UNSOLVED
Celerra Home Directory - Proper ACL's For Auto-Create
I am just now implementing the Celerra Home Directory feature on our CIFS Shares. (NS480 - Dart 5.6.).
I've created the Home Dir Database with the MMC and got the RegExpressions working fine to mount users home directories with the AD Profile set to the drive letter to the \\cifs_server\HOME and it will mount user directories that are already created just fine and it will create users home directories on the proper path if they don't currently exist.
However, if I leave the default cifs share permissions of Everyone - Full Control then even though a user is directly mapped to their home directory they can browse by other means and see other's folders, files, with read/write access. If I change it to only Domain Users or Authenticated Users Read/Execute, etc.. then the home directory still gets created and they get mapped to it, but they can't write to their home directory. They could still browse and read other users folders and files..cant write now, but again can't write to their home dirs either. Of course this is with ABE enabled as well, which doesn't matter because if the newly created home dirs aren't setup so that they are the owner's of the home dirs (which I think should be configurable) then ABE doesn't come into play.
In the past when creating home dirs we create the home dirs and apply the user as the owner of their home dir and using ABE no one else can see their folder and they are the only ones that can read/write to it...
Is their away to make the Auto-Create of home dirs with Celerra Home Directory work better either through inherited ACL'S, permissions, or some programatic way on the celerra to change something so that the user and process that is running that creates the home dir sets the user as the owner?
Thanks!
DELL-Sam L
Community Manager
•
8058 Posts
•
34386 Points
914
0
Posted October 11th, 2021 08:00
Hello wavi,
You will want to use onefs. You can open a support case and we can assist you if your system is still under a support contract.
Rainer_EMC
6 Operator
•
8645 Posts
3123
0
Posted July 15th, 2011 07:00
There were some enhancements through registry settings on the Celerra CIFS server to change the default ACL for homedirs
Search the forums for a post from me or the DART release notes
You might have to upgrade to latest 5.6 or 6.0
Rainer
gbarretoxx1
2 Intern
•
366 Posts
3130
1
Posted July 15th, 2011 09:00
Hi,
This is what changed on DART 6.0 :
When a new folder is created in the file system that runs the celerra HOMEDIR feature the permissions on the folder are different from what were on NAS 5.6. Under 5.6 code the new folders are created with everyone full controll. This allows domain admins to go into that folder and migrate data into it. On 6.0 code the new folders created have explicit permissions on the folder only for the user associated with the folder.
It is controlled via registry key "HKLM\Software\EMC\Homedir\Flags", that has the following values :
0 : only the user logging in will have access (full control), this is the default
1 : inherit ACL from parent; use 0x0 behavior only if inheritance from parent is not allowed
2 : root owner, everyone full control - This was the behavior on 5.6 and earlierGustavo Barreto.
Thanks Rainer, but I don't see anything in the DART Release Notes anywhere about changing the default ACL for Home Dirs and keep seem to locate a post by you concerning the ability to change the Default ACL's on HomeDirs.
Can you point me in the direction of how to change the default ACL's on Home Dirs, so I can see what options are available.
Thanks,
Gustavo, thanks for your answer. I tested and sure enough it creates the folder with the user account as the owner. Based on your email that means the Reg Key is set to 0. Will setting it to 1 inherit and create the folder with the user account as the owner? That's how we would like to do it...so, the Domain Admins can have access as well, but that the user account of the home dir should have full control or owner as well.
Where does this registry key exist? Is this on the Domain Controllers? Celerra?
Thanks!
Rainer_EMC
6 Operator
•
8645 Posts
3130
1
Posted July 18th, 2011 15:00
The key is in the Celerra CIFS servers registry
Well, I've upgraded to DART 6. Have the home directories being auto-created, but the auto rights assignment are not favorable in my opinion.
Is there not a setting so that as the Home Directory is created that it is given rights of the user account and inherits the Domain Admin rights?
Thanks for any assistance.
DELL-Sam L
Community Manager
•
8058 Posts
•
34386 Points
948
0
Posted October 7th, 2021 09:00
Hello wavi,
Here is a link to a kb that maybe of assistance.
https://dell.to/3oHh3d2
https://dell.to/2YCF9Lo
https://dell.to/3iIdHD3