Managing access from administration hosts

Why administration hosts are used

Administration hosts are used for two reasons:

Some administration tasks require that the administrator edit configuration files, but the Data ONTAP software does not include a file editor. The only way you can edit files is by accessing them from an administration host.
It is often more convenient to administer a storage system remotely than to go to the storage system's physical location.

What an administration host is

The administration host is a remote workstation from which you can administer the storage system. The remote workstation can be an NFS client or a CIFS client. When you designate an administration host, the storage system's root file system (/vol/vol0 by default) is accessible to the host through the NFS protocol and as a CIFS share.

When to add administration hosts

Initially, you make a client an administration host when you set up the storage system. After booting the system, you can add as many clients as you want to be administration hosts.

Administration host privileges

The storage system grants root permissions to the administration host after the setup procedure is completed. The following table describes the administration host's privileges.

If the administration host is...	You can...
An NFS client	Mount the storage system root directory and edit configuration files from the administration host. Enter Data ONTAP commands by using a Remote Shell connection.
A CIFS client	Edit configuration files from any CIFS client as long as you connect to the storage system as root or "Administrator."

Controlling access for administrative hosts

You can make sure that only specific hosts are used as administrative hosts to increase security for your storage system.

Requirements for using an NFS client

If you plan to use an NFS client to manage the storage system, the NFS client must

Support a text editor that can display and edit text files containing lines ending with the newline character
Support the telnet and rsh commands
Be able to mount directories by using the NFS protocol

Requirements for using a CIFS client

If you plan to use a CIFS client to manage the storage system, the CIFS client must support the telnet and rsh commands.

Where and how administration hosts are specified

Administration hosts are specified in the /etc/hosts.equiv file in the following format:

hostname [username] or hostname ["user name"]

Examples

client1 peter

client1 "joe smith"

Note
If you access the storage system using rsh from an administration host listed in the /etc/hosts.equiv file, you have root privileges because this access method bypasses user authentication mechanisms. In addition, the /etc/auditlog program displays the user running the commands as root.

Rules for /etc/hosts.equiv file entries

The following rules apply to entries in the /etc/hosts.equiv file:

If multiple users on the same host require access to the storage system through a Remote Shell, you must specify each user's entry as in the following example:
```
client1 anna

client1 carl

client1 peter

client2 leann

client2 sue

client2 tony
```
If hostname specifies an NFS client, the user name is optional. If you do not specify a user name, you must be the root user on that NFS client to execute a Data ONTAP command through the rsh command.
If hostname specifies a CIFS client, you must enter the user name for that CIFS client.

The following is an example of the contents of an /etc/hosts.equiv file:

nfsclient1

client2 lena

client2 root

client3 fred

client3 root

Adding administration hosts

To designate additional NFS clients or CIFS clients as administration hosts, complete the following steps.

Step	Action
1	Open the /etc/hosts.equiv configuration file with an editor.
2	Add the host names and user names of the clients that you want designated as administration hosts.
3	Save the /etc/hosts.equiv file.

Removing administration hosts

To remove an NFS client or CIFS client from the administration hosts list, complete the following steps.

Step	Action
1	Open the /etc/hosts.equiv configuration file with an editor.
2	Locate and delete the entries for the host names and user names you want to remove.
3	Save the /etc/hosts.equiv file.