Overview
The visiting client must be in the same network as the file system, and the created file system needs to configure a permission group to further manage the access permissions and read/write permissions of these visiting clients. The operation methods related to permissions are described below.
Directions
Create permission group
- Log in to the CFS console and click Permission Group in the left sidebar.
- On the Permission Group page, click Create to create a permission group. Configure the permission group name and remarks in the pop-up Create window.
Creating a permission group rule
In the rule list, you can add, edit, or delete rules. If no rules are added to the permission group, all are allowed. Rules are described as follows.
| Field | Description |
|---|---|
| Visiting address | You can write a single IP or IP range, such as 10.1.10.11 or 10.10.1.0/24. The default incoming address is *, which means all addresses are allowed. At the same time, it should be noted that the private IP address of CVM needs to be filled in here. |
| Read/Write Permission | Read-only or read/write. |
| User Permission | There are 4 options for imposing permission restrictions on visiting users. - all_squash: any visiting user will be mapped to an anonymous user or user group. - no_all_squash: A visiting user will be first matched with a local user, and if the match fails, it will be mapped to an anonymous user or user group. - root_squash: A visiting root user will be mapped to an anonymous user or user group. - no_root_squash: A visiting root user will be allowed to maintain root account permissions. Note: Each file system defaults to 755 permissions, and nfsnobody does not have the write permission. Therefore, if there is no special requirement here, it is recommended to configure no_root_squash. If the root user is used to create a file directory and mount the file system, when the visiting IP is set as all_squash or root_squash, the visiting IP can only read files. (Since the mount path is root permission and the visiting IP has been mapped to an anonymous user). |
| Priority | The priority is a positive integer from 1 to 100, where 1 is the highest and 100 is the lowest. Regardless of priority setting, the priority of a single IP will be higher than that of this IP in the IP range. In other cases, the rules with higher priorities will be matched first and take effect. |
Configuring a permission group for a file system
The configuration of a permission group can be modified after the file system is created. You can choose to create a permission group first and select it when creating a file system. You can also select the default permission group when creating a file system and then go to the File System Details page to change the permission group.
Note:
If the file system is mounted with the NFSv4 protocol, after modifying the permission group rules for the file system, you need to wait for 2 minutes for the configuration to take effect.
Modifying the information and rule of a permission group
You can enter the Permission Group Details page to modify the name, remarks, and rule of a permission group.