Celerra Home Directory - Proper ACL's For Auto-Create

Question

I am just now implementing the Celerra Home Directory feature on our CIFS Shares. (NS480 - Dart 5.6.).

I've created the Home Dir Database with the MMC and got the RegExpressions working fine to mount users home directories with the AD Profile set to the drive letter to the \\cifs_server\HOME and it will mount user directories that are already created just fine and it will create users home directories on the proper path if they don't currently exist.

However, if I leave the default cifs share permissions of Everyone - Full Control then even though a user is directly mapped to their home directory they can browse by other means and see other's folders, files, with read/write access. If I change it to only Domain Users or Authenticated Users Read/Execute, etc.. then the home directory still gets created and they get mapped to it, but they can't write to their home directory. They could still browse and read other users folders and files..cant write now, but again can't write to their home dirs either. Of course this is with ABE enabled as well, which doesn't matter because if the newly created home dirs aren't setup so that they are the owner's of the home dirs (which I think should be configurable) then ABE doesn't come into play.

In the past when creating home dirs we create the home dirs and apply the user as the owner of their home dir and using ABE no one else can see their folder and they are the only ones that can read/write to it...

Is their away to make the Auto-Create of home dirs with Celerra Home Directory work better either through inherited ACL'S, permissions, or some programatic way on the celerra to change something so that the user and process that is running that creates the home dir sets the user as the owner?

Thanks!

Rainer_EMC · Answer

There were some enhancements through registry settings on the Celerra CIFS server to change the default ACL for homedirs

Search the forums for a post from me or the DART release notes

You might have to upgrade to latest 5.6 or 6.0

Rainer

kray9 · Answer

Excellent...we go to DART 6 tonight...can't wait to test it...

gbarretoxx1 · Answer

Hi,

This is what changed on DART 6.0 :

When a new folder is created in the file system that runs the celerra HOMEDIR feature the permissions on the folder are different from what were on NAS 5.6. Under 5.6 code the new folders are created with everyone full controll. This allows domain admins to go into that folder and migrate data into it. On 6.0 code the new folders created have explicit permissions on the folder only for the user associated with the folder.

It is controlled via registry key "HKLM\Software\EMC\Homedir\Flags", that has the following values :

0 : only the user logging in will have access (full control), this is the default

1 : inherit ACL from parent; use 0x0 behavior only if inheritance from parent is not allowed

2 : root owner, everyone full control - This was the behavior on 5.6 and earlier

Gustavo Barreto.

kray9 · Answer

Thanks Rainer, but I don't see anything in the DART Release Notes anywhere about changing the default ACL for Home Dirs and keep seem to locate a post by you concerning the ability to change the Default ACL's on HomeDirs.

Can you point me in the direction of how to change the default ACL's on Home Dirs, so I can see what options are available.

Thanks,

kray9 · Answer

Gustavo, thanks for your answer. I tested and sure enough it creates the folder with the user account as the owner. Based on your email that means the Reg Key is set to 0. Will setting it to 1 inherit and create the folder with the user account as the owner? That's how we would like to do it...so, the Domain Admins can have access as well, but that the user account of the home dir should have full control or owner as well.

Where does this registry key exist? Is this on the Domain Controllers? Celerra?

Thanks!

kray9 · Answer

Thanks! I will look into doing that...thanks.

Rainer_EMC · Answer

The key is in the Celerra CIFS servers registry

kray9 · Answer

Well, I've upgraded to DART 6. Have the home directories being auto-created, but the auto rights assignment are not favorable in my opinion.

Is there not a setting so that as the Home Directory is created that it is given rights of the user account and inherits the Domain Admin rights?

Thanks for any assistance.

Rainer_EMC · Answer

Take a Look at the manual - there are some registry settings that change the default ACL

kray9 · Answer

Thanks... Which manual would be the one to review? Are there registry settings other than HLM/Software/EMC/HomeDir - Flags - Reg_Dword 0/1/2 that affect the ACLs? Thanks, Ken

Rainer_EMC · Answer

Yes that's the registry key It's described in the 7.0 A02 CIFS manual and in the DART / VNX OE release notes Rainer

kray9 · Answer

I have yet to be able to get this to work properly (100%). My guess is that it simply doesn't work exactly right.

I've read the documentation and modified the "HKLM\Software\EMC\Homedir\Flags" registry key to

0,1, & 2 and can't get it to set permissions for the Domain Admin and the User.

I can get it to set it to the Domain Admin or I can get it to set it to the User, but not both the User and the Domain Admin. Anyone have any luck with this?

Also, anyone seen where computer accounts are getting created as home directories? We have seen this happen sporradically. We delete them and they pop back...anyone see this? have any ideas?

Thanks for any additional info!

wavi · Answer

Sorry for the necro but we have this exact same issue.

The "users" folder which inherits the ACL is owned by domain admins and grants access to domain admins and instructors. We would like to inherit this behaviour to the autocreated folders.

2 Allows the folder to inherit the ACL of the "users" folder to grant admin rights and sets the owner to the storage.

0&1 both do the same which is to set the owner and full access to the user and don't grant other permissions to anyone. This is problematic because it also blocks our backup.

From what i can tell it blocks the ability to inherit ACL until you set it to give the domain admin rights to the folder at which point it just grabs the entire ACL.

DELL-Josh Cr · Answer

Hi, Which device and which software version are you on? Are they Windows ACLs or Linux/Unix? Are the shares CIFS or NFS?

wavi · Answer

The model is VNXe3200 with software version 3.1.15.10216415. They are windows ACLs and we are using SMB shares.   Thank you.

Celerra

Celerra Home Directory - Proper ACL's For Auto-Create

Was this post helpful?