Skip to content

Commit 8a1fda1

Browse files
v-stsavellv-stsavell
authored
Merge pull request #217281 from b-ahibbard/anf-nfs4.1
ACLs for NFSv4.1
2 parents 1739415 + 1fd0aa5 commit 8a1fda1

File tree

6 files changed

+133
-3
lines changed

6 files changed

+133
-3
lines changed

‎articles/azure-netapp-files/TOC.yml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -181,8 +181,10 @@
181181
href: create-active-directory-connections.md
182182
- name: Modify Active Directory connections
183183
href: modify-active-directory-connections.md
184-
- name: Enable AD DS LDAP authentication for NFS volumes
184+
- name: Configure AD DS LDAP authentication for NFS volumes
185185
href: configure-ldap-over-tls.md
186+
- name: Join a Linux VM to an Active Directory Domain
187+
href: join-active-directory-domain.md
186188
- name: Manage capacity pools
187189
items:
188190
- name: Set up a capacity pool
@@ -225,6 +227,8 @@
225227
href: azure-netapp-files-configure-export-policy.md
226228
- name: Configure Unix permissions and change ownership mode
227229
href: configure-unix-permissions-change-ownership-mode.md
230+
- name: Configure access control lists for NFSv4.1
231+
href: configure-access-control-lists.md
228232
- name: Configure network features for a volume
229233
href: configure-network-features.md
230234
- name: Configure Virtual WAN

‎articles/azure-netapp-files/azure-netapp-files-create-volumes.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -143,4 +143,5 @@ This article shows you how to create an NFS volume. For SMB volumes, see [Create
143143
* [Configure Unix permissions and change ownership mode](configure-unix-permissions-change-ownership-mode.md).
144144
* [Resource limits for Azure NetApp Files](azure-netapp-files-resource-limits.md)
145145
* [Learn about virtual network integration for Azure services](../virtual-network/virtual-network-for-azure-services.md)
146-
* [Application resilience FAQs for Azure NetApp Files](faq-application-resilience.md)
146+
* [Configure access control lists on NFSv4.1 with Azure NetApp Files](configure-access-control-lists.md)
147+
* [Application resilience FAQs for Azure NetApp Files](faq-application-resilience.md)

‎articles/azure-netapp-files/configure-access-control-lists.md

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
---
2+
title: Configure access control lists with Azure NetApp Files | Microsoft Docs
3+
description: This article shows you how to configure access control lists (ACLs) on NFSv4.1 with Azure NetApp Files.
4+
author: b-ahibbard
5+
ms.service: azure-netapp-files
6+
ms.workload: storage
7+
ms.topic: how-to
8+
ms.date: 12/20/2022
9+
ms.author: anfdocs
10+
---
11+
# Configure access control lists on NFSv4.1 volumes for Azure NetApp Files
12+
13+
Azure NetApp Files supports access control lists (ACLs) on NFSv4.1 volumes. ACLs provide granular file security via NFSv4.1.
14+
15+
ACLs contain access control entities (ACEs), which specify the permissions (read, write, etc.) of individual users or groups. When assigning user roles, provide the user email address if you're using a Linux VM joined to an Active Directory Domain. Otherwise, provide user IDs to set permissions.
16+
17+
## Requirements
18+
19+
- ACLs can only be configured on NFS4.1 volumes. You can [convert a volume from NFSv3 to NFSv4.1](convert-nfsv3-nfsv41.md).
20+
21+
- You must have two packages installed:
22+
1. `nfs-utils` to mount NFS volumes
23+
1. `nfs-acl-tools` to view and modify NFSv4 ACLs.
24+
If you do not have either, install them:
25+
- On a Red Hat Enterprise Linux or SuSE Linux instance:
26+
```bash
27+
sudo yum install -y nfs-utils
28+
sudo yum install -y nfs4-acl-tools
29+
```
30+
- On Ubuntu or Debian instance:
31+
```bash
32+
sudo apt-get install nfs-common
33+
sudo apt-get install nfs4-acl-tools
34+
```
35+
36+
## Configure ACLs
37+
38+
1. If you want to configure ACLs for a Linux VM joined to Active Directory, complete the steps in [Join a Linux VM to an Azure Active Directory Domain](join-active-directory-domain.md).
39+
40+
1. [Mount the volume](azure-netapp-files-mount-unmount-volumes-for-virtual-machines.md).
41+
42+
1. Use the command `nfs4_getfacl <path>` to view the existing ACL on a directory or file.
43+
44+
The default NFSv4.1 ACL is a close representation of the POSIX permissions of 770.
45+
- `A::OWNER@:rwaDxtTnNcCy` - owner has full (RWX) access
46+
- `A:g:GROUP@:rwaDxtTnNcy` - group has full (RWX) access
47+
- `A::EVERYONE@:tcy` - everyone else has no access
48+
49+
1. To modify an ACE for a user, use the `nfs4_setfacl` command: `nfs4_setfacl -a|x A|D::<user|group>:<permissions_alias> <file>`
50+
- Use `-a` to add permission. Use `-x` to remove permission.
51+
- `A` creates access; `D` denies access.
52+
- In an Active Directory-joined set up, enter an email address for the user. Otherwise, enter the numerical user ID.
53+
- Permission aliases include read, write, append, execute, etc.
54+
In the following Active Directory-joined example, user [email protected] is given read, write, and execute access to `/nfsldap/engineering`:
55+
```bash
56+
nfs4_setfacl -a A::[email protected]:RWX /nfsldap/engineering
57+
```
58+
59+
## Next steps
60+
61+
* [Configure NFS clients](configure-nfs-clients.md)

‎articles/azure-netapp-files/configure-nfs-clients.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ The examples in this section use the following domain name and IP address:
116116

117117
The following steps are optional. You need to perform the steps only if you use user mapping at the NFS client:
118118

119-
1. Complete all steps described in the [RHEL 8 configuration if you are using NFSv4.1 Kerberos encryption](#rhel8_nfsv41_kerberos) section.
119+
1. Complete all steps described in the [RHEL 8 configuration if you are using NFSv4.1 Kerberos encryption](#rhel8_nfsv41_kerberos) section.
120120

121121
2. Add a static DNS record in your /etc/hosts file to use fully qualified domain name (FQDN) for your AD, instead of using the IP address in SSSD configuration file:
122122

‎articles/azure-netapp-files/convert-nfsv3-nfsv41.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,3 +143,4 @@ This section shows you how to convert the NFSv4.1 volume to NFSv3.
143143
144144
* [Create an NFS volume for Azure NetApp Files](azure-netapp-files-create-volumes.md)
145145
* [Mount or unmount a volume](azure-netapp-files-mount-unmount-volumes-for-virtual-machines.md)
146+
* [Configure access control lists on NFSv4.1 with Azure NetApp Files](configure-access-control-lists.md)

‎articles/azure-netapp-files/join-active-directory-domain.md

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
title: Join a Linux VM to an Azure Active Directory Domain | Microsoft Docs
3+
description: Describes how to join a Linux VM to an Azure Active Directory Domain
4+
services: azure-netapp-files
5+
documentationcenter: ''
6+
author: b-ahibbard
7+
manager: ''
8+
editor: ''
9+
10+
ms.assetid:
11+
ms.service: azure-netapp-files
12+
ms.workload: storage
13+
ms.tgt_pltfrm: na
14+
ms.topic: how-to
15+
ms.date: 12/20/2022
16+
ms.author: anfdocs
17+
---
18+
19+
# Join a Linux VM to an Azure Active Directory Domain
20+
21+
Joining a Linux virtual machine (VM) to an [Azure Active Directory Domain Services (Azure AD DS)](../active-directory-domain-services/overview.md) managed domain enables users to sign into to VMs with one set of credentials. Once joined, the user accounts and credentials can be used to sign in, access, and manage servers.
22+
23+
Refer to [Understand guidelines for Active Directory Domain Services site design and planning](understand-guidelines-active-directory-domain-service-site.md) to learn more about using Active Directory in Azure NetApp Files.
24+
25+
## Steps
26+
27+
1. Configure `/etc/resolv.conf` with the proper DNS server.
28+
29+
For example:
30+
31+
`[root@reddoc cbs]# cat /etc/resolv.conf`
32+
`search contoso.com`
33+
`nameserver 10.6.1.4(private IP)`
34+
35+
2. Add the NFS client record in the DNS server for the DNS forward and reverse lookup zone.
36+
37+
3. To verify DNS, use the following commands from the NFS client:
38+
39+
`# nslookup [hostname/FQDN of NFS client(s)]`
40+
`# nslookup [IP address of NFS client(s)]`
41+
42+
4. Install packages:
43+
44+
`yum update`
45+
`sudo yum -y install realmd sssd adcli samba-common krb5-workstation chrony nfs-utils`
46+
47+
5. Configure the NTP client.
48+
49+
RHEL 8 uses chrony by default. Following the configuration guidelines in [Using the `Chrony` suite to configure NTP](https://access.redhat.com/documentation/en-us/red-hat-enterprise-linux/8/guide/6c230de2-39f1-455a-902d-737eea31ad34).
50+
51+
6. Join the Active Directory domain:
52+
53+
`sudo realm join $DOMAIN.NAME -U $SERVICEACCOUNT --computer-ou="OU=$YOUROU"`
54+
55+
For example:
56+
57+
`sudo realm join CONTOSO.COM -U ad_admin --computer-ou="CN=Computers"`
58+
59+
## Next steps
60+
61+
* [Understand guidelines for Active Directory Domain Services site design and planning for Azure NetApp Files](understand-guidelines-active-directory-domain-service-site.md)
62+
* [Modify an Active Directory Connection](modify-active-directory-connections.md)
63+
* [Configure access control lists for NFSv4.1 volumes](configure-access-control-lists.md)

0 commit comments

Comments
 (0)