跳转到主内容

集群模式虚拟服务器管理:如何设置管理角色

Views:
11
Visibility:
Public
Votes:
0
Category:
data-ontap-8
Specialty:
cifs
Last Updated:

适用于

集群模式 Data ONTAP 8.1 

说明

在 Data ONTAP 8.1 集群模式中,添加了让用户仅管理特定虚拟服务器的功能。

例如,如果存储系统管理员希望允许用户登录、并且只能查看或管理特定虚拟服务器的对象、则他们可以通过虚拟服务器管理 LIF 和 RBAC 的概念来实现此目的。

Terminology

访问级别
访问级别指定用户可以拥有的访问级别。访问级别包括 ReadOnly 、 All 和 None 。

命令目录
命令目录将是集群管理员允许用户访问的命令子集。可以在非常精细的级别指定这些命令,但必须包含完整的命令目录结构。

虚拟服务器管理可能不支持某些指定的命令。如果出现这种情况,将看到以下输出:

::> security login role create -role test -cmddirname "job" -access readonly -vserver vsRBAC

Warning: "test" role has no access to the following commands (they are unsupported for Vserver administrators):
job schedule show-jobs

::> security login role create -role test -cmddirname "statistics show" -access readonly -vserver vsRBAC

Error: command failed: invalid operation

vsadmin
默认情况下, vsadmin 用户被锁定,需要解锁才能使用。

默认情况下, vsadmin 允许以下角色:

::> security login role show -vserver vsRBAC -role vsadmin
             Role          Command/                           Access
Vserver      Name          Directory                              Query Level
-------   -------------  --------------------------------             -------------------
vsRBAC     vsadmin        DEFAULT                          none
vsRBAC    vsadmin        dashboard health vserver                  readonly
vsRBAC     vsadmin        job                            all
vsRBAC    vsadmin        job schedule                       none
vsRBAC    vsadmin             lun                            all
vsRBAC    vsadmin        network connections              readonly
vsRBAC    vsadmin        network connections active show-clients    none
vsRBAC    vsadmin        network connections active show-protocols  none
vsRBAC    vsadmin        network connections active show-services   none
vsRBAC    vsadmin        network interface               readonly
vsRBAC    vsadmin        network interface failover-groups       none
vsRBAC    vsadmin        network routing-groups            readonly
vsRBAC    vsadmin             security login password            all
vsRBAC    vsadmin        security login publickey           all
vsRBAC    vsadmin        security login role show-ontapi        all
vsRBAC    vsadmin        set                      all
vsRBAC    vsadmin        version                    all
vsRBAC    vsadmin             volume                                     all
vsRBAC    vsadmin        volume copy                                none
vsRBAC    vsadmin             volume efficiency                          none
vsRBAC    vsadmin        volume move                  none
vsRBAC     vsadmin        vserver                    readonly
vsRBAC    vsadmin        vserver cifs                 all
vsRBAC    vsadmin        vserver export-policy             all
vsRBAC     vsadmin        vserver fcp                  all
vsRBAC    vsadmin        vserver iscsi                              all
vsRBAC    vsadmin        vserver locks                 all
vsRBAC    vsadmin        vserver name-mapping             all
vsRBAC    vsadmin        vserver nfs                  all
vsRBAC    vsadmin        vserver services                           all
vsRBAC    vsadmin        vserver services kerberos-realm        none
vsRBAC     vsadmin        vserver services ldap client         readonly
vsRBAC    vsadmin        vserver services web                       none
33 entries were displayed.

 

CUSTOMER EXCLUSIVE CONTENT

Registered NetApp customers get unlimited access to our dynamic Knowledge Base.

New authoritative content is published and updated each day by our team of experts.

Current Customer or Partner?

Sign In for unlimited access

New to NetApp?

Learn more about our award-winning Support