toasters

toasters@lists.teaparty.net

2 participants
13529 discussions

RE: Switching from NIS auth to Windows Domain
by Yoder, Alan 02 Feb '05

02 Feb '05

Given that you have multiple domains with no trust relationships, you also have no way of preventing username conflicts once the domain names are stripped off. Looks like you're stuck with your user education issue, sorry. Alan =============================================================== Alan G. Yoder agy~netapp.com Technical Staff Network Appliance, Inc. =============================================================== > -----Original Message----- > From: P.S.Jones [mailto:p.s.jones@durham.ac.uk] > Sent: Wednesday, February 02, 2005 6:45 AM > To: Steve Losen > Cc: Muhlestein, Mark; Hill, Aaron; Kazsuk, Tim; toasters(a)mathworks.com > Subject: Re: Switching from NIS auth to Windows Domain > > > Steve Losen wrote: > > >>Actually, the default behavior is as Tim explained. It is > not necessary > >>to specify a wildcard mapping for the domains, unless you want to > >>exclude certain domains. I'd recommend opening a case so we > can get to > >>the bottom of why this is not working as expected. > >> > >>Mark > > > > > > I guess I didn't explain my problem very well. Everything > is working > > as expected. Our problem is that we are a University. We do not > > centrally manage our Windows domains and many folks do not belong > > to domains at all. Many departments have their own departmental > > Windows domains with their own user naming scheme, and we have no > > trust relationship with those domains. Most students have > > personal workstations, which do not belong to any domain. > > > > When using Unix authentication for CIFS, it does not matter > what domain > > you are in because the filer ignores the domain. So if > your user name > > on the filer is "fred" you can just enter "fred" in the > > "map network drive" login dialog. It does not matter if > this results > > in "fredpc\fred" or "artdept\fred" or anything else because > the filer > > ignores the domain name and looks up "fred". > > > > But when we switch to using our "eservices" Windows domain > for auth, then > > the domain name is important. You cannot login to eservices\fred > > if typing "fred" results in "fredpc\fred". You have to > explicitly type > > "eservices\fred" in the "map network drive" dialog box. This is not > > a software flaw. This is a user education issue. Right > now only about > > 20% of our 30,000 CIFS users login to the eservices domain. > The other > > 80% login other domains or no domain at all. > > > > I was just curious if there was some way to avoid training thousands > > of people to enter "eservices\fred" instead of just "fred". > > > > The usermap.cfg file is close to, but not quite, what we > need. What we > > need is a way to map Windows ids to Windows ids, not > Windows to Unix. > > It would help us if we could do this: > > > > *\* => eservices\* > > > > but this is not what usermap.cfg is for. > > > > Steve Losen scl(a)virginia.edu phone: 434-924-0640 > > > > University of Virginia ITC Unix Support > > > > > > Steve, > > I think what you want to do isn't possible because Windows > regards the > domain prefix as an essential part of the authentication > process. Your > 'native' (eservices) CIFS clients may appear to get away with > just the > plain username but behind the scenes the client is actually sending > eservices\username to the Netapps. Users from 'foreign' domains can't > do this since they would send an invalid domain prefix from the > authentication point of view; they must explicitly add the foreign > domain (from their point of view) eservices as a prefix to their > authentication account. > > -- > Paul Jones, Head of Systems Services, Information Technology Service, > University of Durham, South Road, Durham DH1 3LE > Email: p.s.jones(a)durham.ac.uk Phone/Fax: > 0191 334 2749/2701 >

1 0

RE: Switching from NIS auth to Windows Domain
by Muhlestein, Mark 02 Feb '05

02 Feb '05

Actually, the default behavior is as Tim explained. It is not necessary to specify a wildcard mapping for the domains, unless you want to exclude certain domains. I'd recommend opening a case so we can get to the bottom of why this is not working as expected. Mark -----Original Message----- From: Hill, Aaron [mailto:aaron.hill@cba.com.au] Sent: Tuesday, February 01, 2005 5:04 PM To: 'Steve Losen'; Kazsuk, Tim Cc: 'toasters(a)mathworks.com' Subject: RE: Switching from NIS auth to Windows Domain I believe the usermap.cfg is your ticket. But only if I am understanding your issue correctly. If your usernames are unique, i.e. only 1 fred will ever open a CIFS session on a particular filer, then you should be able to do something like this in the file with great success; <DOMAIN>\* == * <DOMAIN2>\* == * <DOMAIN3>\* == * Etc. etc. Essentially, ESERVICES\FRED will map to unix fred, but so will DONKEYDOMAIN\FRED. So your problem will be duplicate ID's. The == specifies a two-way mapping, i.e. unix fred will also map to the first domain that is found in the list that has a "fred/FRED". If you omit the ==, it will be implied by default. i.e. <DOMAIN>\* == * is the same as saying <DOMAIN>\* *. If youi want the mappings one way, use => or <= . The usermap.cfg parses from top to bottom, so the first match will be the mapping that is used. I do not know if there is a limit to the number of entries. If you need to enter many hundreds of domains, this may become an issue and you may see some slow authentication. For more details on this you will need to talk to a NetApp engineer. There may also be a way to do it thus; *\* == * And combining the cifs.search_domains option to specify the order that the domains are searched. If you omit this setting, they are randomnly searched. So, it may be wise to place your highest populated domains at the top of the list to speed up authentication. Once the mapping cached by the filer, things should move through a lot faster. Even if you have duplicates, my guess is that there will not be many. Particularly if you have good practices regarding the creation of user accounts. If there are, you simply disrupt a "few" users by modifying their user names and associated data. If this is 10% of your 30,000 users it will still be a lot of work, but a lot less than the full 30,000 coming down on you. Test it out, let me know how it goes. Good luck! Thanks, Aaron -----Original Message----- From: Steve Losen [mailto:scl@sasha.acc.virginia.edu] Sent: Wednesday, 2 February 2005 3:16 AM To: Kazsuk, Tim Cc: toasters(a)mathworks.com Subject: Re: Switching from NIS auth to Windows Domain > If the user names are the same on the Windows side and the Unix side, > regardless of what Domain those users are a part of, you shouldn't have > any issues with the drive mappings. As defined in the "System > Administration - File Access Management Guide for Data ONTAP 6.5" pg.93, > these are the steps taken when a CIFS session is requested: > > - It searches the /etc/usermap.cfg to see whether an entry matches the > user's Windows domain name and user name. > - If an entry is found, Data ONTAP uses the UNIX name specified in the > entry to look up the UID and GID from the UNIX password database. If > the UNIX name is a null string, Data ONTAP denies access to the CIFS > user. > - If an entry is not found, Data ONTAP converts the Windows name to > lowercase and considers the UNIX name to be the same as the Windows > name. Data ONTAP uses this UNIX name to look up the UID and GID from > the UNIX password database. > > If that doesn't work, you also might want to look into setting up the > usermap.cfg file in such a way that will work in your environment. > > Regards, > Thanks, but that's not the problem. Right now when you "map network drive" and you fill in the username field in the dialog box, you do not need to specify a domain name. If you enter "fred" in the dialog box then your PC supplies a domain name for you automatically. Because we are using Unix style login for CIFS, the filer strips off the domain name and looks up your account using just "fred". However, once we switch to Windows domain auth, if you enter just "fred" in the username field, and if your PC supplies something other than "eservices" for the domain name (very likely here) then your username is incorrect and you cannot login. You don't even get to the point where your Windows domain credentials are mapped to your Unix UID, etc. Our user education problem is teaching 30,000 people who currently enter just "fred" to start entering "eservices\fred" instead. I was hoping that there might be a magic option on the filer that would help us avoid this. Steve Losen scl(a)virginia.edu phone: 434-924-0640 University of Virginia ITC Unix Support ************** IMPORTANT MESSAGE ************** This e-mail message is intended only for the addressee(s) and contains information which may be confidential. If you are not the intended recipient please advise the sender by return email, do not use or disclose the contents, and delete the message and any attachments from your system. Unless specifically indicated, this email does not constitute formal advice or commitment by the sender or the Commonwealth Bank of Australia (ABN 48 123 123 124) or its subsidiaries. We can be contacted through our web site: commbank.com.au. If you no longer wish to receive commercial electronic messages from us, please reply to this e-mail by typing Unsubscribe in the subject line. ***************************************************************

3 2

RE: McAfee A/V config
by Merkin, David S 02 Feb '05

02 Feb '05

Did this happen when you upgraded to 6.5.2? -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of jeff.mery(a)ni.com Sent: Monday, January 31, 2005 12:18 PM To: toasters(a)mathworks.com Subject: McAfee A/V config The basics: - F940c systems (one cluster) - ONTAP 6.5.2 - ~4.4 TB of data (90% CIFS) - McAfee VirusScan 7.1 for NetApps - 6 x scanner systems (4 x PowerEdge 650SC, 2 x Precision 420) - All scanners scan both filers - All GbE, all systems & filers on same subnet We've been having a small problem with our McAfee virus scanners lately; they all periodically drop off-line causing much havoc with our pagers. Suggestions from McAfee are that the scanners become too busy and when that happens, they drop off line and reset themselves. However, performance indicators on the scanners don't indicate any problems: CPUs almost idle, no disk I/O, very little network activity. From a filer stand-point, they're practically idle: CPU time averages less than 20%, network and disk I/O is minimal. I'd like to hear how some of you have your McAfee environments configured and what (if any) issues you've had similar to this one. As usual, much thanks in advance! Jeff Mery - MCSE, MCP National Instruments ------------------------------------------------------------------------- "Allow me to extol the virtues of the Net Fairy, and of all the fantastic dorks that make the nice packets go from here to there. Amen." TB - Penny Arcade -------------------------------------------------------------------------

3 2

RE: Switching from NIS auth to Windows Domain
by Hill, Aaron 02 Feb '05

02 Feb '05

I believe the usermap.cfg is your ticket. But only if I am understanding your issue correctly. If your usernames are unique, i.e. only 1 fred will ever open a CIFS session on a particular filer, then you should be able to do something like this in the file with great success; <DOMAIN>\* == * <DOMAIN2>\* == * <DOMAIN3>\* == * Etc. etc. Essentially, ESERVICES\FRED will map to unix fred, but so will DONKEYDOMAIN\FRED. So your problem will be duplicate ID's. The == specifies a two-way mapping, i.e. unix fred will also map to the first domain that is found in the list that has a "fred/FRED". If you omit the ==, it will be implied by default. i.e. <DOMAIN>\* == * is the same as saying <DOMAIN>\* *. If youi want the mappings one way, use => or <= . The usermap.cfg parses from top to bottom, so the first match will be the mapping that is used. I do not know if there is a limit to the number of entries. If you need to enter many hundreds of domains, this may become an issue and you may see some slow authentication. For more details on this you will need to talk to a NetApp engineer. There may also be a way to do it thus; *\* == * And combining the cifs.search_domains option to specify the order that the domains are searched. If you omit this setting, they are randomnly searched. So, it may be wise to place your highest populated domains at the top of the list to speed up authentication. Once the mapping cached by the filer, things should move through a lot faster. Even if you have duplicates, my guess is that there will not be many. Particularly if you have good practices regarding the creation of user accounts. If there are, you simply disrupt a "few" users by modifying their user names and associated data. If this is 10% of your 30,000 users it will still be a lot of work, but a lot less than the full 30,000 coming down on you. Test it out, let me know how it goes. Good luck! Thanks, Aaron -----Original Message----- From: Steve Losen [mailto:scl@sasha.acc.virginia.edu] Sent: Wednesday, 2 February 2005 3:16 AM To: Kazsuk, Tim Cc: toasters(a)mathworks.com Subject: Re: Switching from NIS auth to Windows Domain > If the user names are the same on the Windows side and the Unix side, > regardless of what Domain those users are a part of, you shouldn't have > any issues with the drive mappings. As defined in the "System > Administration - File Access Management Guide for Data ONTAP 6.5" pg.93, > these are the steps taken when a CIFS session is requested: > > - It searches the /etc/usermap.cfg to see whether an entry matches the > user's Windows domain name and user name. > - If an entry is found, Data ONTAP uses the UNIX name specified in the > entry to look up the UID and GID from the UNIX password database. If > the UNIX name is a null string, Data ONTAP denies access to the CIFS > user. > - If an entry is not found, Data ONTAP converts the Windows name to > lowercase and considers the UNIX name to be the same as the Windows > name. Data ONTAP uses this UNIX name to look up the UID and GID from > the UNIX password database. > > If that doesn't work, you also might want to look into setting up the > usermap.cfg file in such a way that will work in your environment. > > Regards, > Thanks, but that's not the problem. Right now when you "map network drive" and you fill in the username field in the dialog box, you do not need to specify a domain name. If you enter "fred" in the dialog box then your PC supplies a domain name for you automatically. Because we are using Unix style login for CIFS, the filer strips off the domain name and looks up your account using just "fred". However, once we switch to Windows domain auth, if you enter just "fred" in the username field, and if your PC supplies something other than "eservices" for the domain name (very likely here) then your username is incorrect and you cannot login. You don't even get to the point where your Windows domain credentials are mapped to your Unix UID, etc. Our user education problem is teaching 30,000 people who currently enter just "fred" to start entering "eservices\fred" instead. I was hoping that there might be a magic option on the filer that would help us avoid this. Steve Losen scl(a)virginia.edu phone: 434-924-0640 University of Virginia ITC Unix Support ************** IMPORTANT MESSAGE ************** This e-mail message is intended only for the addressee(s) and contains information which may be confidential. If you are not the intended recipient please advise the sender by return email, do not use or disclose the contents, and delete the message and any attachments from your system. Unless specifically indicated, this email does not constitute formal advice or commitment by the sender or the Commonwealth Bank of Australia (ABN 48 123 123 124) or its subsidiaries. We can be contacted through our web site: commbank.com.au. If you no longer wish to receive commercial electronic messages from us, please reply to this e-mail by typing Unsubscribe in the subject line. ***************************************************************

1 0

Switching from NIS auth to Windows Domain
by Steve Losen 01 Feb '05

01 Feb '05

We have been using filers to store users' home directories since 1997. We started out with NFS on Unix and added CIFS access later. We have about 30,000 user accounts. We have always used NIS authentication for CIFS so that folks have the same password on Unix and CIFS. But we have been unhappy with the passwords going over the network in clear text. We have finally gotten funding for enough Windows client licenses to give all our users accounts in a Windows domain, so we want to switch our filers to Windows domain auth. This is going to cause us a serious user education problem. Currently it does not matter what domain a CIFS user specifies because the domain name is ignored when mapping a to a NIS user. For example, BOGUS\fred maps to "fred" and MYDOM\jane maps to "jane", etc. Right now when "fred" does a "map network drive" he just enters "fred" for his username. His PC supplies the windows domain, whatever that may be. Some folks login to local departmental domains. Some do local Windows logins, etc. Right now that doesn't matter because the filers ignore the domain name when mapping to a NIS username. But that will suddenly change when we switch to Windows domain auth. Fred will suddenly be required enter "ESERVICES\fred" instead of just "fred". Does the filer have any option where it "knows" that no matter what domain name the user supplies, in his heart of hearts he really means "ESERVICES" ? That would save us an awful lot of calls at our help desk when we cut over. By the way, we don't know in advance what domain name a user may supply. Many of them appear to be whatever name the user gave his PC. Steve Losen scl(a)virginia.edu phone: 434-924-0640 University of Virginia ITC Unix Support

7 7

RE: Command to Sanitize NetApp Filer?
by Hart, Paul 01 Feb '05

01 Feb '05

Mike you should try disk sanitize start [-p pattern1|-r [-p pattern2|-r [-p pattern3|-r]]] [-c number_of_cycles] disk_list disk sanitize start [-p pattern|-r [-p pattern|-r [-p pattern|-r]]] [-c cycles] disk_list Used to start the sanitization process on the disks listed. The -p option defines the byte pattern(s) and the number of write passes in each cycle. The -r option may be used to generate a write of random data, instead of a defined byte pattern. If no patterns are specified, the default is 3 using pattern 0x55 on the first pass, 0xaa on the second, and 0x3c on the third. The -c option specifies the number of cycles ofpattern writes. The default is 1 cycle. All sanitization process information is written to the log file at /etc/sanitization.log. The serial numbers of all sanitized disks are written to /etc/sanitized_disks. Paul -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Mike Mueller Sent: Tuesday, February 01, 2005 12:22 PM To: toasters(a)mathworks.com Subject: Command to Sanitize NetApp Filer? We will be retiring a NetApp filer soon and are required to sanitize storage devices. Is there a command that will sanitize the disks, preferably by overwriting the data? Thanks, -- Mike

1 0

RE: Switching from NIS auth to Windows Domain
by Kazsuk, Tim 01 Feb '05

01 Feb '05

If the user names are the same on the Windows side and the Unix side, regardless of what Domain those users are a part of, you shouldn't have any issues with the drive mappings. As defined in the "System Administration - File Access Management Guide for Data ONTAP 6.5" pg.93, these are the steps taken when a CIFS session is requested: - It searches the /etc/usermap.cfg to see whether an entry matches the user's Windows domain name and user name. - If an entry is found, Data ONTAP uses the UNIX name specified in the entry to look up the UID and GID from the UNIX password database. If the UNIX name is a null string, Data ONTAP denies access to the CIFS user. - If an entry is not found, Data ONTAP converts the Windows name to lowercase and considers the UNIX name to be the same as the Windows name. Data ONTAP uses this UNIX name to look up the UID and GID from the UNIX password database. If that doesn't work, you also might want to look into setting up the usermap.cfg file in such a way that will work in your environment. Regards, ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Tim Kazsuk Unix System Administrator The Home Depot Supply Direct: 858-831-2225 Fax: 858-831-2221 NOC: 858-831-2210 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -----Original Message----- From: owner-toasters(a)mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Steve Losen Sent: Tuesday, February 01, 2005 5:50 AM To: toasters(a)mathworks.com Subject: Switching from NIS auth to Windows Domain We have been using filers to store users' home directories since 1997. We started out with NFS on Unix and added CIFS access later. We have about 30,000 user accounts. We have always used NIS authentication for CIFS so that folks have the same password on Unix and CIFS. But we have been unhappy with the passwords going over the network in clear text. We have finally gotten funding for enough Windows client licenses to give all our users accounts in a Windows domain, so we want to switch our filers to Windows domain auth. This is going to cause us a serious user education problem. Currently it does not matter what domain a CIFS user specifies because the domain name is ignored when mapping a to a NIS user. For example, BOGUS\fred maps to "fred" and MYDOM\jane maps to "jane", etc. Right now when "fred" does a "map network drive" he just enters "fred" for his username. His PC supplies the windows domain, whatever that may be. Some folks login to local departmental domains. Some do local Windows logins, etc. Right now that doesn't matter because the filers ignore the domain name when mapping to a NIS username. But that will suddenly change when we switch to Windows domain auth. Fred will suddenly be required enter "ESERVICES\fred" instead of just "fred". Does the filer have any option where it "knows" that no matter what domain name the user supplies, in his heart of hearts he really means "ESERVICES" ? That would save us an awful lot of calls at our help desk when we cut over. By the way, we don't know in advance what domain name a user may supply. Many of them appear to be whatever name the user gave his PC. Steve Losen scl(a)virginia.edu phone: 434-924-0640 University of Virginia ITC Unix Support

2 1

Free NetApp 36U cabinets available for pickup in Minneapolis, MN
by Scott Fischmann 01 Feb '05

01 Feb '05

2 1

[SUMMARY]: Archiving, R200 and SnapVault.
by Ngoh, Clarence 31 Jan '05

31 Jan '05

Thanks to the following people who replied: Aaron Hill Bill Holland It turns out that at the end of the day, using SnapVault was not the most straighforward solution. We simply wish to copy an EOM (end-of-month) snapshot to the R200 temporarily to conserve snapshot space on the production filer whilst getting our backup problem fixed. The use of Snapvault did not meet our need to duplicate the whole volume when compared to how how SnapMirror duplicates its volume. One of the significant difference between the two is that the basic unit in Snapvault is NOT the valume, but the qtree. As such, a transfer must be made to replicate each qtree. It was also pointed out that complexity is added to the restoration process because a snapshot from SnapVault is essentially restored and Snapvault has its way of doing its thing. A third point of complexity is configuring Veritas NetBackup to backup the snapshot - an option that we are not willing to experiment with. So, what are we doing? We have two volumes that are running low on disk space on the Production filers. We have created two volumes on the R200 to reflect those on production and we are snapmirring these across. Once the data is replicated, we remove the older EOM snapshot to free disk space. Backups of the snapshots are then done via 3-way-NDMP. A much more simple and elegant solution. Cheers Clarence. > -----Original Message----- > From: Ngoh, Clarence [mailto:clarence.ngoh@cba.com.au] > Sent: Friday, 28 January 2005 2:51 PM > To: toasters(a)mathworks.com > Subject: Archiving, R200 and SnapVault. > > > G'day toaster folks, > > Our backups in Lidcombe are having issues completing its > backups - the cause is yet unknown. As a result of our EOM > backups not completing successfully, it is eating into our > snapshot space. We have raised a case with NetApp and we are > trying to isolate the root case of the problem. I am not > after suggestions to fix this at the moment. Rather ... > > We have just purchased a R200 for achiving purpose and we are > thinking of > utilising this to alleviate the issue we are having. We > wish to dump some > of the EOMs to this box and backup to tape when we resolve > the backup issue. > > > Our scenario is common ... A production site and a DR site. > > We backup our EOMs at the DR site. We are wondering if the > process is as > simple of copying over the EOM snapshots from the DR filer to > the R200 via SnapVault and configuring our backups (Veritas > NetBackup) to backup from the R200 to cassette. > > Question : From what I have read, backups to cassette can be > done straight from the R200. Any real life experiences to > share? Are they any caveats that we should be aware of? > > Sorry if this question seems somewhat simple -- I am still > ploughing through a pile of whitepapers at the moment, but > because this issue is somewhat urgent, any suggestions would > be much appreciated. > > > Cheers > Clarence. > > > ************** IMPORTANT MESSAGE ************** > This e-mail message is intended only for the addressee(s) and > contains information which may be confidential. > If you are not the intended recipient please advise the > sender by return email, do not use or disclose the contents, > and delete the message and any attachments from your system. > Unless specifically indicated, this email does not constitute > formal advice or commitment by the sender or the Commonwealth > Bank of Australia (ABN 48 123 123 124) or its subsidiaries. > We can be contacted through our web site: commbank.com.au. > If you no longer wish to receive commercial electronic > messages from us, please reply to this e-mail by typing > Unsubscribe in the subject line. > *************************************************************** >

2 1

McAfee A/V config
by jeff.mery＠ni.com 31 Jan '05

31 Jan '05

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

toasters