Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am implementing a new file storage solution for a small firm, and I would like to use Server 2008 R2 to provide Active Directory authentication, but host files on a Unix/ZFS fileserver to take advantage of deduplication, snapshotting, and pool management that ZFS offers. Is there a simple way to control access to the ZFS shares based on Active Directory credentials?

I was thinking of just creating iSCSI targets on the file server and letting Windows Server handle the storage, but I'm pretty sure if I do that I lose just about every benefit I would gain from using ZFS (deduplication and snapshots).

share|improve this question

4 Answers 4

up vote 6 down vote accepted

If you are planning on using OpenSolaris then using the built in CIFS server is simple. You can use the 'smbadm' command to join the OpenSolaris server to your domain. Once you have done that ZFS's ACLs will actually store the SID of each AD user in the file ACL entries, so you can just create file ACLs from a administrator account as you normally would (make sure you use a ZFS ACL aware archiving program for backups or you will have to redo permissions if you restore files from a backup).

You can also enable name resolution with AD as described in this documentation. Once you setup AD user account resolution you can then user "user@domain" notation in chmod ACL commands to grant permissions to windows users from the unix shell.

When using the built-in CIFS server snapshots on the ZFS filesystem appear to be "Previous Versions" to the Windows clients which can allow users to restore accidentally deleted files themselves if you create snapshots via cron.

share|improve this answer
    
I did not know all this was possible. I have a lot of reading to do. Thanks. –  themicahmachine Dec 17 '10 at 0:27

It also looks like recent builds of ZFS have a CIFS server built in. I have no idea how tightly it integrated with AD, but you can always point a "net use" statement at it from your login scripts, same as any other CIFS NAS, and administer permissions from your existing tools.

And I don't know why an iSCSI target wouldn't be able to take advantage of dedupe and snapshots, is that mentioned in the ZFS documentation somewhere?

share|improve this answer
    
It certainly isn't. ZFS iSCSI targets are datasets of type zvol. As such, they can have deduplication enabled and can be snapshotted (and cloned). –  jlliagre Dec 16 '10 at 22:26
    
Pardon my naivety, then. From reading the docs, it looks like I can snapshot and clone, but I wouldn't be able to roll back to a previous snapshot. –  themicahmachine Dec 17 '10 at 0:16
    
No, you can definitely rollback, even with block filesystems shared via iSCSI. The only limitation is that ZFS can only rollback to the most recent snapshot, so if you have intermediate snapshots you have to destroy them first. In most cases you'll just want to clone and share that instead though. –  notpeter Dec 21 '10 at 4:19

Try NexentaStor as it's under more active development and is certainly more polished than a raw OpenSolaris solution at this point. So far, my experience with the AD integration has been okay, but I may end up going with VMs hosted on ZFS or raw iSCSI luns shared from ZFS.

share|improve this answer

Samba can be a member server in Active Directory with full AD semantics.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.