toasters January 2019

toasters@lists.teaparty.net

14 participants
7 discussions

Cyber Security Question
by Chris Hague 29 Jan '19

29 Jan '19

Hi All, The scenario is; An attacker has compromised security on your LAN and gained access to admin access on the NetApp filers. Subsequently they have wiped the primary and DR filers, including all SnapVault backups. How could this be protected against? KR, Chris. p.s. Apologies in advance for the insanely long signature! This email is being sent by a subsidiary of Arthur J. Gallagher Holdings (UK) Limited, part of the Arthur J. Gallagher & Co. global group of companies. For details of the registered office, company number and, where applicable, regulated status of our subsidiaries, please visit https://www.ajginternational.com/legal-regulatory-information/. We are the data controller of any personal information you provide to us or personal information that has been provided to us by a third party. We collect and process information about you in order to arrange insurance policies and to process claims. Your information is also used for business purposes such as fraud prevention and detection and financial management. This may involve sharing your information with third parties such as insurers, reinsurers, other brokers, claims handlers, loss adjusters, credit reference agencies, service providers, professional advisors, our regulators, police and government agencies or fraud prevention agencies. We may record telephone calls to help us monitor and improve the service we provide. For further information on how your information is used and your rights in relation to your information please see our privacy notice at https://www.ajginternational.com/Privacy-Policy/. If you are providing personal data of another individual to us, you must tell them you are providing their information to us and show them a copy of this notice. Where you are obtaining a non-consumer policy of (re)insurance, or cover for additional risks or renewal under an existing policy, you are required to make a fair presentation of the risk to a (re)insurer which discloses every material circumstance which you know or ought to know relating to the risk to be insured. A circumstance is material if it would influence the judgment of a prudent insurer in determining whether to provide insurance for the risk and, if so, on what terms. Disclosure must be reasonably clear and accessible to a prudent insurer and made in good faith. The aforementioned duty of disclosure is the applicable duty under the laws of England and Wales. If your policy is not subject to English law you are expected to disclose risk information in accordance with the requirements of the applicable law. In such circumstances we expect you will disclose risk information at least equal to the standard required under English law and where the applicable law requires you to disclose information over and above the level required under English law you will provide such information in accordance with that law. Where you are obtaining a consumer policy of insurance, you must read each question and answer honestly and fully and must take reasonable care to not make a misrepresentation. Failure to comply with the above disclosure requirements, as they apply to you, could mean that your policy of (re)insurance is void, its terms are materially altered or that (re)insurers are not liable to pay all or part of your claim(s). If you are in any doubt as to your obligations you should ask your usual contact. This e-mail and any attachments are CONFIDENTIAL and may contain legally privileged information. If you are not the intended recipient of this e-mail message, please telephone or e-mail us immediately, delete this message from your system and do not read, copy, distribute, disclose or otherwise use this e-mail message and any attachments. Although the above company has taken reasonable precautions to ensure this e-mail and any attachments are free of any virus or other defect that may affect your computer, it is the responsibility of the recipient to ensure that it is virus free and the above company does not accept any responsibility for any loss or damage arising in any way from its use.

5 6

small query about global exports
by Yuvaraja Shivaram 24 Jan '19

24 Jan '19

Hi All, cmode also behaves in the same way as 7 mode , when it comes to global export.. if already global export policy created (0.0.0.0./0) and later on if we create individual entry of host, does it gives outage, or is that fine since it access uses indexes, did not tested this since we do not have test environment. please let me know on this.. regards Yuvaraja

2 1

Setting permissions on NTFS CIFS share, users not found?
by Ian Ehrenwald 22 Jan '19

22 Jan '19

Hello I am unsure if this is an AD or a ONTAP config problem, but I thought I'd ask. I have not run into this before. Brand new cluster (9.4P4), brand new SVM, pretty minimal config. # Standard issue create CIFS server, allow anyone to connect through default export -policy # Create a volume to test with, NTFS security, and a CIFS share on top of it MyCluster::> vserver cifs create -vserver MySvm -cifs-server MyNas -domain MyAdDomain.Business.com (joined it to MyAdDomain.Business.Com) MyCluster::> vserver export-policy rule create -policyname default -clientmatch 0.0.0.0/0 -rorule any -rwrule any -superuser any -vserver MySvm -protocol cifs MyCluster::> volume create -volume cifs_test -aggregate MyCluster_02_SATA_1 -size 1g -junction-path /cifs_test -security-style ntfs -vserver MySvm MyCluster::> vserver cifs share create -share-name cifs_test -path /cifs_test -vserver MySvm # Test AD SID resolution from the filer, forwards and backwards MyCluster::> set diagnostic MyCluster::*> diag secd authentication translate -node MyCluster-02 -vserver MySvm -win-name MyUserName S-1-5-21-348434689-563360211-3986294115-29846 MyCluster::*> diag secd authentication translate -node MyCluster-02 -vserver MySvm -sid S-1-5-21-348434689-563360211-3986294115-29846 MyAdDomain\MyUserName (Windows User) MyCluster::*> diag secd authentication translate -node MyCluster-02 -vserver MySvm -win-name MyAdDomain\aGroupIamAmemberOf S-1-5-21-348434689-563360211-3986294115-1154 MyCluster::*> diag secd authentication translate -node MyCluster-02 -vserver MySvm -sid S-1-5-21-348434689-563360211-3986294115-1154 MyAdDomain\aGroupIamAmemberOf (Windows Domain group) So far so good. CIFS share permission by default is Everyone/Full. NTFS permission by default is Everyone/Full. I am able to connect to the share at \\MyNas\cifs_test and create a directory. The test directory has permission of Everyone/Full as viewed by right clicking on the test directory, selecting Properties, and viewing the Security tab. If I click on Advanced, I see the Owner correctly set to MyUserName as defined in AD. The Permissions tab in the Advanced window has Allow/Everyone/Full Control. Now, here is the problem. if I click on 'Add', the Permission Entry window pops up and I need to Select A Principal. When I Select A Principal and enter a known-good username into the 'Enter the object name to select' field and click Check Names, I get 'An object with the following name cannot be found.. blahblahblah'. I've tried with multiple users, multiple groups, all with the same result. I know these objects (users, groups) exist. The 'From this location' box in the window that pops up is referencing MyAdDomain.Business.Com, and the Object Type is User/Group/Built In SP. Is this a failure of something in our AD environment and our workstations, or is this a failure somewhere in ONTAP land? I'm leaning towards something screwed up in our AD environment because of the diag secd test from above working, but I'm not sure. Any ideas? Ian Ehrenwald Senior Infrastructure Engineer Hachette Book Group, Inc. 1.617.263.1948 / ian.ehrenwald(a)hbgusa.com This may contain confidential material. If you are not an intended recipient, please notify the sender, delete immediately, and understand that no disclosure or reliance on the information herein is permitted. Hachette Book Group may monitor email to and from our network.

2 2

Re: Bandwidth Calculator for Exiting NetApp
by jordan slingerland 14 Jan '19

14 Jan '19

Again, may be the best option that I can think of...but will it really be equal to your total write rate? What if a block changes 32 times in 5 seconds. I think semi sync is going to be at best every 3 seconds (i am actually asking and confirming that) and thus all 32 of those writes may end up only being 1 or 2 blocks traversing circuit sm is using. --Jordan On Mon, Jan 14, 2019 at 12:36 PM Fenn, Michael <fennm(a)deshawresearch.com> wrote: > One thing you could do is to look at the write rate over time via your > favorite tool (statistics show, OCUM, OCI, Harvest, etc.). Assuming the > goal is to have async SnapMirror “keep up”, all writes effectively need to > be journaled to the remote site. The bandwidth required would correspond > to the total write rate. > > > > Thanks, > > Michael > > > > *From: *<toasters-bounces(a)teaparty.net> on behalf of jordan slingerland < > jordan.slingerland(a)gmail.com> > *Date: *Monday, January 14, 2019 at 11:14 AM > *To: *Basil <basilberntsen(a)gmail.com> > *Cc: *"toasters(a)teaparty.net" <toasters(a)teaparty.net> > *Subject: *Re: Bandwidth Calculator for Exiting NetApp > > > > Best way I can think of ,though,potentially async sm may have a higher > change rate dependent on work load and current sm schedule. > > > > For example, a block might change once every 5 seconds but snapmirror once > every hr will only catch 1 block change every hour. > > > > > > > > > > On Mon, Jan 14, 2019 at 10:40 AM Basil <basilberntsen(a)gmail.com> wrote: > > I use an older version of ontap (9.1) with the old fashioned snapmirror > (DP, not XDP), but basically the estimate should be based on the cumulative > snapshot delta, minus potential compression. > > > > Snapshot show-delta is the command to see the delta between any two > snapshots. > > > > On Mon, Jan 14, 2019 at 9:27 AM Mike Michalakis <mike(a)directit.com.cy> > wrote: > > I’m wondering how anyone approaches the following scenario: > > > > We have an existing NetApp system in place (ONTAP 9.4), currently taking > Snapshots of all the required volumes as per the required RPO objectives as > defined. > > > > The question is: > > There is now a requirement to implement a DR site using Asynchronous > Snapmirror, based on the current snapshots and rate of change, what is an > estimated bandwidth requirement to meet X RPO. > > > > What tools or options are available for completing such an exercise or the > methodology > > > > Thanks > > MikeM > > _______________________________________________ > Toasters mailing list > Toasters(a)teaparty.net > http://www.teaparty.net/mailman/listinfo/toasters > > _______________________________________________ > Toasters mailing list > Toasters(a)teaparty.net > http://www.teaparty.net/mailman/listinfo/toasters > >

1 0

Bandwidth Calculator for Exiting NetApp
by Mike Michalakis 14 Jan '19

14 Jan '19

I’m wondering how anyone approaches the following scenario: We have an existing NetApp system in place (ONTAP 9.4), currently taking Snapshots of all the required volumes as per the required RPO objectives as defined. The question is: There is now a requirement to implement a DR site using Asynchronous Snapmirror, based on the current snapshots and rate of change, what is an estimated bandwidth requirement to meet X RPO. What tools or options are available for completing such an exercise or the methodology Thanks MikeM

4 3

would like to know the prons and cons between OCUM And Zenoss Monitoring tool
by Yuvaraja Shivaram 07 Jan '19

07 Jan '19

Hi All, Any one knows the pros and cons of OCUM and Zenoss monitoring tool.. just would like to know which is more beneficiaries either using OCUM or Zenoss tool for monitoring.. aiming to configure only netapp storage(C-Mode) not for heterogeneous storage's Please let us know if anyone's knows more about it, as I am new to Zenoss monitoring Tool. Regards Yuvaraja

5 4

DP to XDP conversion problems
by Peter D. Gray 04 Jan '19

04 Jan '19

Hi people, We are heavy users of snapmirror DR. We started to convert those relations to XDP from DP. We used: - break snapmirror - snapmirror release on source - snapmirror delete on target - wait (no idea what goes on behind the scenes here) - snapmirror create -destination-path <path> -type XDP -policy MirrorAllSnapshots -identity-preserve true - source-vserver <name> -source-cluster <name> - snapmirror resync -destination-path <path> This works a treat unless you have unprotected volumes. If there are source volumes flagged unprotected and therefore not on the destination vserver you appear to be doomed. We have found no way to ever resynmc the source to destination vservers. What you up wirth is something like: Cluster Source Destination State Status Policy Progress Size Lag SRC svm-esx: svm-esx-dr: Broken-off Idle MirrorAllSnapshots - 39GB - SRC svm-esx:esx_03 svm-esx-dr:esx_slinux_03 Broken-off Idle MirrorAllSnapshots - - - SRC svm-esx:esx_04 svm-esx-dr:esx_slinux_04 Broken-off Idle MirrorAllSnapshots - - - SRC svm-esx:esx_sscratch_00 svm-esx-dr:esx_sscratch_00 Uninitialized Idle MirrorAllSnapshots - - - SRC svm-esx:esx_sscratch_01 svm-esx-dr:esx_sscratch_01 Uninitialized Idle MirrorAllSnapshots - - - SRC svm-esx:esx_10 svm-esx-dr:esx_10 Broken-off Idle MirrorAllSnapshots - - - SRC svm-esx:esx_10 svm-esx-dr:esx_11 Broken-off Idle MirrorAllSnapshots - - - SRC svm-esx:esx_10 svm-esx-dr:esx_12 Broken-off Idle MirrorAllSnapshots - - - The above is hand edited so ignore any errors. You get the idea. No amount of stuffing around (and there has been a lot) has ever go this relationshp to work properly again. Anyine else seen this and/or have a solution. We have guessed that the unprotected flag is no longer supported which is annoying in itself. Regards, pdg Peter Gray Ph (direct): +61 2 4221 3770 Information Management & Technology Services Ph (switch): +61 2 4221 3555 University of Wollongong Fax: +61 2 4229 1958 Wollongong NSW 2522 Email: pdg(a)uow.edu.au Australia URL: http://pdg.uow.edu.au

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters January 2019