- Notes, cautions, and warnings
- Introduction to this guide
- PowerScale scale-out NAS
- Introduction to the OneFS command-line interface
- General cluster administration
- General cluster administration overview
- User interfaces
- Connecting to the cluster
- Licensing
- Certificates
- Cluster identity
- Cluster contact information
- Cluster date and time
- SMTP email settings
- Configuring the cluster join mode
- File system settings
- Data compression settings and monitoring
- Events and alerts
- Security hardening
- Cluster configuration backup and restore
- Cluster monitoring
- Monitoring cluster hardware
- Cluster maintenance
- SRS Summary
- Access zones
- Data Security overview
- Base directory guidelines
- Access zones best practices
- Access zones on a SyncIQ secondary cluster
- Access zone limits
- Quality of service
- Zone-based Role-based Access Control (zRBAC)
- Zone-specific authentication providers
- Managing access zones
- Create an access zone
- Assign an overlapping base directory
- Manage authentication providers in an access zone
- Associate an IP address pool with an access zone
- Modify an access zone
- Delete an access zone
- View a list of access zones
- Create one or more access zones
- Create local users in an access zone
- Access files through the RESTful Access to Namespace (RAN) in non-System zones
- Authentication
- Authentication overview
- Authentication provider features
- Security Identifier (SID) history overview
- Supported authentication providers
- Active Directory
- LDAP
- NIS
- Kerberos authentication
- File provider
- Local provider
- Multi-factor Authentication (MFA)
- Multi-instance active directory
- LDAP public keys
- Managing Active Directory providers
- Managing LDAP providers
- Managing NIS providers
- Managing MIT Kerberos authentication
- Managing file providers
- Managing local users and groups
- SSH Authentication and Configuration
- Administrative roles and privileges
- Identity management
- Home directories
- Home directories overview
- Home directory permissions
- Authenticating SMB users
- Home directory creation through SMB
- Home directory creation through SSH and FTP
- Home directory creation in a mixed environment
- Interactions between ACLs and mode bits
- Default home directory settings in authentication providers
- Supported expansion variables
- Domain variables in home directory provisioning
- Data access control
- File sharing
- File sharing overview
- SMB security
- NFS security
- FTP
- HTTP and HTTPS security
- File filtering
- Auditing and logging
- Auditing overview
- Syslog
- Protocol audit events
- Supported audit tools
- Delivering protocol audit events to multiple CEE servers
- Supported event types
- Sample audit log
- Audit log purging
- Managing audit settings
- Integrating with the Common Event Enabler
- Tracking the delivery of protocol audit events
- View the time stamps of delivery of events to the CEE server and syslog
- Display a global view of delivery of protocol audit events to the CEE server and syslog
- Move the log position of the CEE forwarder
- View the rate of delivery of protocol audit events to the CEE server
- Automatic deletion
- Manual deletion
- Snapshots
- Snapshots overview
- Data protection with SnapshotIQ
- Snapshot disk-space usage
- Snapshot schedules
- Snapshot aliases
- File and directory restoration
- Best practices for creating snapshots
- Best practices for creating snapshot schedules
- File clones
- Snapshot locks
- Snapshot reserve
- Writable snapshots
- SnapshotIQ license functionality
- Creating snapshots with SnapshotIQ
- Managing writable snapshots
- Managing snapshots
- Restoring snapshot data
- Managing snapshot schedules
- Managing snapshot aliases
- Managing with snapshot locks
- Configure SnapshotIQ settings
- Set the snapshot reserve
- Managing changelists
- Managing writable snapshots
- Deduplication with SmartDedupe
- Inline Data Deduplication
- Inline Data Deduplication overview
- Inline deduplication interoperability
- Considerations for using inline deduplication
- Enable inline deduplication
- Verify inline deduplication is enabled
- View inline deduplication reports
- Disable or pause inline deduplication
- Remove deduplication
- Troubleshoot index allocation issues
- Data replication with SyncIQ
- SyncIQ data replication overview
- Replication policies and jobs
- Replication snapshots
- Data failover and failback with SyncIQ
- Recovery times and objectives for SyncIQ
- Replication policy priority
- SyncIQ license functionality
- Replication for nodes with multiple interfaces
- Restrict SyncIQ source nodes
- Creating replication policies
- Managing replication to remote clusters
- Initiating data failover and failback with SyncIQ
- Performing disaster recovery for older SmartLock directories
- Managing replication policies
- Managing replication to the local cluster
- Managing replication performance rules
- Managing replication reports
- Managing failed replication jobs
- Restrict SyncIQ to use the interfaces in the IP address pool
- Modify the Restrict Target Network value
- Data Encryption with SyncIQ
- Data Compression
- Data layout with FlexProtect
- Large file size support
- Administering NDMP
- NDMP backup and recovery overview
- NDMP two-way backup
- NDMP three-way backup
- Support for NDMP sessions on Generation 6 hardware
- Setting preferred IPs for NDMP three-way operations
- NDMP multi-stream backup and recovery
- Snapshot-based incremental backups
- NDMP backup and restore of SmartLink files
- NDMP protocol support
- Supported DMAs
- NDMP hardware support
- NDMP backup limitations
- NDMP performance recommendations
- Excluding files and directories from NDMP backups
- Configuring basic NDMP backup settings
- Managing NDMP user accounts
- Managing NDMP backup devices
- Managing NDMP Fibre Channel ports
- Managing NDMP preferred IP settings
- Managing NDMP sessions
- Managing NDMP restartable backups
- NDMP restore operations
- Managing default NDMP variables
- Managing snapshot based incremental backups
- Managing cluster performance for NDMP sessions
- Managing CPU usage for NDMP sessions
- View NDMP backup logs
- File retention with SmartLock
- SmartLock overview
- Compliance mode
- Enterprise mode
- SmartLock directories
- Replication and backup with SmartLock
- SmartLock license functionality
- SmartLock considerations
- Delete WORM domain and directories
- Set the compliance clock
- View the compliance clock
- Creating a SmartLock directory
- Managing SmartLock directories
- Managing files in SmartLock directories
- Set a retention period through a UNIX command line
- Set a retention period through Windows Powershell
- Commit a file to a WORM state through a UNIX command line
- Commit a file to a WORM state through Windows Explorer
- Override the retention period for all files in a SmartLock directory
- Delete a file committed to a WORM state
- View WORM status of a file
- Data Removal with Instant Secure Erase (ISE)
- Protection domains
- Data-at-rest-encryption
- Data-at-rest encryption overview
- Self-encrypting drives
- Data security on self-encrypting drives
- Data migrations and upgrades to a cluster with self-encrypting drives
- Enabling external key management
- Migrate nodes and SEDs to external key management
- Chassis and drive states
- Smartfailed drive REPLACE state
- Smartfailed drive ERASE state
- SmartQuotas
- SmartQuotas overview
- Quota types
- Default quota type
- Usage accounting and limits
- Disk-usage calculations
- Quota notifications
- Quota notification rules
- Quota reports
- Creating quotas
- Managing quotas
- Search for quotas
- Manage quotas
- Export a quota configuration file
- Import a quota configuration file
- Managing quota notifications
- Email quota notification messages
- Managing quota reports
- Basic quota settings
- Advisory limit quota notification rules settings
- Soft limit quota notification rules settings
- Hard limit quota notification rules settings
- Limit notification settings
- Quota report settings
- Storage Pools
- Storage pools overview
- Storage pool functions
- Autoprovisioning
- Node pools
- Virtual hot spare
- Spillover
- Suggested protection
- Protection policies
- SSD strategies
- Other SSD mirror settings
- Global namespace acceleration
- L3 cache overview
- Tiers
- File pool policies
- Managing node pools through the command-line interface
- Delete an SSD compatibility
- Create a node pool manually
- Add a node to a manually managed node pool
- Add a new node type to an existing node pool
- Remove a node type from a node pool
- Change the name or protection policy of a node pool
- Remove a node from a manually managed node pool
- Remove a node pool from a tier
- View node pool settings
- Modify default storage pool settings
- SmartPools settings
- Managing L3 cache from the command-line interface
- Managing tiers
- Creating file pool policies
- Managing file pool policies
- Monitoring storage pools
- Pool-based tree reporting in FSAnalyze (FSA)
- System jobs
- S3 support
- Small Files Storage Efficiency for archive workloads
- Networking
- Networking overview
- About the internal network
- About the external network
- Managing internal network settings
- Managing groupnets
- Managing external network subnets
- Managing Multi-SSIP
- Managing IP address pools
- Managing SmartConnect Settings
- Managing connection rebalancing
- Managing network interface members
- Managing node provisioning rules
- Managing routing options
- Managing DNS cache settings
- NFS3oRDMA
- Partitioned Performance Monitoring
- IPMI
- Antivirus
- Antivirus overview
- On-access scanning
- ICAP Antivirus policy scanning
- Individual file scanning using ICAP
- WORM files and antivirus
- Antivirus scan reports
- ICAP servers
- CAVA servers
- ICAP threat responses
- CAVA threat responses
- Configuring global antivirus settings
- Managing ICAP servers
- Managing CAVA servers
- Add and connect to a CAVA server
- Modify CAVA connection settings
- List or view CAVA servers
- Disable connection to a CAVA server
- Delete a CAVA server configuration
- Create an IP pool in a CAVA server
- Create a dedicated Access Zone on a CAVA server
- Create an Active Directory authentication provider for the AvVendor access zone
- Update the role in the access zone
- Scan CloudPool files in a CAVA server
- View CloudPool scan timeout
- Manage CAVA filters
- Manage CAVA jobs
- Create an ICAP antivirus policy
- Managing ICAP antivirus policies
- Managing antivirus scans
- Managing antivirus threats
- Managing antivirus reports
PowerScale OneFS 9.3.0.0 CLI Administration Guide
Certificate management
You can manage TLS certificates using the OneFS command line interface.
The isi certificate settings view command enables viewing all of the certificate-related configuration options. For example:
# isi certificate settings view Certificate Monitor Enabled: Yes Certificate Pre Expiration Threshold: 4W2D Default HTTPS Certificate ID: default Subject: C=US, ST=Washington, L=Bellingham, O="Sample Systems, Inc.", OU=Sample Systems, CN=Sample Systems, emailAddress=support@samplesys.com Status: valid
The configuration options Certificate monitor enabled and Certificate Pre Expiration Threshold control a nightly cron job that monitors the expiration of every managed certificate and raises a CELOG alert when a certificate is set to expire within the configured threshold. The default expiration is 30 days. The ID: default option indicates that this certificate is the default TLS certificate.
The
isi certificate server list command lists the available certificates. For example:
# isi certificate server list ID Name Status Expires ------------------------------------------- a50e6da default valid 2021-12-25T11:01:55 c392083 mycert valid 2020-04-19T09:40:29 ------------------------------------------- Total: 2
You can view the settings for a particular certificate using the isi certificate server view
<certificate_name> command, where
<certificate_name> is the name of the certificate for which to view settings. For example, suppose that you want to view the settings for a certificate named
mycert:
# isi certificate server view mycert
ID: c39208312f11f9d85a383f1fb4338e3eac92258c066d01931684a4c2bf343f71
Name: mycert
Description:
Subject: C=US, ST=Washington, CN=*.local.samplesys.com, emailAddress=admincritter@samplesys.com
Issuer: C=US, ST=Washington, L=Bellingham, CN=AdminCritter Root, emailAddress=AdminCritter@samplesys.com
Status: valid
Not Before: 2019-04-10T09:40:29
Not After: 2020-04-19T09:40:29
Fingerprints
Type: SHA1
Value: 58:e7:8e:1f:1a:bb:5f:15:94:88:6b:91:be:e1:4f:47:76:ac:df:90
Type: SHA256
Value: c3:92:08:31:2f:11:f9:d8:5a:38:3f:1f:b4:33:8e:3e:ac:92:25:8c:06:6d:01:93:16:84:a4:c2:bf:34:3f:71
DNS Names: *.local.samplesys.com
Note the DNS Names listed when you view the certificate information. OneFS attempts to map any configured SmartConnect names or aliases to one of the certificates available to the system. If no match is found, OneFS uses the default certificate.
You can change the certificate settings using the
isi certificate settings modify command. For example, to change the default HTTPS certificate to the
mycert certificate:
# isi certificate settings modify --default-https-certificate=mycert
To verify that the default certificate has been changed:
# isi certificate settings view
Certificate Monitor Enabled: Yes
Certificate Pre Expiration Threshold: 4W2D
Default HTTPS Certificate
ID: mycert
Subject: C=US, ST=Washington, CN=*.local.samplesys.com, emailAddress=admincritter@samplesys.com
Status: valid
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please select whether the article was helpful or not.
Comments cannot contain these special characters: <>()\