|
|
United States-English | |
|
|
 |
|
HP 9000 Networking: Advanced Server/9000 Concepts and Planning Guide > Chapter 5 Managing Shared Resources and Resource Security
Sharing Network Resources |
|
|
Advanced Server enables you to designate the resources that you want to share with others. For example, when a directory is shared, authorized users can make connections to the directory and access its files from their workstations. And when a printer is shared, many users can print from it over the network. After a resource is shared, you can restrict its availability over the network to certain users. These restrictions, called share permissions, can vary from user to user. With Advanced Server, you create the appropriate level of network resource security using a combination of resource sharing and resource permissions. Advanced Server provides superior performance, reliability, and security for file sharing. You can set file permissions and directory permissions that specify which groups and users have access and at which level that access is permitted Share permissions work in combination with file and directory permissions. When a directory is shared, permissions set through the shared directory allow users to connect to the share. Using default permissions (Full Control) for shared directories, you can manage the security of files using directory and file permissions. Advanced Server/9000 allows you to share any type of HP-UX file system — such as hfs, jfs, and nfs — with your LAN clients. Specific mapping characteristics are set in the fsmap parameter in the lanman.ini file. For information about HP-UX file systems and the lanman.ini file, see Advanced Server Administration.
For information about setting share permissions see "Setting Permissions on Shared Directories" later in this chapter. The only way to make a file accessible over the network is to share one of its parent directories. When you share a directory on the server, users theoretically can gain access to that directory, the files in it, all of the subdirectories in that directory and their contents, and all of the subdirectories in those subdirectories and their contents. Every point on the directory tree below the shared directory is available to network users. You can use directory permissions to block access to some directories in a shared directory tree and allow access to others by setting permissions on them. A shared directory often is referred to simply as a share. When you share a directory, you give it a share name by which network users refer to it. (A share name can be the same as the actual directory name but it does not have to be.) You can share multiple directories on a directory tree. This makes them accessible to users in two ways: as a directory that actually is shared and as a subdirectory of another shared directory. There are several ways to connect to shared directories. In Windows NT Server and Windows NT Workstation, Version 4.0, and Windows 95, you can use the Find command on the Start menu to connect to any computer or shared directory on the network, or double-click on a computer in Network Neighborhood. To assign a drive letter in My Computer for a particular share, use the Map Network Drive command on the Tools menu in the Explorer. Type the server name and share name into the Path box using the form \\servername\sharename. For Drive you can use the next available letter or select a letter from the drop-down list. For example, to connect to the shared directory Applications on the server named Dept35, type the location in the Path box as shown below: \\Dept35\Applications In the Explorer and My Computer, the mapped drive appears in the window as Applications on `Dept35' (F:) The share appears as a drive on your computer and the content of the shared directory can be viewed as if it was on your computer. You can have the connection re-established every time you log on or clear the Reconnect at Logon check box to disconnect automatically when you log off. If you want to connect to a shared directory using a different user account, use the Connect As box to type the user name for that account. If the account is in a different domain, type the domain name followed by a back slash and then the user name; for example, projects\patc. Users of Windows NT, Version 3.5x, Windows, and Windows for Workgroups can use File Manager to make network connections. After a Windows user makes a connection to a directory, the drive letter assigned to that directory and an icon appear in the drive bar of File Manager. For client computers running MS-DOS with LAN Manager client software (but without Windows), use the net use command to make network connections as follows:
The following naming conventions apply to client computers running MS- DOS:
For more information about Advanced Server file name space mapping, see the next section.
Advanced Server file name space mapping lets client computers running MS-DOS or Window for Workgroups to access files with long file names created by Windows 95 and Windows NT clients. File name space mapping allows different types of clients to access files residing in an HP-UX file system managed by Advanced Server/9000. The file name space mapping feature is composed of the following three elements:
The challenge of mapping between name spaces is resolved on HP-UX systems by concatenating a truncated file name with a pseudo-unique suffix, which is generated dynamically from the i-node number of the HP-UX system file.With file name mapping turned on, if a file is copied from one share to another, the client will dictate the file name under HP-UX. Windows NT clients will create long, mixed case names in the destination share. DOS clients will create shortened, mapped names in the destination share. The following table lists the client computer software that uses only the 8.3 file naming convention:
The following table lists the client computer software that uses the Windows NT-style naming convention:
The following table lists the configuration keys that are used for file name space mapping in the Advanced Server Registry:
The registry path for these settings is as follows:
The MixedCaseSupport key specifies whether mixed-case support is enabled on the server. Mixed-case support allows clients to access file names on the HP-UX system that contain uppercase characters. Enabling mixed-case file names may affect the server's performance negatively. Mixed-case support is disabled by default. Windows NT preserves the case of the file names but is not case-sensitive (does not distinguish file names by their case). In Windows NT, you cannot have two files with the same name but different case in the name. HP-UX preserves the case of the file names. In HP-UX you can have two files with the same name but different case in the name. AS/U allows file names to be stored in their native case but treats them case- insensitively otherwise. With mixed case support activated, the server may experience some performance degradation due to additional processing overhead. With MixedCaseSupport turned on, filenames will be reported to clients as is, without checking for uniqueness. If case insensitively similar file names exist, only one of the files will be available to the client. Therefore, an NT-style client may see a directory containing file names differing only in case, and an 8.3-style client may see multiple files with the same name. Note that AS/U will not allow creation of files with case insensitively similar file names. Case insensitively similar file names will only occur if they were created via HP-UX. The NameSpaceMapping key specifies the type of the mapping enabled on the server, as follows: For HP-UX system file name-to-8.3 type name mapping, the following rules apply:
For example, the file name longfilename.txt and i-node number of 11455, would have a mapped name of long~8u7.txt. For HP-UX system file name-to-Windows NT-style name file name mapping, the following rules apply:
For example, the file name k<l<m.expression and i-node number of 8461 would have a mapped name of k_l_m~6j1.expression. A file name which exceeds the 8.3 format will be truncated then concatenated with a pseudo-unique suffix. The suffix is dynamically generated from the i-node number of the HP-UX file. Since the 8.3 name is dynamically generated based on the HP-UX i-node number of the file, the following operations on the file can change the i-node number and therefore change the mapped file name:
The following keys in the File Service Parameters section of the registry can be used to customize mapping behavior:
For more information about the Advanced Server registry, see the Advanced Server/9000 Administrator's Guide. A decision on whether your server should support mixed-case file names should be considered carefully. Mixed-case support allows clients to have access to file names on HP-UX systems that contain uppercase characters but this feature has a negative impact on server performance. It is inadvisable to switch frequently between mixed-case support on the same server. While mixed-case support is enabled, clients can create files with mixed-case names. These files will become unavailable to them as soon as mixed-case support is disabled. If mixed-case support is changed from "on" to "off," every existing file name should be made lowercase. Do not create file names that are case-insensitively identical in the same directory. Although the HP-UX system is case-sensitive, mixed-case support on Advanced Server/9000 causes the server to preserve case but behave in a case- insensitive way, just like Windows NT. Microsoft product users are not aware of the possibility of having case-insensitive similar file names in a directory because Windows NT does not allow such files. As a result, users may become confused if they access incorrect files or are denied access to files they need. Do not use characters that are invalid in MS-DOS in the names of batch files or DOS executables. If one of those files is executed from a Windows NT or Windows 95 client, Command Shell will be invoked and it will interpret those file names incorrectly. This may result in actual file names not being found. Setting "longfilenames=1" in WINFILE.INI on Windows 3.1 client computers should be done with great caution. Clients with this setting enabled are not able to view files on Windows NT (Versions 3.51 and 4.0) computers. Although these clients can access Advanced Server/9000 files, support for this feature on the client side is unreliable. Long file names will be correctly replicated between Windows NT servers and AS/U version B.*.* servers or among AS/U version B.*.* servers. Mixed case file names will also be replicated correctly between Windows NT and AS/U version B.*.* servers or among AS/U version B.*.* servers when the MixedCaseSupport option is enabled on the AS/U servers. Versions of AS/U prior to AS/U version B.*.* will correctly replicate long and mixed case file names to Windows NT servers. Long file names will be replicated from Windows NT to AS/U or from AS/U to AS/U using their 8.3 file names. The contents of the replicated files are correct, but the file name is converted. It is recommended that you limit replication to files with 8.3 names if the AS/U import server is prior to version B.*.*. If NameSpaceMapping is not enabled, long file names will be ignored during replication. If MixedCaseSupport is not enabled, files with upper case characters in their names will be ignored during replication. If file names are converted during replication, the file name is converted on the export server according to the conversion algorithm. The file is then replicated using the converted name. The converted name on the import server is the file's actual name (both from HP-UX and as seen by the client) and is not dynamically created. Sharing a directory makes the directory and the files located in it available to other network users. Advanced Server integrates two levels of permissions for shared files and directories: share permissions and directory access permissions. Share permissions specify the maximum access possible for a user or group on all files and directories residing on that share. For example, setting share permissions to Read for Everyone would prevent any user from altering the contents. Share permissions are set using Server Manager. Directory access permissions specify the access that a group or user is granted to a particular directory or file. Directory access permissions are set through the Security menu of the File Manager or the Properties menu of the Explorer. Generally it is more useful to control access by setting permissions on files and directories rather than on shares because this method provides more flexibility. In addition to the two levels of permissions supported by Advanced Server/9000, the HP-UX file system imposes a set of permissions that must be considered when managing shared directories. Shared directories must have the appropriate HP-UX system permissions applied to them in order to grant access to Advanced Server/9000 users. Advanced Server/9000 automatically creates special shares for administrative and system use. (The shared directory created for the root system is called C$.) Only members of the Administrators group can change properties for them. Removing these shares is inadvisable. To share a directory in Advanced Server, you must be logged on as a member of the Administrators or Server Operators group. If the directory to be shared does not exist, it will be created automatically when you attempt to share it — if you have Advanced Server permissions. If you do not have permissions to create this directory, you must following the procedure in the next section, "Sharing a Directory in the HP-UX System." If a directory to be shared does not exist and is not created automatically when you attempt to share it, you must create it in the HP-UX system as root and set appropriate HP-UX system ownership and permissions before it can be shared in Advanced Server. For directories that will be owned by an Advanced Server user who has been mapped explicitly to an HP-UX system account, the following procedure is recommended. The example shares the home directory of an Advanced Server user (JohnPublic) who is mapped to an HP-UX system account (jqp) and is a member of the HP-UX system group sales. To create a directory in the HP-UX system, use the mkdir command. Then use the chown, chgrp, and chmod commands to set the ownership and permissions, as described in the following procedure and example.
The results of sharing the home directory of an Advanced Server/9000 user who is mapped to an HP-UX system account are as follows:
Different HP-UX system permissions can be set as appropriate. Access through Advanced Server can be restricted further by setting Advanced Server permissions using File Manager or Explorer. To share directories not owned by a single Advanced Server/9000 user or if an Advanced Server/9000 user is not mapped explicitly to an HP-UX system user account, use the following procedure: (The example prepares the /var/opt/asu/lanman/shares/sales HP-UX system directory to be shared with Advanced Server/9000 users.)
The results of preparing an HP-UX system directory to be shared by Advanced Server/9000 are as follows:
The directory now is ready to be shared as an Advanced Server directory using Server Manager or the net share command. You can use Server Manager to view a computer's shares, add new shares, and stop sharing directories. Server Manager also allows you to monitor and control the use of shared files. For information about sharing directories using Server Manager, see "Sharing a Directory," "Viewing Shared Resources," and "Stopping Directory Sharing" in Server Manager Help. For information about sharing directories using the net share command, type net help share at the Advanced Server command prompt. Advanced Server automatically creates special shares for administrative and system use. Depending on the configuration of the computer being administered, some or all of the following special shares may appear in this list. You should not remove or modify these special shares.
For information about viewing shared resources, see "Viewing Shared Resources" in Server Manager Help. To change properties on a share, you must be logged on as a member of the Administrators or Server Operators group. Members of the Administrators group can change share properties on administrative shares as well (for example, C$). In Server Manager you can select a shared directory and make changes to its properties. Use the Share Properties dialog box to change the directory path, add a comment, or change the number of users allowed to connect to the share at one time. Click on Permissions to see the users and groups who have permission to use the share and to change permissions.
For information about how to manage share permissions, see "To set, view, change, or remove permissions through a shared directory" in Windows NT Help. When you stop sharing a directory, it no longer is available over the network. To stop sharing a directory, you must be logged on as a member of the Administrators or Server Operators group. The Shared Directory dialog box displays shared directories you created, as well as shared directories created by the system. Generally, you should not stop sharing directories created by the system. Use Server Manager to stop sharing a directory.
Advanced Server printers can be shared by users who are:
After a printer has been added, it can be shared using the Sharing tab in the Printer Properties dialog box. Click on Printers in the Settings group on the Start menu to add printers, share printers, install printer drivers, configure printer ports, set printer properties, and set permissions. For information about setting up and sharing printers, and about printer permissions, see Chapter 6, "Setting Up Print Servers." For information about managing printer sharing, see "To set up a new printer," "To share your printer with other people," "To use a shared network printer," and "To stop sharing your printer" in Windows NT Help. Computers running different operating systems that interact with other networks or with workgroups can share files and printers with Advanced Server network computers.
For information about integrating other computers with Advanced Server, see Chapter 2, "Managing Advanced Server Domains." |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 Printable version |
|
|
|
|
|
|||||||||||||||
|
|||||||||||||||
