Confirming and changing Client Access List on a Restorer

SUMMARY

• How to confirm and change Client Information in an Access List on a DDR

APPLIES TO

• All Data Domain Restorers

• All DDOS Releases

cifs access lists

INSTRUCTION

• Client access to the DDR can be managed through the Common Internet File System (CIFS) access list or the Network File System (NFS) access list depending on the protocol used.
• To be able to modify the access lists, you must log in to the Restorer with a user account that has admin level authority (versus user  level authority).
• Currently, management of the Access Lists must be done from the command-line interface (CLI).

CIFS Access
A CIFS client can map to shares on a restorer.

• ddvar is the share for administrative tasks, such as looking at a log file, or upgrading the DDOS.
• backup is the share used by a Windows client for data storage and retrieval.
• On current DDOS versions, you can create a customized share using the CLI.

Enable Clients
To allow access for CIFS clients to a Data Domain System, use the cifs enable operation. Disable Clients
To disable all CIFS clients from accessing the Data Domain System, use the cifs disable operation. View Clients
To view the access list use:
Add Clients to the access list
Each Windows client that will read and write to a Data Domain System must be added as a backup client.
We recommend adding the IP address, fully qualified domain name and short name of the client. 

cifs share modify <share> { max-connections <max connections> | clients <clients> | browsing <enabled|disabled> | writeable <enabled|disabled>| users <users> | comment <comment>} <"client-list">

The client list is a comma-separated list of clients that are allowed to access the share. Other than the comma delimiter, there should not be any white space (blank, tab) characters. The list must be enclosed in double quotes.

Some valid client lists are: Some invalid client lists are: Example: To delete a client, you can use the cifs share modify, and change the client list as you want it.

NFS access
The nfs command manages NFS clients and displays NFS statistics and status.
A Data Domain System exports the directories /ddvar and /backup. /ddvar contains Data Domain System log files and core files.
/backup is the target for data from your NFS Clients. Add backup servers as clients to /backup.
Verify NFS is enabled
Adding NFS clients to the access list
To add NFS clients, use the nfs add operation. Add clients for administrative access to /ddvar. Add clients for Read/Write operations to /backup. A client added to a subdirectory under /backup has access only to that subdirectory. The client-list can contain class-C IP addresses, IP addresses with either netmasks or length, hostnames, or an asterisk (*) followed by a domain name, such as *.yourcompany.com.
The nfs-options list can have a comma, a space, or both between entries.

The default NFS options for an NFS client are: rw, no_root_squash, no_all_squash, and secure. 

The list accepts the following options:
ro Read only permission.
rw Read and write permissions.
root_squash Map requests from uid/gid 0 to the anonymous uid/gid.
no_root_squash Turn off root squashing.
all_squash Map all user requests to the anonymous uid/gid.
no_all_squash Turn off the mapping of all user requests to the anonymous uid/gid
secure Requires that requests originate on an Internet port that is less than IPPORT_RESERVED (1024).
insecure Turn off the secure option
anonuid=id Set an explicit user-ID for the anonymous account. The id is an integer bounded from -65635 to 65635.
anongid=id Set an explicit group-ID for the anonymous account. The id is an integer bounded from -65635 to 65635.

For example, to add an NFS client with an IP address of 192.168.1.02 and read/write access to /backup: with the secure option: Netmasks, as in the following examples, are supported: Remove Clients
To remove NFS clients that can access the Data Domain System, use the nfs del export client-list operation. A client can be removed from access to /ddvar and still have access to /backup. The client-list can contain IP addresses, hostnames, and an asterisk (*) and can be comma-separated, space separated, or both. For example, to remove an NFS client with an IP address of 192.168.1.02 from /ddvar access: To display the list of nfs clients enter