Specifying security services

About security services  

Data ONTAP allows you to specify a security service for the resource you are mounting. By specifying the security service, you determine how secure NFS access is to the filer. For information about setting up secure NFS access, see Providing secure NFS access.

Security service types  

You can create different levels of secure NFS access by specifying different security service types. Data ONTAP supports two security service types. The two types, from least to most secure, are:

• UNIX (AUTH_SYS) authentication--Does not use strong cryptography and is the least secure of the security services. This is the default security service used by Data ONTAP.
• Kerberos version 5 (v5) -- Provides three methods of security:
  • Authentication (krb5) -- Uses strong cryptography to prove a user's identity to a filer and to prove a filer's identity to a user.
  • Integrity (krb5i) -- Provides a cryptographic checksum of the data portion of each request and the response message to each request. This defends against "man in the middle" tampering with filer NFS traffic.
  • Privacy (krb5p) -- Encrypts the contents of packets bidirectionally, including procedure arguments and user data, using a shared session key established by the client from the filer.

    Note
    Before you can specify a Kerberos v5 security setup, Kerberos services must be set up for NFS. For more information about setting up NFS, see Providing secure NFS access.

Specifying security services  

Data ONTAP allows you to specify more than one security service. This enables users with different types of security to have NFS access. If you want to require a particular level of security, specify only one security service in the /etc/exports file.

To specify more than one security service type, complete the following step.

/vol/vol0/home -sec=krb5:krb5i:krb5p

To specify only one security service type, complete the following step.

/vol/vol0/home -sec=krb5p

Copyright © 1994-2003, Network Appliance, Inc. All rights reserved.
Part No. 210-00473
File: nfs7.htm
Last updated: 11/25/03 18:02:36