Skip to main content
NetApp Knowledge Base

How to restrict the export policy commands to a specific group of users?

  1. Last updated
    Aug 22, 2024
  2. Save as PDF
Views:
139
Visibility:
Public
Votes:
0
Category:
ontap-9
Specialty:
core
Last Updated:
8/22/2024, 1:52:10 PM

 

Applies to

  • ONTAP 9
  • Role-Based Access Control (RBAC) 

Answer

  • Start first by creating a security role for a user category with the command directory  'DEFAULT' access set to 'all'

Example:

::> security login role create -role restrict -cmddirname DEFAULT -access all

  • Then for the same role, add the command directory 'vserver export-policy' access set to 'none'

::> security login role create -role restrict -cmddirname "vserver export-policy" -access none -query ""

  • Validate the configuration:

::> security login role show -role restrict

           Role          Command/                                      Access
Vserver    Name          Directory                               Query Level
---------- ------------- --------- ----------------------------------- --------
aff320-2n-rtp-2 restrict DEFAULT                                       all
                         vserver export-policy                         none

  • Create a test user or a group and associate the role that you created with this user.

::> security login create -user-or-group-name test -application ssh -authentication-method password -role restrict

Please enter a password for user 'test':
Please enter it again:

  • Validate by logging into a new session with user:test, and run ‘vserver export-policy’ command, which should fail with an error:

::> whoami
  (security login whoami)

User: test
Role: restrict

::> vserver export

Error: "export" is not a recognized command
::> vserver export-policy show

Error: "export-policy" is not a recognized command

Additional Information

 
 

 

NetApp provides no representations or warranties regarding the accuracy or reliability or serviceability of any information or recommendations provided in this publication or with respect to any results that may be obtained by the use of the information or observance of any recommendations provided herein. The information in this document is distributed AS IS and the use of this information or the implementation of any recommendations or techniques herein is a customer's responsibility and depends on the customer's ability to evaluate and integrate them into the customer's operational environment. This document and the information contained herein may be used solely in connection with the NetApp products discussed in this document.