Maintaining filer security through options
Options that help maintain security
The following table describes options that help you to maintain filer security.
Option
|
Description
|
|---|
trusted.hosts
|
Controls which hosts can access the filer through a Telnet session for administrative purposes. You can disable Telnet access completely, allow Telnet access from up to five hosts, or allow Telnet access from all hosts.
|
telnet.access
|
Controls which hosts can access the filer through a Telnet session for administrative purposes. You can restrict Telnet access to the filer by specifying host names, IP addresses, or network interface names.
|
rsh.access
|
Controls which hosts can access the filer through a Remote Shell session for administrative purposes. You can restrict Remote Shell access to the filer by specifying host names, IP addresses, or network interface names.
|
nfs.mount_rootonly
|
Controls whether the filer's volumes can be mounted from NFS clients only by the root user on privileged ports (ports 1 through 1,023) or by all users on all ports. This option is applicable only if the NFS protocol is licensed.
|
wafl.root_only_chown
|
Controls whether all users or only the root user can change directory and file ownership. This option is applicable only if the NFS protocol is licensed.
|
cifs.restrict_anonymous.enable
|
Controls whether anonymous CIFS users can look up CIFS shares, users, or groups on a filer. This option is applicable only if the CIFS protocol is licensed.
|
|
Note
For more information about the options in this table, see the na_protocolaccess(8) man page. |
Controlling Telnet access using host names
To limit Telnet access to specific hosts, complete the following steps.
Step
|
Action
|
|---|
|
1 |
Access the filer command line through the console or through a Telnet session.
|
|
2 |
If...
|
Then...
|
You want to disable Telnet access for all hosts
|
Enter the following command:
options trusted.hosts -
|
You want to restrict Telnet access to up to five hosts
|
Enter the following command:
options trusted.hosts
host1[, ..., host5]
|
You want to allow Telnet access for all hosts
|
Enter the following command:
options trusted.hosts *
|
Controlling Telnet access using host names, IP addresses, and network interface names
To limit Telnet access to specific host names, IP addresses, and network interface names, complete the following steps.
Step
|
Action
|
|---|
|
1 |
Access the filer command line through the console or through a Telnet session.
|
|
2 |
Enter the following command:
options telnet.access host=[ hostname | IP_address |
interface_name ]
hostname is the name of the host to which you want to allow Telnet access.
IP_address is the IP address of the host to which you want to allow Telnet access.
interface_name is the network interface name of the host to which you want to allow Telnet access.
Note
If this option is set, the trusted.hosts option is ignored for Telnet. |
Note
For more information on controlling Telnet access to a filer using multiple host names, IP addresses, and network interfaces, see the na_protocolaccess(8) man page.
Controlling Remote Shell access
To allow Remote Shell access to a filer from a single host, complete the following steps.
Step
|
Action
|
|---|
|
1 |
Access the filer command line through the console or through a Telnet session.
|
|
2 |
Enter the following command:
options rsh.access host=hostname
hostname is the name of the host to which you want to allow Remote Shell access.
|
Note
For information on controlling Remote Shell access to a filer from multiple hosts using the host name, IP address or network interface name, see the na_protocolaccess(8) man page.
Controlling mount privilege
To control the NFS mount privilege for the filer's volumes, complete the following steps.
Note
Some PC clients and some older implementations of NFS on UNIX workstations use nonprivileged ports to send requests. If you have these clients at your site, disable the mount_rootonly option or upgrade the client software.
Step
|
Action
|
|---|
|
1 |
Access the filer command line through the console or through a Telnet session.
|
|
2 |
If...
|
Then...
|
You want to restrict the mount privilege to only the root user using privileged ports (ports 1 through 1,024)
|
Enter the following command:
options nfs.mount_rootonly
on
|
You want to allow the mount privilege for all users on all ports
|
Enter the following command:
options nfs.mount_rootonly
off
|
Controlling file ownership change privileges
To control who has privileges to change directory and file ownership, complete the following steps.
Note
The following behaviors apply to ownership changes:
- When a nonroot user changes the owner of a file, the set-user-id and set-group-id bits are cleared.
- If a nonroot user tries to change the owner of a file but the change causes the file's recipient to exceed the quota, the attempt fails.
Step
|
Action
|
|---|
|
1 |
Access the filer command line through the console or through a Telnet session.
|
|
2 |
If...
|
Then...
|
You want to restrict the privilege of changing directory and file ownership to the root user
|
Enter the following command:
options
wafl.root_only_chown on
|
You want to allow the privilege of changing directory and file ownership to all users
|
Enter the following command:
options
wafl.root_only_chown off
|
Controlling anonymous CIFS share lookups
To control whether anonymous CIFS users can look up CIFS shares, users, or groups on a filer, complete the following steps.
Step
|
Action
|
|---|
|
1 |
Access the filer command line through the console or through a Telnet session.
|
|
2 |
If...
|
Then...
|
You want to restrict anonymous share lookups
|
Enter the following command:
options
cifs.restrict_anonymous.enable on
|
You want to allow anonymous share lookups
|
Enter the following command:
options
cifs.restrict_anonymous.enable off
|
Copyright © 1994-2003, Network Appliance, Inc. All rights
reserved.
Part No. 210-00472
File: admin37.htm
Last updated: 11/17/03 16:57:06