Providing secure NFS access

What secure NFS access does

Secure NFS access uses an authentication protocol to ensure the security of data and identity of users within a controlled domain.

Authentication protocol used

Data ONTAP provides secure NFS access using the Kerberos v5 authentication protocol.

Data ONTAP Kerberos KDC options

The Data ONTAP Kerberos v5 implementation supports the following Kerberos Key Distribution Center (KDC) options:

A Windows 2000-based KDC, that is, a Windows 2000 network using Kerberos authentication. The Windows 2000 domain is the Kerberos realm.
A UNIX-based KDC, that is, a UNIX network using Kerberos authentication. The UNIX domain is not always equivalent to the Kerberos realm.

Clients supported in a UNIX-based KDC

Kerberos v5 authentication supports the following clients:

Solaris 2.6 running NFS version 2 (NFSv2) or NFS version 3 (NFSv3), with Solaris Easy Access Server (SEAM) 1.0
Solaris 7 running NFSv2 or NFSv3, with Solaris Easy Access Server (SEAM) 1.0
Solaris 8 running NFSv2 or NFSv3, with SEAM 1.01 (Solaris 8 Admin Pack) or the Solaris 8 Encryption Pack
Solaris 9
Windows clients running NFSv2 or NFSv3, with Hummingbird Maestro version 7
Windows clients running NFSv2, NFSv3, or NFSv4, with Hummingbird Maestro version 8

Setting up security services using a Windows 2000-based KDC

The security service setup procedure adds a filer to a Windows 2000-based KDC as a service principal called nfs/hostname.domain@REALM.

Note
After you set up Windows 2000 security for NFS, Network Appliance does not support changing to an MIT KDC for NFS security.

To set up security service in a Windows 2000 network using the Kerberos protocol, follow these steps.

Step	Action
1	Edit the resource name in the /etc/exports file to include the security service you want. For information about exporting resources with security services, see Specifying security services. Example vol/vol0 -access=host1,sec=krb5
2	Enter the following command: exportfs path_name path_name is a file or directory. Example exportfs vol/vol0
3	Enter the following command: nfs setup Result if CIFS is already set up The nfs setup program leads you through the following prompt: `Enable Kerberos for NFS [y]:` The nfs setup program uses information you entered when you set up CIFS to connect to a Windows 2000 domain controller and completes the setup by enabling Kerberos authentication for NFS. Result if CIFS is not set up The nfs setup program leads you through the first prompt followed by these prompts: `Do you want to modify this name? [no]:` The nfs setup program uses the default filer name if you press Enter. You can change the name of the filer by entering the filer name at this prompt. `Enter the Windows Domain for the filer []:` The setup program uses the Windows domain you enter as the Kerberos realm. `Please enter the Windows 2000 user []:` The setup program requires an administrator account that can add the filer to the Windows domain. `Password for:` The setup program requires the password for the administrator account. After you enter the password, the filer connects to the Windows 2000 domain controller and completes the setup by enabling Kerberos authentication for NFS.

Step

Action

Edit the resource name in the /etc/exports file to include the security service you want. For information about exporting resources with security services, see Specifying security services.

Example

vol/vol0 -access=host1,sec=krb5

Enter the following command:

exportfs path_name

path_name is a file or directory.

Example

exportfs vol/vol0

Enter the following command:

nfs setup

Result if CIFS is already set up

The nfs setup program leads you through the following prompt:

Enable Kerberos for NFS [y]:

The nfs setup program uses information you entered when you set up CIFS to connect to a Windows 2000 domain controller and completes the setup by enabling Kerberos authentication for NFS.

Result if CIFS is not set up

The nfs setup program leads you through the first prompt followed by these prompts:

Do you want to modify this name? [no]:
The nfs setup program uses the default filer name if you press Enter. You can change the name of the filer by entering the filer name at this prompt.
Enter the Windows Domain for the filer []:
The setup program uses the Windows domain you enter as the Kerberos realm.
Please enter the Windows 2000 user []:
The setup program requires an administrator account that can add the filer to the Windows domain.
Password for:
The setup program requires the password for the administrator account.

After you enter the password, the filer connects to the Windows 2000 domain controller and completes the setup by enabling Kerberos authentication for NFS.

Setting up security services using a UNIX-based KDC

The security service setup procedure adds a filer to a standard UNIX-based KDC as a service principal called nfs/hostname.domain@REALM.

Before setting up security services, make sure the following requirements are met:

An NFS client and a UNIX-based KDC are set up, with client principals for root and at least one non-root client.
NFS access is verified between the client and a non-NetApp server.

This procedure assumes that you are using MIT KDC software for creating the server principal and keytab on the NFS server.

Note
After you set up security for NFS using an MIT KDC, Network Appliance does not support changing to Windows 2000 security for NFS.

To set up security service in a UNIX-based network using the Kerberos protocol, follow these steps.

Step	Action
1	On the NFS server, at the kadmin or kadmin.local command prompt, enter the following command: ank -randkey nfs/hostname.domain hostname is the host name of the NFS server principal. domain is the domain of the NFS server principal. Example kadmin: ank -randkey nfs/server.lab.netapp.com Result A principal is created for the NFS server, for example, nfs/server.lab.netapp.com@LAB.NETAPP.COM, where the realm is @LAB.NETAPP.COM.
2	On the NFS server, from kadmin or kadmin.local, enter the following command: xst -k/tmp/filer.krb5.keytab nfs/hostname.domain hostname is the host name of the server principal created in Step 1. domain is the domain of the server principal created in Step 1. Example kadmin: xst -k/tmp/filer.krb5.keytab nfs/server.lab.netapp.com Result In this example, a keytab is created for the server principal nfs/server.lab.netapp.com@LAB.NETAPP.COM. The KVNO 3 encryption type DES-CBC-CRC is added to the keytab WRFILE:/tmp/filer.krb5.keytab.
3	On the NFS server, enter the following command: cp /tmp/filer.krb5.keytab /net/filer/vol/vol0/etc/krb5.keytab Result The keytab is copied to the filer. Note Once the keytab is copied to the filer, be sure you do not NFS-export the /etc subdirectory of the volume. If you NFS-export the /etc subdirectory, NFS clients can read the key information and could masquerade as the filer.
4	To copy the krb5.conf file to the filer, do one of the following: On a UNIX client running MIT KDC software, enter the following command: `cp /etc/krb5.conf /net/filer/vol/vol0/etc/krb5.conf` On a Solaris client running SEAM, enter the following command: `cp /etc/krb5/krb5.conf /net/filer/vol/vol0/etc/krb5.conf`
5	On the filer, enter the following command: options nfs.kerberos.file_keytab.enable on Result Enables use of a file-based keytab in /etc/krb5.keytab.
6	Enter the following command: options nfs.kerberos.principal hostname.domain hostname is the host name of the server principal created in Step 1. domain is the domain of the server principal created in Step 1. Example options nfs.kerberos.principal server.lab.netapp.com Note Be sure that the host name and domain you enter is the same as the host name and domain you entered for the server principal in Step 1 and the keytab in Step 2. In this step, you do not enter "nfs/" before the host name.
7	Enter the following command: options nfs.kerberos.realm realm realm is the realm-specific part of the NFS server's Kerberos principal name. Example options nfs.kerberos.realm @NETAPP.COM
8	Enter the following command: exportfs -i -o sec=krb5 path_name path_name is a file or directory. Example `exportfs -i -o sec=krb5 /vol/vol0/home`