- Notes, cautions, and warnings
- Introduction to this guide
- PowerScale scale-out NAS
- Introduction to the OneFS command-line interface
- General cluster administration
- General cluster administration overview
- User interfaces
- Connecting to the cluster
- Licensing
- Certificates
- Cluster identity
- Cluster contact information
- Cluster date and time
- SMTP email settings
- Configuring the cluster join mode
- File system settings
- Data compression settings and monitoring
- Events and alerts
- Security hardening
- Cluster configuration backup and restore
- Cluster monitoring
- Monitoring cluster hardware
- Cluster maintenance
- SupportAssist
- SRS Summary
- Access zones
- Data Security overview
- Base directory guidelines
- Access zones best practices
- Access zones on a SyncIQ secondary cluster
- Access zone limits
- Quality of service
- Zone-based Role-based Access Control (zRBAC)
- Zone-specific authentication providers
- Managing access zones
- Create an access zone
- Assign an overlapping base directory
- Manage authentication providers in an access zone
- Associate an IP address pool with an access zone
- Modify an access zone
- Delete an access zone
- View a list of access zones
- Create one or more access zones
- Create local users in an access zone
- Access files through the RESTful Access to Namespace (RAN) in non-System zones
- Authentication
- Authentication overview
- Authentication provider features
- Security Identifier (SID) history overview
- Supported authentication providers
- Active Directory
- LDAP
- NIS
- Kerberos authentication
- File provider
- Local provider
- Multifactor authentication (MFA)
- Single sign-on overview
- Multi-instance active directory
- LDAP public keys
- Managing Active Directory providers
- Managing LDAP providers
- Managing NIS providers
- Managing MIT Kerberos authentication
- Managing file providers
- Managing local users and groups
- View a list of users and groups by provider
- Create a local user
- Create a local group
- Naming rules for local users and groups
- Configure or modify a local password policy
- Local password policy settings
- Modify a local user
- Modify a local group
- Delete a local user
- Delete a local group
- Configure a login delay
- Configure a concurrent session limit
- Set a user account to be disabled when inactive
- Reset a password for a user
- Change a user password
- Managing SSH MFA for Duo
- Managing SSO
- Administrative roles and privileges
- Identity management
- Home directories
- Home directories overview
- Home directory permissions
- Authenticating SMB users
- Home directory creation through SMB
- Home directory creation through SSH and FTP
- Home directory creation in a mixed environment
- Interactions between ACLs and mode bits
- Default home directory settings in authentication providers
- Supported expansion variables
- Domain variables in home directory provisioning
- Data access control
- File sharing
- File sharing overview
- SMB security
- NFS security
- FTP
- HTTP and HTTPS security
- File filtering
- Auditing and logging
- Auditing overview
- Syslog
- Syslog forwarding and TLS
- OpenBSM service
- Protocol audit events
- Audit log purging
- Managing audit settings
- Enable configuration change auditing
- Forward configuration changes to syslog
- Enable protocol access auditing
- Forward protocol access events to syslog
- Configure protocol audited zones
- Configure protocol event filters
- Enable system auditing and forwarding
- Import certificate for TLS syslog forwarding
- Set the audit hostname
- View audit settings
- Automatic deletion
- Manual deletion
- Integrating with the Common Event Enabler
- Snapshots
- Snapshots overview
- Data protection with SnapshotIQ
- Snapshot disk-space usage
- Snapshot schedules
- Snapshot aliases
- File and directory restoration
- Best practices for creating snapshots
- Best practices for creating snapshot schedules
- File clones
- Snapshot locks
- Snapshot reserve
- Writable snapshots
- SnapshotIQ license functionality
- Creating snapshots with SnapshotIQ
- Managing snapshots
- Restoring snapshot data
- Managing snapshot schedules
- Managing snapshot aliases
- Managing with snapshot locks
- Configure SnapshotIQ settings
- Set the snapshot reserve
- Managing changelists
- Deduplication with SmartDedupe
- Inline Data Deduplication
- Inline Data Deduplication overview
- Inline deduplication interoperability
- Considerations for using inline deduplication
- Enable inline deduplication
- Verify inline deduplication is enabled
- View inline deduplication reports
- Disable or pause inline deduplication
- Remove deduplication
- Troubleshoot index allocation issues
- Data replication with SyncIQ
- SyncIQ data replication overview
- Replication policies and jobs
- Replication snapshots
- Data failover and failback with SyncIQ
- Recovery times and objectives for SyncIQ
- Replication policy priority
- SyncIQ license functionality
- Replication for nodes with multiple interfaces
- Restrict SyncIQ source nodes
- Creating replication policies
- Managing replication to remote clusters
- Initiating data failover and failback with SyncIQ
- Performing disaster recovery for older SmartLock directories
- Managing replication policies
- Managing replication to the local cluster
- Managing replication performance rules
- Managing replication reports
- Managing failed replication jobs
- Restrict SyncIQ to use the interfaces in the IP address pool
- Modify the Restrict Target Network value
- Data Encryption with SyncIQ
- Data Transfer with Datamover (SmartSync)
- Datamover (SmartSync) overview
- Datamover definitions
- Datamover policies
- Bandwidth and CPU throttling during data transfer
- Generate and install certificates
- Example DM to DM system workflow
- Datamover management tasks
- Create a Datamover account
- List and view Datamover accounts
- Create a Datamover base policy
- List and view Datamover base policies
- Link a Datamover base policy to a concrete policy
- Create a Datamover CREATION policy
- Create a Datamover COPY policy
- List and view Datamover policies
- Delete a Datamover policy
- Delete a Datamover account
- Data Compression
- Data layout with FlexProtect
- Large file size support
- Administering NDMP
- NDMP backup and recovery overview
- NDMP two-way backup
- NDMP three-way backup
- Support for NDMP sessions on Generation 6 hardware
- Setting preferred IPs for NDMP three-way operations
- NDMP multi-stream backup and recovery
- Snapshot-based incremental backups
- NDMP backup and restore of SmartLink files
- NDMP protocol support
- Supported DMAs
- NDMP hardware support
- NDMP backup limitations
- NDMP performance recommendations
- Excluding files and directories from NDMP backups
- Configuring basic NDMP backup settings
- Managing NDMP user accounts
- Managing NDMP backup devices
- Managing NDMP Fibre Channel ports
- Managing NDMP preferred IP settings
- Managing NDMP sessions
- Managing NDMP restartable backups
- NDMP restore operations
- Managing default NDMP variables
- Managing snapshot based incremental backups
- Managing cluster performance for NDMP sessions
- Managing CPU usage for NDMP sessions
- View NDMP backup logs
- File retention with SmartLock
- SmartLock overview
- Compliance mode
- Enterprise mode
- SmartLock directories
- Replication and backup with SmartLock
- SmartLock license functionality
- SmartLock considerations
- Delete WORM domain and directories
- Set the compliance clock
- View the compliance clock
- Creating a SmartLock directory
- Managing SmartLock directories
- Managing files in SmartLock directories
- Set a retention period through a UNIX command line
- Set a retention period through Windows Powershell
- Commit a file to a WORM state through a UNIX command line
- Commit a file to a WORM state through Windows Explorer
- Override the retention period for all files in a SmartLock directory
- Delete a file committed to a WORM state
- View WORM status of a file
- Data Removal with Instant Secure Erase (ISE)
- Protection domains
- Data-at-rest-encryption
- Data-at-rest encryption overview
- Self-encrypting drives
- Data security on self-encrypting drives
- Data migrations and upgrades to a cluster with self-encrypting drives
- Enabling external key management
- Migrate nodes and SEDs to external key management
- Chassis and drive states
- Smartfailed drive REPLACE state
- Smartfailed drive ERASE state
- SmartQuotas
- SmartQuotas overview
- Quota types
- Default quota type
- Usage accounting and limits
- Disk-usage calculations
- Quota notifications
- Quota notification rules
- Quota reports
- Creating quotas
- Managing quotas
- Search for quotas
- Manage quotas
- Export a quota configuration file
- Import a quota configuration file
- Managing quota notifications
- Email quota notification messages
- Managing quota reports
- Basic quota settings
- Advisory limit quota notification rules settings
- Soft limit quota notification rules settings
- Hard limit quota notification rules settings
- Limit notification settings
- Quota report settings
- Storage Pools
- Storage pools overview
- Storage pool functions
- Autoprovisioning
- Node pools
- Virtual hot spare
- Spillover
- Suggested protection
- Protection policies
- SSD strategies
- Other SSD mirror settings
- Global namespace acceleration
- L3 cache overview
- Tiers
- File pool policies
- Managing node pools through the command-line interface
- Delete an SSD compatibility
- Create a node pool manually
- Add a node to a manually managed node pool
- Add a new node type to an existing node pool
- Remove a node type from a node pool
- Change the name or protection policy of a node pool
- Remove a node from a manually managed node pool
- Remove a node pool from a tier
- View node pool settings
- Modify default storage pool settings
- SmartPools settings
- Managing L3 cache from the command-line interface
- Managing tiers
- Creating file pool policies
- Managing file pool policies
- Monitoring storage pools
- Pool-based tree reporting in FSAnalyze (FSA)
- System jobs
- S3 support
- Small Files Storage Efficiency for archive workloads
- Networking
- Networking overview
- About the internal network
- About the external network
- Managing internal network settings
- Managing IPv6
- Managing groupnets
- Managing external network subnets
- Managing Multi-SSIP
- Managing IP address pools
- Managing SmartConnect Settings
- Managing connection rebalancing
- Managing network interface members
- Managing node provisioning rules
- Managing routing options
- Managing DNS cache settings
- Managing host-based firewalls
- Reset global policy for the OneFS firewall service
- Clone a firewall policy
- Create a firewall policy
- Delete a firewall policy
- List firewall policies
- Modify a firewall policy
- View a firewall policy
- Create a firewall rule
- Delete a firewall rule
- List firewall rules
- Modify a firewall rule
- View a firewall rule
- List firewall services
- Modify firewall settings
- View firewall settings
- NFS3oRDMA
- Smart QoS
- Smart QoS
- Workload monitoring
- Create a standard dataset
- Pin a workload
- Enable or disable protocol operations
- View protocol operations limits
- Set protocol operations workload limits
- Clear protocol operations workload limits
- View workload protocol operations limits
- Create a dataset with filters
- Apply filter(s) to a dataset
- View statistics
- Additional information
- IPMI
- Antivirus
- Antivirus overview
- On-access scanning
- ICAP Antivirus policy scanning
- Individual file scanning using ICAP
- WORM files and antivirus
- Antivirus scan reports
- ICAP servers
- CAVA servers
- ICAP threat responses
- CAVA threat responses
- Configuring global antivirus settings
- Managing ICAP servers
- Managing CAVA servers
- Add and connect to a CAVA server
- Modify CAVA connection settings
- List or view CAVA servers
- Disable connection to a CAVA server
- Delete a CAVA server configuration
- Create an IP pool in a CAVA server
- Create a dedicated Access Zone on a CAVA server
- Create an Active Directory authentication provider for the AvVendor access zone
- Update the role in the access zone
- Scan CloudPool files in a CAVA server
- View CloudPool scan timeout
- Manage CAVA filters
- Manage CAVA jobs
- Create an ICAP antivirus policy
- Managing ICAP antivirus policies
- Managing antivirus scans
- Managing antivirus threats
- Managing antivirus reports
PowerScale OneFS 9.5.0.0 CLI Administration Guide
Create a root-squashing rule for an export
By default, the NFS service implements a root-squashing rule for the default NFS export. The root-squashing rule prevents root users on NFS clients from exercising root privileges on the NFS server.
-
Use the
isi nfs exports view command to view the current settings of the default export.
The following command displays the settings of the default export:
isi nfs exports view 1
-
Confirm the following default values for these settings, which show that root is mapped to nobody, restricting root access:
Map Root Enabled: True User: Nobody Primary Group: - Secondary Groups: - -
If the root-squashing rule is not in effect, you can implement it for the default NFS export. Run the
isi nfs export modify
command, as follows:
isi nfs exports modify 1 --map-root-enabled true --map-root nobody
Users cannot gain root privileges on the NFS server regardless of their credentials on the NFS client.
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please select whether the article was helpful or not.
Comments cannot contain these special characters: <>()\