Mount an SMB file system on macOS

To mount a File Storage NAS file system on your local macOS client, you must connect to the virtual private cloud (VPC) in the region where the file system resides. This topic describes how to mount a Server Message Block (SMB) file system on a macOS client over a VPN and how to access an SMB file system using the Kerberos protocol.

Prerequisites

Create an SMB file system. For more information, see Create a file system.
Create a mount target in a VPC. For more information, see Create a mount target.

Connect your macOS client to the VPC using a VPN gateway. For more information, see Connect a macOS client to a VPC.

When you create an SSL server, ensure that the Client CIDR Block and Local CIDR Block do not overlap. The Local CIDR Block is the CIDR block of the VPC. You can log on to the VPC console to view the VPC CIDR block. In the Edit SSL Server dialog box, set Name to ssl-india, select the target VPN gateway, set Local Network to 172.31.0.0/16, and set Client Subnet to 192.168.1.0/24. The client subnet cannot conflict with the CIDR block of any VSwitch in the VPC. Click OK.
Verify the connectivity between the macOS client and the SMB file system mount target.
- Verify network connectivity
  After the VPN gateway is connected, use the ping command to ping the mount target of the SMB file system in the VPC to verify that the connection is working properly.
```
IT-C02WW0JRG8WN:Volumes      $ ping xxx.nas.aliyuncs.com
PING xxx.nas.aliyuncs.com (172.31.16.146): 56 data bytes
64 bytes from 172.31.16.146: icmp_seq=0 ttl=101 time=211.562 ms
64 bytes from 172.31.16.146: icmp_seq=1 ttl=101 time=199.784 ms
64 bytes from 172.31.16.146: icmp_seq=2 ttl=101 time=173.240 ms
^C
--- xxx.nas.aliyuncs.com ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 173.240/194.862/211.562/16.027 ms
```
  Note
  If the ping fails, get the mount target's IP address by running the ping command from an ECS instance in the same VPC as the SMB file system. Then, use that IP address to mount the file system on your macOS client.
- Verify service port connectivity
```
telnet [SMB file system mount target] 445
```
Mount the SMB file system.
- Use the macOS GUI
  1. In the Finder menu bar at the top of your macOS desktop, select .
  2. In the Connect to Server dialog box, enter the SMB mount address in the Server Address field. The address must be in the format smb:///myshare. Then, click Connect.
  3. In the Connect As section of the dialog box, select Guest and click Connect.
  4. In the Finder menu bar at the top of your macOS desktop, select and select the myshare volume to view the mounted SMB file system.
    
    Note
    After mounting, your macOS client reads all files in the mounted NAS file system. During this process, the myshare folder might appear empty. Please wait for the process to complete.
- Use the macOS command line
  Run the mount_smbfs command to mount the SMB file system. The following is an example:
  mount_smbfs '//gue**@nas-mount-point.nas.aliyuncs.com/myshare' /Volumes/myshare/
  
  In the command, nas-mount-point.nas.aliyuncs.com is the VPC mount target of the SMB file system. Replace it with your actual value.
  If output similar to the following is returned, the mount is successful.
  
  IT-C02WW0JRG8WN:Volumes (xxx)$ mount_smbfs '//xxx.nas.aliyuncs.com/myshare' /Volumes/myshare IT-C02WW0JRG8WN:Volumes xxx$ mount /dev/disk1s1 on / (apfs, local, journaled) devfs on /dev (devfs, local, nobrowse) /dev/disk1s4 on /private/var/vm (apfs, local, noexec, journaled, noatime, nobrowse) map -hosts on /net (autofs, nosuid, automounted, nobrowse) map auto_home on /home (autofs, automounted, nobrowse) /dev/disk1s3 on /Volumes/Recovery (apfs, local, journaled, nobrowse) //xxx@xxx.nas.aliyuncs.com/myshare on /Volumes/myshare (smbfs, nodev, nosuid, mounted by xxx)

Access an SMB file system on macOS using Kerberos

By default, SMB file systems support only the NTLM authentication protocol. Regardless of the identity you use to mount from a macOS client, the authenticated identity becomes 'Everyone', which has full permissions by default. Alibaba Cloud File Storage NAS supports AD domain-based user authentication and file system-level access control. Follow these steps to manage permissions for different users to access an SMB file system.

Set up an AD domain.
Join the SMB file system mount target to the AD domain. For more information, see Join an SMB mount target to an AD domain.
Add the VPN SSL subnet to a security group. For more information, see Add a security group rule.
Add the following rules to the security group of the ECS instance to allow the AD domain to process DNS and SMB requests from your macOS client.
- DNS port: UDP 53
- Kerberos port: TCP 88
- LDAP port: TCP 389
- LDAP Global Catalog port: TCP 3268
For example, to add a rule for the DNS port, in the Edit Security Group Rule dialog box, set NIC Type to Internal Network, Direction to Inbound, Action to Allow, Protocol Type to Custom UDP, Port Range to 53, Priority to 1, and Authorization Type to IPv4 CIDR Block. Set Authorization Object to 192.168.1.6/24, and then click OK. Add rules for the other ports (TCP 88, TCP 389, and TCP 3268) in the same way.
Set the DNS server for the macOS client to the AD domain server.
1. Run the ipconfig command on the AD domain server to query its internal IP address.
2. In the Finder menu bar at the top of your macOS desktop, select .
3. In the Network dialog box, set the DNS of the macOS client to the internal IP address of the AD domain server.

Verify the connection between the macOS client and the AD domain.

Run the ping command to verify connectivity to the AD domain. The following example shows a successful connection.

IT-C02WW0JRG8WN:Volumes xxx$ ping smb-hk.com
PING smb-hk.com (172.31.59.36): 56 data bytes
64 bytes from 172.31.59.36: icmp_seq=0 ttl=127 time=172.032 ms
64 bytes from 172.31.59.36: icmp_seq=1 ttl=127 time=173.217 ms
64 bytes from 172.31.59.36: icmp_seq=2 ttl=127 time=176.154 ms
^C
--- smb-hk.com ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 172.032/173.801/176.154/1.733 ms
IT-C02WW0JRG8WN:Volumes xxx$

Mount the SMB file system using the Kerberos protocol.

Run kinit to verify your AD domain credentials. Example:
```
kinit user@MYDOMAIN.COM
```
Run the klist command to view the AD domain identity. Example:
```
klist
```
Run the kinit command to obtain a Kerberos ticket for the AD domain identity. Example:
```
kinit
```

Run the command to mount the SMB file system. Example:

mount_smbfs //administrator@nas-mount-point.nas.aliyuncs.com/myshare /Volumes/myshare

Note

If you receive an error message such as mount_smbfs: server rejected the connection: Authentication error, run the kinit command to verify your AD domain credentials, and then try again.

The following example shows the complete process of obtaining a Kerberos ticket, mounting the file system, and verifying the mount:

IT-C02WW0JRG8WN:Volumes xxx$ kinit xxx@SMB-HK.COM
xxx@SMB-HK.COM's password:
IT-C02WW0JRG8WN:Volumes xxx$ klist
Credentials cache: API:25A9ACD7-9930-499C-81DF-3EF76C83EE36
        Principal: xxx@SMB-HK.COM
  Issued                Expires               Principal
Apr 15 03:49:18 2020  Apr 15 13:49:12 2020  xxx              xxx@SMB-HK.COM
IT-C02WW0JRG8WN:Volumes xxx$ mount_smbfs '//xxx.nas.aliyuncs.com/myshare' /Volumes/myshare
IT-C02WW0JRG8WN:Volumes xxx$ mount
/dev/disk1s1 on / (apfs, local, journaled)
devfs on /dev (devfs, local, nobrowse)
/dev/disk1s4 on /private/var/vm (apfs, local, noexec, journaled, noatime, nobrowse)
map -hosts on /net (autofs, nosuid, automounted, nobrowse)
map auto_home on /home (autofs, automounted, nobrowse)
/dev/disk1s3 on /Volumes/Recovery (apfs, local, journaled, nobrowse)
//xxx@xxx.nas.aliyuncs.com/myshare on /Volumes/myshare (smbfs, nodev, nosuid, mounted by xxx)
IT-C02WW0JRG8WN:Volumes xxx$

After a successful mount, running the klist command shows two service principals, as follows:

$ klist
Credentials cache: API:25A9ACD7-9930-4xxx
        Principal: xxxr@SMB-HK.COM
  Issued                Expires               Principal
Apr 15 03:49:18 2020  Apr 15 13:49:12 2020  krbtgt/SMB-HK.COM@SMB-HK.COM
Apr 15 03:49:27 2020  Apr 15 13:49:12 2020  cifs/xxx.cn-hongkong.nas.aliyuncs.com@SMB-HK.COM

Note

Although macOS Finder does not display SMB ACLs, the AD domain identity is still enforced. When you perform a file operation, the SMB file system checks the ACL to allow or deny the action. To set ACLs, mount the SMB file system on the AD domain server and configure them there.