Managing client host access to DAFS exports
About ACLs for DAFS exports
Each DAFS export has an associated access control list (ACL) that controls how the client host can access it. The following are the entry types in an ACL:
The default is an empty export ACL indicating that all client hosts can access a DAFS export. This default provides the best performance. The host-based ACLs on the DAFS exports give or deny access at the export level. ACLs are subject to the DAFS exports restrictions, for example, a read-only access mode or a disabled DAFS export.
For more information about DAFS exports, see Managing exports for DAFS service.
Note
When you update ACLs, the changes take effect immediately.
About managing host access to DAFS exports
To manage client host access to DAFS exports, use the dafs access command. The command syntax and functions provided are as follows:
Adding a client host to a DAFS export ACL
To add a client host to a DAFS export ACL, complete the following step.
Step
|
Action
|
|---|
|
1 |
At the filer command line, enter the following command:
dafs access add [-n] -h hostname [-e export_name ] -p
path]
-n indicates that the ACL entry for the host is DENY.
hostname is the client's host name. You must use the host names of VI NICs on the client. A sample host name is db_server.
export_name is the DAFS export name. If export_name is not specified, then the host is added to all DAFS exports.
Result
The host name is added to either all DAFS export ACLs or a specified ACL.
Examples:
filer> dafs access add -h client -e data1
filer>
filer> dafs access add -n -h client_ext
filer>
In the first example, client is added to the ACL for the data1 export. In the second example, a DENY entry for client_ext is added to all DAFS exports to deny this client access to all DAFS exports.
|
Deleting a client host from a DAFS export ACL
To delete a host from a DAFS export ACL, complete the following step.
Step
|
Action
|
|---|
|
1 |
At the filer command line, enter the following command:
dafs access delete [-n] -h hostname [-e export_name|-p
path]
-n indicates that the ACL entry for the host is DENY.
hostname is the client's host name. You must use the host name of a VI NIC on the client. A sample host name is client.
export_name is the DAFS export name. If export_name is not specified, then the host is deleted from all DAFS exports.
Result
The host name is deleted from either all DAFS export ACLs or a specified ACL.
Examples:
filer> dafs access delete -h client
filer>
filer> dafs access delete -h client_1 -e data1
filer>
In the first example, client is deleted from all DAFS exports. In the second example, client_1 is deleted from the data1 DAFS export.
|
Replacing the ACL for a DAFS export
To replace the ACL for a DAFS export with a list of host names, complete the following step.
Step
|
Action
|
|---|
|
1 |
At the filer command line, enter the following command:
dafs access set [-n] -h host_list [-e export_name|-p
path]
-n indicates that the ACL entry for the hosts is DENY.
host_list is a list of client VI host names, delimited by colons (:). A sample host name is dbclient.
export_name is the DAFS export name. If export_name is not specified, then host_list replaces all ACLs for all DAFS exports.
Result
host_list replaces the ACL for either all DAFS exports or a specified DAFS export. If host_list is not specified, then the ACL is made empty.
Example:
filer> dafs access set -h dbclient:dbclient
-e data1
filer>
In this example, the host list dbclient:dbclient replaces the ACL for data1 export.
Note
If you want to reset the host list for an export name to the default (empty) list, enter the following command:
dafs access set -h "" -e export_name |
Displaying the ACL for a DAFS export
To display the ACL for a DAFS export, complete the following step.
Step
|
Action
|
|---|
|
1 |
At the filer command line, enter the following command:
dafs access get [-e export_name | -p path]
export_name is the DAFS export name. If export_name is not specified, then the ACLs for all DAFS exports are displayed.
Result
The display shows the ACLs for either all DAFS exports or a specified DAFS export. The displayed ACL shows the DAFS export name, the ACL entry type, and the client host name.
Example:
filer> dafs access get
qtree1 deny client1
qtree2 <none>
vol1 access client2
- The DAFS export qtree1 denies access to client1; all other DAFS clients are allowed access.
- The DAFS export qtree2 allows all DAFS clients access; none are denied access. This is the default ACL.
- The DAFS export vol1 allows access for client2; all other DAFS clients are denied access.
|
Copyright © 1994-2003, Network Appliance, Inc. All rights
reserved.
Part No. 210-00473
File: dafs9.htm
Last updated: 11/25/03 18:03:06