Behind the Scenes: Episode 76 – Customer Chat with Yahoo’s Jeff Mohler

Welcome to the Episode 76, part of the continuing series called “Behind the Scenes of the NetApp Tech ONTAP Podcast.”

group-4-2016

This week on the podcast, we bring in a NetApp customer for a candid chat about how they use NetApp’s portfolio in their environment and what sort of challenges they face in day to day operations. Join us as we talk with Jeff Mohler (https://www.linkedin.com/in/jemohler/), a principal Global Storage Architect at Yahoo and get a feel for how an enterprise customer manages thousands of NetApp systems.

If you’re a NetApp customer and you’re interested in appearing on the podcast to chat about how you’re using NetApp, be sure to shoot us an email to podcast@netapp.com!

Finding the Podcast

The podcast is all finished and up for listening. You can find it on iTunes or SoundCloud or by going to techontappodcast.com.

Also, if you don’t like using iTunes or SoundCloud, we just added the podcast to Stitcher.

http://www.stitcher.com/podcast/tech-ontap-podcast?refid=stpr

I also recently got asked how to leverage RSS for the podcast. You can do that here:

http://feeds.soundcloud.com/users/soundcloud:users:164421460/sounds.rss

You can listen here:

Behind the Scenes: Episode 75 – NetApp 101

Welcome to the Episode 75, part of the continuing series called “Behind the Scenes of the NetApp Tech ONTAP Podcast.”

group-4-2016

This week, we brought in a couple of NetApp n00bz from SolidFire – Amy Lewis (@CommsNinja) and Mike Turner (@1andOnlyMikeT) to talk about NetApp basics, from our portfolio offerings to our culture. Mike plays the role of interviewer, while Glenn, Andrew and Justin play the role of podcast guests.

Finding the Podcast

The podcast is all finished and up for listening. You can find it on iTunes or SoundCloud or by going to techontappodcast.com.

Also, if you don’t like using iTunes or SoundCloud, we just added the podcast to Stitcher.

http://www.stitcher.com/podcast/tech-ontap-podcast?refid=stpr

I also recently got asked how to leverage RSS for the podcast. You can do that here:

http://feeds.soundcloud.com/users/soundcloud:users:164421460/sounds.rss

You can listen here:

SMB1 Vulnerabilities: How do they affect NetApp’s Data ONTAP?

Google SMBv1 vulnerability, and you’ll get a ton of hits. There’s a reason for this.

SMB1 is the devil!

waterboy-smb1.jpg

But seriously, there are some major security holes in the protocol.

For a good rundown, check out the new NetApp CIFS/SMB TME Chris Hurley’s blog:

http://averageguyx.blogspot.com/2017/03/smb1-is-baaaaaad.html

This is in addition to the limitations of SMB1, such as lack of resiliency for network loss, lack of durable handles and overall performance and chattiness. There are many good reasons why Microsoft has decided to deprecate SMB1 in favor of newer protocols. SMB owner at Microsoft, Ned Pyle (@NerdPyle), gives a plethora of impassioned reasoning in his TechNet blog “Stop using SMB1!

So, there we are. SMB1 is bad, mmkay?

How does SMB1’s devil status affect NetApp’s ONTAP operating systems?

This question comes up a bit here at NetApp, since security scanners will throw bells, whistles and alarms whenever SMB1 is detected in an environment. What follows is:

  • Does SMB1 in ONTAP have the same vulnerabilities?
  • Can I disable SMB1 in ONTAP?
  • If I can’t disable it, can I block it?

The good news is, the main security vulnerabilities that plague SMB1 in Windows generally don’t affect ONTAP (such as 0-day), because ONTAP isn’t a Windows client. It’s using a proprietary, custom built CIFS/SMB stack (akin to Samba). Thus, the vulnerabilities that impact Windows don’t impact ONTAP.

Note: I can’t take all the credit for the information in this blog. That credit goes to John Lantz (CIFS TME at NetApp), as well as various CIFS/SMB engineering resources here.

Can I disable SMB1 in ONTAP?

While the vulnerabilities don’t necessarily affect ONTAP, the security scanners still are triggering alarms and managers are still wanting the red X’s to go away.

scan

As a result, people want to just turn it off in ONTAP, especially since they aren’t currently using it in their environments (hopefully).

The good news is that ONTAP is in the process of deprecating SMB1. The bad news? It’s still there and there’s no current way to disable it. NetApp is currently working on adding a way to do it. The closest thing we have is the ability to control what SMB version is used with domain controllers for authentication. In systems running ONTAP 7-mode, use the following option to enable SMB2.

cifs.smb2.client.enable

In systems running clustered ONTAP, starting in ONTAP 9.1, you can disable SMB1 connections to the DC, as well as enabling SMB2.

[-smb1-enabled-for-dc-connections {false|true|system-default}] - SMB1 Enabled for DC Connections
 This parameter specifies whether SMB1 is enabled for use with connections to domain controllers. If you do not specify this parameter, the default is system-default.

SMB1 Enabled For DC Connections can be one of the following:
o false - SMB1 is not enabled.
o true - SMB1 is enabled.
o system-default - This sets the option to whatever is the default for the release of Data ONTAP that is running. For this release it is: SMB1 is enabled.

[-smb2-enabled-for-dc-connections {false|true|system-default}] - SMB2 Enabled for DC Connections
 This parameter specifies whether SMB2 is enabled for use with connections to domain controllers. If you do not specify this parameter, the default is system-default.

SMB2 Enabled For DC Connections can be one of the following:
o false - SMB2 is not enabled.
o true - SMB2 is enabled.
o system-default - This sets the option to whatever is the default for the release of Data ONTAP that is running. For this release it is: SMB2 is not enabled.

Use the following command to do that:

cifs security modify -vserver DEMO -smb1-enabled-for-dc-connections false -smb2-enabled-for-dc-connections true

Since I can’t disable it in ONTAP, can I block it?

Technically, you *could* block the SMB1 ports. However, if you block ports that SMB2 also needs (such as 445), you’d be in trouble.

The official recommendation from Microsoft is a combination of disabling SMB1 on clients (you could handle this via Group Policy), as well as blocking ports on *external* facing interfaces. In other words, don’t allow SMB outside of the firewall.

Here’s the official link:

https://technet.microsoft.com/en-us/library/cc766392%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396

To disable SMB1 on the client:

https://support.microsoft.com/en-us/kb/2696547

Inside your firewall, you shouldn’t need the following ports, so block away:

  • UDP/137 (NetBIOS name service)
  • UDP/138 (NetBIOS datagram service)
  • TCP/139 (NetBIOS session service)

In some cases, you won’t be able to rid yourself entirely of SMB1. Remember that $30k printer/copier/scanner that you bought 10 years ago that was cool because you could scan directly to a SMB share? Yeah…. that’s probably still using SMB1. Check with your scanner/copier vendor to see if they have any software updates. Otherwise, you may need to disable SMB1 on the copier/scanner, or budget for a new one.

copier

For official NetApp statement on SMB1, check out this TR, starting on page 4:

http://www.netapp.com/us/media/tr-4543.pdf

Behind the Scenes: Episode 74 – Performance 101 with Tony Gaddis

Welcome to the Episode 74, part of the continuing series called “Behind the Scenes of the NetApp Tech ONTAP Podcast.”

group-4-2016

This week, we welcome Mr. Performance, Tony Gaddis (gaddis@netapp.comgaddis@netapp.com) into the studio to give us an ONTAP performance primer. We discuss WAFL, ONTAP performance basics, frequently asked questions and approaches to performance troubleshooting.

Finding the Podcast

The podcast is all finished and up for listening. You can find it on iTunes or SoundCloud or by going to techontappodcast.com.

Also, if you don’t like using iTunes or SoundCloud, we just added the podcast to Stitcher.

http://www.stitcher.com/podcast/tech-ontap-podcast?refid=stpr

I also recently got asked how to leverage RSS for the podcast. You can do that here:

http://feeds.soundcloud.com/users/soundcloud:users:164421460/sounds.rss

You can listen here:

https://soundcloud.com/techontap_podcast/episode-74-ontap-performance-101-with-tony-gaddis

Behind the Scenes: Episode 73 – SNIA and Technology Trends

bgydxiicqaa1yk7

Welcome to the Episode 73, part of the continuing series called “Behind the Scenes of the NetApp Tech ONTAP Podcast.”

group-4-2016

This week, we invited one of the board members over at the storage industry’s standards organization, the Storage Networking Industry Association (SNIA). Alex McDonald (@alextangent) is a director and vice-chair at SNIA and covers cloud, as well as NFS.

logo

He also happens to be part of the office of the CTO here at NetApp and was kind enough to join us whilst in RTP to chat about SNIA and technology trends. We talk a bit more about NVMe, which we also covered in last week’s podcast.

In addition, I went off on one of my classic tangents. This time, it was regarding Spaceballs, and the concept of “now.”

Finding the Podcast

The podcast is all finished and up for listening. You can find it on iTunes or SoundCloud or by going to techontappodcast.com.

Also, if you don’t like using iTunes or SoundCloud, we just added the podcast to Stitcher.

http://www.stitcher.com/podcast/tech-ontap-podcast?refid=stpr

I also recently got asked how to leverage RSS for the podcast. You can do that here:

http://feeds.soundcloud.com/users/soundcloud:users:164421460/sounds.rss

You can listen here:

ONTAP CLI comparison tool

ontapcli

Ever wonder where a command you always used to use went? Or what the new commands in an ONTAP release are? Didn’t want to read every document on the planet to find out?

Well, good news!

NetApp has released a new tool that does ONTAP CLI comparisons between releases on the support site! And you don’t even need a valid NetApp login to see it.

http://mysupport.netapp.com/NOW/products/support/cli-comparison.shtml

This tool takes comparisons of commands between one major release and color codes them to show which have been added, changed or removed.

ontapcli-compare1ontapcli-compare-menu

Once you click on one of the releases, you get a page that has a color-coded legend and a series of drop down boxes that allow you to navigate different levels of the CLI directory structure. Green means “added.” Yellow is “changed.” Red is “removed.”

In addition, the drop down menus allow for quick navigation of the CLI directories. For instance, you can click “vserver” and get all of the sub-commands.

ontapcli-compare2

Once you select one, it takes you to the area of the table that you selected.

ontapcli-compare3.png

That’s it! Pretty simple. If you’re interested in some ONTAP CLI tricks and tips, check out TECH::Become a clustered Data ONTAP CLI Ninja.

Behind the Scenes: Episode 72 – Demystifying NVMe

mysterio_earth-3000

Welcome to the Episode 72, part of the continuing series called “Behind the Scenes of the NetApp Tech ONTAP Podcast.”

group-4-2016

This week, we invited a gaggle of NetApp’s flash brain trust to discuss the emerging technology NVMe and its place within the storage landscape and attempt to demystify it.

Is NVMe the future or a passing trend? And where does NVMe fit within the NetApp product portfolio?

Featured on the podcast (in alphabetical order):

  • Andy Banta, Storage Janitor at NetApp SolidFire (@andybanta)
  • Val Bercovici, CTO for NetApp SolidFire (@valb00)
  • Andy Grimes, Mr. Flash/Principal Architect for Flash at NetApp (@andy_NTAP_flash)
  • Mark Harrison, NetApp SE (@NetApp_Mark)
  • Anthony Whitehouse, Senior Product Manager at NetApp (@apwhitehouse)
  • John Woodall, VP, Engineering at Integrated Archive Systems; NetApp A-Team member (@John_Woodall)

Keith Aasen, NetApp Solutions Architect also gives some perspective on NVMe in this blog post:

http://community.netapp.com/t5/Technology/NVMe-A-Step-into-the-Future/ba-p/127309

Also check out Val Bercovici in this article on NVMe from The Register:

https://www.theregister.co.uk/2017/01/31/netapp_and_nvme_drives_and_fabric_access/

Finding the Podcast

The podcast is all finished and up for listening. You can find it on iTunes or SoundCloud or by going to techontappodcast.com.

Also, if you don’t like using iTunes or SoundCloud, we just added the podcast to Stitcher.

http://www.stitcher.com/podcast/tech-ontap-podcast?refid=stpr

I also recently got asked how to leverage RSS for the podcast. You can do that here:

http://feeds.soundcloud.com/users/soundcloud:users:164421460/sounds.rss

You can listen here:

Managing ACLs via the ONTAP Command Line

In a previous post, I covered multiprotocol NAS in ONTAP, as well as mixed security styles. The following post covers how to manage permissions from the ONTAP CLI, as well as how to centralize permission management from a single Linux client. Some of the following was moved from the previous post to this one to make it easier to read and digest.

Viewing permissions in multiprotocol NAS

There are options to display permissions from both types of clients. For viewing UNIX permissions from Windows property tabs, use the cifs option is-unix-nt-acl-enabled.

cluster::*> cifs option show -vserver parisi-fields is-unix-nt-acl-enabled
vserver is-unix-nt-acl-enabled
----------- ----------------------
parisi     true

When using this option, the Windows clients will show a security tab entry that approximates the UNIX mode bits into ACLs. It will show the owner, group and “other” permissions. It will also attempt to convert the UNIX UID into a Windows-friendly SID so the client can display it. The Windows user will look like this:

unix-windows-acl1

That user is a “fake SID” that is tied to the cluster’s Storage Virtual Machine. It translates to a SID that ONTAP creates based on the numeric ID of the user or group. The Windows client uses that SID to translate into a name.

For example:

cluster::*> diag secd authentication translate -node node1 -vserver SVM -win-name UNIXPermUid\root
S-1-5-21-2038298172-1297133386-11111-0

cluster::*> diag secd authentication translate -node node1 -vserver SVM -unix-user-name root
0

cluster::*> diag secd authentication translate -node node1 -vserver SVM -win-name UNIXPermUid\user3
S-1-5-21-2038298172-1297133386-11111-703

cluster::*> diag secd authentication translate -node node1 -vserver SVM -unix-user-name user3
703

cluster::*> diag secd authentication translate -node node1 -vserver SVM -win-name UNIXPermGid\homedirs
S-1-5-21-2038298172-1297133386-22222-1002

cluster::*> diag secd authentication translate -node node1 -vserver SVM -unix-group-name homedirs
1002

From Windows, we can see the level of access for the users from the “Change Permissions” window:

unix-windows-acl2

On the NFS side, mode bits have no clue how to translate NTFS permission concepts like extended attributes. Instead, the clients only know Read, Write, Execute, Traverse, etc. It’s possible to show an approximation of those mode bits in UNIX for NTFS security style volumes with this option:

cluster::*> nfs server show -fields ntacl-display-permissive-perms
vserver ntacl-display-permissive-perms
----------- ------------------------------
parisi     disabled

When that option is disabled, NTFS ACLs show up as closely to UNIX permissions as they can. In the following example, I have an NTFS security style folder that allowed only the owner to have full control, but allows read to “Everyone.” With the option mentioned, we see that reflected as “755” in permissions:

unix-windows-acl3

drwxr-xr-x 3 user1 homedirs 4096 Nov 8 14:15 user1

Translating NTFS style DACLs

As previously mentioned, in ONTAP we can view the Windows ACLs on a file, folder or volume using vserver security file-directory show.

cluster::*> vserver security file-directory show -vserver SVM-path /homedir1/user1

Vserver: SVM
 File Path: /homedir1/user1
 File Inode Number: 10363
 Security Style: mixed
 Effective Style: ntfs
 DOS Attributes: 10
 DOS Attributes in Text: ----D---
Expanded Dos Attributes: -
 UNIX User Id: 701
 UNIX Group Id: 1002
 UNIX Mode Bits: 777
 UNIX Mode Bits in Text: rwxrwxrwx
 ACLs: NTFS Security Descriptor
 Control:0x8004
 Owner:CPOC\user1
 Group:CPOC\Domain Users
 DACL - ACEs
 ALLOW-CPOC\Administrator-0xe0000040-OI|IO
 ALLOW-CPOC\Administrator-0x1201ff-CI
 ALLOW-CPOC\user1-0x10000000-OI|IO
 ALLOW-CPOC\user1-0x1f01ff-CI
 ALLOW-Everyone-0xa0000000-OI|IO
 ALLOW-Everyone-0x1200a9-CI

However, as you can see, those ACLs don’t make a ton of sense unless you can read hexadecimal. (If you can, more power to ya.)

Let’s break down the ACLs a bit to understand them better.

  • First, DACL means “Discretionary Access Control List.” From MSDN:
  • An access control list that is controlled by the owner of an object and that specifies the access particular users or groups can have to the object.
  • In the DACLs above, we can see whether the DACL is an ALLOW or a DENY ACL. (Deny ACLs override ALLOWS.) We can also see the user or group being allowed access. After that, the information isn’t really in a “human readable” format.
  • The CI, IO, OI values are “ACE strings” and tell us whether the ACL was inherited by the owner or container. MSDN has a handy list of those here: ACE Strings

The rest of the ACLs are hexadecimal values and translate into what the actual permissions that were set were.

Expanding ACLs

Rather than try to decode all of those, ONTAP has an option on the file-directory show command that allows you to expand the ACL mask from the CLI (-expand-mask). This actually cracks open the DACLs and shows an expanded view of what actual permissions are allowed.

For example:

cluster::> vserver security file-directory show -vserver parisi -path /cifs -expand-mask true

Vserver: parisi
 File Path: /cifs
 File Inode Number: 64
 Security Style: ntfs
 Effective Style: ntfs
 DOS Attributes: 10
 DOS Attributes in Text: ----D---
Expanded Dos Attributes: 0x10
 ...0 .... .... .... = Offline
 .... ..0. .... .... = Sparse
 .... .... 0... .... = Normal
 .... .... ..0. .... = Archive
 .... .... ...1 .... = Directory
 .... .... .... .0.. = System
 .... .... .... ..0. = Hidden
 .... .... .... ...0 = Read Only
 UNIX User Id: 0
 UNIX Group Id: 0
 UNIX Mode Bits: 777
 UNIX Mode Bits in Text: rwxrwxrwx
 ACLs: NTFS Security Descriptor
 Control:0x8004

1... .... .... .... = Self Relative
 .0.. .... .... .... = RM Control Valid
 ..0. .... .... .... = SACL Protected
 ...0 .... .... .... = DACL Protected
 .... 0... .... .... = SACL Inherited
 .... .0.. .... .... = DACL Inherited
 .... ..0. .... .... = SACL Inherit Required
 .... ...0 .... .... = DACL Inherit Required
 .... .... ..0. .... = SACL Defaulted
 .... .... ...0 .... = SACL Present
 .... .... .... 0... = DACL Defaulted
 .... .... .... .1.. = DACL Present
 .... .... .... ..0. = Group Defaulted
 .... .... .... ...0 = Owner Defaulted

Owner:BUILTIN\Administrators
 Group:BUILTIN\Administrators
 DACL - ACEs
 ALLOW-Everyone-0x1f01ff
 0... .... .... .... .... .... .... .... = Generic Read
 .0.. .... .... .... .... .... .... .... = Generic Write
 ..0. .... .... .... .... .... .... .... = Generic Execute
 ...0 .... .... .... .... .... .... .... = Generic All
 .... ...0 .... .... .... .... .... .... = System Security
 .... .... ...1 .... .... .... .... .... = Synchronize
 .... .... .... 1... .... .... .... .... = Write Owner
 .... .... .... .1.. .... .... .... .... = Write DAC
 .... .... .... ..1. .... .... .... .... = Read Control
 .... .... .... ...1 .... .... .... .... = Delete
 .... .... .... .... .... ...1 .... .... = Write Attributes
 .... .... .... .... .... .... 1... .... = Read Attributes
 .... .... .... .... .... .... .1.. .... = Delete Child
 .... .... .... .... .... .... ..1. .... = Execute
 .... .... .... .... .... .... ...1 .... = Write EA
 .... .... .... .... .... .... .... 1... = Read EA
 .... .... .... .... .... .... .... .1.. = Append
 .... .... .... .... .... .... .... ..1. = Write
 .... .... .... .... .... .... .... ...1 = Read

ALLOW-Everyone-0x10000000-OI|CI|IO
 0... .... .... .... .... .... .... .... = Generic Read
 .0.. .... .... .... .... .... .... .... = Generic Write
 ..0. .... .... .... .... .... .... .... = Generic Execute
 ...1 .... .... .... .... .... .... .... = Generic All
 .... ...0 .... .... .... .... .... .... = System Security
 .... .... ...0 .... .... .... .... .... = Synchronize
 .... .... .... 0... .... .... .... .... = Write Owner
 .... .... .... .0.. .... .... .... .... = Write DAC
 .... .... .... ..0. .... .... .... .... = Read Control
 .... .... .... ...0 .... .... .... .... = Delete
 .... .... .... .... .... ...0 .... .... = Write Attributes
 .... .... .... .... .... .... 0... .... = Read Attributes
 .... .... .... .... .... .... .0.. .... = Delete Child
 .... .... .... .... .... .... ..0. .... = Execute
 .... .... .... .... .... .... ...0 .... = Write EA
 .... .... .... .... .... .... .... 0... = Read EA
 .... .... .... .... .... .... .... .0.. = Append
 .... .... .... .... .... .... .... ..0. = Write
 .... .... .... .... .... .... .... ...0 = Read

This also works with NFSv4 ACLs:

cluster::*> vserver security file-directory show -vserver DEMO -path /shared/unix -expand-mask true

                Vserver: DEMO
              File Path: /shared/unix
      File Inode Number: 20034
         Security Style: unix
        Effective Style: unix
         DOS Attributes: 10
 DOS Attributes in Text: ----D---
Expanded Dos Attributes: 0x10
     ...0 .... .... .... = Offline
     .... ..0. .... .... = Sparse
     .... .... 0... .... = Normal
     .... .... ..0. .... = Archive
     .... .... ...1 .... = Directory
     .... .... .... .0.. = System
     .... .... .... ..0. = Hidden
     .... .... .... ...0 = Read Only
           UNIX User Id: 1100
          UNIX Group Id: 1101
         UNIX Mode Bits: 770
 UNIX Mode Bits in Text: rwxrwx---
                   ACLs: NFSV4 Security Descriptor
                         Control:0x8014
                              1... .... .... .... = Self Relative
                              .0.. .... .... .... = RM Control Valid
                              ..0. .... .... .... = SACL Protected
                              ...0 .... .... .... = DACL Protected
                              .... 0... .... .... = SACL Inherited
                              .... .0.. .... .... = DACL Inherited
                              .... ..0. .... .... = SACL Inherit Required
                              .... ...0 .... .... = DACL Inherit Required
                              .... .... ..0. .... = SACL Defaulted
                              .... .... ...1 .... = SACL Present
                              .... .... .... 0... = DACL Defaulted
                              .... .... .... .1.. = DACL Present
                              .... .... .... ..0. = Group Defaulted
                              .... .... .... ...0 = Owner Defaulted

                         DACL - ACEs
                           ALLOW-OWNER@-0x1601ff
                              0... .... .... .... .... .... .... .... = Generic Read
                              .0.. .... .... .... .... .... .... .... = Generic Write
                              ..0. .... .... .... .... .... .... .... = Generic Execute
                              ...0 .... .... .... .... .... .... .... = Generic All
                              .... ...0 .... .... .... .... .... .... = System Security
                              .... .... ...1 .... .... .... .... .... = Synchronize
                              .... .... .... 0... .... .... .... .... = Write Owner
                              .... .... .... .1.. .... .... .... .... = Write DAC
                              .... .... .... ..1. .... .... .... .... = Read Control
                              .... .... .... ...0 .... .... .... .... = Delete
                              .... .... .... .... .... ...1 .... .... = Write Attributes
                              .... .... .... .... .... .... 1... .... = Read Attributes
                              .... .... .... .... .... .... .1.. .... = Delete Child
                              .... .... .... .... .... .... ..1. .... = Execute
                              .... .... .... .... .... .... ...1 .... = Write EA
                              .... .... .... .... .... .... .... 1... = Read EA
                              .... .... .... .... .... .... .... .1.. = Append
                              .... .... .... .... .... .... .... ..1. = Write
                              .... .... .... .... .... .... .... ...1 = Read

                           ALLOW-user-prof1-0x1601ff
                              0... .... .... .... .... .... .... .... = Generic Read
                              .0.. .... .... .... .... .... .... .... = Generic Write
                              ..0. .... .... .... .... .... .... .... = Generic Execute
                              ...0 .... .... .... .... .... .... .... = Generic All
                              .... ...0 .... .... .... .... .... .... = System Security
                              .... .... ...1 .... .... .... .... .... = Synchronize
                              .... .... .... 0... .... .... .... .... = Write Owner
                              .... .... .... .1.. .... .... .... .... = Write DAC
                              .... .... .... ..1. .... .... .... .... = Read Control
                              .... .... .... ...0 .... .... .... .... = Delete
                              .... .... .... .... .... ...1 .... .... = Write Attributes
                              .... .... .... .... .... .... 1... .... = Read Attributes
                              .... .... .... .... .... .... .1.. .... = Delete Child
                              .... .... .... .... .... .... ..1. .... = Execute
                              .... .... .... .... .... .... ...1 .... = Write EA
                              .... .... .... .... .... .... .... 1... = Read EA
                              .... .... .... .... .... .... .... .1.. = Append
                              .... .... .... .... .... .... .... ..1. = Write
                              .... .... .... .... .... .... .... ...1 = Read

                           ALLOW-GROUP@-0x1201ff-IG
                              0... .... .... .... .... .... .... .... = Generic Read
                              .0.. .... .... .... .... .... .... .... = Generic Write
                              ..0. .... .... .... .... .... .... .... = Generic Execute
                              ...0 .... .... .... .... .... .... .... = Generic All
                              .... ...0 .... .... .... .... .... .... = System Security
                              .... .... ...1 .... .... .... .... .... = Synchronize
                              .... .... .... 0... .... .... .... .... = Write Owner
                              .... .... .... .0.. .... .... .... .... = Write DAC
                              .... .... .... ..1. .... .... .... .... = Read Control
                              .... .... .... ...0 .... .... .... .... = Delete
                              .... .... .... .... .... ...1 .... .... = Write Attributes
                              .... .... .... .... .... .... 1... .... = Read Attributes
                              .... .... .... .... .... .... .1.. .... = Delete Child
                              .... .... .... .... .... .... ..1. .... = Execute
                              .... .... .... .... .... .... ...1 .... = Write EA
                              .... .... .... .... .... .... .... 1... = Read EA
                              .... .... .... .... .... .... .... .1.. = Append
                              .... .... .... .... .... .... .... ..1. = Write
                              .... .... .... .... .... .... .... ...1 = Read

                           ALLOW-EVERYONE@-0x120080
                              0... .... .... .... .... .... .... .... = Generic Read
                              .0.. .... .... .... .... .... .... .... = Generic Write
                              ..0. .... .... .... .... .... .... .... = Generic Execute
                              ...0 .... .... .... .... .... .... .... = Generic All
                              .... ...0 .... .... .... .... .... .... = System Security
                              .... .... ...1 .... .... .... .... .... = Synchronize
                              .... .... .... 0... .... .... .... .... = Write Owner
                              .... .... .... .0.. .... .... .... .... = Write DAC
                              .... .... .... ..1. .... .... .... .... = Read Control
                              .... .... .... ...0 .... .... .... .... = Delete
                              .... .... .... .... .... ...0 .... .... = Write Attributes
                              .... .... .... .... .... .... 1... .... = Read Attributes
                              .... .... .... .... .... .... .0.. .... = Delete Child
                              .... .... .... .... .... .... ..0. .... = Execute
                              .... .... .... .... .... .... ...0 .... = Write EA
                              .... .... .... .... .... .... .... 0... = Read EA
                              .... .... .... .... .... .... .... .0.. = Append
                              .... .... .... .... .... .... .... ..0. = Write
                              .... .... .... .... .... .... .... ...0 = Read

However, with a ton of ACLs on an object, this could get a bit overwhelming. So, translating the hex might be better overall. This blog covers it in a bit more detail:

About the ACCESS_MASK structure

In the above ACL, we see 0x1f01ff for Everyone. That’s Full Control. In addition, 0x10000000 is considered GENERIC_ALL.

Applying ACLs to objects from the storage

In addition to displaying ACLs, vserver security file-directory commands can be used to apply SACLs and DACLs to objects from the cluster’s CLI.

The general steps are covered in this KB article:

https://kb.netapp.com/support/s/article/how-to-modify-permissions-on-files-and-folders-in-clustered-data-ontap-when-there-is-no-permission-to-take-ownership?t=1484836401866

The following shows an example of doing this on a single qtree in ONTAP.

This is a qtree called “mixed.” It has an effective security style of UNIX, unix permissions 770 and root:sharedgroup as the owners.

cluster::*> vserver security file-directory show -vserver DEMO -path /shared/mixed

                Vserver: DEMO
              File Path: /shared/mixed
      File Inode Number: 20035
         Security Style: mixed
        Effective Style: unix
         DOS Attributes: 10
 DOS Attributes in Text: ----D---
Expanded Dos Attributes: -
           UNIX User Id: 0
          UNIX Group Id: 1206
         UNIX Mode Bits: 770
 UNIX Mode Bits in Text: rwxrwx---
                   ACLs: -

To change permissions on this object (or other objects, if desired), first create a security policy:

cluster::*> file-directory policy create -vserver DEMO -policy-name Policy1
  (vserver security file-directory policy create)
 
cluster::*> vserver security file-directory policy show -vserver DEMO -instance
    Vserver: DEMO
Policy Name: Policy1

Then, create a security descriptor, which allows a storage admin to add access control entries (ACEs) to the discretionary access control list (DACL) and the system access control list (SACL). This provides the ability to add, in bulk, an owner, group or control flags in raw hex:

cluster::*> vserver security file-directory ntfs create -vserver DEMO -ntfs-sd sdname 
 -owner ntfsonly

cluster::*> vserver security file-directory ntfs show -instance
                      Vserver: DEMO
NTFS Security Descriptor Name: sdname
                        Owner: NTAP\ntfsonly
                Primary Group: -
            Raw Control Flags: -

Next, create one or more DACLs or SACLs. In this case, I’ve created 2 DACLs. This command allows the following:

cluster::*> vserver security file-directory ntfs dacl add ?
    -vserver                                                   Vserver
   [-ntfs-sd]                                             NTFS Security Descriptor Name
   [-access-type] {deny|allow}                                               Allow or Deny
   [-account]                                                   Account Name or SID
  { [[-rights] {no-access|full-control|modify|read-and-execute|read|write}]  DACL ACE's Access Rights
  | [ -advanced-rights , ... ]                        DACL ACE's Advanced Access Rights
  | [ -rights-raw  ] }                                          *DACL ACE's Raw Access Rights
  [ -apply-to {this-folder|sub-folders|files}, ... ]                         Apply DACL Entry

The users I’m adding are ntfsonly and student1. Ntfsonly gets full control; student1 gets readonly access. I’m applying the DACL to all objects (this-folder, sub-folders, files).

NOTE: If you don’t apply the DACL to the top level folder, you run the risk of denying access to everyone because the owner doesn’t get set properly.

ontap9-tme-8040::*> vserver security file-directory ntfs dacl add -vserver DEMO -ntfs-sd sdname -access-type allow -account ntfsonly -apply-to this-folder,sub-folders,files -advanced-rights full-control

ontap9-tme-8040::*> vserver security file-directory ntfs dacl add -vserver DEMO -ntfs-sd sdname -access-type allow -account student1 -rights read -apply-to this-folder,sub-folders,files

In addition to the ACLs we define, we also get default built-in DACLs. Feel free to delete those as needed.

ontap9-tme-8040::*> vserver security file-directory ntfs dacl show -vserver DEMO -instance


                      Vserver: DEMO
NTFS Security Descriptor Name: sdname
                Allow or Deny: allow
          Account Name or SID: BUILTIN\Administrators
                Access Rights: full-control
            Raw Access Rights: -
       Advanced Access Rights: -
             Apply DACL Entry: this-folder, sub-folders, files
                Access Rights: full-control

                      Vserver: DEMO
NTFS Security Descriptor Name: sdname
                Allow or Deny: allow
          Account Name or SID: BUILTIN\Users
                Access Rights: full-control
            Raw Access Rights: -
       Advanced Access Rights: -
             Apply DACL Entry: this-folder, sub-folders, files
                Access Rights: full-control

                      Vserver: DEMO
NTFS Security Descriptor Name: sdname
                Allow or Deny: allow
          Account Name or SID: CREATOR OWNER
                Access Rights: full-control
            Raw Access Rights: -
       Advanced Access Rights: -
             Apply DACL Entry: this-folder, sub-folders, files
                Access Rights: full-control

                      Vserver: DEMO
NTFS Security Descriptor Name: sdname
                Allow or Deny: allow
          Account Name or SID: NT AUTHORITY\SYSTEM
                Access Rights: full-control
            Raw Access Rights: -
       Advanced Access Rights: -
             Apply DACL Entry: this-folder, sub-folders, files
                Access Rights: full-control

                      Vserver: DEMO
NTFS Security Descriptor Name: sdname
                Allow or Deny: allow
          Account Name or SID: NTAP\ntfsonly
                Access Rights: -
            Raw Access Rights: -
       Advanced Access Rights: full-control
             Apply DACL Entry: this-folder, sub-folders, files
                Access Rights: full-control

                      Vserver: DEMO
NTFS Security Descriptor Name: sdname
                Allow or Deny: allow
          Account Name or SID: NTAP\student1
                Access Rights: read
            Raw Access Rights: -
       Advanced Access Rights: -
             Apply DACL Entry: this-folder, sub-folders, files
                Access Rights: read
6 entries were displayed.

Now that the policy is created and I have the desired DACLs and SACLs, I can apply them to whatever paths I want. In the above, I’ve set the DACLs to only apply to the specific folder. To apply the policy, create a new task and define the path you want to re-ACL. The task will “propogate” by default. You can also specify “replace” if desired.

cluster::*> file-directory policy task add -vserver DEMO -policy-name Policy1 -path /shared/mixed -ntfs-sd sdname
  (vserver security file-directory policy task add)

cluster::*> file-directory policy task show
  (vserver security file-directory policy task show)

Vserver: DEMO
  Policy: Policy1

   Index  File/Folder  Access           Security  NTFS       NTFS Security
          Path         Control          Type      Mode       Descriptor Name
   -----  -----------  ---------------  --------  ---------- ---------------
   1      /shared/mixed
                       file-directory   ntfs      propagate  sdname

Once everything appears in order, apply the policy:

cluster::*> file-directory apply -vserver DEMO -policy-name Policy1
  (vserver security file-directory apply)

[Job 3229] Job is queued: Fsecurity Apply. Use the "job show -id 3229" command to view the status of this operation.

If you want status of the progress, use job show. If you want detailed progress, use job show -instance.

cluster::*> job show -id 3229
                            Owning
Job ID Name                 Vserver    Node           State
------ -------------------- ---------- -------------- ----------
3229   Fsecurity Apply      cluster
                                       cluster2
                                                      Success
       Description: File Directory Security Apply Job

Then, check your ACLs. Note how the effective style of the mixed qtree has changed from UNIX to NTFS:

cluster::*> vserver security file-directory show -vserver DEMO -path /shared/mixed

                Vserver: DEMO
              File Path: /shared/mixed
      File Inode Number: 20035
         Security Style: mixed
        Effective Style: ntfs
         DOS Attributes: 10
 DOS Attributes in Text: ----D---
Expanded Dos Attributes: -
           UNIX User Id: 0
          UNIX Group Id: 0
         UNIX Mode Bits: 777
 UNIX Mode Bits in Text: rwxrwxrwx
                   ACLs: NTFS Security Descriptor
                         Control:0x8014
                         Owner:NTAP\ntfsonly
                         Group:BUILTIN\Administrators
                         DACL - ACEs
                           ALLOW-BUILTIN\Administrators-0x1f01ff-OI|CI
                           ALLOW-BUILTIN\Users-0x1f01ff-OI|CI
                           ALLOW-CREATOR OWNER-0x1f01ff-OI|CI
                           ALLOW-NT AUTHORITY\SYSTEM-0x1f01ff-OI|CI
                           ALLOW-NTAP\ntfsonly-0x1f01ff
                           ALLOW-NTAP\student1-0x120089     

If you want to apply the policy to other paths (or multiple paths at once), create new tasks:

cluster::*> vserver security file-directory show -vserver DEMO -path /shared/security
                Vserver: DEMO
              File Path: /shared/security
      File Inode Number: 96
         Security Style: mixed
        Effective Style: unix
         DOS Attributes: 10
 DOS Attributes in Text: ----D---
Expanded Dos Attributes: -
           UNIX User Id: 0
          UNIX Group Id: 0
         UNIX Mode Bits: 770
 UNIX Mode Bits in Text: rwxrwx---
                   ACLs: -

cluster::*> file-directory policy task add -vserver DEMO -policy-name Policy1 -path /shared/security -ntfs-sd sdname
  (vserver security file-directory policy task add)

cluster::*> file-directory policy task show
  (vserver security file-directory policy task show)
Vserver: DEMO
  Policy: Policy1
   Index  File/Folder  Access           Security  NTFS       NTFS Security
          Path         Control          Type      Mode       Descriptor Name
   -----  -----------  ---------------  --------  ---------- ---------------
   1      /shared/mixed
                       file-directory   ntfs      propagate  sdname
   2      /shared/security
                       file-directory   ntfs      propagate  sdname
2 entries were displayed.

cluster::*> file-directory apply -vserver DEMO -policy-name Policy1
  (vserver security file-directory apply)

[Job 3232] Job is queued: Fsecurity Apply. Use the "job show -id 3232" command to view the status of this operation.

cluster::*> vserver security file-directory show -vserver DEMO -path /shared/security
                Vserver: DEMO
              File Path: /shared/security
      File Inode Number: 96
         Security Style: mixed
        Effective Style: ntfs
         DOS Attributes: 10
 DOS Attributes in Text: ----D---
Expanded Dos Attributes: -
           UNIX User Id: 0
          UNIX Group Id: 0
         UNIX Mode Bits: 777
 UNIX Mode Bits in Text: rwxrwxrwx
                   ACLs: NTFS Security Descriptor
                         Control:0x8014
                         Owner:NTAP\ntfsonly
                         Group:BUILTIN\Administrators
                         DACL - ACEs
                           ALLOW-BUILTIN\Administrators-0x1f01ff-OI|CI
                           ALLOW-BUILTIN\Users-0x1f01ff-OI|CI
                           ALLOW-CREATOR OWNER-0x1f01ff-OI|CI
                           ALLOW-NT AUTHORITY\SYSTEM-0x1f01ff-OI|CI
                           ALLOW-NTAP\ntfsonly-0x1f01ff
                           ALLOW-NTAP\student1-0x120089

Example of a running job with more information:

cluster::*> job show -id 3317 -instance
                      Job ID: 3317
              Owning Vserver: cluster
                        Name: Fsecurity Apply
                 Description: File Directory Security Apply Job
                    Priority: Low
                        Node: cluster02
                    Affinity: Cluster
                    Schedule: @now
                  Queue Time: 01/24 09:45:19
                  Start Time: 01/24 09:45:19
                    End Time: -
              Drop-dead Time: -
                  Restarted?: false
                       State: Running
                 Status Code: 0
           Completion String:
                    Job Type: FSEC_APPLY
                Job Category: FSECURITY
                        UUID: b9e7bf61-e243-11e6-a40c-00a0986b1210
          Execution Progress: Fsecurity Apply processed 46766 files/dirs. Last Processed: /shared/security/files/topdir_77/subdir_81
                   User Name: admin
                     Process: mgwd
  Restart Is or Was Delayed?: false
Restart Is Delayed by Module: -

Centralizing permission management

With multiprotocol NAS, it’s possible to view and manage ACLs from multiple clients, as well as the storage. The way I did this was to set up passwordless SSH on a Linux client and then create simple shell scripts that call SSH commands to the cluster. Another way to do this would be to leverage the ONTAP SDK. I’ll write up a post on the SDK at some point in the future, but for now, we’ll focus on the bash scripts.

To set up passwordless SSH to the cluster, do the following (from TR-4073):

Create the SSH Keypair

In the following example, ssh-keygen is used on a Linux box.

  • If a ssh key pair already exists, there is no need to generate one using ssh-keygen.
monitor@linux:/$ ssh-keygen -q -f ~/.ssh/id_rsa -t rsa
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
monitor@linux:/$ ls -lsa ~/.ssh
total 16
4 drwx------ 2 monitor monitor 4096 2008-08-26 11:47 .
4 drwxr-xr-x 3 monitor monitor 4096 2008-08-26 11:47 ..
4 -rw------- 1 monitor monitor 1679 2008-08-26 11:47 id_rsa
4 -rw-r--r-- 1 monitor monitor 401 2008-08-26 11:47 id_rsa.pub

Create the User with a Public Key Authentication Method

cluster::> security login create -username monitor -application ssh -authmethod publickey -profile admin

Create the Public Key on the Cluster

Copy the public key contents of the id_rsa.pub file and place it between quotes in the security login public key create command. Take caution not to add carriage returns or other data that modifies the keystring; leave it in one line.

netapp::> security login publickey create -username monitor -index 1 -publickey “ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA5s4vVbwEO1sOsq7r64V5KYBRXBDb2I5mtGmt0+3p1jjPJrXx4/IPHFLalXAQkG7LhV5Dyc5jyQiGKVawBYwxxSZ3GqXJNv1aORZHJEuCd0zvSTBGGZ09vra5uCfxkpz8nwaTeiAT232LS2lZ6RJ4dsCz+GAj2eidpPYMldi2z6RVoxpZ5Zq68MvNzz8b15BS9T7bvdHkC2OpXFXu2jndhgGxPHvfO2zGwgYv4wwv2nQw4tuqMp8e+z0YP73Jg0T3jV8NYraXO951Rr5/9ZT8KPUqLEgPZxiSNkLnPC5dnmfTyswlofPGud+qmciYYr+cUZIvcFaYRG+Z6DM/HInX7w==  monitor@linux”

Alternatively, you can use the load-from-uri function to bring the public key from another source.

cluster::> security login publickey load-from-uri -username monitor -uri http://linux/id_rsa.pub

Verify Creation

netapp::> security login publickey show -username monitor

UserName: monitor Index: 1

Public Key:

ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA5s4vVbwEO1sOsq7r64V5KYBRXBDb2I5mtGmt0+3p1jjPJrXx4/IPHFLalXAQkG7LhV5Dyc5jyQiGKVawBYwxxSZ3GqXJNv1aORZHJEuCd0zvSTBGGZ09vra5uCfxkpz8nwaTeiAT232LS2lZ6RJ4dsCz+GAj2eidpPYMldi2z6RVoxpZ5Zq68MvNzz8b15BS9T7bvdHkC2OpXFXu2jndhgGxPHvfO2zGwgYv4wwv2nQw4tuqMp8e+z0YP73Jg0T3jV8NYraXO951Rr5/9ZT8KPUqLEgPZxiSNkLnPC5dnmfTyswlofPGud+qmciYYr+cUZIvcFaYRG+Z6DM/HInX7w==monitor@linux

Test Access from the Host

monitor@linux:~$ ssh 10.61.64.150
The authenticity of host '10.61.64.150 (10.61.64.150)' can't be established.
DSA key fingerprint is d9:15:cf:4b:d1:7b:a9:67:4d:b0:a9:20:e4:fa:f4:69.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.61.64.150' (DSA) to the list of known hosts.

Once that’s done, you can set up scripts to make SSH calls without having to interact.

Sample scripts

I’ve posted some sample bash scripts on GitHub to allow for open-sourcing of the tasks. But, essentially, the scripts I created can:

  • Show ACLs for specified paths
  • Change ACLs en masse for a specified object
  • Clean up policies and DACLs created
  • Be used as a wrapper

Creating a wrapper command

In addition to the scripts above, it’s also possible to create a simple wrapper command in Linux that will call a script to make life easier for an administrator. To do this, modify the .bashrc file in the user’s home directory. In the following example, I created a command called ONTAP_ACL and pointed it to my script.

# cat ~/.bashrc
# .bashrc

# User specific aliases and functions

alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'
alias ONTAP_ACL='/scripts/./show-ACL.sh'

Once this is done, you can restart the shell session and the command can be run to execute the script. In the above, the show-ACL script simply takes the path input and asks a yes/no question and dumps the output.

# ONTAP_ACL /home
Do you want to expand the ACL masks to show all fields? (enter 1 or 2)
CAUTION: Output may be lengthy

1) Yes
2) No
#? 2


 Vserver: DEMO
 File Path: /home
 File Inode Number: 64
 Security Style: mixed
 Effective Style: ntfs
 DOS Attributes: 10
 DOS Attributes in Text: ----D---
Expanded Dos Attributes: -
 UNIX User Id: 0
 UNIX Group Id: 1
 UNIX Mode Bits: 711
 UNIX Mode Bits in Text: rwx--x--x
 ACLs: NTFS Security Descriptor
 Control:0x9504
 Owner:NTAP\Administrator
 Group:NTAP\Domain Users
 DACL - ACEs
 ALLOW-NTAP\Administrator-0x1f01ff-OI|CI
 ALLOW-Everyone-0x100020-OI|CI

I could also apply a wrapper to other scripts, such as the script to modify ACLs if I chose. This allows a simple way to centrally manage your file and folder ACLs  rather than having to jump between clients and storage.

Testing the scripts

Be sure to test the scripts only in protected environments, rather than on your production data. Make generous use of ONTAP features such as FlexClone, SnapMirror (to new Storage Virtual Machines) and Snapshots.

Questions? Leave them in the comments!

 

Behind the Scenes: Episode 71 – SPC-1 benchmark and the A700s

Welcome to the Episode 71, part of the continuing series called “Behind the Scenes of the NetApp Tech ONTAP Podcast.”

group-4-2016

We decided to do a mid-week release of the podcast to talk about the brand new AFF platform, as well as the insanely high results from the SPC-1 benchmark test! We bring in the performance team, featuring Chad Morgenstern and Jim Laing, to talk numbers. Then, we invite Mr. Flash, Andy Grimes (@andy_ntap_flash),  to give us the lowdown on the new compact beast, the A700s.

Finding the Podcast

The podcast is all finished and up for listening. You can find it on iTunes or SoundCloud or by going to techontappodcast.com.

Also, if you don’t like using iTunes or SoundCloud, we just added the podcast to Stitcher.

http://www.stitcher.com/podcast/tech-ontap-podcast?refid=stpr

I also recently got asked how to leverage RSS for the podcast. You can do that here:

http://feeds.soundcloud.com/users/soundcloud:users:164421460/sounds.rss

You can listen here:

Behind the Scenes: Episode 70 – SnapCenter 2.0

Welcome to the Episode 70, part of the continuing series called “Behind the Scenes of the NetApp Tech ONTAP Podcast.”

group-4-2016

This week on the podcast, we welcome NetApp Technical Marketing Engineer John Spinks (@jbspinks) to talk about the latest release of SnapCenter and how it’s improving backup management!

Finding the Podcast

The podcast is all finished and up for listening. You can find it on iTunes or SoundCloud or by going to techontappodcast.com.

Also, if you don’t like using iTunes or SoundCloud, we just added the podcast to Stitcher.

http://www.stitcher.com/podcast/tech-ontap-podcast?refid=stpr

I also recently got asked how to leverage RSS for the podcast. You can do that here:

http://feeds.soundcloud.com/users/soundcloud:users:164421460/sounds.rss

You can listen here: