Sun Storage 7000 Unified Storage System: How to configure Access Based Enumeration (ABE)

Asset ID:	1-71-1574016.1
Update Date:	2013-08-28
Keywords:

Solution Type Technical Instruction Sure

Solution 1574016.1 : Sun Storage 7000 Unified Storage System: How to configure Access Based Enumeration (ABE)

Applies to:

Sun ZFS Storage 7320 - Version All Versions to All Versions [Release All Releases]
Sun ZFS Storage 7120 - Version All Versions to All Versions [Release All Releases]
Sun ZFS Storage 7420 - Version All Versions to All Versions [Release All Releases]
Sun Storage 7110 Unified Storage System - Version All Versions to All Versions [Release All Releases]
Sun Storage 7210 Unified Storage System - Version All Versions to All Versions [Release All Releases]
7000 Appliance OS (Fishworks)

Goal

How to hide files and folders that users do not have permission to access and display only the files and folders that a user has permissions to access

To discuss this information further with Oracle experts and industry peers, we encourage you to review, join or start a discussion in the My Oracle Support Community - Disk Storage ZFS Storage Appliance Community

Solution

Access Based Enumeration (ABE) is a new feature included with Windows Server 2003 Service Pack 1.

This feature allows users of Windows Server 2003–based file servers to list only the files and folders to which they have access when browsing content on the file server.

This eliminates user confusion that can be caused when users connect to a file server and encounter a large number of files and folders that they cannot access.

Access Based Enumeration filters the list of available files and folders on a server to include only those that the requesting user has access to.

If customer needs to grant access only to some of the shares from the project, and deny the privileges to the others, use ABE:

ABE allows Windows users to see only the files and folders to which they have access when browsing content on the file server. So they will not see all the shares, and they will not see the shares that they cannot access.

This option is not enabled by default in SMB and must be manually selected.

You can enable this from BUI as follows:

For the entire project: Go to Shares menu -> select project -> go to Protocols tab -> go to SMB section -> uncheck the "Inherit from project" option -> check the option "Enable Access-based Enumeration" -> APPLY

For a particular share within the project: Go to Shares menu -> select project -> select share -> go to Protocols tab -> go to SMB section -> uncheck the "Inherit from project" option -> check the option "Enable Access-based Enumeration" -> APPLY

If you want to restrict the entire project for Windows Users you can do it from the same screen, Protocols tab, section SMB, Share Level ACL -> select Named Group -> in the target box write the name of the AD group composed by the Windows users -> Deny Access.

References

<NOTE:1439883.1> - Sun Storage 7000 Unified Storage System: How to Troubleshoot Windows/SMB file and directory permissions issues
<NOTE:1439378.1> - Sun Storage 7000 Unified Storage System: How to Troubleshoot UNIX/NFS file and directory permission issues

Attachments

This solution has no attachment