatically cached on the share
-auto_program_caching to enable programs and user documents to be automatically cached on the share

When you change share properties from the command line, you can specify the following:

-no_caching to disable client-side caching for the share
-manual_caching to enable manual selection of files to be cached on the share
-auto_document_caching to enable user documents to be automatically cached on the share
-auto_program_caching to enable programs and user documents to be automatically cached on the share
Note
You can also set client-side caching properties for a share using the Computer Management application on Windows 2000, XP, and 2003 clients.

Creating a share from Server Manager

To create a share using Server Manager, complete the following steps.

Step	Action
1	Create a folder or a qtree on the filer.
2	Start Server Manager and select your filer.
3	Create a share as you would on a Windows NT server. You can specify the maximum number of users and share-level ACLs for the share. Note In the Path field of the New Share window, be sure to type the absolute path name of the folder or qtree you created in Step 1, starting with the C:\vol\vol_name prefix. C: is ignored by the filer. Example The following figure illustrates how to create a new share named specs that corresponds to the /vol/vol0/development directory on the filer.

Step

Action

Create a folder or a qtree on the filer.

Start Server Manager and select your filer.

Create a share as you would on a Windows NT server. You can specify the maximum number of users and share-level ACLs for the share.

Note
In the Path field of the New Share window, be sure to type the absolute path name of the folder or qtree you created in Step 1, starting with the C:\vol\vol_name prefix. C: is ignored by the filer.

Example

The following figure illustrates how to create a new share named specs that corresponds to the /vol/vol0/development directory on the filer.

Creating a share from the Data ONTAP command line

To create a share from the Data ONTAP command line, complete the following step.

Step	Action
1	Enter the following command: cifs shares -add shareName path [ -comment description ] [ -maxusers userlimit ] [ -forcegroup groupname ] [ -widelink ] [ -nosymlink_strict_security ] [ -novscan ] [ -novscanread ] [ -umask mask ] [ -no_caching \| -auto_document_caching \| -auto_program_caching ] If an argument contains a space, enclose it in double quotation marks. Path separators can be backward or forward slashes, although Data ONTAP displays them as forward slashes. Example cifs shares -add webpages /vol/vol1/companyinfo -comment "Product Information" -forcegroup web -maxusers 100 Result This command creates a share named webpages. The directory being shared is /vol/vol1/companyinfo. All files created by CIFS users in this share are owned by the web group, and a maximum of 100 users can access this share simultaneously.

Step

Action

Enter the following command:

cifs shares -add shareName path [ -comment description ] 
[ -maxusers userlimit ] [ -forcegroup groupname ] 

[ -widelink ] [ -nosymlink_strict_security ] [ -novscan ] 
[ -novscanread ] [ -umask mask ] [ -no_caching | 

-auto_document_caching | -auto_program_caching ]

If an argument contains a space, enclose it in double quotation marks.

Path separators can be backward or forward slashes, although Data ONTAP displays them as forward slashes.

Example

cifs shares -add webpages /vol/vol1/companyinfo 
-comment "Product Information" -forcegroup web -maxusers 
100

Result

This command creates a share named webpages. The directory being shared is /vol/vol1/companyinfo. All files created by CIFS users in this share are owned by the web group, and a maximum of 100 users can access this share simultaneously.