Oracle ZFS Storage Appliance Administration Manual page 405

Type
DNS Domain
IPv4 Subnet
IPv6 Subnet
For each client or collection of clients, you specify whether the client has read-only or read-
write access to the share. If you are setting an NFS exception, you also specify whether the
client has root user privileges or is treated as a user without root access.
Managing Netgroups
Netgroups can be used to control access for NFS exports. However, managing netgroups can be
complex. Consider using IP subnet rules or DNS domain rules instead.
If netgroups are used, they will be resolved from NIS or LDAP, depending on which service is
enabled. If LDAP is used, each netgroup must be located at the default location, ou=Netgroup,
(Base DN), and must use the standard schema.
The username component of a netgroup entry typically has no effect on NFS; only the hostname
is significant. Hostnames contained in netgroups must be canonical and, if resolved using DNS,
fully qualified. That is, the NFS subsystem will attempt to verify that the IP address of the
requesting client resolves to a canonical hostname that matches either the specified FQDN, or
one of the members of one of the specified netgroups. This match must be exact, including any
domain components; otherwise, the exception will not match and the next exception will be
tried. For more information on hostname resolution, see DNS.
As of the 2013.1.0 software release, UNIX client users may belong to a maximum of 1024
groups without any performance degradation. Prior releases supported up to 16 groups per
UNIX client user.
NFS Share Modes and Exception Options
In the CLI, all NFS share modes and exceptions are specified using a single options string for
the sharenfs property. This string is a comma-separated list of values. It should begin with one
of ro, rw, on, or off, as an analogue to the global share modes described for the BUI.
CLI Prefix Description
netgroup containing fully qualified names
to which a client's IP address resolves.
All clients whose IP addresses resolve to a
.
fully qualified name ending in this suffix.
@ All clients whose IP addresses are within
the specified IPv4 subnet, expressed in
CIDR notation.
@ All clients whose IP addresses are within
the specified IPv6 subnet, expressed in
CIDR notation.
Share and Project Protocols
Example
sf.example.
com
192.0.2.254
/22
2001:db8:
410:d43::/64
Shares and Projects 405