#cifs superuser

1 messages · Page 1 of 1 (latest)

strange quail
#

as of a post in here it is stated that the command cifs superuser is deprecated since 9.4:
https://community.netapp.com/t5/ONTAP-Discussions/What-are-the-security-checks-that-cifs-superuser-privileges-allow-Data-ONTAP-to/m-p/141076#M31200

I can still find the command in the dock of latest ontap version with no mention of deprecated:
https://docs.netapp.com/us-en/ontap-cli-9131//vserver-cifs-superuser-create.html#description

I have a documentation for varonis fpolicy that needs a cifs superuser. Now is it deprecated or not?

Re: What are the security checks that cifs superuser privileges, al...

Hi there,   As of ONTAP 9.4 the "vserver cifs superuser" commands are deprecated - the preferred method is to add a user to the AD Domain Admins group.   Per http://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cifs-nfs-audit%2FGUID-8658509D-AE99-44A6-8CFB-F47D673A7127.html    Avoid...

vserver cifs superuser create

Adds superuser permissions to a CIFS account

ivory lantern
#

Is the CIFS superuser role the same as setting the CIFS privilege of SeTcbPrivilege ?
If it is, I guess you can use that one.

strange quail
#

The vserver cifs superuser create command elevates the privileges of the specified domain account in this Vserver to superuser. With superuser privileges, Data ONTAP bypasses some of the security checks. This command is not supported for workgroup CIFS servers.

#

This is documentated. I dont know more.

ivory lantern
#

SeTcbPrivilege completely ignores security checks, as far as I am aware. Very dangerous but can be helpful.
Perhaps I am derailing the discussion here, just thought I'd provide what I think is an alternative but perhaps I misunderstood the thoughts behind the original question.