Sharing directories

Information you need to create a share

When you create a share, you must provide

The complete path name of an existing folder, qtree, or volume to be shared
The name of the share entered by users when they connect to the share
The permission for the share
You can select from a list of permissions, or enter specific permissions for each user or a group of users.

Optional information for creating a share

When you create a share, you can optionally specify

A description for the share
The share description appears in the Comment field when you browse the shares on the network.

If you create the share from the Data ONTAP command line, you can also specify the following share properties:

Group membership for files in the share
Control of share boundary checking for symbolic links in the share
Support for wide symbolic links in the share
Umask value for the share
Disabling of virus scanning when files in the share are opened
Disabling of virus scanning when files in the share are opened for read-only access
Disallowing file caching in the share by Windows clients
Support for automatic caching of documents and programs in the share by Windows clients
You can change these attributes at any time after you create a share.

Information you can specify after creating a share

After you have created a share, you can specify these share properties:

Maximum number of users who can simultaneously access the share
If you do not specify a number, the number of users is limited by storage system memory. For more information about how storage system memory affects the number of users who can connect to the storage system simultaneously, see Managing ACLs.
Share-level ACL

Share naming conventions

Share naming conventions for Data ONTAP are the same as for Windows. For example, share names ending with the $ character are hidden shares, and certain share names, such as ADMIN$ and IPC$, are reserved.

Share names are not case-sensitive.

About group membership of files in the share

When you create a share from the Data ONTAP command line, you can specify that all files created by CIFS users in that share belong to the same group, which must be a predefined group in the UNIX group database. The group you specify is called a "forcegroup."

Effects of a forcegroup on CIFS access

The following list describes what happens to files created by CIFS if the share has a forcegroup:

All files in this share created by CIFS users belong to the same forcegroup, regardless of the GID of the file owner.
CIFS users who access this share are temporarily changed to the GID of the forcegroup. This GID enables them to access files in this share that are not accessible normally with their primary GID or UID.

When CIFS users try to access a file created by NFS, the CIFS users' primary GIDs determine access rights.

Effects of a forcegroup on NFS access

The forcegroup does not affect how NFS users access files in this share. A file created by NFS acquires the GID from the file creator. Determination of access permissions is based on the UID and primary GID of the NFS user who is trying to access the file.

Advantages of specifying a forcegroup

Using a forcegroup makes it easier to ensure that files can be accessed by CIFS users belonging to various groups. For example, if you want to create a share to store the company's Web pages and give write access to users in Engineering and Marketing, you can create a share and give write access to a forcegroup named "web." Because of the forcegroup, all files created by CIFS users in this share are owned by the web group. In addition, users are automatically assigned the GID of the web group when accessing the share. As a result, all the users can write to this share without your managing the access rights of the Engineering and Marketing groups.

Where a forcegroup is useful

Specifying a forcegroup is meaningful only if the share is in a UNIX or mixed qtree. There is no need to use forcegroups for shares in an NTFS qtree because access to files in these shares is determined by Windows permissions, not GIDs.

About the share-level ACL

When you create a share using the Computer Management snap-in for Microsoft Management Console (MMC), you can specify the share-level ACL. If you use the Data ONTAP command line, you can specify the share-level permissions only after a share has been created. By default, a newly created share gives everyone Read access. For more information about share-level ACLs, see Applying Group Policy Objects.

About share boundary checking for symbolic links

You disable share boundary checking for symbolic links for a share if you want to allow CIFS clients to follow symbolic links in that share to destinations anywhere on the same storage system. If share boundary checking is disabled, the storage system checks the share permissions only of the share that has the symbolic link. By default, the storage system does share boundary checking for symbolic links to prevent users from accessing files outside the share.

When you create a share from the Data ONTAP command line, you can disable share boundary checking for symbolic links by specifying the option
-nosymlink_strict_security. When you change share properties from the command line, you can specify -symlink_strict_security or
-nosymlink_strict_security to enable or disable share boundary checking for symbolic links.

For details about disabling share boundary checking for symbolic links, see About disabling share boundary checking for symbolic links.

About wide symbolic links

You enable wide symbolic links for a share if you want to allow CIFS clients to follow absolute symbolic links to destinations outside the share or outside your storage system. By default, this feature is disabled.

When you create a share from the Data ONTAP command line, you can add support for wide symbolic links by specifying -widelink. When you change share properties from the command line, you can specify either
-widelink or -nowidelink to enable or disable wide symbolic links.

After you enable wide symbolic links, you need to create Widelink entries in the /etc/symlink.translations file to specify how the storage system determines the destination of each wide symbolic link. For more information about how to create Widelink entries and additional requirements, see About Widelink entries. For more information about how to enable support for wide symbolic links in home directory shares, see Managing home directories.

About the umask value

You can set the file mode creation umask for shares in qtrees with either UNIX or mixed security styles. The umask determines the permissions setting of newly created files. The umask must be an octal value. The default umask value is 0.

When you create a share from the Data ONTAP command line, you can specify the umask using the command -umask mask. When you change share properties from the command line, you can reset the umask value back to 0 using the command -noumask, or you can specify a different umask value using -umask mask.

Example

The following example turns off write access for "group" and "other" permissions when a file is created.

-umask 022

Note
The CIFS share umask value does not affect NFS.

About virus scanning

You can specify whether the storage system performs a virus scan when clients open files on a share. You can also specify whether a virus scan is performed when clients open files for read-only access. Virus scanning for all opened files is turned on by default for new shares.

When you create a share from the Data ONTAP command line, you can turn off virus scanning as follows:

For all files opened on the share by specifying -novscan
Only for files opened for read-only access by specifying -novscanread

When you change share properties from the command line, you can turn virus scanning on or off as follows:

For all files by specifying -vscan or -novscan
Only for files opened for read-only access by specifying -vscanread or
-novscanread

For more information about specifying virus scanning for CIFS shares, see the Data Protection Guide.

About client-side caching

Client-side caching allows files to be cached for offline use on Windows 2000, XP, or 2003 clients. You can specify whether Windows clients are allowed to cache files on a share. You can also specify whether Windows user documents and programs are automatically cached on a share or whether the files must be manually selected for caching. Manual caching is enabled by default for new shares.

When you create a share from the Data ONTAP command line, you can specify the following:

-no_caching to disable client-side caching for the share
-auto_document_caching to enable user documents to be automatically cached on the share
-auto_program_caching to enable programs and user documents to be automatically cached on the share

When you change share properties from the command line, you can specify the following:

-no_caching to disable client-side caching for the share
-manual_caching to enable manual selection of files to be cached on the share
-auto_document_caching to enable user documents to be automatically cached on the share
-auto_program_caching to enable programs and user documents to be automatically cached on the share
Note
You can also set client-side caching properties for a share using the Computer Management application on Windows 2000, XP, and 2003 clients.

Connecting to the storage system using MMC

To connect to your storage system using the Microsoft Management Console (MMC), complete the following steps.

Step	Action
1	On your Windows server, go to the MMC.
2	Perform the following actions to connect the Computer Management MMC to the storage system. Select Computer Management from the left panel of the MMC. Click Action (from the menu choices on top of the MMC). Select Connect to another computer. In the box labeled Another Computer, enter the name of the storage system on which you created the folder, qtree, or volume. Or click browse to browse for the storage system. Click OK. You are now managing the storage system using the MMC.

Step

Action

On your Windows server, go to the MMC.

Perform the following actions to connect the Computer Management MMC to the storage system.

Select Computer Management from the left panel of the MMC.
Click Action (from the menu choices on top of the MMC).
Select Connect to another computer.
In the box labeled Another Computer, enter the name of the storage system on which you created the folder, qtree, or volume. Or click browse to browse for the storage system.
Click OK.
You are now managing the storage system using the MMC.

Creating a share from the MMC

To create a share (publish a resource, such as a file or directory) using the MMC, complete the following steps.

Step	Action
1	Create a folder, qtree, or volume on the storage system.
2	Connect to the storage system using the MMC as described in Connecting to the storage system using MMC.
3	Perform the following actions to launch the Share a Folder wizard in the MMC: Click Computer Management, if it is not selected already. Double-click System Tools > Shared Folders > Shares > Action > New Share to launch the Share a Folder Wizard. The wording of these menu items might vary slightly, depending on your Windows version.
4	Follow the instructions in the Share a Folder wizard to share the folder, qtree, or volume you created in Step 1. For a list of information you need to successfully complete the Share a Folder Wizard, see Information you need to create a share.

Creating a share from the Data ONTAP command line

To create a share from the Data ONTAP command line, complete the following step.

Step	Action
1	Enter the following command: cifs shares -add shareName path [-comment description] [-userlimit] [-forcegroup groupname] [-widelink] [-nosymlink_strict_security] [-novscan] [-novscanread] [-umask mask] [-no_caching \| -auto_document_caching \| -auto_program_caching] If an argument contains a space, enclose it in double quotation marks. Path separators can be backward or forward slashes, although Data ONTAP displays them as forward slashes. Example cifs shares -add webpages /vol/vol1/companyinfo -comment "Product Information" -forcegroup web -maxusers 100 Result This command creates a share named webpages. The directory being shared is /vol/vol1/companyinfo. All files created by CIFS users in this share are owned by the web group, and a maximum of 100 users can access this share simultaneously.

Step

Action

Enter the following command:

cifs shares -add shareName path [-comment description] 
[-userlimit] [-forcegroup groupname] [-widelink] 
[-nosymlink_strict_security] [-novscan] [-novscanread] 
[-umask mask] [-no_caching | -auto_document_caching | 
-auto_program_caching]

If an argument contains a space, enclose it in double quotation marks.

Path separators can be backward or forward slashes, although Data ONTAP displays them as forward slashes.

Example

cifs shares -add webpages /vol/vol1/companyinfo 
-comment "Product Information" -forcegroup web -maxusers 
100

Result

This command creates a share named webpages. The directory being shared is /vol/vol1/companyinfo. All files created by CIFS users in this share are owned by the web group, and a maximum of 100 users can access this share simultaneously.