HP OpenVMS Systems
HP Advanced Server for OpenVMS
Table 4-7, Share Permissions, shows permissions available for shares and the actions available to users for each permission.
|Actions||No Access||Read Access||Change Access||Full Control|
|Display subdirectory names and file names||X||X||X|
|Display file data and attributes||X||X||X|
|Run program files||X||X||X|
|Go to subdirectories of the directory||X||X||X|
|Create subdirectories and add files||X||X|
|Change data in and append data to files||X||X|
|Change file attributes||X||X|
|Delete subdirectories and files||X||X|
|Change permissions (Windows NT files and directories only)||X|
|Take ownership (Windows NT files and directories only)||X|
You can share an existing OpenVMS directory. When you share a directory, you specify its location on the server, including the disk device, the directory name, and the name for the share. The following example shows how to share a directory on the server:
LANDOFOZ\\TINMAN> ADD SHARE/DIRECTORY RAINBOW USER1:[SHARED] - _LANDOFOZ\\TINMAN> /HOST_ATTRIBUTES=(RMS_FORMAT=STREAM) %PWRK-S-SHAREADD, share "RAINBOW" added on server "TINMAN"
This command adds a directory share named RAINBOW for the directory
USER1:[SHARED]. Files created in this directory will be RMS
stream-format files. Because the /PERMISSIONS qualifier is not included
on the command line, the new share is available to all network users.
220.127.116.11 Creating a Personal Share
The Advanced Server allows you to set up personal shares, which are typically used for sharing a user's OpenVMS login directory. Personal shares are unique in that they are hidden (they will not appear in the list of shares users can display, such as in Network Neighborhood), but the names of personal shares do not end with a dollar sign ($). Thus, when users want to map a drive to their OpenVMS login directory, they specify a personal share name (typically the same as their user name) without having to include a dollar sign in the share name.
Users cannot specify personal shares in the UNC path when connecting to or listing resources. To access such a file or run an application from the personal share, users must specify the device associated with the share.
A personal share typically points to the root directory of a user's OpenVMS account. For example, network user SCARECROW has a personal share that is mapped to the OpenVMS directory [STRAWMAN] on server TINMAN. If you display the personal shares on TINMAN, the following information appears:
LANDOFOZ\\TINMAN> SHOW SHARES/TYPE=PERSONAL Shared resources on server "TINMAN": Name Type Description ------------ --------- ------------------------------------- STRAWMAN Personal Total of 1 share
STRAWMAN, the host mapped OpenVMS account, has a login directory defined in the UAF record; for example: DUA1:STRAWMAN.DIR, or DUA1:[STRAWMAN]. You can use the AUTHORIZE utility to display a system's UAF records. For example:
$ MCR AUTHORIZE UAF> SHOW STRAWMAN Username: STRAWMAN Owner: SYSTEM MANAGER Account: SYSTEM UIC: [360,44] ([PCSA,STRAWMAN]) CLI: DCL Table: DCLTABLES Default: DUA1:[STRAWMAN] LGICMD: LOGIN . . .
Only users in the Administrators group can display and access all the personal shares on a server.
A user with OpenVMS user accounts on multiple servers in a domain may have a personal share associated with an account on each server.
Follow these steps to create a personal share:
LANDOFOZ\\TINMAN> ADD SHARE GREATOZ USER1:[USERS] - _LANDOFOZ\\TINMAN> /PERSONAL/NOPERMISSIONS/PERMISSIONS=(LION=FULL) %PWRK-S-SHAREADD, share "GREATOZ" added on server "TINMAN" LANDOFOZ\\TINMAN> SHOW SHARES/TYPE=PERSONAL/FULL Shared resources on server "TINMAN": Name Type Description ------------ --------- ------------------------------------------ GREATOZ Personal Path: USER1:[USERS] Connections: Current: 0, Maximum: No limit RMS file format: Stream Directory Permissions: System: RWED, Owner: RWED, Group: RWED, World: RE File Permissions: System: RWD, Owner: RWD, Group: RWD, World: R Share Permissions: LION Full Control Total of 1 share LANDOFOZ\\TINMAN>
After the personal share is created, you can set up the associated
directory as the user's home directory. The home directory contains
files and programs for the user, and is automatically accessible when
the user logs on to the network. For information about setting up home
directories, see Section 3.1.10, Specifying Home Directories.
18.104.22.168 Stopping Directory Sharing
You may need to stop sharing a directory when the directory is no longer being used and you want to delete it; for example, when a project requiring the use of shared files is completed. Advise users when you are planning to stop sharing a directory.
For example, to stop sharing the directory GREATOZ, use the ADMINISTER command REMOVE SHARE, as follows:
LANDOFOZ\\TINMAN> REMOVE SHARE GREATOZ/NOCONFIRM %PWRK-S-SHAREREM, share "GREATOZ" removed from server "TINMAN" LANDOFOZ\\TINMAN>
This example removes the share named GREATOZ from the server named
TINMAN; no confirmation is required. When you stop sharing a directory,
the share name is removed from the share database and no longer appears
on the list of available shares. However, the directory and its files
are not deleted.
4.3.3 Displaying Information About Shares
You can use the SHOW SHARES command to display the shares provided by a server and to see which shares are available to the network. Before sharing a new directory from the server, first check which shares are currently available.
The following example shows how to display the shared directories for your server:
LANDOFOZ\\TINMAN> SHOW SHARES Shared resources on server "TINMAN": Name Type Description ------------ --------- --------------------------------------- NETLOGON Directory Logon Scripts Directory PWLIC Directory PATHWORKS Client License Sftwr PWLICENSE Directory PATHWORKS Client License Sftwr PWUTIL Directory Adv. Srv. Client-based Utilities USERS Directory Users Directory Total of 5 shares LANDOFOZ\\TINMAN>
The default display does not show administrative shares and personal shares.
You can display information about administrative shares (those that end with $) using the SHOW SHARES/HIDDEN command, as described in Section 4.2, Administrative Shares.
You can display information about personal shares using the SHOW SHARES/TYPE=PERSONAL command.
You can display information about all shares using the SHOW
22.214.171.124 Displaying Information About a Specific Share
You can display information about any share, regardless of the type of share, by specifying the share name, as in the following example:
LANDOFOZ\\TINMAN> SHOW SHARES RAINBOW Shared resources on server "TINMAN": Name Type Description ------------ --------- -------------------- RAINBOW Personal Total of 1 share
To display share permissions, use the SHOW SHARES command with the /PERMISSIONS qualifier. For example:
LANDOFOZ\\TINMAN> SHOW SHARES/PERMISSIONS Shared resources on server "TINMAN": Name Type Description ------------ --------- -------------------------------------------------- DICK Printer Dick's print share Share Permissions: Everyone Full Control NETLOGON Directory Logon Scripts Directory Share Permissions: Everyone Read PATHWORKS Directory Share Permissions: Everyone Full Control PWLIC Directory PATHWORKS Client License Sftwr Share Permissions: Administrators Full Control Everyone Read PWLICENSE Directory PATHWORKS Client License Sftwr Share Permissions: Administrators Full Control Everyone Read PWUTIL Directory Adv. Srv. Client-based Utilities Share Permissions: Everyone Read USERS Directory Users Directory Share Permissions: Everyone Full Control Total of 7 shares LANDOFOZ\\TINMAN>
To change the properties of a shared directory, you must be logged on as a member of the Administrators or Server Operators group.
The following example shows how to use the MODIFY SHARE command to add permissions on an existing directory share called GREATOZ and to grant READ access to the user SCARECROW:
LANDOFOZ\\TINMAN> MODIFY SHARE GREATOZ/PERMISSIONS=(SCARECROW=READ) %PWRK-S-SHAREMOD, share "GREATOZ" modified on server "TINMAN" LANDOFOZ\\TINMAN>
Users and groups can be granted or denied access to specific files and subdirectories in a shared directory. A user denied access to a file or directory, either individually or as a member of a group, can connect to the share but cannot perform any operations with the files and directories in the share. You can grant specific unique access permissions for files and directories in shares that users can access. Once a user connects to the resource, the file and directory access permissions control the operations that the user can perform. For information about specifying share permissions, see Section 126.96.36.199, Planning Share Permissions.
You can enable users to set access permissions on their own files and
directories. These users can then control whether other users can read,
write, or modify files in that directory. To enable users to set access
permissions, give them full control using the SET FILE command.
188.8.131.52 File and Directory Access Permissions
Table 4-8, Directory Access Permissions and Actions on Directories, lists the types of access users can have and the permissions to set on directories.
|User Actions||NONE||LIST||READ||ADD||ADD AND READ||CHANGE||FULL CONTROL|
|Display directory file names||X||X||X||X||X|
|Display directory attributes||X||X||X||X||X||X|
|Go to directory subdirectories||X||X||X||X||X||X|
|Change directory attributes||X||X||X||X|
|Create subdirectories and add files||X||X||X||X|
|Display directory owner and permissions||X||X||X||X||X||X|
|Delete the directory||X||X|
|Delete any file or empty subdirectory in a directory||X|
|Change directory permissions||X|
|Take ownership of the directory||X|
Table 4-9, Directory Access Permissions and Actions on Files, lists the types of access users can have to files and the permissions to set on them.
|User Actions||NONE||LIST||READ||ADD||ADD AND READ||CHANGE||FULL CONTROL|
|Display file owner and permissions||X||X||X||X|
|Display file data||X||X||X||X|
|Display file attributes||X||X||X||X|
|Run a program file||X||X||X||X|
|Change file attributes||X||X|
|Change data in and append data to the file||X||X|
|Delete the file||X||X|
|Change the file permissions||X|
|Take ownership of the file||X|
By default, anyone with a valid network user name and password can log on to a server and connect to a share on that server. However, a user must have the requisite permissions to access the directories and files in the share. You use the SET FILE/PERMISSIONS command to set permissions on a shared directory. You may need to change access permissions if users cannot access the directories or files they need, or if unauthorized users can access them. For information about how a file or directory that does not have explicit permissions inherits the permissions, see Section 184.108.40.206, Inheritance of Directory Permissions, and Section 220.127.116.11, Inheriting Permissions.
Permissions for disk resources are stored on the disk with each
resource as an OpenVMS access control list (ACL). Thus, resource
permissions are backed up by the OpenVMS Backup utility.
18.104.22.168 Inheriting Permissions
As you create subdirectories and files in shared directories that have
existing permissions, those permissions are automatically propagated to
the new subdirectories and files. (This assumes the default for the
STORE_SECURITY_ACES is in effect; see Section 22.214.171.124, Streamlining Security Information Storage and Lookups,
for more information.) However, if you decide to share a directory that
contains existing subdirectories and files, the permissions you assign
to the new share are not propagated to its subdirectories and files.
You can either explicitly set permissions for each subdirectory and
file, or you allow their permissions to be inherited.
4.3.6 Specifying File and Directory Access Permissions
When sharing a directory on a server, you specify the name of the groups and users who can access the share, its subdirectories, and its files, and the permissions each group or user has for the share. After the share has been created, you can modify the permissions on the files and directories in the share. The following example shows how to use the SET FILE/PERMISSIONS command to modify permissions. In this example, the command specifies the access permissions for all files with the .C extension in the directory CURTAIN in share GREATOZ.
LANDOFOZ\\TINMAN> SET FILE GREATOZ\CURTAIN\*.C - _LANDOFOZ\\TINMAN> MUNCHKINS/PERMISSIONS=READ - _LANDOFOZ\\TINMAN> SCARECROW/PERMISSIONS=FULL_CONTROL %PWRK-S-FILEMOD, "GREATOZ\CURTAIN\FILE1.C" modified on server "TINMAN" %PWRK-S-FILESMODIFIED, total of 1 file modified LANDOFOZ\\TINMAN>
As a result, the following permissions are set: