toasters

toasters@lists.teaparty.net

3 participants
13514 discussions

SnapDrive User Permission Lockdown
by Christopher Mende 05 Feb '08

05 Feb '08

Hi All, We've all been asked this question before -- does the snapdrive account HAVE to be a domain admin, and be an administrator on the filer? I've played with making the shares to the LUN-containing volumes read-only, but most of that is just a panacea. Here is an IIS server which is accessible to multiple outside entities. Specifically, looking to lessen the impact the snapdrive account may have on the filer, should the IIS server be compromised. I suspect the answer is "it doesn't matter" because you could wreak the same damage from Administrator if compromised -- but I just gotta ask. Thanks! Christopher

2 1

OnTap 7.2.x and NFSv4: krb5.keytab not created?
by Nathan Patwardhan 03 Feb '08

03 Feb '08

Hello, When I've setup new filers in our environment, I always enable Kerberos when I do an 'nfs setup' (as well as joining a Windows domain w/'cifs setup'). As a result of doing this, I noticed that /etc/krb5.keytab is created as part of the setup process. This allows us to enable sec=krb5 at our leisure and when we configure nfs.v4 options on the filer and stop/start 'nfs', "things just work". Cool. However, when an existing filer has already been setup, that is, the filer already had a 'cifs setup' and has NOT had Kerberos enabled for NFS, I've noticed that /etc/krb5.keytab is not changed when I enable Kerberos during an 'nfs setup'. No matter whether or not I stop/start 'nfs' after I'm done with 'nfs setup', I'm unable to use NFSv4 on the filer until I re-run the entire cifs AND nfs setup (a closer view of the messages file suggests that the filer can't find a service principal for 'nfs' in its keytab). It appears then that enabling NFSv4 on the filer is not an online event as I'd expect and that I have to terminate all of my cifs sessions so that I can run through the cifs setup again. Uggh. Can someone confirm if they've seen this behavior before? Or am I just missing something? Outside of running 'ktpass' on the Windows KDC and securely copying krb5.keytab from it to the filer, is there another way I can generate a new krb5.keytab or update the existing krb5.keytab on the filer? Or is there a utility I can use to see what lives in the krb5.keytab on the filer? 'klist -k -e ...' doesn't seem to like the format of it. -- Nate

1 0

Aggr's at 100% with FlexVols
by Paul Letta 02 Feb '08

02 Feb '08

Hi, I know when traditional vols are in use, you don't want to let them get too close to full because performance will be affected. But what about using FlexVols and Aggrs ? I have a few Aggrs that are at 100%. But the FlexVols in those Aggrs are mostly under 50%. I had a NetApp support person tell me that its bad to have Aggrs at 100%, even if the FlexVols are not full. What's the answer here. Does having Aggrs at 100% because the FlexVols contained in them are sized to fill the Aggr present a performance issue ? I would think that as long as the flexvols are not close to full, its ok to have the aggr's at 100%. Thanks, Paul

10 10

Weird CIFS problem
by David McWilliams 01 Feb '08

01 Feb '08

I'm domain admin, and I'm accessing a share on my filer \\filer1\tdrive<file://filer1/tdrive>(/vol/vol0/tdrive). It is a seperate qtree, the only perms on the share are everyone/ full control. I even added a domain/administrator full control entry. I can see the top level of sub-dirs, bt I cannot go any deeper. Does this make sense, or am I missing something? -- Sláinte, David Get a safer, faster, better web browser @ http://www.mozilla.org/products/firefox/

8 10

ToE and NFS in VMware
by Page, Jeremy 30 Jan '08

30 Jan '08

On page 20 of Network Appliance and VMware ESX Server 3.0 Storage Best Practices the authors say "With the release of VMware ESX 3.0.1 Support for TOE enabled NICs has been added", can someone tell me where I can find a list of TOE enabled NICs for 3.5? Everything I have read says that TOE is only supported for iSCSI, not NFS. I am getting ready to move a mid to large sized ESX environment from FC to NFS (probably with x3850's) and I want to make certain I get the right NICs. If I can use TOE cards for NFS then that's a no brainer, but I want to make certain there will be a benefit. If not does anyone have any recommendations? I want to make certain they support TSO and hopefully IOAT (at least I'd like to experiment with it), even if they are just regular NICs This message (including any attachments) contains confidential and/or proprietary information intended only for the addressee. Any unauthorized disclosure, copying, distribution or reliance on the contents of this information is strictly prohibited and may constitute a violation of law. If you are not the intended recipient, please notify the sender immediately by responding to this e-mail, and delete the message from your system. If you have any questions about this e-mail please notify the sender immediately.

2 1

NetApp & Leopard
by Carl Howell 30 Jan '08

30 Jan '08

I've stumbled across a problem we're having accessing filer hosted CIFS shares from Mac OS X Leopard 10.5.1. The Leopard boxes I've tried this on are all bound to our Win2k3 Active Directory. If you log into Leopard with your domain credentials and try to access a share on a filer(this happens on all of our filers and all are at 7.x and above), you will be prompted for your password. If you try to access the same CIFS share hosted on a Win2k3 box, you will get right in. Has anyone else seen this? Thanks, --Carl

2 2

Usermapping from Linux User to WIndows
by Willeke, Jochen 30 Jan '08

30 Jan '08

Hi Toasters, i have a question regarding usermapping from linux users (local /etc/passwd) to windows users. Let me explain my problem with a short example: SystemA, alex (UID 600) SystemB, alex (UID 700) --------- usermap.cfg DOMAIN\user.test <= SystemA:alex DOMAIN\user.test <= SystemB:alex --------- /etc/passwd on the filer alex::600:600:user:/home/user: --------- When i mount a qtree (NTFS-Sec-Style and "DOMAIN\user.test" has access) on SystemA everything works, but when i want to use it from SystemB it won't work due to the different UID. Does anyone know if there is a way to get this running, or are the only solutions to have the same UID's in local /etc/passwd on the hosts or to have a directory service like NIS for user-management?? Best Regards and thanks in advance Jochen -- Wincor Nixdorf International GmbH Sitz der Gesellschaft: Paderborn Registergericht Paderborn HRB 3507 Gesch�ftsf�hrer: Eckard Heidloff (Vorsitzender), Stefan Auerbach, J�rgen Wilde, Dr. J�rgen Wunram Vorsitzender des Aufsichtsrats: Karl-Heinz Stiller Steuernummer: 339/5884/0020 - Ust-ID Nr.: DE812927716 - WEEE-Reg.-Nr. DE44477193 Diese E-Mail enth�lt vertrauliche Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrt�mlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail ist nicht gestattet. This e-mail may contain confidential information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden.

3 2

Recommended iSCSI timeout
by Robert Lazzurs 29 Jan '08

29 Jan '08

Hello all, I have been searching for a while on the NOW site and the only reference I can find about what the timeout settings for iSCSI should be are in "iSCSI SUSE(R) Linux(R) Host Utilities 3.1 for Native OS Setup Guide". In that document it says the configuration value node.session.timeo.replacement_timeout should be set to 5 however the default it 120. Now if anything I expected for head failover to work it would have to be higher? Does anyone have any experience with iSCSI head failover in Linux who can comment on what this value in the iscsid.conf should be? Thanks in advance.

1 0

Thin provisioning LUNs, A-SIS, and notifications
by Daniel Keisling 27 Jan '08

27 Jan '08

Hello, I am starting to thin provision LUNs (lun set reservation disable) in order to start using A-SIS on some large (1TB) volumes. Before I turn A-SIS on, I started testing these LUNs and do see the space on the filer grow accordingly with writes on the host. However, the space never seems to go down when I delete files on the host: rtpstore2b> df /vol/iscsi Filesystem kbytes used avail capacity Mounted on /vol/iscsi/ 10485760 9974748 511012 95% /vol/iscsi/ /vol/iscsi/.snapshot 0 0 0 ---% /vol/iscsi/.snapshot [root@vrhel5 /]# df /mnt/iscsi Filesystem 1K-blocks Used Available Use% Mounted on /dev/sde1 10321192 7804844 1992064 80% /mnt/iscsi I see that when I begin writing again, the filer space won't start increasing until there is an increase in space above what the filter already thinks. Is this behavior normal? When I turn SIS on, will the filer LUN size reduce as blocks are deduplicated so that I can then reduce the volume? Lastly, I will definitely need to know when my volumes autosize so I can focus my attention on not having the aggregate fill up. It would be wonderful if I could set up an SNMP trap to send to Nagios for notification. Before I dig into the MIBs and create the custom trap (if I even can), has anyone done anything similar they could share? TIA, Daniel ______________________________________________________________________ This email transmission and any documents, files or previous email messages attached to it may contain information that is confidential or legally privileged. If you are not the intended recipient or a person responsible for delivering this transmission to the intended recipient, you are hereby notified that you must not read this transmission and that any disclosure, copying, printing, distribution or use of this transmission is strictly prohibited. If you have received this transmission in error, please immediately notify the sender by telephone or return email and delete the original transmission and its attachments without reading or saving in any manner.

2 2

ssh public key authentication (NetApp Release 7.2.3)
by Karl Amrhein 25 Jan '08

25 Jan '08

NetApp Release 7.2.3: Thu Jul 5 10:06:16 PDT 2007 How do I get ssh public key authentication working? I tried putting ssh V1 and V2 public keys in /etc/sshd/authorized_keys /etc/sshd/authorized_keys2 /etc/sshd/root/.ssh/authorized_keys /etc/sshd/root/.ssh/authorized_keys2 But none of that worked. Is there some documentation about how to get ssh key (non-password) authentication working? Thanks in advance, Karl

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters