User rights in mixed mode (NFS & SMB)

Question

Dear All,

I am going to implement file share with specific rights, and has some trouble to configure exaclty what is required.

From NFS side, application data access as root and appsrv. There is appsrv group too. There is a user appclnt, and it is in the group appsrv.

The folder is /ifs/app, and it is shared rw on NFS, root, and appsrv user is writing and accessing it, no root squash is required.

The mentioned foled is shared on SMB two times.

As ro \\isilon\app and rw \\isilon\app-rw. Booth shares accessed as Guest (without any authentication), on rw share if you write anythin, it must be stored as appclnt(UID) and appsrv(GID) with permission 660.

I enabled Guest user, and created the mentioned group and users, in System: Local.

Then created the rw share, and added rw rights to Guest, and used the Impersonate User setting to write files as appclnt.

If I create a file or folder on the app-rw SMB share, it is created as appclnt:appsrv (UID:GID), but with 770.

Where to set it to 660? I do not want the x, only rw.

The "file and directory settings" is not working, I tried to set the mask, without any success.

When I created the folder, in Filesystem Explorer, owner root, group is wheel, and mask is 777.

ONEFS is on 7.0.2.1.

Thank You in advance!

Regards, Krisztian

christopher_ime · Answer

Please consider moving this question as-is (no need to recreate) to the proper forum for maximum visibility.  Questions written to the users' own 'Discussions' space don't get the same amount of attention and questions can go unanswered for a long time. You can do so by selecting 'Move' under ACTIONS along the upper-right.  Then search for and select: 'Isilon Support Forum' which would be the most relevant for this question.

szekelyk · Answer

Hi Christopher, thank you for this information, I moved the question to Isilon Support Forum. Regards, Krisztian

Peter_Sero · Answer

You can either use UNIX permissions bits, which will be perfectly compatible with NFS.

SMB clients will see (synthetic) ACLs equivalent to the NFS side.

Or you set up ACLs, more or less perfectly compatible with SMB,

and the NFS clients "see" approximating permission bits,

but find the actual behavior of their actions guarded by the (NFS-invisible) ACLs.

The rule for mapping permission bits and ACLs, back and forth,

are outlined in detail here:

https://support.emc.com/docu42659_White-Paper:-EMC-Isilon-Multiprotocol-Data-Access-with-a-Unified-Security-Model-for-SMB-and-NFS.pdf

and in short form here (beware, ASCII art formatting for the actual rules is somewhat broken...):

https://emc--c.na5.visual.force.com/apex/KB_BreakFix_1?id=kA1700000000Qom&popup=true

And, of cause, a recent expert thread on the topic:

Ask the Expert: SMB Protocol on an Isilon Cluster

If I understand correctly, you plan to add one more twist by

setting different export/share options. Better leave that out for a start...

-- Peter

Isilon

User rights in mixed mode (NFS & SMB)

Was this post helpful?