How /etc/exports works

Specifying security services

About security services  

Data ONTAP allows you to specify a security service for the resource you are mounting. By specifying the security service, you determine how secure NFS access is to the filer. For information about setting up secure NFS access, see Providing secure NFS access.

Security service types  

You can create different levels of secure NFS access by specifying different security service types. Data ONTAP supports two security service types. The two types, in ascending order of strength, are as follows:

• UNIX authentication--Does not use strong cryptography and is the least secure of the security services.
• Kerberos version 5 (v5)--Provides three types of security service.
  • Authentication--Uses strong cryptography to prove a user's identity to a filer and to prove a filer's identity to a user.
  • Integrity--Provides a cryptographic checksum of the data portion of each request and response message in those messages to prove no attacker in the middle has tampered with the NFS traffic.
  • Privacy--Encrypts the contents of packets, including procedure arguments and user data, in both directions using a shared session key established by the client from the filer.

    Note
    UNIX authentication is the default security service used by Data ONTAP.

Specifying security services  

Data ONTAP allows you to specify more than one security service. This enables users who are using different levels of security to have NFS access. If you want users to use a particular level of security, specify only one security service in the /etc/exports file.

To specify more than one security service type, complete the following step.

/vol/vol0/home -sec=krb5:krb5i:krb5p

To specify only one security service type, complete the following step.

/vol/vol0/home -sec=krb5p

Copyright © 1994-2003, Network Appliance, Inc. All rights reserved.
Part No. 210-00323
File: nfs7.htm
Last updated: 01/15/03 15:45:12