OpenIndiana vs Centos and interoperability...

[drsgrid]

Ok, so I have OI 151 with napp-it and zfs - and its great but since we mostly run linux we seem to be having problems with user and group permissions mapping over to our OI storage box.

To complicate things our storage box needs to honor the permissions on the linux servers. Each 'project' has different groupID and different users associated with it - i have not been able to get this working seamlessly with centos.

So Im wondering which would be a better approach with the least problems/least performance hit.

1) use OI on the second machine and install a centos VM which the rest of the network would interact with (this way we can still us ethe nice napp-it sw to manage the pools)

2) add in kernel support for zfs in centos and figure out a way to install napp-it on linux to manage the pools (is it even possible to run napp-it on linux [cant find source code, no yum entry either])?

Can anyone offer any advice? If i can figure out how to get the OpenIndiana permissions working better with centos - id just assume stick to OI. Just that sometimes files and users originating from windows boxes(samba) or even on centos, get permission denied like OI is not properly honoring the YP on the storage box and if i could put a centos VM on OI and have the other centos boxes interact with the VM - and read the zfs pools via VM proxy that might work just worry about lag and other performance issues.

Thoughts anyone?

 

[brutalizer]

This is weird. OI has CIFS in kernel, and speaks true Windows. Samba is not fully Windows compatible - as I understand it. There are some corner cases where samba does not cut it. True CIFS is better than Samba.

So IO should be able to do everything that Linux does, and then more. It should only be a matter of configuration.

 

[cantalup]

This is weird. OI has CIFS in kernel, and speaks true Windows. Samba is not fully Windows compatible - as I understand it. There are some corner cases where samba does not cut it. True CIFS is better than Samba.

So IO should be able to do everything that Linux does, and then more. It should only be a matter of configuration.

just let you know, linux CIFS was part of SMB before they dscided to treat as two. some people refers SMB/CIFS on linux

as I know, SMB/CIFS is pretty stable on linux. CIFS support is already in the current linux kernel of any linux distro

https://wiki.samba.org/index.php/LinuxCIFS_utils

 

[_Gea]

Ok, so I have OI 151 with napp-it and zfs - and its great but since we mostly run linux we seem to be having problems with user and group permissions mapping over to our OI storage box.

To complicate things our storage box needs to honor the permissions on the linux servers. Each 'project' has different groupID and different users associated with it - i have not been able to get this working seamlessly with centos.

So Im wondering which would be a better approach with the least problems/least performance hit.

1) use OI on the second machine and install a centos VM which the rest of the network would interact with (this way we can still us ethe nice napp-it sw to manage the pools)

2) add in kernel support for zfs in centos and figure out a way to install napp-it on linux to manage the pools (is it even possible to run napp-it on linux [cant find source code, no yum entry either])?

Can anyone offer any advice? If i can figure out how to get the OpenIndiana permissions working better with centos - id just assume stick to OI. Just that sometimes files and users originating from windows boxes(samba) or even on centos, get permission denied like OI is not properly honoring the YP on the storage box and if i could put a centos VM on OI and have the other centos boxes interact with the VM - and read the zfs pools via VM proxy that might work just worry about lag and other performance issues.

Thoughts anyone?

I do not really understand the problem.

If you connect the OpenIndiana box via SMB, you only can do via username and password
and the according Windows SUID, the Unix ID's are irrelevant from outside view.

These users must be created on OpenIndiana or you need a Windows Domain for centralized users.
There is no mapping between "external users" and OI users outside a domain.

SMB access on OI to files is restricted via ACL only. (SMB on OI is like Windows, ACL only)
You can set ACL according to your users UID's

If you use groups, you must create SMB groups on OI (different from unix groups) and must create a
maping betwwed a SMB group (and its SID) to a Unix group (GID).

If you want to connect a share, the files within must be accessible for the user that connects.
At least from Windows, its enough to create the same OI user/pw like the Windows user to
connect without entering a PW. Per default, only user root has permission.

I doubt that SAMBA (also available on OI) works basically different.
Or did you try with NFS?

 

[brutalizer]

just let you know, linux CIFS was part of SMB before they dscided to treat as two. some people refers SMB/CIFS on linux

as I know, SMB/CIFS is pretty stable on linux. CIFS support is already in the current linux kernel of any linux distro

https://wiki.samba.org/index.php/LinuxCIFS_utils

Ok, good to know.

I guess this does not apply any longer, then? Or? This is from 2007:
https://blogs.oracle.com/amw/entry/cifs_in_solaris

"There is a common misconception that Windows interoperability is just a case of implementing file transfer using the CIFS protocol. Unfortunately, that doesn't get you very far. Windows interoperability also requires that a server support various Windows services, typically MSRPC services, and it is very sensitive to the way that those services behave: Windows inter- operability requires that a CIFS server convince a Windows client or server that it "is Windows". This is really only possible if the operating system supports those services at a fundamental level.

...

We added support for SIDs to Solaris credentials. This solved the centralized access control problem: CIFS can specify users in terms of SIDs and ZFS can perform native file system access control using that information.

There are various VFS updates and enhancements to support new attributes, share reservations and mandatory locking. As with the credential change, this was also a significant effort, which affected the interface to every file system in Solaris.

ZFS enhancements include:
Support for DOS attributes (archive, hidden, read-only and system)
Case-insensitive file name operations.
There are three modes: case-sensitive, case-insensitive and mixed.
Support for ubiquitous cross-protocol file sharing through an option to ensure UTF8-only name encoding.
Atomic ACL-on-create semantics.
Enhanced ACL support for compatibility with Windows.
sharesmb, which is similar to sharenfs.