Understanding session authentication
About session authentication
Session authentication involves authenticating a client user's access for either a trusted or untrusted session. A DAFS client requests one of the following types of user access to authenticate with the filer:
- AUTH_NONE--This access bypasses authentication and can be used by a trusted user only. This is equivalent to root access. By default, AUTH_NONE is disabled.
- AUTH_TEXT--This access uses a traditional user name and password authentication.
- AUTH_GSS--This access uses GSS Host Key or Kerberos authentication.
- AUTH_DEFAULT--This access uses the default filer credentials and is similar to anonymous FTP.
Viewing filer credentials
To view the default set of filer credentials, complete the following steps.
Step
|
Action
|
|---|
|
1 |
On the filer command line, enter the following command:
options dafs.default_uid
Result
The value of the DAFS default UID (user ID) is displayed.
Example
filer> options dafs.default_uid
dafs.default_uid 122
|
|
2 |
On the filer command line, enter the following command:
options dafs.default_gid
Result
The value of the DAFS default GID (group ID) is displayed.
Example
filer> options dafs.default_gid
dafs.default_gid 122
|
Types of authentication sessions
There are two types of authenticated sessions:
- A trusted session where the client user's access has more than one set of credentials. AUTH_NONE and AUTH_TEXT access are for a trusted session.
- An untrusted session where the user's access has only one set of credentials. AUTH_DEFAULT, AUTH_TEXT, and AUTH_GSS access are for an untrusted session.
To determine whether AUTH_TEXT is for a trusted or untrusted session, the DAFS service does the following:
- If the user name and password are in the filer's user name database, then the session is trusted. The useradmin command administers the filer's user name database.
- If the user name and password are in NIS or the etc/passwd file, then the session is untrusted.
- If the user name and password are not in the filer's user name database, NIS, or etc/passwd file, then the user fails authentication and is not allowed access to the filer.
Using the dafs setup command to configure authentication
When you configure the DAFS service with the dafs setup command, you can enable or disable the filer's AUTH_NONE access. If AUTH_NONE is enabled, then all clients communicating with that filer have unlimited access to the filer. Only privileged clients that are trusted to have multiple sets of credentials should have AUTH_NONE access.
Note
AUTH_NONE access should be used in an environment where networks are secure and clients and filers are physically secured.
Enabling authentication for DAFS Database Accelerator clients
The DAFS Database Accelerator requires AUTH_NONE enabled in order to access files on the filer. To enable AUTH_NONE authentication, complete the following step.
Step
|
Action
|
|---|
|
1 |
On the filer console, enter the following command:
options dafs.auth_none.enable on
|
About the dafs kerberos command
Data ONTAP 6.4 can participate in a Kerberos v5 realm. MIT Kerberos and Windows 2000 domains are supported for those clients that use Kerberos authentication. AUTH_GSS Host Key, AUTH_GSS Kerberos, AUTH_TEXT, and AUTH_DEFAULT can be used regardless of the setting for dafs.auth_none.enable. Setting up Kerberos does not preclude HOSTKEY, TEXT, or DEFAULT authentication. The dafs kerberos command is used to enable, disable, and configure the Kerberos environment.
Example:
filer> dafs kerberos
Usage:
dafs kerberos [ setup | enable | disable ]
- Perform DAFS kerberos setup.
Enabling and configuring Kerberos authentication for DAFS clients
To enable Kerberos authentication, use the dafs kerberos setup command as shown in the following steps.
Step
|
Action
|
|---|
|
1 |
Enter the following command to check if the DAFS service is running:
dafs status -n
Result
The filer console displays the status of the DAFS service.
|
|
2 |
If....
|
Then...
|
The DAFS service is running
|
On the filer console, enter the following command:
dafs stop
Result:
The DAFS service stops.
Proceed to Step 3.
|
The DAFS service is not running
|
Proceed to Step 3.
|
|
3 |
On the filer command line, enter the following command:
dafs kerberos setup
Respond to the prompts using information for your environment.
Example
The following is an example of dafs kerberos setup for a Windows KDC authenticated environment:
filer> dafs kerberos setup
Enter the kerberos realm: realm.netapp.com
Enter the password for filer principal (1 - 63
characters):
Supported encryption algorithms are:
(1) ENCTYPE_DES_CBC_CRC
(2) ENCTYPE_DES_CBC_MD5
Enter the encryption algorithm: [2] 1
GSS/Kerberos authentication for DAFS has been setup
successfully
Please make sure the principal "
dafs/filer.realm.netapp.com@realm.netapp.com " has been
added to the
KDC
Note
The MD5 encryption algorithm is the default for MIT Kerberos. CRC is the default for Windows 2000 KDCs. For specific information, see the documentation for your Kerberos KDC. Result
The dafs kerberos setup command enables Kerberos authentication for those clients that support it and starts the DAFS protocol with Kerberos authentication enabled.
|
Enabling and disabling Kerberos authentication
You can turn Kerberos authentication on or off at any time by issuing the dafs kerberos enable or dafs kerberos disable command at the filer command prompt.
Examples
filer> dafs kerberos disable
GSS/Kerberos authentication for DAFS has been disabled
filer> dafs kerberos enable
GSS/Kerberos authentication for DAFS has been enabled
Using Host Key authentication
The filer can authenticate DAFS clients via GSS using a 128-byte key value that is known to both the client and the filer. This key is generated by the client and stored in the file /etc/dafs_key on the root volume of the filer. The format of this file is as follows:
[client name] [filer name] [128B key]
Note
For instructions on generating the [128B key] value, see your DAFS client documentation.
Copyright © 1994-2003, Network Appliance, Inc. All rights
reserved.
Part No. 210-00323
File: dafs7.htm
Last updated: 01/15/03 15:46:01