toasters March 2003

toasters@lists.teaparty.net

92 participants
102 discussions

RE: Security on Win2k
by Nail, Larry 28 Mar '03

28 Mar '03

Bill, Not sure where you're going here? File shares are controlled by the ACL's of the Share & the File ACL's. This is the excact same way an NT/W2K file server controls access. If the Share is set to read only, the access to the share & the files in it are limited to read only. Even if the file level ACL's are set to full control, the access is still read only. Think "most restrictive". Regards, Larry -----Original Message----- From: Bill Bello [mailto:Bill.Bello@hds.com] Sent: Thursday, March 27, 2003 6:46 PM To: toasters(a)mathworks.com All, A question has come up in our lab on the subject. If 'read only' is set on the filer for a CIFS share, a user can still have full rights to that share IF security is NOT set in Win2k as well. Has anyone figured a way to make the share secure from the filer only? Thanks in advance. Regards, Bill Bello ATC PreSales Open Systems Support Westchester Office (914) 773-9131 New York Office (212) 827-1314

1 0

RE: Security on Win2k
by Mike Sphar 28 Mar '03

28 Mar '03

This doesn't sound correct to me. Have you actually tested it? In windows network permissions, share permissions are applied first, then individual file or directory ACLs are applied, and the most restrictive permissions always apply. So if a share is read-only to a user, then even if all the files in that share are writeable by everyone, then that user should not be able to update those files or create any new files or directories in that share. I would be very surprised to find that Netapp was not emulating the standard windows file server behavior in this case. -- Mike Sphar - Sr Systems Administrator - Remedy, a BMC Software Company -----Original Message----- From: Bill Bello [mailto:Bill.Bello@hds.com] Sent: Thursday, March 27, 2003 6:46 PM To: toasters(a)mathworks.com Subject: Security on Win2k All, A question has come up in our lab on the subject. If 'read only' is set on the filer for a CIFS share, a user can still have full rights to that share IF security is NOT set in Win2k as well. Has anyone figured a way to make the share secure from the filer only? Thanks in advance. Regards, Bill Bello ATC PreSales Open Systems Support Westchester Office (914) 773-9131 New York Office (212) 827-1314

1 0

Security on Win2k
by Bill Bello 28 Mar '03

28 Mar '03

All, A question has come up in our lab on the subject. If 'read only' is set on the filer for a CIFS share, a user can still have full rights to that share IF security is NOT set in Win2k as well. Has anyone figured a way to make the share secure from the filer only? Thanks in advance. Regards, Bill Bello ATC PreSales Open Systems Support Westchester Office (914) 773-9131 New York Office (212) 827-1314

1 0

snapshots
by George Kahler 27 Mar '03

27 Mar '03

HI, I was wondering if there is a performance issue of letting the snapshot reserve (the size of the current snapshot area) roll into the regular data area of the volume, ie. snapshot capacity be at > 100 % ? All things aside, does the filer perform any less under this condition ? Thanks. George ------------------------------------------------------------------------------- George Kahler e-mail: george(a)yorku.ca Sr. Systems Administrator humans: (416) 736-2100 x.22699 Computing and Network Services machines: (416) 736-5830 Ontario, Canada, M3J-1P3

2 1

RE: maxdir size on ontap 6.2 and higher
by Sam Schorr 27 Mar '03

27 Mar '03

I have found this bug at the NOW site: 69823 Here is the text. There is a workaround documented and it is fixed in 6.3 and up: Before OnTAP release 6.2, wafl.maxdirsize was a filer-wide option that could legally take on values larger than 64 MB (65,536 x 1,024 bytes). OnTAP 6.2 changes wafl.maxdirsize in two important ways. First, it obsoletes the single, filer-wide option and replaces it individual maxdirsize settings for each volume. Second, it allows maxdirsize to be set no higher than 64 MB. In filers that had set wafl.maxdirsize to a value greater than 65,536 (64 MB), an upgrade to OnTAP 6.2 sets the new per-volume maxdirsize value to its default, 10,240 (10 MB). The upgrade output does not highlight this change to the system administrator. Given that wafl.maxdirsize had been previously set to a much larger value, there is a good probability that the upgrade will produce a nontrivial number of directories that are now larger than the volume's new (relatively small) maxdirsize setting. Although all such directories can still be loaded into memory and handle lookups, they have been rendered "ungrowable". Workaround Formatted Before upgrading any filer whose wafl.maxdirsize is larger than 64 MB, examine its volumes to locate all "large" (over 10 MB) directories. If any such large directories exist, please reset wafl.maxdirsize on the filer to an appropriate value (that is still smaller than the new 64 MB limit) BEFORE the upgrade. This way, the upgrade to OnTAP 6.2 will propagate this more reasonable value to each volume. If any existing directories are LARGER than 64 MB, try to reduce their size below 64 MB. Since directories never shrink in OnTAP, you may be able to recreate these very large ones and thus get rid of a significant amount of wasted space. If, despite these efforts, you still have directories that are larger than 64 MB, then they will be "ungrowable" after the upgrade. If you have already upgraded one or more filers to OnTAP 6.2 whose wafl.maxdir option had been set to more than 64 MB, you should check them for any large directories that are now past the new 10 MB default per-volume maxdirsize setting. Use the "vol options" command to raise maxdirsize to a value large enough to make those directories growable again (as long as they are still below the new 64 MB maximum). Notes Formatted Network Appliance is working on a change to the maxdirsize portion of the OnTAP 6.2 upgrade that sets a more reasonable value in these circumstances. In cases where the filer-wide wafl.maxdirsize setting is found to be larger than 64 MB, the upgrade will choose a maxdirsize of 64 MB (instead of 10 MB). This guarantees that all existing directories that are still smaller than the new 64 MB limit are still growable, and minimizes user "surprise". The upgrade code will also print out a message describing the change in maxdirsize (and its implications) to administrators. Related Solutions Version Found Data ONTAP: 6.1.3R1 Likely Exists Data ONTAP: 6.1.3R1 through 6.2.2 Fixed-In Version Data ONTAP 6.3 (First Fixed) - Fixed Data ONTAP 6.3.1R1 (GA) - Fixed Data ONTAP 6.3.2(FCS) - Fixed Data ONTAP 6.4R1(FCS) - Fixed -----Original Message----- From: Reinoud Reynders [mailto:Reinoud.Reynders@uz.kuleuven.ac.be] Sent: Wednesday, March 26, 2003 12:41 AM To: kyle; toasters(a)mathworks.com Subject: Re: maxdir size on ontap 6.2 and higher Hi Kyle, This is indeed a problem, and on this moment, there is no workaround. I have the same problem. We have done some migration from 1 directory to multi directories. Netapp is working on this issue, but for the details, you must contact your local netapp guys. Best regards, Reinoud ----- Original Message ----- From: "kyle" <kyle(a)sportsline.com> To: <toasters(a)mathworks.com> Sent: Tuesday, March 25, 2003 8:14 PM Subject: maxdir size on ontap 6.2 and higher > Seems there is a limit of 64k. This is keeping me from upgrading. I > currently use 6.1R1 and just tried upgrading one of my lab netapps and > see I cant go higher than 64k for maxdir size. Is there some workaround? > >

1 0

Re: Virus Scanning
by Seth Moskowitz 26 Mar '03

26 Mar '03

In my environment there are thousands of windows machines and although they have virus software there are always some cracks so I take the position that if you afford to do it and there is enough windows data to merit it then you should have virus protection on the Filers. My company already has Symantec NAV internally throughout the oganization as well as Mcaffee products on all the firewalls and e-mail servers. Given that Norton was here and they were the first to come out with a working product for the Filers I looked at it. It worked ok and has gotten better in time. 2 years ago I fully deployed Carrier Scan 2.0 which is now SAVSE 4.x. There have been some issues but during migrations from older Novell/NT servers to the Filers I have caught and cleaned 100's of viruses, especially from Novell servers. In the case of one migration from a merging companies server we caught 1400 viruses in one migration. Granted that isn't the norm but it happens. The set up I have built is basically that each filer has a dedicated 1GB network connection for Admin. Admin in this case includes snap mirror and virus scanning. Each Filer also has 2 virus scanning serves dedicated to it each with a 1GB network connection. Moving forward with the newer symantec version I will be pooling all of these scanning servers to basically create a scanning farm. I should mention this solution might be overkill for some but on our home server filers we have 3000+ clients each. We do not have scanning on our NFS only Filers but have over 50TB of data that is being scanned. Lastly since we already have a Symantec platform I leveraged that environment using the LiveUpdate features of Symantec so my virus definitions are automatically updated as our virus people stress test new definitions and roll them out to our LiveUpdate server(s). >From: Geoff Hardin <geoff.hardin(a)dalsemi.com> >To: toasters(a)mathworks.com >Subject: Virus Scanning >Date: Tue, 25 Mar 2003 11:44:53 -0600 > > I was wondering what other admins were using for virus scanning. And as >an aside, I really want to know whether it is worth the time and money. >Basically, I've been asked to evaluate the virus scanning software out >there for the filers, but I'm not really sure it's even necessary. > I am a UNIX admin, so I typically don't see the viruses that plague my >NT compatriots, but I don't believe we've really had a problem on our >filers with CIFS shares. But maybe I'm just biased, so that's why I'm >asking for your input. > >1. Which A/V software do you use > a) McAfee NetShield for Netapp > b) Symantec Antivirus for Netapp > c) Trend Micro Server Protect > d) other (are there any others?) > >2. Is it really necessary? Please explain your answer. > > >Thanks for any and all input. > >Geoff Hardin >UNIX System Administrator >geoff.hardin(a)dalsemi.com >This space is for rent in order to increase company revenue. > _________________________________________________________________ The new MSN 8: advanced junk mail protection and 2 months FREE* http://join.msn.com/?page=features/junkmail

1 0

maxdir size on ontap 6.2 and higher
by kyle 26 Mar '03

26 Mar '03

Seems there is a limit of 64k. This is keeping me from upgrading. I currently use 6.1R1 and just tried upgrading one of my lab netapps and see I cant go higher than 64k for maxdir size. Is there some workaround?

2 1

RE: Virus Scanning
by Mike Sphar 25 Mar '03

25 Mar '03

What situation are you still seeing virus files deposited? The only situations I'm aware of would be if a client placed the file there via NFS, then no scan takes place, or if a virus-infected file is embedded deep in an archive such as a zip or tar file. In the first case though, when a windows client attempts to read the file, I believe the virus scan will still take place, so it should get caught then. I'm not sure what solution there is to a deeply embedded virus. Most systems (server or desktop) simply can't handle the performance hit of doing deep scans of every zip file. -- Mike Sphar - Sr Systems Administrator - Remedy, a BMC Software Company -----Original Message----- From: David Papas [mailto:david.papas@newisys.com] Sent: Tuesday, March 25, 2003 12:13 PM To: toasters(a)mathworks.com Subject: RE: Virus Scanning I asked tis list recently regarding the "most popular software" part of your question. Trend seems to have been the winner in that poll, followed by Symantec. The reason I was inquiring is that, despite having file system and mail scanners everywhere else, I found it is still possible to deposit viruses on the filer. With a batch of infected files there, it is only a matter of time until an unprotected client connects and keeps spreading the love. -D. > -----Original Message----- > From: Geoff Hardin [mailto:geoff.hardin@dalsemi.com] > Sent: Tuesday, March 25, 2003 11:45 AM > To: toasters(a)mathworks.com > Subject: Virus Scanning > > > I was wondering what other admins were using for virus scanning. > And as an aside, I really want to know whether it is worth > the time and > money. Basically, I've been asked to evaluate the virus scanning > software out there for the filers, but I'm not really sure it's even > necessary. > I am a UNIX admin, so I typically don't see the viruses > that plague > my NT compatriots, but I don't believe we've really had a > problem on our > filers with CIFS shares. But maybe I'm just biased, so > that's why I'm > asking for your input. > > 1. Which A/V software do you use > a) McAfee NetShield for Netapp > b) Symantec Antivirus for Netapp > c) Trend Micro Server Protect > d) other (are there any others?) > > 2. Is it really necessary? Please explain your answer. > > > Thanks for any and all input. > > Geoff Hardin > UNIX System Administrator > geoff.hardin(a)dalsemi.com > This space is for rent in order to increase company revenue. > >

2 1

RE: Virus Scanning
by Ed Sanborn 25 Mar '03

25 Mar '03

One other consideration is the issue of new viruses. Viruses that do not yet have a fix posted in an antivirus software's definitions will not yet detect this new virus. Whether through email, web browsers, ftp download, etc, it can find it's way on the NetApp (especially if you are using the NetApp for home directories). Now if this new virus infects .exe's or other heavily shared files the virus can spread like wild-fire. Once the new virus fix is found and the new definition is posted and applied then it will be auto-detected just fine but by then the damage is done. The NetApp may already have a kagillion infected files. Although scanning does take a long time depending on how large your filesystems are I try to scan the NetApp atleast once a month. It will stop the spread of brand new viruses but atleast once the definition is in place atleast you'll find that you were infected and can actually clean-up. Of course, even if you we're hit and the PC client's have the new def's then whenever they hit one of the bad files they would sound the alarm too but I try to be proactive, atleast a bit, so that if files need to be restored I can get a jump on it before users complain. Also, another suggestion is to try and dissuade folks from placing executables of any nature on the fileserver. That is, if IT is using the server to place CD copies of MS-Office or other apps in order to more easily load software over the net try to not do this. The .exe files are too easily infected and then it is easy to spread the virus to other's unwittingly. The Klez virus nailed us here until I had a chance to reinstall our old, decrepit McAfee virus server. By the time I fixed the server and reinstalled client software our NetApp was soaked with viruses mostly .exe files.... -Ed -----Original Message----- From: Mike Sphar [mailto:mike.sphar@Remedy.COM] Sent: Tuesday, March 25, 2003 1:37 PM To: toasters(a)mathworks.com Subject: RE: Virus Scanning What situation are you still seeing virus files deposited? The only situations I'm aware of would be if a client placed the file there via NFS, then no scan takes place, or if a virus-infected file is embedded deep in an archive such as a zip or tar file. In the first case though, when a windows client attempts to read the file, I believe the virus scan will still take place, so it should get caught then. I'm not sure what solution there is to a deeply embedded virus. Most systems (server or desktop) simply can't handle the performance hit of doing deep scans of every zip file. -- Mike Sphar - Sr Systems Administrator - Remedy, a BMC Software Company -----Original Message----- From: David Papas [mailto:david.papas@newisys.com] Sent: Tuesday, March 25, 2003 12:13 PM To: toasters(a)mathworks.com Subject: RE: Virus Scanning I asked tis list recently regarding the "most popular software" part of your question. Trend seems to have been the winner in that poll, followed by Symantec. The reason I was inquiring is that, despite having file system and mail scanners everywhere else, I found it is still possible to deposit viruses on the filer. With a batch of infected files there, it is only a matter of time until an unprotected client connects and keeps spreading the love. -D. > -----Original Message----- > From: Geoff Hardin [mailto:geoff.hardin@dalsemi.com] > Sent: Tuesday, March 25, 2003 11:45 AM > To: toasters(a)mathworks.com > Subject: Virus Scanning > > > I was wondering what other admins were using for virus scanning. > And as an aside, I really want to know whether it is worth > the time and > money. Basically, I've been asked to evaluate the virus scanning > software out there for the filers, but I'm not really sure it's even > necessary. > I am a UNIX admin, so I typically don't see the viruses > that plague > my NT compatriots, but I don't believe we've really had a > problem on our > filers with CIFS shares. But maybe I'm just biased, so > that's why I'm > asking for your input. > > 1. Which A/V software do you use > a) McAfee NetShield for Netapp > b) Symantec Antivirus for Netapp > c) Trend Micro Server Protect > d) other (are there any others?) > > 2. Is it really necessary? Please explain your answer. > > > Thanks for any and all input. > > Geoff Hardin > UNIX System Administrator > geoff.hardin(a)dalsemi.com > This space is for rent in order to increase company revenue. > >

1 0

RE: Virus Scanning
by Mike Sphar 25 Mar '03

25 Mar '03

I think it depends on how close to 100% you can guarantee that your windows clients are virus free. Depending on permissions on your shares and files, all it could take is one infected windows machine in your entire network to infect thousands of files on your filer. We've had this happen probably at least a half-dozen times. We just have way too many windows machines in our network: desktop machines, laptops that people take home and hook up to their home networks, and often the worst of all lab machines since we often can't fully control how those machines are set up. We have probably hundreds of machines running IIS for web development, trying to keep all of them patched is so far an extremely difficult job. You can block viruses through your mail gateway, but are you blocking employees from accessing hotmail or msn or any other web-based mail? Because viruses can easily sneak into your network from there. Are you blocking/filtering ftp? Because that's another way. Not to mention the various P2P file sharing services. We have Norton corporate edition deployed throughout most of our desktop clients, which in theory should be keeping all the clients up-to-date, but we find far too often that the automated client updates aren't happening, or that the client AV software is not running for some reason, etc. From what I've heard from people using other vendors like Symantec and Mcafee in big enterprise environments, they can be plagued with similar problems as well. We're still working on deploying the Netapp AV solution from Trend (budgeting and planning can sometime take *way* too long) but when we deployed a trial version we were very impressed by the efficiency with which it stopped virus infections onto the file server. We started getting notices of attempted virus infections within minutes of activating the software. For a long time when people complained about viruses on the file server, I would take the position that if we just prevented virus infections on the client side there would be no problem. But I've come to accept that it is just virtually impossible to guarantee that you can keep every client on your network up to date and virus-free at all times. And manually scanning the file server regularly just isn't feasible, given a very large file server it can be like painting the golden gate bridge, and with today's viruses it can only take a window of a few minutes to infect thousands of files. So, in summary, I'd say that virus protection on the file server is very important, unless you are *very* confident that your windows clients will always be virus free, or perhaps if your file server is very very restrictive permission-wise, such that an individual infected user can't do anything more than damage their own personal folders, *and* you have good frequent backups. -- Mike Sphar - Sr Systems Administrator - Remedy, a BMC Software Company -----Original Message----- From: Geoff Hardin [mailto:geoff.hardin@dalsemi.com] Sent: Tuesday, March 25, 2003 11:45 AM To: toasters(a)mathworks.com Subject: Virus Scanning I was wondering what other admins were using for virus scanning. And as an aside, I really want to know whether it is worth the time and money. Basically, I've been asked to evaluate the virus scanning software out there for the filers, but I'm not really sure it's even necessary. I am a UNIX admin, so I typically don't see the viruses that plague my NT compatriots, but I don't believe we've really had a problem on our filers with CIFS shares. But maybe I'm just biased, so that's why I'm asking for your input. 1. Which A/V software do you use a) McAfee NetShield for Netapp b) Symantec Antivirus for Netapp c) Trend Micro Server Protect d) other (are there any others?) 2. Is it really necessary? Please explain your answer. Thanks for any and all input. Geoff Hardin UNIX System Administrator geoff.hardin(a)dalsemi.com This space is for rent in order to increase company revenue.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters March 2003