IBM i NetServer: Easy Access to IBM i Data

Transcription

1 IBM i NetServer: Easy Access to IBM i Data Margaret Fenlon mfenlon@us.ibm.com Session ID: Agenda Key: CP Integrated File System Sessions Understanding the Power of the Integrated File System Introduction to the Integrated File System IBM i NetServer: Easy Access to Data ***YOU ARE HERE*** Integrated File System Security OPEN LAB: Integrated File System and File Servers IBM i File Sharing in a Linux World and Distributed File Systems Integrated File System: Real Life Integrated File System: Advanced Topics 2

2 Agenda Overview and Release Updates Using IBM i NetServer Configuration Administration Performance Miscellaneous topics YOUR DATA YOU 3 What is IBM inetserver? 4

3 Integrated File System Applications/Generic Commands FMS Non-POSIX APIs Logical File System POSIX APIs PC File Server (Shared Folders) NFS Server IBM i NetServer vnode interface QDLS PFS QSYS.LIB PFS Root PFS QOPT PFS QOpenSys PFS NFS Client PFS User-Defined PFS QFileSvr.400 Client PFS QNTC PFS IBM BladeCenter blade and System x models attached to an IBM i solution via an iscsi network 5 IBM i Support for Windows Network Neighborhood" File and print serving for Common Internet File System (CIFS) clients Windows 7 Windows 8 Windows 10 Windows Server 2008 Windows Server 2012 Windows Server 2016 Linux Samba at current release levels Compatible with Microsoft Networking and Samba Part of the base IBM i Uses TCP/IP for connectivity 6

4 Release Updates IBM i7.3 Updated to use Server Message Block (SMB), Version 2 (SMB2) Major internal update for better interoperability with newer clients File sharing configuration unchanged Print sharing PC configuration slightly different (more later) SMB2 support can be disabled CALL QZLSMAINT PARM( x80 ) Disabling SMB2 disables it for both file sharing and print sharing and NetServer will function as it did prior to IBM i7.3 7 Why use IBM inetserver? Need transparent file system access to your IBM idata through a mounted drive or file system path Need to access / update a portion of a file without the need to transfer the entire file over the network Need better security than UID/GID authentication used by the Network File System (NFS) 8

5 IBM i Integrated File System Shares Server shares: Public Home Home\Chuck Home\Steve Home\Carl Home\Vern Home\John Home\Jean \\Server\Public h: \\Server\Home\Chuck \\Server\Public h: \\Server\Home\Jean \\Server\Public h: \\Server\Home\Steve \\Server\Public h: \\Server\Home\Carl \\Server\Public h: \\Server\Home\Vern \\Server\Public h: \\Server\Home\John 9 IBM i NetServer Scenarios Copying files in the integrated file system Each branch stores data in their directory (ex: /corp/branchnn) Home office uses IBM i NetServer to copy.xls files to corporate directory (ex: /corp/home) Home office uses Excel to work with branch data. PC scanning application stores data in the integrated file system Vehicle titles are scanned using PC attached scanner. Scanning app stores files to a share mapped to IBM inetserver. Images are archived using IBM isav / RST functions. 10

6 Using IBM i NetServer 11 Using IBM i NetServer Security Configuration and file shares Working with output queues Using Network DOS commands Encrypted password security 12

7 Security 13 Another way to access your data Rather than mapping a drive use UNC format. The Universal Naming Convention (UNC) is two backslashes followed by the computer name, share name, folder name(s), and filename, each separated by a single backslash. 14

8 IBM i NetServer Configuration 15 Configuring IBM i NetServer Prerequisites System i Navigator Interfaces IBM i Configuration Configuration wizard Properties 16

9 IBM i Setup - Prerequisites TCP/IP support configured NetServer supports IPv6 QSERVER subsystem started STRSBS SBS(QSERVER) If using the subsystem support, the alternate subsystems must be started as well. IBM i NetServer started STRTCPSVR SVR(*NETSVR) 17 Locating IBM inetserverin Navigator for IBM i 18

10 IBM i NetServer Management 19 Use the Wizard for Initial Configuration 20

11 Properties: Subsystems Tab 21 Properties: General Tab 22

12 Properties: Advanced Tab 23 Properties: Security Tab 24

13 Properties: WINS Configuration Tab 25 Add a file share 26

14 Add a file share (cont) 27 Add a file share (cont) 28

15 Add a file share (cont) 29 PC Client Configuration Client for Microsoft Networks Accessing your IBM i NetServer Share Linux/Samba 30

16 PC Setup Use "Client for Microsoft Networks" 31 Accessing an IBM i 32

17 Mapping a Drive 33 Mapping a Drive 34

18 Linux / Samba smbclient smbclient //mynetserver/myshare -U username mount mount t cifs o username=smbusername,password=mypasswd //mynetserver/myshare /usr/mnts/my400 use "man" for details 35 Network Authentication Services Support 36

19 NetServer Authentication Option NetServer Properties -> Security -> Next Start 37 Authentication SMITH????? bsmith BJS SMITH

20 Network Authentication 2 bsmith BJS Authentication provider Authentication Provider 1 bsmith Network Authentication Services Support Why should I use NAS authentication? No need to match Windows and IBM i profile names or passwords Single network signon Increased authentication security 40

21 Network Authentication Services Support EIM Terminology Association Registry2 Identifier Association Registry1 41 Network Authentication Services Support Understanding EIM Employee: Jane S Doe Company's network IBM i: machine1 IBM i: machine2 AIX: mc3 Kerberos realm: MYCOMPANY.COM ID: JANEDOE ID: JSDOE ID: JANED Principal: janedoe@mycompany.com Given Jane's situation, the following EIM associations could be established: List Of EIM Associations For Jane Susan Doe EIM Identifier Registry Name Registry User Name Association Type Jane S. Doe MYCOMPANY.COM janedoe@mycompany.com Source Jane S. Doe machine1 JANEDOE Target Jane S. Doe machine2 JSDOE Target Jane S. Doe mc3 JANED Target 42

22 User Defined Subsystems 43 User Defined Subsystem Support Sales team runs here Opt Subsystem/Job User Type QSERVER QSYS SBS QPWFSERVSD QUSER BCH QSERVER QPGMR ASJ QZDASRVSD QUSER BCH QZLSSERVER QPGMR BCH ACCOUNTING QSYS SBS QZLSFILE QUSER PJ QZLSFILET QUSER PJ SALES_NW QSYS SBS QZLSFILE QUSER PJ QZLSFILET QUSER PJ Accounting runs here You decide where IBM i NetServer jobs will run. 44

23 User Defined Subsystem Support Enabling the Support 45 Administration 46

24 Administration File Sharing Designing a file sharing solution Create the directory structure Sharing Files and Printers Text conversion Integrated file system directory permission considerations 47 Administration Design Considerations What files and directories need to be accessed? Wherewill the users be when they access the data? Who needs access to files and directories? How much authority and disk space do users need? Are there any special considerations? 48

25 Administration Print Sharing Setting Up Print Shares Sharing an output queue Installing a network printer on the client Printing 49 Print Share Example PC printing to IBM i Printer 1 Create OUTQ on the IBM i 2 Share the OUTQ with "IBM AFP 3820" printer driver, *AFP spool file type 3 Use the share 50

26 Sharing a Printer Navigator for i : Basic Operations->Printers 51 Sharing a Printer 52

27 Set up shared printer on PC IBM i7.3 for SMB2 Open Windows command prompt Issue the NET USE command to map a printer share to an unused local LPT printer port NET USE LPTx\\server\share Where x is a valid LPT port number 53 Install a Local Printer on Your PC IBM i7.3 for SMB2 54

28 SMB2 Print sharing IBM i7.3 for SMB2 Printing with SMB2 allows spooling output to network printer share Does not support advanced queue management for the mapped printer Once the print job has spooled to the shared queue on the IBM i, using PC print queue you cannot: Hold print jobs Cancel print jobs View print jobs SMB2 can be disabled (disables for both print and file sharing) CALL QZLSMAINT PARM( x80 ) 55 Install a Network Printer on Your PC (Pre IBM i7.3 or for SMB1) Connect to the print share from a client PC 56

29 Administration Managing Activity GO NETS Disabled Users Working with Jobs 57 Administration on a Green Screen GO NETS Provides menu driven use of IBM i NetServer APIs Shipped in the QUSRTOOL library 7.3: 5770-SS1 Option : 5770-SS1 Option : 5770-SS1 Option 7. 58

30 Administration GO NETS Setting up GO NETS Follow these steps to build the GO NETS command tool into library NETSRVCMD. Create the target library. NETSRVCMD may be replaced with the library name of your choice. CRTLIB LIB(NETSRVCMD) TEXT( IBM i NetServer menu and commands') Expand the necessary files: CALL QUSRTOOL/UNPACKAGE PARM('*ALL ' 1) Create the installation program: CRTCLPGM NETSRVCMD/TZLSINST QUSRTOOL/QATTCL Call the installer to create the GO NETS tool: CALL NETSRVCMD/TZLSINST NETSRVCMD Add the new library to the library list: ADDLIBLE NETSRVCMD Run the tool's menu interface. From now on, you need only type this command to bring up GO NETS function. GO NETS 59 Disabled Users A user is disabled for IBM i NetServer access when the number of password violations exceeds the QMAXSIGN system value. Users must be enabled using the Enable User ID button or the QZLSCHSI API using format ZLSS Enable user information. 60

31 Disabled Users How does a NetServer user become disabled? When a user clicks into a UNC path or Network system from Windows, the PC first attempts to connect with the credentials of the logged in user. The PC may make several attempts to connect to the server before it ever prompts the user for credentials. How do you know if a user is disabled? A message is sent to the QSYSOPR message queue by NetServer whenever a user profile is disabled for NetServer use. A profile disabled for NetServer will not be disabled for green screen access. How can a disabled user be re-enabled? Disabled NetServer users are automatically re-enabled whenever NetServer is restarted. The only other way to re-enable a user is to use the QZLSCHSI API (ZLSS0200 format) either directly or indirectly through the IBM Navigator for i GUI. 61 Working with Sessions NetServer Sessions : Managing the active connections 62

32 Working with Sessions NetServer Sessions : Managing the active connections 63 Working with Sessions NetServer Sessions : Managing the active connections 64

33 Performance 65 Multi-threaded support Single Threaded Multi- Threaded QZLSFILE USER1 QZLSFILET USER1 USER2 USER3 QZLSFILE USER2 66

34 Multi-threaded support 1 QZLSFILET job in QSERVER subsystem for all clients Configuration allows for QZLSFILET jobs in other subsystems. Non-thread safe activity requires QZLSFILE jobs QDLS file system activity QSYS.LIB access to SAVF and DEVD Access denied errors for non-thread safe activity in QZLSFILET job 67 Multi-threaded Support To run non-threaded mode, end QZLSFILET job RMVPJE SBSD(QSYS/QSERVER) PGM(QSYS/QZLSFILET) When running threaded it is not an option to end the file server job in order to end a client session. Ending QZLSFILET to end all sessions Use System inavigator to end a specific session. QIBM_QPWFS_FILE_SERV exit point changes ADDEXITPGM THDSAFE parameter also determines if server runs threaded THDSAFE(*UNKNOWN) or THDSAFE(*NO) forces IBM inetserverto run a client session non-threaded (in a QZLSFILE job) IBM i NetServer references on Integrated File System Properties page 68

35 IBM i NetServer References Indicates NetServer usage of files, folders, or objects. 69 IBM i NetServer References - Details Displays the list of clients that are currently using the object 70

36 Opportunistic Locking Support 3 Open file A IFS File A 5 File A is open 2 Yes, no one else will mess with File A. 4 Someone else wants A. Clean your cache 1 Can I Op Lock File A? 71 Opportunistic Locking Support CIFS protocol mechanism for client-side caching of file data. Client locks the file -server breaks the lock if another client wants to use the file. Server notifies original client when it needs to break the lock. Opportunistic Locking parameter on IBM i NetServer configuration. 72

37 Opportunistic Locking Configuration 73 Miscellaneous Topics 74

38 Message Authentication YOU 75 Message Authentication CIFS mechanism for protecting data transmissions between clients and servers (no data encryption). Requires equivalent support on clients 3 Configuration settings available No Message authentication will not be used Optional - Based on client preference Yes - Required authentication 76

39 Message Authentication - Configuration NetServer Properties -> Security -> Next Start 77 Windows-style Messages IBM i NetServer can automatically send informational messages to users. Password about to expire Access is denied Impromptu messages IBM Navigator for i configuration Administrative Alerts Yes/No Minimum Message severity Messenger Service must be started on client System message IDs CPIB68A through CPIB692 78

40 Windows-style Messaging - Configuration 79 Additional Resources IBM i NetServer Web Site: IBM Knowledge Center for IBM i The AS/400 NetServer Advantage Redbook: SG

41 Integrated File System Sessions Understanding the Power of the Integrated File System Introduction to the Integrated File System IBM i NetServer: Easy Access to Data Integrated File System Security OPEN LAB: Integrated File System and File Servers IBM i File Sharing in a Linux World and Distributed File Systems Integrated File System: Real Life Integrated File System: Advanced Topics 81 Power Systems Social Media IBM Power Systems Official Channels:

42 More to Follow: Blogs to Follow More to Follow Hashtags To Use IBM Systems Magazine You and I (Steve Will) IBM Systems Magazine i-can (Dawn May) IBM Systems Magazine: idevelop (Jon Paris and Susan Gantner) IBM Systems Magazine: italk with Tuohy IBM DB2 for i (Mike Cain) IBM DB2 Web Query for i #PowerSystems #IBMi #IBMAIX #POWER8 #LinuxonPower #OpenPOWER #HANAonPower #ITinfrastructure #OpenSource #HybridCloud #BigData 83 Backup Slides 84

43 Administration 85 GO NETS Add Shares 86

44 GO NETS Change Configuration 87 GO NETS View Configuration Shows pending changes 88

45 GO NETS View List of Shares 89 Special notices This document was developed for IBM offerings in the United States as of the date of publication. IBM may not make these offerings available in other countries, and the information is subject to change without notice. Consult your local IBM business contact for information on the IBM offerings available in your area. Information in this document concerning non-ibm products was obtained from the suppliers of these products or other public sources. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. IBM may have patents or pending patent applications covering subject matter in this document. The furnishing of this document does not give you any license to these patents. Send license inquires, in writing, to IBM Director of Licensing, IBM Corporation, New Castle Drive, Armonk, NY USA. All statements regarding IBM future direction and intent are subject to change or withdrawal without notice, and represent goals and objectives only. The information contained in this document has not been submitted to any formal IBM test and is provided "AS IS" with no warranties or guarantees either expressed or implied. All examples cited or described in this document are presented as illustrations of the manner in which some IBM products can be used and the results that may be achieved. Actual environmental costs and performance characteristics will vary depending on individual client configurations and conditions. IBM Global Financing offerings are provided through IBM Credit Corporation in the United States and other IBM subsidiaries and divisions worldwide to qualified commercial and government clients. Rates are based on a client's credit rating, financing terms, offering type, equipment type and options, and may vary by country. Other restrictions may apply. Rates and offerings are subject to change, extension or withdrawal without notice. IBM is not responsible for printing errors in this document that result in pricing or information inaccuracies. All prices shown are IBM's United States suggested list prices and are subject to change without notice; reseller prices may vary. IBM hardware products are manufactured from new parts, or new and serviceable used parts. Regardless, our warranty terms apply. Any performance data contained in this document was determined in a controlled environment. Actual results may vary significantly and are dependent on many factors including system hardware configuration and software design and configuration. Some measurements quoted in this document may have been made on development-level systems. There is no guarantee these measurements will be the same on generally-available systems. Some measurements quoted in this document may have been estimated through extrapolation. Users of this document should verify the applicable data for their specific environment. Revised September 26,

46 Special notices (cont.) IBM, the IBM logo, ibm.com AIX, AIX (logo), AIX 5L, AIX 6 (logo), AS/400, BladeCenter, Blue Gene, ClusterProven, DB2, ESCON, i5/os, i5/os (logo), IBM Business Partner (logo), IntelliStation, LoadLeveler, Lotus, Lotus Notes, Notes, Operating System/400, OS/400, PartnerLink, PartnerWorld, PowerPC, pseries, Rational, RISC System/6000, RS/6000, THINK, Tivoli, Tivoli (logo), Tivoli Management Environment, WebSphere, xseries, z/os, zseries, Active Memory, Balanced Warehouse, CacheFlow, Cool Blue, IBM Systems Director VMControl, purescale, TurboCore, Chiphopper, Cloudscape, DB2 Universal Database, DS4000, DS6000, DS8000, EnergyScale, Enterprise Workload Manager, General Parallel File System,, GPFS, HACMP, HACMP/6000, HASM, IBM Systems Director Active Energy Manager, iseries, Micro-Partitioning, POWER, PowerExecutive, PowerVM, PowerVM (logo), PowerHA, Power Architecture, Power Everywhere, Power Family, POWER Hypervisor, Power Systems, Power Systems (logo), Power Systems Software, Power Systems Software (logo), POWER2, POWER3, POWER4, POWER4+, POWER5, POWER5+, POWER6, POWER6+, POWER7, System i, System p, System p5, System Storage, System z, TME 10, Workload Partitions Manager and X-Architecture are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both. If these and other IBM trademarked terms are marked on their first occurrence in this information with a trademark symbol ( or ), these symbols indicate U.S. registered or common law trademarks owned by IBM at the time this information was published. Such trademarks may also be registered or common law trademarks in other countries. A full list of U.S. trademarks owned by IBM may be found at: Adobe, the Adobe logo, PostScript, and the PostScript logo are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, and/or other countries. AltiVec is a trademark of Freescale Semiconductor, Inc. AMD Opteron is a trademark of Advanced Micro Devices, Inc. InfiniBand, InfiniBand Trade Association and the InfiniBand design marks are trademarks and/or service marks of the InfiniBand Trade Association. Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo, Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. IT Infrastructure Library is a registered trademark of the Central Computer and Telecommunications Agency which is now part of the Office of Government Commerce. Java and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates. Linear Tape-Open, LTO, the LTO Logo, Ultrium, and the Ultrium logo are trademarks of HP, IBM Corp. and Quantum in the U.S. and other countries. Linux is a registered trademark of Linus Torvalds in the United States, other countries or both. Microsoft, Windows and the Windows logo are registered trademarks of Microsoft Corporation in the United States, other countries or both. NetBench is a registered trademark of Ziff Davis Media in the United States, other countries or both. SPECint, SPECfp, SPECjbb, SPECweb, SPECjAppServer, SPEC OMP, SPECviewperf, SPECapc, SPEChpc, SPECjvm, SPECmail, SPECimap and SPECsfs are trademarks of the Standard Performance Evaluation Corp (SPEC). The Power Architecture and Power.org wordmarks and the Power and Power.org logos and related marks are trademarks and service marks licensed by Power.org. TPC-C and TPC-H are trademarks of the Transaction Performance Processing Council (TPPC). UNIX is a registered trademark of The Open Group in the United States, other countries or both. Other company, product and service names may be trademarks or service marks of others. Revised December 2,