Fpolicy in NetApp
Cara-cara nak enforce fpolicy kat netapp...lepas buat benda nie...ape2 file yg ade .exe,.int,.ini semua xleh nk write kat storage...so xmerebak la virusus tu kat pc2 share folder.
On progress clean virus.
contoh share folder
file yg dh kena block
nie kali ke 2 buat....1st time buat file..,xpasti kenapa...screen untuk avi,mp3,exe ngan int....tp semua file kena block...
so td jumpa mamat dari india nie page....test2 ok ...alhamdulillah..so far user xbising..maybe leh letak screen untuk audio/movie file sekali...
**http://vipulvajpayeestorage.blogspot.com/2012/04/fpolicy-in-netapp.html
Fpolicy: FPolicy is an infrastructure component of Data ONTAP that enables partner applications connected to your storage systems to monitor and set file access permissions.
FPolicy determines how the storage system handles requests from individual client systems for operations such as create, open, rename, and delete. The storage system maintains a set of properties for FPolicy, including the policy name and whether that policy is active. You can set these properties for FPolicy using the storage system console commands.
What is Serverless FPolicy, why would I want it and how does it work?
filer> fpolicy monitor set mp3blocker -p cifs create,rename
filer> fpolicy options mp3blocker required on
filer> fpolicy volume include set mp3blocker vol0,vol1
filer> fpolicy enable mp3blocker -f
Fpolicy flow chart:
Fpolicy
FPolicy determines how the storage system handles requests from individual client systems for operations such as create, open, rename, and delete. The storage system maintains a set of properties for FPolicy, including the policy name and whether that policy is active. You can set these properties for FPolicy using the storage system console commands.
File Screening on NAS
Run the following commands to enable the file screening on NAS box to prevent the copying of EXE, JPG, MP3, MP4, PST, AVI, and DAT.
1. Create the file screening policy
fpolicy create <Policy Name> <Policy Type>
E.g. fpolicy create techm screen
2. Add the extensions for scan
fpolicy ext[ension] {exc[lude]|inc[lude]} [add|remove|set|reset|show] <PolicyName> [<ext>[,<ext>]]
E.g. Fpolicy ext inc add techm jpg,exe,dat
3. fpolicy options <PolicyName> required [on|off]
E.g. fpolicy options techm required on
4. Enable the policy
fpolicy enable <PolicyName> [-f]
E.g. fpolicy enable techm –f
5. Enable the File screening Monitor when users try to write files to the NAS.
fpolicy mon[itor] [add|remove|set] <PolicyName> [-p {nfs|cifs}] -f op_spec[,op_spec,...,op_spec]
E.g. fpolicy mon add techm –p cifs –f write
After applying all the above commands you can see the below results using the below command.
:Fpolicy show techm
· Normally a file policy has an external server to administer the policy
A typical sequence would be to create a policy, configure it, then set up an fpolicy server to administer the policy. As user requests come to the filer, those that fit the criteria of the policy cause the filer to notify the FPolicy server. For example, a quotas policy would cause the filer to notify the FPolicy server when a user did something that reserved or freed disk space.
But, as its name suggests, Serverless FPolicy involves creating a policy with the expectation of not connecting a server to administer the policy.
· When would someone use Serverless FPolicy?
Serverless FPolicy is used as a "poor man's" file blocking policy. It may not have features or flexibility but it costs nothing and has excellent performance. If you simply want to prevent users from soaking up disk space with their MP3 music files for example, Serverless FPolicy may be perfect for you.
· How does it work?
Conceptually, the policy is created and configured. Then the policy's option required is turned on. Because user access requires an FPolicy server to validate their request, and because there is no server, 100% of the user requests which fall under this policy will be rejected.
· Can you give me an example showing how to set it up?
Let's say you want to prevent users from putting MP3 files onto the filer. Note that this example only works for CIFS users because NFS does not do a formal "file create" operation. First, create the policy.
filer> fpolicy create MP3Blocker screen
Now configure the policy. Set the extension list to "MP3". Set the operations monitored to "create" and "rename". This will block both creation of MP3 files and the more sneaky method of copying the MP3 under a different name and then renaming it once it is in place. Set the "required" option and enable the policy. Optionally, you can restrict the policy to certain volumes.
filer> fpolicy ext inc set mp3blocker mp3filer> fpolicy monitor set mp3blocker -p cifs create,rename
filer> fpolicy options mp3blocker required on
filer> fpolicy volume include set mp3blocker vol0,vol1
filer> fpolicy enable mp3blocker -f
· Any further useful pointers you can give?
o Note that the fpolicy monitor command was provided initially in Ontap 7.1
o In older releases it is not so simple to set the list of operations controlled by a policy. Basically, you'll need to go into "advanced" mode on the filer console and directly insert values into the filer's registry. (http://now.netapp.com/Knowledgebase/solutionarea.asp?id=kb10098)]. But note that "registry set" is not supported for vfilers so you are just plain out of luck using the registry-hack procedure to set up a Serverless FPolicy for a vfiler.
Fpolicy flow chart:
