You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/storage/files/storage-how-to-use-files-linux.md
+20-15Lines changed: 20 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,16 +16,21 @@ Azure file shares can be mounted in Linux distributions using the [SMB kernel cl
16
16
This article shows how to mount an SMB Azure file share using NTLMv2 authentication (storage account key). Using identity-based authentication is preferred for security reasons. See [Enable Active Directory authentication over SMB for Linux clients accessing Azure Files](storage-files-identity-auth-linux-kerberos-enable.md).
17
17
18
18
## Applies to
19
-
20
-
| File share type | SMB | NFS |
21
-
|-|:-:|:-:|
22
-
| Standard file shares (GPv2), LRS/ZRS |||
23
-
| Standard file shares (GPv2), GRS/GZRS |||
We recommend using SMB 3.1.1. By default, Azure Files requires encryption in transit, which is supported by SMB 3.0+. Azure Files also supports SMB 2.1, which doesn't support encryption in transit, but you can't mount Azure file shares with SMB 2.1 from another Azure region or on-premises for security reasons. Unless your application specifically requires SMB 2.1, use SMB 3.1.1. SMB 2.1 support was added to Linux kernel version 3.7, so if you're using a version of the Linux kernel after 3.7, it should support SMB 2.1.
33
+
By default, Azure Files enforces encryption in transit. SMB encryption is available starting with SMB 3.0. Azure Files also supports SMB 2.1, which doesn't support SMB encryption. As a result, Azure Files doesn't permit file shares to be mounted using SMB 2.1 from another Azure region or on-premises, without additional networking configuration, for security reasons. You should use SMB 3.1.1 unless your application specifically requires an older version.
29
34
30
35
| Distribution | SMB 3.1.1 (Recommended) | SMB 3.0 |
31
36
|-|-----------|---------|
@@ -108,11 +113,11 @@ On other distributions, use the appropriate package manager or [compile from sou
108
113
Connection to <your-storage-account> 445 port [tcp/microsoft-ds] succeeded!
109
114
```
110
115
111
-
If you're unable to open up port 445 on your corporate network or are blocked from doing so by an ISP, you may use a VPN connection or ExpressRoute to work around port 445. For more information, see [Networking considerations for direct Azure file share access](storage-files-networking-overview.md).
116
+
You can use a VPN connection or ExpressRoute ifport 445 is blocked on your network. For more information, see [Networking considerations for direct Azure file share access](storage-files-networking-overview.md).
112
117
113
118
## Permissions
114
119
115
-
All mounting scripts in this article will mount the file shares using the default 0755 Linux file and folder permissions. This means read, write, and execute for the file/directory owner, read and execute for users in the owner group, and read and execute for other users. Depending on your organization's security policies, you might want to set alternate `uid`/`gid` or `dir_mode` and `file_mode` permissions in the mount options. For more information on how to set permissions, see [Unix symbolic notation](https://en.wikipedia.org/wiki/File-system_permissions#Symbolic_notation). See [mount options](#mount-options) for a list of mount options.
120
+
All mounting scripts in this article mount the file shares using the default 0755 Linux file and folder permissions. This means read, write, and execute forthe file/directory owner, read and execute for usersin the owner group, and read and execute forother users. Depending on your organization's security policies, you might want to set alternate `uid`/`gid` or `dir_mode` and `file_mode` permissionsin the mount options. For more information on how to set permissions, see [Unix symbolic notation](https://en.wikipedia.org/wiki/File-system_permissions#Symbolic_notation). See [mount options](#mount-options) for a list of mount options.
116
121
117
122
### Unix-style permissions support
118
123
@@ -378,19 +383,19 @@ You can use the following mount options when mounting SMB Azure file shares on L
378
383
|`password2=`| Storage account secondary key | Recommended incase when no-downtime key-rotation is desirable. |
379
384
|`mfsymlinks`| n/a | Recommended. Forces the mount to support symbolic links, allowing applications like git to clone repos with symlinks. |
380
385
|`actimeo=`| 30-60 | Recommended. The time (in seconds) that the CIFS client caches attributes of a file or directory before it requests attribute information from a server. Using a value lower than 30 seconds can cause performance degradation because attribute caches for files and directories expire too quickly. We recommend setting `actimeo` between 30 and 60 seconds. |
381
-
|`nosharesock`| n/a | Optional. Forces the client to always make a new connection to the server even if it has an existing connection to the SMB mount. This can enhance performance, as each mount point will use a different TCP socket. In some cases, `nosharesock` can degrade performance due to not caching the same file when opened from two mounts from the same client. |
382
-
|`max_channels=`| 4 | Recommended when using SMB Multichannel. Specifies the maximum number of channels (network connections) to the file share. If you're using SMB Multichannel and the number of channels exceeds four, this will result in poor performance. |
386
+
|`nosharesock`| n/a | Optional. Forces the client to always make a new connection to the server even if it has an existing connection to the SMB mount. This can enhance performance, as each mount point uses a different TCP socket. In some cases, `nosharesock` can degrade performance due to not caching the same file when opened from two mounts from the same client. |
387
+
|`max_channels=`| 4 | Recommended when using SMB Multichannel. Specifies the maximum number of channels (network connections) to the file share. Using SMB Multichannel with more than four channels resultsin poor performance. |
383
388
|`remount`| n/a | Remounts the file share and changes mount options if specified. Use with the `password2` option in cases where you want to specify an alternative password to fix an expired password after the original mount. |
384
389
|`nobrl`| n/a | Recommended in single-client scenarios when advisory locks are required. Azure Files doesn't support advisory locks, and this setting prevents sending byte range lock requests to the server. |
385
390
| `snapshot=` | time | Mount a specific snapshot of the file share. Time must be a positive integer identifying the snapshot requested (in 100-nanosecond units that have elapsed since January 1, 1601, or alternatively it can be specified in GMT format e.g. @GMT-2024.03.27-20.52.19). |
386
391
| `closetimeo=` | 5 | Configures deferred close timeout (handle cache) in seconds, or disables it by setting to 0. Default is 5 seconds. |
387
392
| `nostrictsync` | n/a | Don't ask the server to flush on fsync(). Some servers perform non-buffered writes by default, in which case flushing is redundant. This option can improve performance for workloads where a client is performing a lot of small write + fsync combinations and where network latency is much higher than the server latency. |
388
-
| `multiuser` | n/a | Map user accesses to individual credentials when accessing the server. By default, CIFS mounts only use a single set of user credentials (the mount credentials) when accessing a share. With this option, the client instead creates a new session with the server using the user's credentials whenever a new user accesses the mount. Further accesses by that user will also use those credentials. Because the kernel can't prompt for passwords, multiuser mounts are limited to mounts using `sec=` options that don't require passwords. |
393
+
|`multiuser`| n/a | Map user accesses to individual credentials when accessing the server. By default, CIFS mounts only use a single set of user credentials (the mount credentials) when accessing a share. With this option, the client instead creates a new session with the server using the user's credentials whenever a new user accesses the mount. Further accesses by that user also use those credentials. Because the kernel can't prompt for passwords, multiuser mounts are limited to mounts using `sec=` options that don't require passwords. |
389
394
| `cifsacl` | n/a | This option is used to map CIFS/NTFS ACLs to/from Linux permission bits, map SIDs to/from UIDs and GIDs, and get and set Security Descriptors. Only supported for NTLMv2 authentication. |
390
395
| `idsfromsid,modefromsid` | n/a | Recommended when client needs to do client-enforced authorization. Enables Unix-style permissions. Only works when UIDs/GIDs are uniform across all the clients. Only supported for NTLMv2 authentication. |
391
396
| `sec=` | krb5 | Required for Kerberos authentication. To enable Kerberos security mode, set `sec=krb5`. You must omit username and password when using this option. The Linux client must be domain-joined. See [Enable Active Directory authentication over SMB for Linux clients](storage-files-identity-auth-linux-kerberos-enable.md). |
392
-
|`uid=`| 0 | Optional. Sets the uid that will own all files or directories on the mounted filesystem when the server doesn't provide ownership information. It can be specified as either a username or a numeric uid. When not specified, the default is 0. |
393
-
| `gid=` | 0 | Optional. Sets the gid that will own all files or directories on the mounted filesystem when the server doesn't provide ownership information. It can be specified as either a groupname or a numeric gid. When not specified, the default is 0. |
397
+
| `uid=` | 0 | Optional. Sets the uid that owns all files or directories on the mounted filesystem when the server doesn't provide ownership information. It can be specified as either a username or a numeric uid. When not specified, the default is 0. |
398
+
|`gid=`| 0 | Optional. Sets the gid that owns all files or directories on the mounted filesystem when the server doesn't provide ownership information. It can be specified as either a groupname or a numeric gid. When not specified, the default is 0. |
394
399
| `file_mode=` | n/a | Optional. If the server doesn't support the CIFS Unix extensions, this overrides the default file mode. |
395
400
|`dir_mode=`| n/a | Optional. If the server doesn't support the CIFS Unix extensions, this overrides the default mode for directories. |
396
401
| `handletimeout=` | n/a | Optional. The time (in milliseconds) for which the server should reserve the file handle after a failover waiting for the client to reconnect. |
Copy file name to clipboardExpand all lines: articles/storage/files/storage-how-to-use-files-mac.md
+22-16Lines changed: 22 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,5 @@
1
1
---
2
-
title: Mount SMB Azure file share on macOS
2
+
title: Mount an Azure file share on macOS
3
3
description: Learn how to mount an Azure file share over SMB with macOS using Finder or Terminal.
4
4
author: khdownie
5
5
ms.service: azure-file-storage
@@ -8,40 +8,46 @@ ms.date: 12/13/2024
8
8
ms.author: kendownie
9
9
---
10
10
11
-
# Mount SMB Azure file share on macOS
11
+
# Mount an Azure file share on macOS
12
12
13
-
[Azure Files](storage-files-introduction.md) is Microsoft's easy-to-use cloud file system. Azure file shares can be mounted with the industry standard SMB 3 protocol by macOS High Sierra 10.13+. This article shows two different ways to mount an Azure file share on macOS: with the Finder UI and using the Terminal.
13
+
[Azure Files](storage-files-introduction.md) is Microsoft's easy-to-use cloud file system. Azure file shares can be mounted with the industry standard SMB 3 protocol by macOS High Sierra 10.13+.
14
14
15
15
> [!WARNING]
16
16
> Mounting a file share using storage account keys carries inherent security risks. For information on how to protect and manage your keys, see [Manage storage account access keys](../common/storage-account-keys-manage.md). Azure Files doesn't currently support using identity-based authentication to mount a file share on macOS.
17
17
18
18
## Applies to
19
-
20
-
| File share type | SMB | NFS |
21
-
|-|:-:|:-:|
22
-
| Standard file shares (GPv2), LRS/ZRS |||
23
-
| Standard file shares (GPv2), GRS/GZRS |||
## Prerequisites for mounting an Azure file share on macOS
27
33
28
-
***Storage account name**: To mount an Azure file share, you'll need the name of the storage account.
34
+
***Storage account name**: To mount an Azure file share, you need the name of the storage account.
29
35
30
-
***Storage account key**: To mount an Azure file share, you'll need the primary (or secondary) storage account key. SAS tokens aren't currently supported for mounting Azure file shares.
36
+
***Storage account key**: To mount an Azure file share, you need the primary (or secondary) storage account key.
31
37
32
-
***Ensure port 445 is open**: SMB communicates over TCP port 445. On your client machine (the Mac), check to make sure your firewall isn't blocking TCP port 445. If your organization or ISP is blocking port 445, you might need to set up a VPN from on-premises to your Azure storage account with Azure Files exposed on your internal network using private endpoints. With this configuration, traffic will go through a secure tunnel as opposed to over the internet. For more information, see [Networking considerations for direct Azure file share access](storage-files-networking-overview.md). To see a summary of ISPs that allow or disallow access from port 445, go to [TechNet](https://social.technet.microsoft.com/wiki/contents/articles/32346.azure-summary-of-isps-that-allow-disallow-access-from-port-445.aspx).
38
+
***Ensure port 445 is open**: SMB communicates over TCP port 445. On your macOS, check to make sure your firewall doesn't block TCP port 445. If port 445 is blocked, you can set up a VPN from on-premises to your Azure file share using private endpoints. For more information, see [Networking considerations for direct Azure file share access](storage-files-networking-overview.md).
33
39
34
40
## Mount an Azure file share via Finder
35
41
36
42
1.**Open Finder**: Finder is open on macOS by default, but you can ensure that it's the currently selected application by clicking the macOS face icon on the dock:
37
43
38
44
39
-
1.**Select "Connect to Server" from the "Go" Menu**: Using the UNC path, convert the beginning double backslash (`\\`) to `smb://` and all other backslashes (`\`) to forward slashes (`/`). Your link should look like the following:
45
+
1.**Select "Connect to Server" from the "Go" Menu**: Using the UNC path, convert the beginning double backslash (`\\`) to `smb://` and all other backslashes (`\`) to forward slashes (`/`).
40
46
41
47
42
-
1.**Use the storage account name and storage account key when prompted for a username and password**: When you select **Connect** on the **Connect to Server** dialog, you'll be prompted for the username and password (this will be autopopulated with your macOS username). You have the option of placing the storage account name/storage account key in your macOS Keychain.
48
+
1.**Use the storage account name and storage account key when prompted for a username and password**: If desired, you can persist the storage account name and storage account key in your macOS Keychain.
43
49
44
-
1.**Use the Azure file share as desired**: After substituting the share name and storage account key for the username and password, the share will be mounted. You may use this as you would normally use a local folder/file share, including dragging and dropping files into the file share:
50
+
1.**Use the Azure file share as desired**: After substituting the share name and storage account key for the username and password, the share is be mounted. You can use the file share as you would normally use a local folder, including dragging and dropping files into the file share:
45
51
46
52
47
53
@@ -53,7 +59,7 @@ ms.author: kendownie
53
59
open smb://<storage-account-name>:<storage-account-key>@<storage-account-name>.file.core.windows.net/<share-name>
54
60
```
55
61
56
-
1. **Use the Azure file share as desired**: The Azure file share will be mounted at the mount point specified by the previous command.
62
+
1. **Use the Azure file share as desired**: The Azure file share is mounted at the mount point specified by the previous command.
57
63
58
64
0 commit comments