Understanding security styles

About security styles

Every qtree and volume has a security style setting. This setting determines whether files in that qtree or volume can use Windows NT or UNIX security.

Note
Although security styles can be applied to both qtrees and volumes, they are not shown as a volume attribute, and are managed for both volumes and qtrees using the qtree command.

Security styles

Three security styles apply to qtrees and volumes. They are described in the following table.

Security style

Description

Effect of changing to the style

NTFS

For CIFS clients, security is handled using Windows NTFS ACLs.

For NFS clients, the NFS UID (user id) is mapped to a Windows SID (security identifier) and its associated groups. Those mapped credentials are used to determine file access, based on the NFTS ACL.

Note
To use NTFS security, the storage system must be licensed for CIFS.

You cannot use an NFS client to change file or directory permissions on qtrees with the NTFS security style.

If the change is from a mixed qtree, Windows NT permissions determine file access for a file that had Windows NT permissions. Otherwise, UNIX-style (NFS) permission bits determine file access for files created before the change.

Note
If the change is from a CIFS storage system to a multiprotocol storage system, and the /etc directory is a qtree, its security style changes to NTFS.

UNIX

Exactly like UNIX; files and directories have UNIX permissions.

The storage system disregards any Windows NT permissions established previously and uses the UNIX permissions exclusively.

Mixed

Both NTFS and UNIX security are allowed: A file or directory can have either Windows NT permissions or UNIX permissions.

The default security style of a file is the style most recently used to set permissions on that file.

If NTFS permissions on a file are changed, the storage system recomputes UNIX permissions on that file.

If UNIX permissions or ownership on a file are changed, the storage system deletes any NTFS permissions on that file.

Security style	Description	Effect of changing to the style
NTFS	For CIFS clients, security is handled using Windows NTFS ACLs. For NFS clients, the NFS UID (user id) is mapped to a Windows SID (security identifier) and its associated groups. Those mapped credentials are used to determine file access, based on the NFTS ACL. Note To use NTFS security, the storage system must be licensed for CIFS. You cannot use an NFS client to change file or directory permissions on qtrees with the NTFS security style.	If the change is from a mixed qtree, Windows NT permissions determine file access for a file that had Windows NT permissions. Otherwise, UNIX-style (NFS) permission bits determine file access for files created before the change. Note If the change is from a CIFS storage system to a multiprotocol storage system, and the /etc directory is a qtree, its security style changes to NTFS.
UNIX	Exactly like UNIX; files and directories have UNIX permissions.	The storage system disregards any Windows NT permissions established previously and uses the UNIX permissions exclusively.
Mixed	Both NTFS and UNIX security are allowed: A file or directory can have either Windows NT permissions or UNIX permissions. The default security style of a file is the style most recently used to set permissions on that file.	If NTFS permissions on a file are changed, the storage system recomputes UNIX permissions on that file. If UNIX permissions or ownership on a file are changed, the storage system deletes any NTFS permissions on that file.

Note
When you create an NTFS qtree or change a qtree to NTFS, every Windows user is given full access to the qtree, by default. You must change the permissions if you want to restrict access to the qtree for some users. If you do not set NTFS file security on a file, UNIX permissions are enforced.

For more information about file access and permissions, see the File Access and Protocols Management Guide.