Providing secure NFS access

What secure NFS access does

Secure NFS access uses an authentication protocol to ensure the security of data and the identity of users within a controlled domain.

Authentication protocol used

Data ONTAP provides secure NFS access using the Kerberos v5 authentication protocol.

Data ONTAP Kerberos KDC options

The Data ONTAP Kerberos v5 implementation supports two Kerberos Key Distribution Center (KDC) types:

KDC Type	Description
Active Directory-based	The Windows domain is the Kerberos realm. CIFS and the Active Directory server must use the same domain controller.
UNIX-based KDC	The UNIX domain is not always equivalent to the Kerberos realm. Because of the unavailability of UNIX-based KDCs that support Kerberos for CIFS, a filer configured to run both an NFS and CIFS server cannot support Kerberos for CIFS.

Note
A filer can support only one KDC type at a time.

NFS clients supporting Kerberos v5 security

Kerberos v5 authentication supports the following popular clients:

Note
The list of clients that support Kerberos v5 security only includes widely used clients that have been tested either in Network Appliance's laboratory or at interoperability test events, such as Connectathon (www.connectathon.org). For information about using Kerberos v5 with other clients, contact your NFS client vendor and verify that their products support RFC1964 and RFC2203.

Operating system	Versions supported for Kerberos v5	Required software and availability notes
Linux	Linux 2.6 running NFS version 4	No additional software is necessary.
Solaris	Solaris 2.6 running NFS version 2 (NFSv2) or NFS version 3 (NFSv3)	Sun Enterprise Authentication Mechanism (SEAM) 1.0, available in Sun Microsystems' Solaris Easy Access Server (SEAS) 3.0 product bundle
	Solaris 7 running NFSv2 or NFSv3	SEAM 1.0, available from Sun Microsystems' SEAS 3.0 product bundle
	Solaris 8 running NFSv2 or NFSv3	SEAM 1.0.1, available from Sun Microsystems' Solaris 8 Admin Pack or the Solaris 8 Encryption Pack at www.sun.com
	Solaris 9 running NFSv2 or NFSv3	No additional software is necessary.
	Solaris Express (Solaris 10) running NFSv2, NFSv3, or NFSv4	No additional software is necessary.
Windows	Windows clients running NFSv2 or NFSv3	Hummingbird NFS Maestro version 7 or NFS Maestro Solo version 7
Windows	Windows clients running NFSv2, NFSv3, or NFSv4	Hummingbird NFS Maestro Client version 8 or NFS Maestro Solo version 8

Specifying secure NFS

You specify secure NFS using the exportfs command or by setting the resource entry in the /etc/exports file. For information about exporting resources with security services, see Specifying security services.

To specify secure NFS, complete the following steps.

Step

Action

1
Edit the resource entry in the /etc/exports file to include the security service you want.

Example

/vol/vol0 -rw=host1,sec=krb5

2
Enter the following command:

exportfs path_name

path_name is a file or directory.

Example

exportfs /vol/vol0

Step	Action
1	Edit the resource entry in the /etc/exports file to include the security service you want. Example /vol/vol0 -rw=host1,sec=krb5
2	Enter the following command: exportfs path_name path_name is a file or directory. Example exportfs /vol/vol0

Enabling Kerberos v5 security services for NFS

Before the security options you specify using the exportfs sec option will work, you need to use nfs setup to enable security services. The nfs setup script prompts you to specify either an Active Directory Kerberos v5 Key Distribution Center (KDC), or a UNIX-based KDC. Steps for configuring the filer to use an Active Directory KDC and a UNIX-based KDC are described separately, in the following sections.

Setting up security services using a Windows Active Directory-based KDC

The security service setup procedure adds a filer to an Active Directory-based KDC as a service principal called nfs/hostname.domain@REALM.

There are two scenarios for using nfs setup to configure Data ONTAP for an Active Directory-based KDC:

If have already run cifs setup and configured Data ONTAP to use Active Directory for CIFS, nfs setup automatically uses some of the configuration information you specified for CIFS.
If have not run cifs setup to configure CIFS, you need to enter the configuration information that would otherwise have been taken from your CIFS configuration.
Note
Regardless of which protocol you configure first, you must configure CIFS and NFS Kerberos v5 security to use the same Active Directory realm.

Setting up NFS Active Directory KDC services before configuring CIFS

To set up Kerberos security services using a Windows Active Directory KDC before CIFS is set up, you need to do the following:

Configure the filer to use Active Directory as the DNS server.
Configure the filer to use your Active Directory KDC.

Configuring the filer to use Active Directory as the DNS server

To configure the filer to use Active Directory-based domain name service, modify the /etc/resolv.conf file as necessary to ensure that it lists only Active Directory servers, as described in the following step.

Step	Action
1	Modify the filer's /etc/resolv.conf file as necessary to list only the Active Directory servers for the realm. Example: For a Kerberos realm in which the Active Directory servers are 172.16.1.180 and 172.16.1.181, change /etc/resolv.conf to include only the following Active Directory server entries: nameserver 172.16.1.180 nameserver 172.16.1.181 Make sure you remove all other Active Directory server entries for that realm.

Step

Action

Modify the filer's /etc/resolv.conf file as necessary to list only the Active Directory servers for the realm.

Example:

For a Kerberos realm in which the Active Directory servers are 172.16.1.180 and 172.16.1.181, change /etc/resolv.conf to include only the following Active Directory server entries:

nameserver 172.16.1.180

nameserver 172.16.1.181

Make sure you remove all other Active Directory server entries for that realm.

Configuring the filer to use an Active Directory-based KDC

To configure the filer to use an Active Directory-based KDC, run the nfs setup script and enter configuration information as described in the following steps.

Note
If you have already used nfs setup to enter configuration information, the prompts you receive may differ from those shown in the following procedure.

Step	Action
1	Enter the following command: nfs setup Result You receive the following message from `nfs setup`: `Enable Kerberos for NFS?`
2	Enter `y` to continue. Result: You are asked to specify the type of KDC. The filer supports these types of Kerberos Key Distribution Centers (KDCs): 1 - UNIX KDC 2 - Microsoft Active Directory KDC Enter the type of your KDC (1-2):
3	Enter `2`. Result: You are prompted to specify the filer name. The default name of this filer will be 'SERVER' Do you want to modify this name? [no]:
4	Enter `yes` to be prompted for a filer name or press `Enter` to access the default filer name "SERVER". If you have previously assigned a name to the filer, it will appear in place of the default filer name. Result: You are prompted to specify the domain name for the filer's Active Directory server. `Enter the Windows Domain for the filer []:`
5	Enter the domain name for the Active Directory server, as shown below. Example `ADKDC.LAB.DOCEXAMPLE.COM` Result: The domain name you enter is also used as the Kerberos realm name. You are prompted to set up a local administrator account.
6	Enter the local administrator account information. Note This step has no effect on Kerberos configuration for an Active Directory KDC.
7	After you enter local administrator account information, verify that you receive a message that looks similar to the following example. ADKDC.LAB.DOCEXAMPLE.COM is a Windows 2000(tm) domain. This message verifies that the filer was able to find the Active Directory server, and that the filer has determined this server can function as a KDC server. If you do not receive a message such as this one, it indicates that there may be a problem with the Active Directory server, or that the DNS server for the filer is not an Active Directory server. Check your network configuration, then run `nfs setup` again.
8	When you receive the following type of message, enter name and password information for the Active Directory domain administrator: In order to create this filer's domain account, you must supply the name and password of an administrator account with sufficient privilege to add the filer to the ADKDC.LAB.DOCEXAMPLE.COM domain. Please enter the Windows 2000 user [Administrator@ADKDC.LAB.DOCEXAMPLE.COM] Password for Administrator: Result: If the password is correct and the specified account has the proper permissions within the filer domain, you receive the following type of message: CIFS - Logged in as administrator@ADKDC.LAB.DOCEXAMPLE.COM. Welcome to the ADKDC (ADKDC.LAB.DOCEXAMPLE.COM) Windows 2000(tm) domain. Kerberos now enabled for NFS. NFS setup complete.
8

Note
You may see the following message in the output text upon completion of NFS setup. This output is an artifact of the installation process, and can be ignored:
CIFS is not licensed. (Use the "license" command to license it.)

Setting up NFS Active Directory KDC services after configuring CIFS

To set up Kerberos security services using a Windows Active Directory KDC after CIFS has been set up, complete the following steps.

Note
If you have already used nfs setup to enter configuration information, the prompts you receive may differ from those shown in the following procedure.

Step

Action

Enter the following command:

nfs setup

Result

You receive the following message from nfs setup:

Enable Kerberos for NFS?

Enter y to continue.

Result:

You are asked to specify the type of KDC.

The filer supports these types of Kerberos Key 
Distribution Centers (KDCs):

1 - UNIX KDC

2 - Microsoft Active Directory KDC

Enter the type of your KDC (1-2):

Enter 2.

Result:

You receive the following message:

Kerberos now enabled for NFS.

NFS setup complete.

The Data ONTAP is now configured for Active Directory-based KDC Kerberos over NFS.

Setting up security services using a UNIX-based KDC

To set up Kerberos security services using a UNIX-based KDC, you need to

Create a principal (a realm user ID) and generate a keytab (key table file) for the filer
Configure Data ONTAP to use your UNIX-based KDC

Procedures for these tasks are provided in the following sections. These procedures show by example how to add a filer to a standard UNIX-based KDC as a service principal called nfs/hostname.domain@REALM.

Note
Due to proprietary restrictions, there are no UNIX-based Kerberos implementations that support CIFS clients. If you configure Data ONTAP for UNIX-based KDC services, be aware that you cannot authenticate CIFS clients.

If you have used previous Data ONTAP versions

In previous Data ONTAP versions, you had to set up Kerberos by using the options command to enter values for each Data ONTAP NFS option. Now, you use the nfs setup script to set up Kerberos. See Data ONTAP command reference information about NFS Kerberos options (options nfs.kerberos.*) you can modify without running nfs setup.

Before you set up security services on the filer

Make sure the following requirements are met:

An NFS client and a UNIX-based KDC are set up, with client principals for root and at least one non-root client.
NFS access is verified for a client and an existing network server.
Note
It is strongly recommended that you enable DNS on your filer before setting up and using secure NFS. If the host component is not already a fully qualified domain name and DNS has not been enabled, then you will need to change all your NFS server principal names in order to enable DNS later.

Creating a principal and generating a keytab file

To create a principal and generate a keytab file, complete the following steps.

Note
The following steps for creating the server principal and keytab on the NFS server are performed using Massachussetts Institute of Technology (MIT) KDC software. If you do not use MIT KDC software, see your software product documentation.

Step	Action
1	If any version of Kerberos is currently enabled on the filer, you must first disable it by running `nfs setup`. On the filer, enter the following command: nfs setup Result If any form of Kerberos is currently enabled, the following prompt appears: Disable Kerberos for NFS? Regardless of your response (`y` or `n`), the filer terminates NFS setup; if you choose to disable Kerberos, the filer first disables any current Kerberos implementation you have configured. For UNIX-based Kerberos, the `nfs.kerberos.file_keytab.enable` option is set to off.
2	On a UNIX or Linux system that supports UNIX-based Kerberos v5 services, enter the `kadmin` command or, if logged into the KDC, enter the `kadmin.local` command.
3	On the `kadmin` or `kadmn.local` command line, enter the following command: ank -randkey nfs/hostname.domain hostname is the host name of the NFS server principal. domain is the domain of the NFS server principal. Example kadmin: ank -randkey nfs/server.lab.netapp.com Result A principal is created for the NFS server, for example, nfs/server.lab.netapp.com@LAB.NETAPP.COM, where the realm is @LAB.NETAPP.COM.
4	On the `kadmn` or `kadmn.local` command line, enter the following command: xst -k/tmp/filer.krb5.keytab nfs/hostname.domain hostname is the host name of the server principal created in Step 3. domain is the domain of the server principal created in Step 3. Example kadmin: xst -k/tmp/filer.krb5.keytab nfs/server.lab.netapp.com Result In this example, a keytab is created for the server principal nfs/server.lab.netapp.com@LAB.NETAPP.COM. The KVNO 3 encryption type DES-CBC-CRC is added to the keytab WRFILE:/tmp/filer.krb5.keytab.
5	On the NFS server, enter the following command: cp /tmp/filer.krb5.keytab /net/filer/vol/vol0/etc/krb5.keytab Result The keytab is copied to the filer. Note Once the keytab is copied to the filer, be sure you do not export the /etc subdirectory of the volume. If you export the /etc subdirectory, clients can read the key information and could masquerade as the filer.
6	To copy the krb5.conf file to the filer, do one of the following: On a UNIX client running MIT KDC software, enter the following command: `cp /etc/krb5.conf /net/filer/vol/vol0/etc/krb5.conf` On a Solaris client running SEAM, enter the following command: `cp /etc/krb5/krb5.conf /net/filer/vol/vol0/etc/krb5.conf`

Configuring Data ONTAP for UNIX KDC services

Complete the following steps to configure Data ONTAP for a UNIX-based KDC server.

Note
The nfs setup script permits you to configure the filer for a UNIX-based KDC before creating the server principal and keytab file. However, you need to create the server principal and keytab file before you can use Kerberos.


nfs setup
The filer supports these types of Kerberos Key 
Distribution Centers (KDCs):
There is no /etc/krb5.conf file yet. You will need to 
establish one.
Enter the Kerberos realm name.
Enter the host instance of the NFS server principal name 
[default: server.lab.netapp.com]:

Step	Action
1	Enter the following command: nfs setup Result You receive the following message from `nfs setup`: `Enable Kerberos for NFS?`
2	Enter `y` to continue. Result: You are asked to specify the type of KDC. The filer supports these types of Kerberos Key Distribution Centers (KDCs): 1 - UNIX KDC 2 - Microsoft Active Directory KDC Enter the type of your KDC (1-2):
3	Enter `2`. Result If you have not yet set up your server principal file and keytab file as described earlier in this procedure, you will receive either or both of the following warnings, but the setup process will continue. There is no /etc/krb5.conf file yet. You will need to establish one. There is no /etc/krb5.keytab file yet. You will need to establish one. If you have previously used a Windows-based version of Kerberos, you may receive a warning to let you know that UNIX-based KDCs cannot validate CIFS clients. It appears that CIFS has been set up to use Kerberos. CIFS requires an Active Directory KDC. If you want to use a UNIX KDC with NFS, you will not be able to secure CIFS with a Kerberos KDC. Do you wish to continue with setup for a UNIX KDC? A negative response terminates the `nfs setup` script without saving any of your changes.
4	Enter the Kerberos realm name when you receive the following prompt: Enter the Kerberos realm name. The realm name is the realm-specific part of the NFS server's Kerberos principal name (the name you specified for the NFS server principal). Example NETAPP.COM The realm name you enter can be verified or modified later by changing the value of the `nfs.kerberos.realm` option: *options nfs.kerberos.realm [realm_name]* Example options nfs.kerberos.realm LAB.NETAPP.COM
5	Enter a host instance when you receive the following prompt: Enter the host instance of the NFS server principal name [default: server.lab.netapp.com]: Example server.lab.netapp.com Result If DNS is enabled, it is used to verify that you have entered a fully qualified domain name for your host. If you have entered a partial name and your host has been entered in DNS, the missing domain information will be appended to your entry. The host instance you enter can be verified using the `nfs.kerberos.principal` option. options nfs.kerberos.principal The `nfs setup` script uses your entries for the host instance and realm name to identify the Kerberos principal. The principal is derived from `nfs setup` entries as described below: nfs/<value from nfs.kerberos.principal>@<value from nfs.kerberos.realm> Once you enter the host instance and exit `nfs setup`, the filer is configured to use the key table file you generated. You can modify this configuration later by running `nfs setup` again.