Configuring universal share user authentication
The universal share created with CIFS/SMB protocol supports two methods of user authentication:
Active Directory-based user authentication
Local user-based authentication
If the appliance, Flex Appliance application instance, or MSDP BYO server is part of the Active Directory domain, you can use this approach.
When you create a universal share from the NetBackup web UI, you can specify Active Directory users or groups. This approach restricts access to only specified users or groups. You can also control permissions from the Windows client where the universal share is mounted. See the NetBackup Web UI Administrator's Guide for more information.
For information about setting up Active Directory users or groups with an appliance, see the NetBackup Appliance Security Guide.
For information about setting up Active Directory users or groups with a Flex Appliance application instance, see the NetBackup 10.1 Application Guide for Flex Appliance OS.
Universal shares can be created with NFS or SMB protocol. When the SMB protocol is used, SMB must be set up with ADS or in local user mode. The following table describes how to configure the media server with Active Directory for various platforms and create a universal share using SMB.
Table: Describes the requirements for different platforms to join the Active Directory domain
Platform | Requirements |
|---|---|
BYO appliance | For BYO, Example usage of register_samba_to_ad.sh: /usr/openv/pdde/vpfs/bin/register_samba_to_ad.sh --domain=<domain> --username=<username> The following are other options you can use with register_samba_to_ad.sh: --domain=<domain> : domain name --domaincontroller=<domain controller> : domain controller --username=<username> : windows domain username which has the privilege to join the client to domain --help|-h : Print the usage |
NetBackup appliance (NBA) | Review the section Adding an Active Directory server configuration in the NetBackup Appliance Administrator's Guide. |
Flex media server | The same as BYO. |
Flex media server HA | The same as BYO. |
WORM enabled storage server | The storage server can be configured to join or leave Active Directory with Restricted Shell commands. [msdp-16.0] deecl01vm046p3 > setting ActiveDirectory configure ad_server=<ad_server> domain=<domain_server> domain_admin=<domain_adin> |
Flex Scale | Review the section Configuring AD server for Universal shares and Instant Access in the NetBackup Flex Scale Administrator's Guide. |
AKS/EKS AD | NetBackup support only SMB local user mode. The SMB server is configured with local user mode by default. |
Once the storage server has been added to an Active Directory domain, a universal share can be created as normal. Any users and user groups that are specified are checked using the wbinfo command to ensure that they are valid. The following procedure describes how to add a universal share to an Active Directory.
Adding a universal share to an Active Directory
- Create a universal share with SMB protocol on NetBackup web UI.
- Mount the shared storage on a Windows client.
Provide all necessary credentials.
- Verify that the universal share is fully set up, and can be backed up and restored using a Universal-Share policy.
The following items must be set up for to add Microsoft SQL Instant Access to an Active Directory:
Storage server and client must be in the same domain.
Use domain user to log in to the Microsoft SQL client.
Register Microsoft SQL instance with the domain user on the NetBackup Administration Console.
Must use domain user credentials to do instant access.
You must configure SMB users on the corresponding storage server and enter the credentials on the client.
If the SMB service is part of a Windows domain, the Windows domain users can use the SMB share. In this scenario, credentials are not required to access the share.
For Azure Kubernetes Service (AKS) and Amazon Elastic Kubernetes Service (EKS) cloud platforms, only a SMB local user can access the SMB share. You must add SMB users to access the SMB share.
If the SMB service is not part of Windows domain, perform the following steps:
For a NetBackup Appliance:
For a NetBackup Appliance, local users are also SMB users. To manage local users, log in to the CLISH and select . The SMB password is the same as the local user's login password.
For an MDSP BYO server:
For an MDSP BYO server, create a Linux user (if one does not exist). Then, add the user to SMB.
For example, the following commands create a test_smb_user use for the SMB service only:
# adduser --no-create-home -s /sbin/nologin test_smb_user
# smbpasswd -a test_smb_user
To add an existing user to the SMB service, run the following command:
# smbpasswd -a username
For a Flex Appliance primary or media server application instance:
For a Flex Appliance primary or media server application instance, log in to the instance and add any local user to the SMB service as follows:
If desired, create a new local user with the following commands:
#useradd <username> #passwd <username>
You can also use an existing local user.
Run the following commands to create user credentials for the SMB service and enable the user:
smbpasswd -a <username> smbpasswd -e <username>
For a WORM storage server application instance:
For a WORM storage server instance, log in to the instance and add a local SMB user with the following command: setting smb add-user username=<username> password=<password>
You can view the new user with the setting smb list-users command. To remove a user, run the setting smb remove-user username=<username> command.
For the AKS and the EKS cloud platform:
Log in to the MSDP engine pod in a cluster using kubectl.
Run the following command to log in to RShell in the MSDP engine.
su - msdpadm
Run the following RShell command to add a SMB user.
setting samba add-user username=[samba user name] password=[samba password]
For example,
msdp-16.1] > setting samba add-user username=test_samba_user password=Te@Pss1fg0
You can use the same command to update the password for an existing user.
In AKS and EKS cloud platforms, the SMB RShell command configures SMB servers in all MSDP engines in a cluster.