To set for all shares: isi smb settings share modify --access-based-enumeration=true
There is also a global command for ABE that is for browsing share access. This can be turned on and off using this global command.
# isi smb settings global modify --access-based-share-enum true
There is an option for "ABE on root only". With this option you will see ABE at top level directory but below that ABE is not processed saving time to display files/folders in a hierarchical environment where ABE is not needed below the top level directory.
We are running on OneFS 7.0.2.4 and we are migrating data from Windows file servers to Isilon. Is there a way to migrate ABE from existing file servers rather than setting it on Isilon manually.
Access based enumeration (ABE) (files and directories)
Access based share enumeration (ABSE) (for shares only)
Basically, the first option will only show you the files and directories that you have permission to access, whereas the second only shows you the shares that you have permission to mount/access.
People often think that using ABE/ABSE is good for an additional level of security, but consider the scenario in a school/university. If your users can see all shares on the cluster (ABE/ABSE disabled), they might try to access those that they shouldn't, find out that they can't, and give up bothering after a while. If they can only see those that they should be accessing (ABSE enabled) and you make a mistake when setting permissions, as soon as the new share appears, the users will know that they can access it and will swarm all over it like a rash.
Consider carefully whether you need this feature before you start configuring it.
Rdamal
2 Intern
•
165 Posts
3033
0
Posted January 13th, 2014 13:00
Hi Jeremy,
We are running on OneFS 7.0.2.4 and we are migrating data from Windows file servers to Isilon. Is there a way to migrate ABE from existing file servers rather than setting it on Isilon manually.
Thanks,
Damal