Using Group Policy to Manage and Enforce ACL on VNX for File P/N REV A01 February 2011

Transcription

1 EMC VNX Series Release 7.0 Using Group Policy to Manage and Enforce ACL on VNX for File P/N REV A01 February 2011 This technical note contains information on these topics: Business problem... 2 Introduction... 2 What s new... 2 Architecture... 3 Client considerations... 7 Implementation considerations... 7 Windows GUI... 8 Appendix Group policy object editor

2 Business problem Business problem Introduction What s new Windows administrators use the Microsoft Management Console (MMC) Group Policy Object (GPO) to set and configure their Windows environment. The file system objects can be used to enter access control entries (ACEs) to grant and limit access to the file system objects in Windows to users and groups. A group of ACEs for a file system is called an access control list (ACL). Windows will update the file system ACLs periodically according to the security rules set up by the administrator. If a rule is not set, it will run the update cycle every 90 minutes. The update cycle can be computer resource intensive, especially if the file system is large, and deep, and have a lot of directory branches. Also, since it may not be immediately updated, a security loophole may exist between the time the ACL is updated, and the GPO rule is updated. For these reasons, the EMC VNX operating system can initiate an update event of the file system, ACLs, to provide immediate changes to the file systems. EMC VNX for file will provide a GUI tool that will directly apply the GPO security settings to the file systems. It will have the same effect as applying the security update from a Windows server, but it will take significantly shorter time to do so on large and deep directories, because the security settings are managed locally on the Data Movers. This is a new feature for EMC VNX for file 7.0. For versions prior to this, Windows customers can run the gpupdate.exe command in their Windows domain controller to force an immediate execution of the security settings. 2 EMC VNX Series Using Group Policy to Manage and Enforce ACL on VNX for File

3 Architecture Architecture Consider the following Windows configuration as an example: CIFS server: 108DM3-114 CIFS share: FS3 Directory: \dir4 UNC to the directory: \\108DM3-114\FS3\dir4 Users: user1 and user2 User1 is given full control of the directory and user2 is denied all access to the directory. Appendix Group Policy Object Editor explains the procedure to start the group policy editor. To set the file system security ACL: 1. In the Default Domain Policy, navigate to Computer Configuration > Windows Settings > Security Settings > File System. 2. Right-click File System and select Add File. In the Add a file or folder window, type the UNC path for the directory (or file) in the Folder text box. In this example, type \\108DM3-114\fs3\dir4. The UNC is displayed under the Object Name in the right panel as shown in Figure 1. Using Group Policy to Manage and Enforce ACL on VNX for File Patni Confidential 3

4 Architecture Figure 1: Group Policy Object editor 3. To enter the ACL for the directory, right-click the UNC name in the right panel, and select Properties. 4 EMC VNX Series Using Group Policy to Manage and Enforce ACL on VNX for File

5 Architecture Notice that there are three security policy settings as shown in Figure 2: Propagate The settings will propagate down to all the subdirectories and files. Replace The settings will replace all the existing permissions on the subdirectories and files. Do not allow permissions on this file or folder to be replaced No action will be done. Figure 2: Security properties 4. Click Edit Security to add the ACL entries. Figure 3 shows the ACL for user1 and user2 user1 is granted full access and user2 is denied all access. Using Group Policy to Manage and Enforce ACL on VNX for File Patni Confidential 5

6 Architecture Figure 3: Assigning user and group permissions Since this GPO setting is not due to update for a while, you can test this by logging on to another Windows client as the domain administrator, map the directory, and assign user2 to have full control to this directory. Log off and log on as user2. Navigate to this directory; user2 should be able to create files and subdirectories in /fs3/dir4. To force this security setting to apply immediately, log on to the Control Station of the VNX that has the CIFS server and run the command: server_security server_x -update policy gpo server_security will force a read of the GPO on the Active Directory. 6 EMC VNX Series Using Group Policy to Manage and Enforce ACL on VNX for File

7 Client considerations The file system GPO will be applied asynchronously when the dedicated threads are awakened. After some time, you will notice that user2 no longer has the privilege to create folders and files in this directory. Client considerations This feature will work with Windows 2000, 2003, and 2008 servers. Implementation considerations The GPO is updated periodically. By default, it is updated every 16 hours. To avoid any performance impact on the Data Mover, there is a long interval between the updates. If the update interval is relatively less, and the GPO update is not completed when the next update is due, the next update will wait until the previous one is completed before it will proceed. Update interval parameter A Data Mover parameter, gpo.filesecurityupdateinterval, is available to define the update interval in the CIFS facility. The following are the details of the parameter: $ server_param server_2 facility cifs info gpo.filesecurityupdateinterval server_2 name = gpo.filesecurityupdateinterval facility_name = cifs default_value = 17 current_value = 60 configured_value = user_action = none change_effective = immediate range = (10,259200) description =Interval between 2 updates of the GPO (in hours) The Parameters Guide for VNX provides additional information. Using Group Policy to Manage and Enforce ACL on VNX for File Patni Confidential 7

8 Windows GUI Windows GUI EMC has developed a Windows GUI tool that will enhance your file systems security experience. This graphical tool is used to update the file system security setting on a directory tree. Use this tool on your Windows server, with the directory tree mapped by using a universal naming convention (UNC) path. Note: The pathname used in this tool must be entered in a UNC format, that is, \\server\share\. The tool will not accept pathnames in any other format. For example, Z:\directory\file-name format will not work, even if the network drive was previously mapped by using an UNC format. The tool name is emcacl.exe. To use the Windows GUI tool: 1. Go to Start > Run to access this tool or you can access it from the system Prompt command line by entering: emcacl.exe /secwin. 8 EMC VNX Series Using Group Policy to Manage and Enforce ACL on VNX for File

9 Windows GUI Figure 4: EMC Security Directive Editor In the EMC Security Directive Editor, there are two main sections. The first section displays all the UNC paths that have been defined. The second section displays three groups with specific action buttons: Edition Action File If this is the first time you are using the editor, the main window will be blank. To add a UNC path, click Add. 2. In the Add an Object prompt, type the UNC path. In this example, we add the UNC path as \\Fuzzy\SFTP\b01. Using Group Policy to Manage and Enforce ACL on VNX for File Patni Confidential 9

10 Windows GUI Figure 5: Adding a UNC pathname While the UNC path in the main screen is highlighted, you can change the permission settings by clicking Edit. The Security for \\Fuzzy\SFTP\b01 window is displayed as shown in Figure To add users and groups to the UNC path, click Add. Windows users will be familiar with the screen dialogue that follows, selecting users from the local computer, or from the Active Directory. Figure 6: Adding users and groups You can click Advanced to assign more detailed permissions to users and groups, as shown in Figure When the permissions for users and groups are assigned, click Apply in the Action group. This applies the assigned permissions to the named UNC path. 10 EMC VNX Series Using Group Policy to Manage and Enforce ACL on VNX for File

11 Windows GUI Note: In Figure 6, there is a drop-down list where you can select the propagation mode. There are three propagation modes: Replace ACL The settings will replace all the existing permissions on the subdirectories and files Merge ACL The settings will merge with the existing permissions on the subdirectories and files Stop propagation The permissions from the higher directories will not be applied on the subdirectories and files Figure 7: Adding advanced security settings: Selecting a user or a group 5. Click Edit to view or modify the permission entries for user or group as shown in Figure 8. Using Group Policy to Manage and Enforce ACL on VNX for File Patni Confidential 11

12 Windows GUI Figure 8: Permission Entries for user or group 12 EMC VNX Series Using Group Policy to Manage and Enforce ACL on VNX for File

13 Appendix Group policy object editor Appendix Group policy object editor To start the Group Policy Object Editor: 1. Go to Start > Run and type mmc. You will get a screen with the Console Root. 2. Click File and select Add/Remove Snap-in. The Add/Remove snapin window is displayed. 3. Click Add. The Add Standalone Snap-in window is displayed. Scroll down to Group Policy Object Editor, and click Add. This will start the Wizard screen. 4. Click Browse. The Domain/OU is displayed. In the Look in: dropdown list, ensure you select your domain name, then select Default Domain Policy in the Domains, OUs and linked Group Policy Objects: section, and click OK. 5. Click Finish to return to the Add Standalone Snap-in window. 6. Click Close to return to the Add/Remove Snap-in window. 7. Click OK to return to the Console 1 window. 8. Open the Default Domain Policy [for your domain-name] tree. Click Computer Configuration > Windows Settings > Security Settings > File System. 9. Right-click File System. Select Add File, and in the Add a file or folder window, go to the Folder: text box, and type the UNC path of the directory or file that you want to impose the ACL settings. Note: This UNC path must be the DNS recognized UNC path. In general, UNC path using IP addresses will not work. It must have a naming services named UNC path, like \\server-x\dir-y\file-z. If you want to change the group policy refresh rate, start the default domain policy editor as explained earlier, and select default domain Policy [for your domain-name] tree. 10. Click Administrative Templates > System > Group Policy, and click standard tab. You will find the Group Policy refresh interval for workstations and domain controllers. Using Group Policy to Manage and Enforce ACL on VNX for File Patni Confidential 13

14 Appendix Group policy object editor 11. If you need to change the users rights, use the Group Policy Editor. Go to Start > Run and type gpedit.msc to start the editor. Under Local Computer Policy navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment. The policies are displayed in the right panel. 14 EMC VNX Series Using Group Policy to Manage and Enforce ACL on VNX for File

15 Appendix Group policy object editor Copyright 2011 EMC Corporation. All Rights Reserved. EMC believes the information in this publication is accurate as of its publication date. The information is subject to change without notice. THE INFORMATION IN THIS PUBLICATION IS PROVIDED "AS IS." EMC CORPORATION MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND WITH RESPECT TO THE INFORMATION IN THIS PUBLICATION, AND SPECIFICALLY DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Use, copying, and distribution of any EMC software described in this publication requires an applicable software license. For the most up-to-date listing of EMC product names, see EMC Corporation Trademarks on EMC.com. All other trademarks used herein are the property of their respective owners. Using Group Policy to Manage and Enforce ACL on VNX for File Patni Confidential 15