NAS Servers
NAS Servers
A NAS server is the identity and authentication endpoint that SMB and NFS shares authenticate against —— it's the "server" your Windows and Linux/macOS clients see when they connect, complete with its own name, floating IP(s), and authentication configuration for both protocols. You need a NAS server configured before you can create any SMB/NFS shares.
A NAS server configures SMB and NFS authentication independently:
- SMB authenticates either as a standalone Workgroup member, or by joining an Active Directory domain.
- NFS authenticates with no authentication, by reusing the same Active Directory configured for SMB, or with its own Kerberos/LDAP configuration independent of SMB (Non-Active Directory).
If NFS authentication is enabled at all, you also choose a default Kerberos mode for the shares it serves (optional, required, or required-with-encryption) —— individual shares can override this default (see Shares).
A NAS server can optionally also use NIS (Network Information Service) to resolve host netgroups.
Creating a NAS server
Using the web interface
- Open Application Volumes > NAS Servers and choose Create.
- Under Name, enter the NAS server's NetBIOS name.
- Under Floating IPs, choose the floating IP(s) it will use.
- Under SMB Authentication Type, choose Workgroup or Active Directory, then fill in the matching fields under SMB Authentication Settings.
- Under NFS Authentication Type, choose No Auth, Same as SMB's Active Directory, or Non-Active Directory; for Non-Active Directory, fill in the Kerberos/LDAP fields under NFS LDAP/Kerberos Settings.
- If NFS authentication is enabled, choose the default Kerberos mode under NFS Default Share Authentication.
- Optionally configure NIS for host netgroups.
- Confirm to create the NAS server.
Using the CLI
nas_servers create
--name=<netbios> --floatingIps=<name...>
(--workgroup|--activeDirectory)
--workgroupName=<name> (--activeDirectoryRealm=<name> --activeDirectoryUsername=<name> --activeDirectoryPassword=<password_general>)
(--nfsNoAuth|--nfsSameActiveDirectoryAsSmb|--nfsNonActiveDirectory)
(--nfsNonAdDomainName=<name> --nfsKerberosRealmName=<name> --nfsKerberosKdc=<name> --nfsKerberosAdminServer=<name> --nfsKerberosUsername=<name> --nfsKerberosPassword=<password_general> --nfsLdapQueriesUri=<text> --nfsLdapBaseSearchPath=<text> --nfsLdapUsername=<text> --nfsLdapPassword=<password_general>)
(--nfsKerberosAuthenticationOptional | --nfsKerberosAuthenticationRequired | --nfsKerberosAuthenticationAndEncryptionRequired)
[(--nisDomain=<name> --nisServer=<name>)]
[--force]
| Option | Description |
|---|---|
--name=<netbios> |
The NetBIOS name of the new NAS server. |
--floatingIps=<name...> |
Floating IPs to use for this NAS server. |
--workgroup |
Use SMB in Workgroup mode. |
--activeDirectory |
Use SMB in Active Directory mode. |
--workgroupName=<name> |
The name of the workgroup the NAS server will reside on. |
--activeDirectoryRealm=<name> |
The Active Directory realm the NAS server will authenticate with. |
--activeDirectoryUsername=<name> |
Username of the user that will authenticate with Active Directory. |
--activeDirectoryPassword=<password_general> |
Password for that user. |
--nfsNoAuth |
Use NFS without authentication. |
--nfsSameActiveDirectoryAsSmb |
Use NFS in Active Directory mode, with the same AD configured for SMB. |
--nfsNonActiveDirectory |
Use NFS with Non-Active Directory (Kerberos/LDAP) authentication. |
--nfsNonAdDomainName=<name> |
Domain name for Non-Active Directory authentication. |
--nfsKerberosRealmName=<name> |
Kerberos realm name for Non-Active Directory authentication. |
--nfsKerberosKdc=<name> |
Kerberos key distribution center for Non-Active Directory authentication. |
--nfsKerberosAdminServer=<name> |
Kerberos administration server for Non-Active Directory authentication. |
--nfsKerberosUsername=<name> |
Kerberos username for Non-Active Directory authentication. |
--nfsKerberosPassword=<password_general> |
Kerberos password for Non-Active Directory authentication. |
--nfsLdapQueriesUri=<text> |
LDAP queries URI for Non-Active Directory authentication. |
--nfsLdapBaseSearchPath=<text> |
LDAP base search path for Non-Active Directory authentication. |
--nfsLdapUsername=<text> |
LDAP username for Non-Active Directory authentication. |
--nfsLdapPassword=<password_general> |
LDAP password for Non-Active Directory authentication. |
--nfsKerberosAuthenticationOptional |
Default share Kerberos mode: optional, based on client mount settings. |
--nfsKerberosAuthenticationRequired |
Default share Kerberos mode: required. |
--nfsKerberosAuthenticationAndEncryptionRequired |
Default share Kerberos mode: required with encryption. |
--nisDomain=<name> |
The NIS domain to connect to. |
--nisServer=<name> |
NIS server IP address or hostname. |
--force |
Skip the confirmation prompt (including overwriting an existing Active Directory computer object with the same name). |
Examples
Create a Workgroup NAS server with no NFS authentication:
nas_servers create --name FILESRV1 --floatingIps fip-10 --workgroup --workgroupName WORKGROUP --nfsNoAuth
Create a NAS server joined to Active Directory for both SMB and NFS, requiring Kerberos on shares by default:
nas_servers create --name FILESRV2 --floatingIps fip-11 --activeDirectory --activeDirectoryRealm corp.example.com --activeDirectoryUsername admin --activeDirectoryPassword "s3cr3t!" --nfsSameActiveDirectoryAsSmb --nfsKerberosAuthenticationRequired
Create an Active-Directory SMB server with independent Non-Active-Directory NFS Kerberos/LDAP authentication:
nas_servers create --name FILESRV3 --floatingIps fip-12 --activeDirectory --activeDirectoryRealm corp.example.com --activeDirectoryUsername admin --activeDirectoryPassword "s3cr3t!" --nfsNonActiveDirectory --nfsNonAdDomainName nfs.example.com --nfsKerberosRealmName NFS.EXAMPLE.COM --nfsKerberosKdc kdc.example.com --nfsKerberosAdminServer kdc.example.com --nfsKerberosUsername nfsadmin --nfsKerberosPassword "s3cr3t!" --nfsLdapQueriesUri ldap://ldap.example.com --nfsLdapBaseSearchPath "dc=example,dc=com" --nfsLdapUsername lookup --nfsLdapPassword "s3cr3t!" --nfsKerberosAuthenticationOptional
Editing a NAS server
Anything set at creation time can be changed afterward, including renaming the NAS server and switching authentication modes. You can also disable NIS entirely.
Using the web interface
- Open Application Volumes > NAS Servers, select the NAS server, and choose Edit.
- Update the fields you need under NAS Server Selection, Floating Ips, the SMB/NFS authentication sections, or NIS.
- Confirm the change.
Using the CLI
nas_servers edit
--name=<netbios> [--newName=<netbios> --floatingIps=<name...>]
(--workgroup|--activeDirectory)
[--workgroupName=<name> --activeDirectoryRealm=<name> --activeDirectoryUsername=<name> --activeDirectoryPassword=<password_general>]
[(--nfsNoAuth|--nfsSameActiveDirectoryAsSmb|--nfsNonActiveDirectory)]
[--nfsNonAdDomainName=<name> --nfsKerberosRealmName=<name> --nfsKerberosKdc=<name> --nfsKerberosAdminServer=<name> --nfsKerberosUsername=<name> --nfsKerberosPassword=<password_general> --nfsLdapQueriesUri=<text> --nfsLdapBaseSearchPath=<text> --nfsLdapUsername=<text> --nfsLdapPassword=<password_general>]
[(--nfsKerberosAuthenticationOptional | --nfsKerberosAuthenticationRequired | --nfsKerberosAuthenticationAndEncryptionRequired)]
[--disableNis|(--nisDomain=<name> --nisServer=<name>)]
[--force]
| Option | Description |
|---|---|
--name=<netbios> |
The name of the NAS server to edit. |
--newName=<netbios> |
The new NetBIOS name for the NAS server. |
--floatingIps=<name...> |
Floating IPs to use for this NAS server. |
--workgroup |
Use SMB in Workgroup mode. |
--activeDirectory |
Use SMB in Active Directory mode. |
--workgroupName=<name> |
The name of the workgroup the NAS server will reside on. |
--activeDirectoryRealm=<name> |
The Active Directory realm the NAS server will authenticate with. |
--activeDirectoryUsername=<name> |
Username of the user that will authenticate with Active Directory. |
--activeDirectoryPassword=<password_general> |
Password for that user. |
--nfsNoAuth |
Use NFS without authentication. |
--nfsSameActiveDirectoryAsSmb |
Use NFS in Active Directory mode, with the same AD configured for SMB. |
--nfsNonActiveDirectory |
Use NFS with Non-Active Directory (Kerberos/LDAP) authentication. |
--nfsNonAdDomainName=<name> |
Domain name for Non-Active Directory authentication. |
--nfsKerberosRealmName=<name> |
Kerberos realm name for Non-Active Directory authentication. |
--nfsKerberosKdc=<name> |
Kerberos key distribution center for Non-Active Directory authentication. |
--nfsKerberosAdminServer=<name> |
Kerberos administration server for Non-Active Directory authentication. |
--nfsKerberosUsername=<name> |
Kerberos username for Non-Active Directory authentication. |
--nfsKerberosPassword=<password_general> |
Kerberos password for Non-Active Directory authentication. |
--nfsLdapQueriesUri=<text> |
LDAP queries URI for Non-Active Directory authentication. |
--nfsLdapBaseSearchPath=<text> |
LDAP base search path for Non-Active Directory authentication. |
--nfsLdapUsername=<text> |
LDAP username for Non-Active Directory authentication. |
--nfsLdapPassword=<password_general> |
LDAP password for Non-Active Directory authentication. |
--nfsKerberosAuthenticationOptional |
Default share Kerberos mode: optional, based on client mount settings. |
--nfsKerberosAuthenticationRequired |
Default share Kerberos mode: required. |
--nfsKerberosAuthenticationAndEncryptionRequired |
Default share Kerberos mode: required with encryption. |
--disableNis |
Disable usage of Network Information Service. |
--nisDomain=<name> |
The NIS domain to connect to. |
--nisServer=<name> |
NIS server IP address or hostname. |
--force |
Skip the confirmation prompt (including overwriting an existing Active Directory computer object with the same name). |
Renaming a NAS server that's in Active Directory, or changing its Active Directory realm, requires supplying the Active Directory username and password again so StorONE can re-authenticate under the new identity.
Examples
Rename a NAS server:
nas_servers edit --name FILESRV1 --newName FILESRV1-OLD
Add a second floating IP:
nas_servers edit --name FILESRV1 --floatingIps fip-10 fip-13
Switch a NAS server's NFS authentication default from optional to required:
nas_servers edit --name FILESRV2 --nfsKerberosAuthenticationRequired
Deleting a NAS server
A NAS server can't be deleted while any shares still exist in the system —— remove the shares first.
Using the web interface
- Open Application Volumes > NAS Servers, select the NAS server, and choose Delete.
- Confirm the deletion.
Using the CLI
nas_servers delete --name=<netbios> [--force]
| Option | Description |
|---|---|
--name=<netbios> |
The name of the NAS server to delete. |
--force |
Skip the confirmation prompt. |
Example
nas_servers delete --name FILESRV1-OLD
Listing NAS servers
Using the web interface
Open Application Volumes > NAS Servers to see every configured NAS server.
Using the CLI
nas_servers list
This command takes no options.
Example
nas_servers list
Testing the Active Directory join
For a NAS server joined to Active Directory, this checks that the computer object StorONE created is still valid and the join is healthy —— useful after domain-side changes (like a password reset or object deletion) to confirm the NAS server can still authenticate.
This command is CLI-only.
Using the CLI
nas_servers active_directory test_join
This command takes no options.
Example
nas_servers active_directory test_join
Next: Local Admins —— managing Active Directory users with local administrative access to the NAS server.