Understanding authentication issues

Types of authentication

There are three types of authentication for the filer:

Traditional UNIX authentication
Windows workgroup authentication
Windows Kerberos authentication

UNIX Mode authentication

Using UNIX mode, authentication is performed using entries in the /etc/passwd file and/or using NIS/LDAP-based authentication.

Using UNIX authentication:

Passwords are sent "in the clear" (unencrypted).
Authenticated users are given credentials with no unique user identification (SID).

The filer verifies the received password against a "hash" (algorithmic variant) of the user password. Passwords are not stored on the filer.

Configuration requirements for UNIX authentication

In order to provide UNIX client authentication, the following items must be configured:

Client information must be in the filer /etc/passwd file.
Client information must be entered in NIS and/or LDAP.
Windows client registries must be modified to allow plain text passwords.

Because UNIX authentication transmits unencrypted passwords, Windows clients require a registry edit to enable them to send passwords without encryption. Clients that are not properly configured to send clear text passwords to the filer may be denied access and display an error message similar to the following:

System error 1240 has occurred.

The account is not authorized to login from this station.

Enabling plain text passwords for Windows clients

Refer to Microsoft support for information to enable plain text passwords, to allow clients to use UNIX authentication.

Workgroup authentication

Workgroup authentication allows local Windows client access. Workgroup authentication

Does not rely upon a domain controller
Limits filer access to 96 local clients
Is managed using the filer's useradmin command

For more information about managing local user accounts in workgroups, see Understanding local user accounts.

Kerberos authentication

Upon connection to the filer, the client will negotiate the highest possible security level. There are two primary levels of security that can be chosen:

Basic (Windows NT-4) security, based on network services such as NTLM, lanman, and netlogon
Extended security using Windows 2000 Kerberos implementation
Note
Extended security features are only available to clients that are members of a Windows Active Directory domain.