Null session access provides permissions for network resources, such as filer data, to client-based services running under the local system. A null session occurs when a client process uses the "system" account to access a network resource.
In Kerberos implementations, clients that run local processes using the "system" account assign those processes to the machine account when accessing remote resources. The machine account is assigned the computer name registered with the domain controller, followed by a dollar sign ($). Machine accounts are subjected to the same Kerberos authentication as user accounts, so they do not need to be mapped on the filer.
Because null session shares do not require authentication, clients that require null session access must have their IP addresses mapped on the filer. By default, unmapped null session clients can access certain filer services, such as share enumeration, but they are restricted from accessing any filer data.
Unless otherwise configured, a client running a local process that requests filer access through a null session is a member of only non-restrictive groups, such as "everyone." To limit null session access to selected filer resources, you may want to create a group to which all null session clients belong; creating this group enables you to restrict filer access and to set filer resource permissions that apply specifically to null session clients.
To allow access to filer resources by null session clients, configure your network by performing the following tasks:
On the filer, you grant null session access to resources by performing the following tasks:
Data ONTAP provides a mapping syntax in the /etc/usermap.cfg file to specify the IP address of clients allowed access to filer resources using a null user session. Once you create a group for null users, you can specify access restrictions for filer resources and resource permissions that apply only to null sessions.
Caution
Any null user accessing the filer from a mapped IP address is granted mapped user permissions. Consider appropriate precautions to prevent unauthorized access to filers mapped with null users. For maximum protection, place the filer and all clients requiring null user filer access on a separate network, to eliminate the possibility of IP address "spoofing."
To configure the /etc/usermap.cfg file with null users so they have access to null session shares, complete the following steps.
Copyright © 1994-2003, Network Appliance, Inc. All rights
reserved.
Part No. 210-00473
File: cifs24.htm
Last updated: 11/25/03 18:02:42