Access Control (Acl Function) - Fujitsu ETERNUS DX S5 Series Design Manual

4. NAS Functions

Access Control (ACL Function)

Access Control (ACL Function)
A NAS file system reserves extended ACL areas to store permission entries.
If the CIFS protocol or the NFSv3 protocol is used, up to 256 access permission entries can be registered for files
and directories.
In addition, ACLs that are registered for files and directories can also be referenced.
In a CIFS environment, the following well-known SIDs are supported.
• Domain SIDs (S-1-5-21-*)
Administrators (S-1-5-32-544)
•
• Users (S-1-5-32-545)
• Backup Operators (S-1-5-32-551)
The folders and files registered with Administrators, Users, and Backup Operators are accessible from the
Domain Admins group or the Domain Users group. For local users, access to files and folders is granted by
setting the group to which the user belongs in the Administrators group, the Users group, or the Backup
Operators group.
Accessing to files or directories is not allowed even if unsupported well-known SIDs are specified for the ACL
function. Refer to the following site for the well-known SIDs list.
• Well-known security identifiers in Windows operating systems
https://support.microsoft.com/en-us/kb/243330
Caution
During the configuration phase
If there are more ACLs than the maximum number of ACL entries that can be registered for each NAS
volume, the access privileges information for the target files or directories may be deleted.
During the operation phase
• For CIFS access, if the ETERNUS DX is used as the backup destination or the data migration destination
and if a file that is set with the ACL of an SID that does not exist in the user management of the
ETERNUS DX (authentication server or local user authentication) is copied to the ETERNUS DX, the
copied file will become inaccessible. Do not copy the ACL information of an SID that does not exist in the
ETERNUS DX user management.
• When folders or files are created, write privileges and execution privileges are assigned to groups or
"Everyone". After creating folders and files, set the appropriate access privileges.
181 Design Guide