Configuring an authentication style

About configuring an authentication style

You can configure one of the following authentication styles for the FTP service on your filer:

UNIX
NTLM
Mixed

By default, the authentication style is set to Mixed when the FTP service is enabled.

For more information about these authentication styles, see Authentication database for the FTP service.

Limitations of NTLM authentication style

Data ONTAP allows only lowercase names for user home directories. Even if you specify the user name in uppercase, you must make sure that a lowercase name is specified for the user's home directory; otherwise, the user will not be able to access files after logging in.

NTLMv2 relies on domain controller-based services which do not exist on the filer. For this reason, only NTLMv1 and earlier can be used to connect to filers operating in workgroup mode.

Workgroup filer Windows clients that use NTLM authentication should have "LAN Manager authentication level" set to a level other than "NTLMv2 Only." Setting this option changes the registry value for "LMCompatibilitylevel" to 0, 1, or 2. These are the only NTLM settings supported by the filer for workgroup environments.

Though domain-based clients in an Active Directory environment can authenticate using NTLMv2 (because requests are passed along from the filer to the domain controller), no connection information for local filer accounts will be available to the domain controller. For this reason, local filer accounts would fail authentication during attempts to connect to a filer in such an environment.

Configuring the UNIX authentication style

To configure the UNIX authentication style for the FTP service on your filer, complete the following step.

Step	Action
1	If...	Then...
	You want to use only the /etc/passwd file for authentication and have NIS disabled on your filer	Enter the following command: options ftpd.auth_style unix
	You want to use only the /etc/passwd file for authentication and have NIS enabled on your filer	Enter the following command: options ftpd.auth_style unix In the /etc/nsswitch.conf file, edit the passwd map as follows: passwd: files

	You want to use only NIS for authentication	Enter the following commands: options ftpd.auth_style unix options nis.enable on In the /etc/nsswitch.conf file, edit the passwd map as follows: passwd: nis
	You want to use only NIS for authentication
	You want to use both /etc/passwd and NIS for authentication	Enter the following commands: options ftpd.auth_style unix options nis.enable on In the /etc/nsswitch.conf file, edit the passwd map as follows: passwd: files nis
	You want to use both /etc/passwd and NIS for authentication

Configuring the NTLM authentication style

To configure the NTLM authentication style for the FTP service on your filer, complete the following step.

Step	Action
1	Enter the following command: options ftpd.auth_style ntlm options cifs.home_dir pathname pathname is location of user home directories; for example, \home. Note The home directory of a user is a combination of the path name specified by the `cifs.home_dir` option and the user ID of the user. The path name specified by the `cifs.home_dir` option is case-sensitive; however, the user ID is not case-sensitive. For example, if `cifs.home_dir` is \home and the user name is JOHN, the home directory for the user is \home\john.

Step

Action

Enter the following command:

options ftpd.auth_style ntlm

options cifs.home_dir pathname

pathname is location of user home directories; for example, \home.

Note
The home directory of a user is a combination of the path name specified by the cifs.home_dir option and the user ID of the user. The path name specified by the cifs.home_dir option is case-sensitive; however, the user ID is not case-sensitive. For example, if cifs.home_dir is \home and the user name is JOHN, the home directory for the user is \home\john.

Configuring the Mixed authentication style

To configure the Mixed authentication style on your filer, complete the following step.

Step	Action
1	Enter the following command: options ftpd.auth_style mixed

Note
If you want to use NIS for authentication of users specifying their user name without a domain name, make sure that the nis.enable option on your filer is set to On. For more information, see Authentication database for the FTP service and Configuring the UNIX authentication style.