Home / server / Questions / 589091
Accepted
Sobrique
Asked: 2014-04-16 01:47:05 +0800 CST

NetApp filer - resetting NTFS permissions with fsecurity?

  • 772

I have a NetApp filer, with a CIFS export. The permissions have been locked down on it, to a point where it's no longer accessible. I need to reset the permissions on this - I've figured out I can probably do this by changing the qtree to Unix security mode and back again (provided I'm prepared to unexport the share temporarily).

However, I think I should be able to use the fsecurity command to do this. There's just one problem - the manpage example refers to 'applying ACLs from a config file': https://library.netapp.com/ecmdocs/ECMP1196890/html/man1/na_fsecurity_apply.1.html

But what it doesn't do, is give me an example of what a 'security definition file' actually looks like.

Is anyone able to give me an example? Resetting a directory structure to Everyone/Full Control is sufficient for my needs, as re-applying permissions isn't a problem.

storage

2 Answers

  1. Best Answer

    There is a utility on the NetApp website called 'secedit' that helps create a 'security definition file:

    http://support.netapp.com/NOW/download/tools/secedit/download.shtml

    A basic file looks like this:

    cb56f6f4
1,0,"/vol/vol_name/qtree_name/subdirectory",0,"D:(A;CIOI;0x1f01ff;;;Everyone)"

    This will set 'Everyone / Full Control' as an explicit ACL on the designated path. (If subfolders inherit, then it'll propagate, but not otherwise). You should then be able to reset the permissions to something more appropriate.

    You'll need o save this into a file on your filer - for example, /etc/security.conf And then use

    fsecurity apply /etc/security.conf

    (You may wish to use 'fsecurity show' before and after to verify the ACLs)

    • 4

  2. if you take here 2 and not 0 as in the example

    cb56f6f4
1,0,"/vol/vol_name/qtree_name/subdirectory",2,...

    then you can replace all permissions by only the new one. !Be carefully with it you will really remove all other permissions in all Subdirectorys!

    Normal you will need this option only if you have interrupted inheritance in subfolders.

    • 3