Understanding file screening

File screening in Data ONTAP

File screening enables you to control permissions according to file types. For example, you could restrict certain file types, such as .jpg and .mpg files from being stored on the filer.

File screening in Data ONTAP is the coordination of a Data ONTAP file screening policy with third-party file screening software. The Data ONTAP file screening policy is set on the filer and specifies the types of CIFS files you want to screen. The file screening software runs on a client that functions as a file screening server.

Prerequisite for file screening

Before you use file screening, you need file screening software that is supported by Data ONTAP. You can check for client file screening software on the NetApp Partners Web page at http://www.netapp.com/partners.

About file policies

A file policy determines how the filer handles requests from individual client systems for operations such as open, rename, and create. The filer maintains a set of properties for a file policy, including, for example, the policy name and whether that file policy is active. You can set these properties for a file policy using filer console commands.

How file screening works

You use the file screening policy to specify that certain types of CIFS files are screened before they can be opened, created, or renamed. For example, you might use file screening to block users from creating audio or graphics files by specifying that audio and graphics files be screened.

Once your policy is set, when the filer receives a request to open, create, or rename a file, the filer checks its file screening policy. If the policy specifies screening for that file based on its extension, the file name is sent to the file screening server to be screened. The file screening server applies policies to the file name to determine whether the filer should allow the requested file operation. The file screening server then sends a response to the filer to either allow or block the requested file operation.

File screening defaults and limitations

Data ONTAP includes one built-in file screening policy and policy name. This file screening policy is named default, and it belongs to the built-in policy type screen. File screening is disabled by default.

You can create and use up to 20 file screening policies at one time. Names for screening policies and policy types can have up to 80 characters.