Managing NDMP security features

About NDMP security features

Data ONTAP provides the following commands to enable you to manage and monitor the security of NDMP connections to the filer.

The options ndmpd.access command enables you to restrict which hosts can run NDMP sessions with the filer. For details see Specifying NDMP access by host or interface.
The ndmpd authtype command enables you to specify the authentication method (plaintext, challenge, or both) through which users are allowed to start NDMP sessions with the filer. For details see Specifying the NDMP authentication type.
The options ndmpd.connectlog command allows you to enable or disable logging of NDMP connections attempts with the filer. For details see Enabling or disabling NDMP connection logging.
The ndmpd password command enables even administrators with non-root level privilege on the filer to obtain a system-generated secure password. This is the password that will allow them to carry out NDMP operations, either through an NDMP-compliant backup application or through the filer command-line interface (CLI) that require a password. For details see Obtaining a generated NDMP-specific password for non-root administrators.

Specifying NDMP access by host or interface

You can use the options ndmpd.access configuration to specify the hosts or interfaces through which NDMP sessions are permitted. If you use this option to list specific authorized hosts or interfaces, NDMP sessions will be refused through any host or interface that is not listed by this option. Conversely, you can also specify hosts or interfaces to block from NDMP sessions.

To specify permitted hosts or interfaces, complete the following steps.

Step	Action
1	Start a console session on the filer to which you want to restrict NDMP access.
2	Enter the following command: *`options ndmpd.access {all\|legacy\|host[!]=`hosts`\|if[!]=`interfaces}* host=hosts is a parameter string that allows a specified host or a comma-separated list of hosts to run NDMP sessions on this filer. The hosts can be specified by either hostname or IP address. host!=hosts is a parameter string that blocks a specified host or a comma-separated list of hosts from running NDMP sessions on this filer. The hosts can be specified by either hostname or IP address. if=interfaces is a parameter string that allows NDMP sessions through a specified interface or a comma-separated list of interfaces on this filer. if!=interfaces is a parameter string that blocks NDMP sessions through a specified interface or a comma-separated list of interfaces on this filer. `all` is the default value, which permits NDMP sessions with any host. `legacy` restores previous values in effect before a Data ONTAP version upgrade. In the case of Data ONTAP 6.2, the legacy value is equal to `all`.

Step

Action

Start a console session on the filer to which you want to restrict NDMP access.

Enter the following command:

options ndmpd.access 
{all|legacy|host[!]=hosts|if[!]=interfaces}

host=hosts is a parameter string that allows a specified host or a comma-separated list of hosts to run NDMP sessions on this filer. The hosts can be specified by either hostname or IP address.

host!=hosts is a parameter string that blocks a specified host or a comma-separated list of hosts from running NDMP sessions on this filer. The hosts can be specified by either hostname or IP address.

if=interfaces is a parameter string that allows NDMP sessions through a specified interface or a comma-separated list of interfaces on this filer.

if!=interfaces is a parameter string that blocks NDMP sessions through a specified interface or a comma-separated list of interfaces on this filer.

all is the default value, which permits NDMP sessions with any host.

legacy restores previous values in effect before a Data ONTAP version upgrade. In the case of Data ONTAP 6.2, the legacy value is equal to all.

Specifying the NDMP authentication type

Data ONTAP supports two methods, plaintext and challenge, for authenticating NDMP access to a filer.

You can use the options ndmpd.authtype command to specify whether a filer will accept plaintext, challenge, or both plaintext and challenge methods to authenticate NDMP session requests. To specify the authentication type, complete the following steps.

Step	Action
1	Start a console session on the filer whose NDMP authentication method you want to specify.
2	Enter one of the following command lines: `options ndmpd.authtype challenge` `options ndmpd.authtype plaintext` `options ndmpd.authtype plaintext,challenge` The first command line accepts the challenge authentication method, generally the preferred and more secure authentication method. The second command line accepts the plaintext authentication method, in which the login password is transmitted as clear text. The third command line accepts both challenge and plaintext authentication methods. If you are carrying out NDMP operations through a backup application, the authentication type or types you specify on this command line must include the types supported by that backup application.

Step

Action

Start a console session on the filer whose NDMP authentication method you want to specify.

Enter one of the following command lines:

options ndmpd.authtype challenge

options ndmpd.authtype plaintext

options ndmpd.authtype plaintext,challenge

The first command line accepts the challenge authentication method, generally the preferred and more secure authentication method.

The second command line accepts the plaintext authentication method, in which the login password is transmitted as clear text.

The third command line accepts both challenge and plaintext authentication methods.

If you are carrying out NDMP operations through a backup application, the authentication type or types you specify on this command line must include the types supported by that backup application.

Enabling or disabling NDMP connection logging

By default Data ONTAP logs NDMP connection attempts in the /etc/syslog file. These entries enable an administrator to determine whether and when authorized or unauthorized individuals are attempting to start NDMP sessions.

To enable or disable logging, complete the following step.

Step	Action
1	Start a console session on the filer on which you want to enable or disable NDMP connection monitoring.
2	Enter the following command: `options ndmpd.connectlog.enabled {on\|off}` The value you set for this option will persist across filer reboots.
3	If you want to check attempted NDMP connection activity, use your UNIX or Windows Admin host to view your filer's /etc/syslog file. Entries recording attempted NDMP connections or operations will display the following fields: time thread NDMP request and action (allow or refuse) NDMP version session ID source IP (address of where the NDMP request originated) destination IP (address of the filer receiving the NDMP request) source port (port through which the NDMP request was transmitted) filer port through which the NDMP request was received Example entry Friday Sept 13:16:45:17GMT ndmpd.access allowed for version =4, sessid=34, from src ip = 172.29.19.40, dst ip =172.29.19.95, src port = 63793, dst port = 10000.

Step

Action

Start a console session on the filer on which you want to enable or disable NDMP connection monitoring.

Enter the following command:

options ndmpd.connectlog.enabled {on|off}

The value you set for this option will persist across filer reboots.

If you want to check attempted NDMP connection activity, use your UNIX or Windows Admin host to view your filer's /etc/syslog file. Entries recording attempted NDMP connections or operations will display the following fields:

time
thread
NDMP request and action (allow or refuse)
NDMP version
session ID
source IP (address of where the NDMP request originated)
destination IP (address of the filer receiving the NDMP request)
source port (port through which the NDMP request was transmitted)
filer port through which the NDMP request was received

Example entry

Friday Sept 13:16:45:17GMT ndmpd.access allowed for 
version =4, sessid=34,

from src ip = 172.29.19.40, dst ip =172.29.19.95,

src port = 63793, dst port = 10000.

Obtaining a generated NDMP-specific password for non-root administrators

Administrators who have an account on a filer, but do not have root status on that filer need to input a special NDMP-specific password when carrying out NDMP-related operations on the filer. This password is a system-generated string derived from the non-root administrator's regular filer account password.

The non-root administrator uses this NDMP-specific password for any NDMP backup and restore operation, in either a backup application or CLI environment, that requires password input.

The non-root administrator obtains an NDMP-specific password by completing the following steps:

Step	Action
1	Start a console session on the filer you want to access.
2	Enter the following command: ndmpd password username username is the username of the non-root administrator. The system returns a 16 character string, for example: >ndmp password barbaraD `>ndmp password: QM12N%$cnaFWPBVe` You use this password in any current or future NDMP operation that requires password input. Note This NDMP-specific password is valid until you change the password to your regular account.
3	If you change the password to your regular filer account, repeat this procedure to obtain your new system-generated NDMP-specific password.

Step

Action

Start a console session on the filer you want to access.

Enter the following command:

ndmpd password username

username is the username of the non-root administrator.

The system returns a 16 character string, for example:

>ndmp password barbaraD

>ndmp password: QM12N%$cnaFWPBVe

You use this password in any current or future NDMP operation that requires password input.

Note
This NDMP-specific password is valid until you change the password to your regular account.

If you change the password to your regular filer account, repeat this procedure to obtain your new system-generated NDMP-specific password.