SMB reference

Applies to VAST Cluster 5.5.

VAST Cluster 5.5 serves SMB 2.1 and SMB 3.0 for Windows and other SMB clients. These docs cover SMB only where it meets S3 and NFS on the same data. Shares, authentication, encryption and share-level ACLs are set up by your platform team; the VAST knowledge base documents them.

SMB with S3 and NFS on the same data

• An SMB view needs Active Directory. SMB shares work only when the cluster is joined to Active Directory, including multiprotocol views. On a tenant without an Active Directory provider, creating a view with SMB fails with Failed to enable SMB on view, Active Directory provider is not set for the tenant.
• Identities line up through the directory. A user's SID (SMB), UID (NFS) and S3 access key all belong to the same VAST user, and permissions are checked against all of them. Without a shared directory, the SMB user and the NFS or S3 user are different users.
• The security flavor decides whose permissions apply (multiprotocol access):
  • With the SMB flavor, SMB ACLs decide for every protocol, only SMB clients can change permissions, and files created over NFS or S3 inherit ACLs from their parent directory. S3 requests are checked against the object's own ACL only, and identity and bucket policies are ignored.
  • With the NFS flavor, SMB clients get permissions derived from the mode bits and can't change them.
  • With S3 Native, SMB requests that map to S3 actions are allowed or denied by identity and bucket policies (opening a file for read needs s3:GetObject, for write s3:PutObject, deleting s3:DeleteObject, listing a directory s3:ListBucket). Changing an ACL or owner over SMB is denied, and SMB privileged users and groups aren't honoured.
  • With Mixed Last Wins, SMB clients can set ACLs, and so can NFSv4 clients, unless the platform team restricts one of them.
• Simultaneous access isn't the default design. Non-simultaneous access to files from SMB and from NFS or S3 is fully supported by default; design so that one protocol writes a file at a time.
• Alternate data streams stay SMB-only. Other protocols don't see them, and they're dropped when data is replicated to S3.
• Hardlinks over SMB can't point to another SMB-enabled view or to a directory.

Where SMB is documented

Admin task: send to your platform team for shares, authentication and security:

• SMB File Sharing Protocol: all SMB pages.
• SMB Overview, Authentication for SMB Access, SMB Encryption, Share-Level ACLs, Continuously Available SMB Shares and SMB Multi-Channel.
• Controlling File and Directory Permissions Across Protocols: the full SMB-to-S3 permission mapping.