viewpolicy create

--name NAME

Sets a unique name for the view policy.

--flavor NFS|SMB|MIXED_LAST_WINS|S3_NATIVE

Sets a security flavor for the view policy:

For more information about security flavors, see Controlling File and Directory Permissions Across Protocols.Controlling File and Directory Permissions Across Protocols

--auth-source RPC|PROVIDERS|RPC_AND_PROVIDERS

Specifies which source is trusted for the user's group memberships, when users' access to the view is authorized. Possible values:

--permission-per-vip-pool <pool ID 1>=RW|RO,<pool ID 2>=RW|RO,...

Grants read/write or read-only access to clients from certain virtual IP pools.

Specify a comma-separated list of virtual IP pool IDs with indication of the access type (RW for read/write or RO for read-only) for each of the pools, for example:

--permission-per-vip-pool 1=RW,2=RW,3=RO

--tenant-id TENANT_ID

Associates the view policy with a specific tenant.

--serve-all-tenants

Sets the view policy to serve all tenants (default setting).

--audit-protocols PROTOCOLS

Lists access protocols for which you are enabling or disabling protocol auditing on views that use this view policy.

Use this parameter together with --enable-audit-settings or --disable-audit-settings to enable or disable auditing of the specified protocols.

When specifying --audit-protocols , you must also specify --audit-operations and/or --audit-options.

Specify PROTOCOLS as a comma-separated list of values. Valid values:

--audit-operations OPERATIONS

Lists categories of protocol operations for which you are enabling or disabling protocol auditing on views that use this view policy.

Use this parameter together with --audit-protocols and either --enable-audit-settings or --disable-audit-settings to enable or disable auditing of the specified protocol operations for views that use this view policy.

Specify OPERATIONS as a comma-separated list of values, each of which specifies a category of operations being audited. Valid values:

--audit-options OPTIONS

Lists audit options to enable or disable on views that use this view policy.

Use this parameter together with --audit-protocols and either --enable-audit-settings or --disable-audit-settings to enable or disable the specified options for the specified protocols.

Specify OPTIONS as a comma-separated list of values. Valid values:

--enable-audit-settings

Enables audit settings specified in the same command line by the --audit-protocols, --audit-operations and  --audit-options parameters.

Any auditing protocols, operations options that are already enabled in the policy remain enabled.

Any audit settings (protocols, operations or options) that are already enabled in the view policy remain enabled.

--disable-audit-settings

Disables audit settings specified in the same command line by the --audit-protocols, --audit-operations and  --audit-options parameters.

Any audit settings (protocols, operations or options) that are already enabled in the view policy and that are not specified in the same command line remain enabled.

--smb-file-mode SMB_FILE_MODE

--smb-directory-mode SMB_DIRECTORY_MODE

For multiprotocol views, if the security flavor is NFS, specify default Unix permission bits for files (--smb-file-mode) and directories (--smb-directory-mode). These are applied as initial permissions to files and directories created by SMB or S3 clients.

Specify SMB_FILE_MODE and SMB_DIRECTORY_MODE in three digit numeric notation, in which each digit represents a component of the permissions: user, group and others (in that order). Each digit is the sum of the following component bits:

Example

Supposing you want to set the following permissions for file mode:

The user's read bit (4) and a write bit (2) total 6, the group and others each have a read bit only so that is 4 each. Therefore, you set the permission bits to 644:

--smb-file-mode 644

Defaults

SMB file mode permission bits: 644

SMB directory mode permission bits: 755

--enable-inherit-parent-mode-bits

If specified, permission mode bits for files/objects and directories/buckets created by protocols other than NFS on a view controlled with the NFS security flavor, inherit their permission mode bites from the parent directory.

--disable-inherit-parent-mode-bits

If specified, permission mode bits for files/objects and directories/buckets created by protocols other than NFS on a view controlled with the NFS security flavor, are taken from the view policy definition (instead of inheriting them from the parent directory).

--s3-read-write [HOSTS]

Controls which S3 client hosts have read/write access to the view.

By default, all hosts have read/write access.

To remove all hosts from read/write access, include this option without any values.

To restrict read/write access to specific hosts, specify HOSTS according to the format description above this table.

For example: --s3-read-write 98.51.100.1,98.51.100.2

--s3-read-only [HOSTS]

Specifies which S3 client hosts have read-only access to the view.

Specify HOSTS according to the format description above this table.

--smb-read-write [HOSTS]

Controls which SMB client hosts have read/write access to the view.

By default, all hosts have read/write access.

To remove all hosts from read/write access, include this option without any values.

To restrict read/write access to specific hosts, specify HOSTS according to the format description above this table.

For example: --smb-read-write 98.51.100.1,98.51.100.2

--smb-read-only [HOSTS]

Specifies which SMB client hosts have read-only access to the view.

Specify HOSTS according to the format description above this table.

--access-flavor NFS4|SMB|ALL

Caution

Changing this setting when already in effect on a view that is being used by clients could lead to unexpected behavior and is not advised.

If --flavor is MIXED_LAST_WINS, this parameter can be used to control which protocols can set file permissions, including Access Control Lists (ACLs) and setting user-owner and group-owner of files.

Note

NFSv3 is unaffected by this setting. NFSv3 users can set permission mode bits in Mixed Last Wins security flavor regardless of this setting.

Attempts by the blocked protocol fail silently. See Controlling File and Directory Permissions Across Protocols for details. Controlling File and Directory Permissions Across Protocols

Possible values:

--path-length LCD|NPL

Specifies the policy for limiting file path component name length.

Possible values:

--allowed-characters LCD|NPL

Specifies the policy for which characters are allowed in file names.

Possible values:

--gid-inheritance linux|bsd

Specifies how files receive their owning group when they are created.

Possible values:

--nfs-read-write [HOSTS]

Determines which NFS client hosts have read/write access to the view.

By default, all hosts have read/write access.

To restrict read/write access to specific hosts, specify HOSTS as shown above the table. For example: --nfs-read-write 98.51.100.1,98.51.100.2

To prohibit read/write access for all hosts, specify this option without any values.

To create a reversed rule, e.g. a rule that allows read/write access from all IPs except the one specified, prepend the IP address with a tilde, for example: ~192.0.2.0

--nfs-read-only [HOSTS]

Determines which NFS client hosts have read-only access to the view.

Specify HOSTS as shown above the table.

--nfs-no-squash [HOSTS]

Determines which hosts have no squash access. With no squash, all operations are supported. Use this option if you trust the root user not to perform operations that will corrupt data.

This option is not relevant for NFSv4.1 users if Kerberos is used, since Active Directory does not include the 'root' user principal by default and since the handling of credentials for the user with UID 0 depends on configuration of the rpc.gssd service.

Specify HOSTS as shown above the table.

--nfs-root-squash [HOSTS]

Determines which hosts have root squash access. With root squash, the root user is mapped to nobody for all file and folder management operations on the export. This enables you to prevent the strongest super user from corrupting all user data on the VAST Cluster.

This option is not relevant for NFSv4.1 users if Kerberos is used, since Active Directory does not include the 'root' user principal by default and since the handling of credentials for the user with UID 0 depends on configuration of the rpc.gssd service.

By default, all hosts have root squash access.

To restrict root squash to specific hosts, specify HOSTS according to the format description above this table.

To remove root squash access for all hosts, include this option without values.

--nfs-all-squash [HOSTS]

Determines which hosts have all squash access. With all squash, all client users are mapped to nobody for all file and folder management operations on the export.

Specify HOSTS as shown above the table.

--nfs-trash-access [HOSTS]

Determines which hosts have access to the trash folder, if the trash folder is enabled for the cluster.

Granting this permission gives hosts the ability to delete files by moving them into the  trash folder, from which they are automatically deleted. Requires that the host is listed as No Squash (--nfs-no-squash).

Note

This option is applicable for NFSv3 only. The Trash folder feature is not supported for NFSv4.1 clients.

Specify HOSTS as shown above the table.

--atime-frequency ATIME_FREQUENCY

atime is a metadata attribute of NFS files that represents the last time the file was updated. atime is updated on read operations if the difference between the current time and the file's atime value is greater than the configured atime frequency. Consider that a very low value might have a performance impact if high numbers of files are being read.

Specify ATIME_FREQUENCY as an integer followed by a unit of time (s = seconds, m= minutes, h=hours, d=days).

Example: 1h

Default: 0, which means no atime updates.

--nfs-return-open-permissions

Sets the NFS server to unilaterally return open (777) permission for all files and directories when responding to client side access checks.

This setting works around a permissions issue that occurs with Windows clients. Windows clients perform NFSv3 access checks before executing read/write requests. This client side check uses the UID and the primary GID of the user without taking into account secondary GIDs. If the check fails, requests are not executed. This means that some permissions may not be honored as they should be, such as those based on secondary groups.

When return open permissions is enabled, VAST Cluster returns open permissions for client side access checks, so that the Windows client allows access rights and executes read/write requests. VAST Cluster does a proper permission check when the request is executed.

Caution

Use this feature with caution if Windows client systems are shared by more than one user, since the following security breach could occur: While a user is accessing a file with correct permissions and the file is cached in memory on the Windows system, if another user tries to access the same file, access is incorrectly allowed. No proper access check is done for the second user.

Starting with VAST Cluster 5.2.2,  enable-nfs-return-open-permissions is the default setting which is honored with all security flavors. Prior to VAST Cluster 5.2.2, the setting was by default disabled; it was ignored if the flavor was S3 Native.

--disable-nfs-return-open-permissions

Disables the NFS return open permissions setting. See --nfs-return-open-permissions.

--enable-nfs-posix-acl

Enables full support of extended POSIX Access Control Lists (ACL). By default, VAST Cluster supports the traditional POSIX file system object permission mode bits, (minimal ACL mode) in which each file has three ACL entries defining the permissions for the owner, owning group, and others, respectively. To learn more about POSIX ACL, see https://linux.die.net/man/5/acl.

Note

The Posix ACL setting is relevant for NFSv3 only.

Note

The Posix ACL setting is supported only with the NFS security flavor.

Note

The setfacl Linux command is blocked if this option is not enabled.

Note

• NFSv4.1 does not support POSIX ACLs.

• If clients have created files and directories with POSIX ACLs using NFSv3 and then they start to access those files and directories via NFSv4.1, the POSIX ACLs will have no effect.

• If this setting is enabled, POSIX ACLs may be used via NFSv3 only. They cannot be used via NFSv4.1.

• Support for NFSv4.1 ACLs requires Mixed Last Wins security flavor and is not supported concurrently with POSIX ACLs for NFSv3.

--disable-nfs-posix-acl

Disables support for extended POSIX ACLs, restoring default minimal ACL mode.

--enable-32bit-fileid

Sets the VAST Cluster's NFS server to use 32-bit file IDs. This setting supports legacy 32-bit applications running over NFSv3.

--disable-32bit-fileid

Disables 32-bit file IDs (default).

--nfs-minimal-protection-level NONE|SYSTEM|KRB_AUTH_ONLY|KRB_INTEGRITY|KRB_PRIVACY

Set the Kerberos Authentication Minimal protection level to accept from NFSv4.1 client RPCs:  

--nfs4-case-sensitive

When this option is specified, VAST Cluster honors case in the names of files or directories accessed through NFSv4.

This is the default behavior.

Caution

Changing the NFSv4.1 case insensitivity setting   for an existing view may have unpredictable results.

--nfs4-case-insensitive

When this option is specified,  VAST Cluster does not honor case in the names of files or directories accessed through NFSv4.

Caution

Changing the NFSv4 case insensitivity setting for an existing view may have unpredictable results.

--enable-enforce-tls-cert

Enforces TLS encryption between the  NFS client and the cluster.  When this setting is enabled, the Kerberos Authentication Minimal  protection level for NFSv4 must be set to System or None.

Note

TLS encryption requires further setup in addition to this view policy setting. For details, see Configuring TLS Encryption with NFS.

--disable-enforce-tls-cert

Disables enforcing of TLS encryption between the NFS client and the cluster.

--enable-nfs-enforce-tls-relaxed

Notice

This option is introduced in VAST Cluster 5.2.2.

Applicable only if --enable-enforce-tls-cert is enabled, this setting allows non-TLS connections on auxiliary NFSv3 subprotocols such as MOUNT, NLM, NSM and RQUOTA.

--disable-nfs-enforce-tls-relaxed

Notice

This option is introduced in VAST Cluster 5.2.2.

Disables --enable-nfs-enforce-tls-relaxed.