Folks,
My Unix, or rather, command-line, bias is showing here, so please bear
with me. We're running a mixed-security-style filer, OnTAP-5.3.6R2,
also testing 6.1R1. Historically, we've done all management of the
filer from a Unix admin host, but we do like for our NT admins to
be able to set and/or override permissions for our NT users, so
we've done the obligatory two-way mapping in usermap.cfg between
the Unix "root" account and the NT domain admin account.
In doing so, we've opened what we consider to be a hole in our desired
Unix-only management of the filer: It's now possible for our NT admins
to create/delete/change shares using Server Manager. We'd really
prefer to keep this functionality restricted to a command-line type
of interface, so we can keep it under control via scripting, version
control, and other types of automation that so far aren't possible
using the Windows Server Manager GUI.
So, does anyone know how to disable access to Server Manager, and
in particular to the ability to create/change shares, but still preserve
the ability to manipulate permissions on behalf of our users (via shares
previously setup)? I've seen reference to the magic "IPC$" share, and
assume that if I could delete that it would prevent remote management
from the Windows systems, but I've yet to find a way to accomplish this.
Advice welcome....
Regards,
--
Marion Hakanson <hakanson(a)cse.ogi.edu>
CSE Computing Facilities