Understanding authentication issues

Types of authentication

There are three types of authentication for NetApp storage systems:

Traditional UNIX authentication
Windows workgroup authentication
Windows Kerberos authentication

UNIX Mode authentication

Using UNIX mode, authentication is performed using entries in the /etc/passwd file and/or using NIS/LDAP-based authentication.

Using UNIX authentication:

Passwords are sent "in the clear" (unencrypted).
Authenticated users are given credentials with no unique, secure user identification (SID).

The storage system verifies the received password against a "hash" (algorithmic variant) of the user password. Passwords are not stored on the storage system.

Configuration requirements for UNIX authentication

In order to provide UNIX client authentication, the following items must be configured:

Client information must be in the storage system /etc/passwd file.
Client information must be entered in NIS and/or LDAP.
Windows client registries must be modified to allow plain text passwords.

Because UNIX authentication transmits unencrypted passwords, Windows clients require a registry edit to enable them to send passwords without encryption. Clients that are not properly configured to send clear text passwords to the storage system might be denied access and display an error message similar to the following:

System error 1240 has occurred.

The account is not authorized to login from this station.

Enabling plain text passwords for Windows clients

Refer to Microsoft support for information to enable plain text passwords, to allow clients to use UNIX authentication.

Workgroup authentication

Workgroup authentication allows local Windows client access. Workgroup authentication

Does not rely upon a domain controller
Limits storage system access to 96 local clients
Is managed using the storage system's useradmin command

For more information about managing local user accounts in workgroups, see Managing ACLs.

Kerberos authentication

Upon connection to your storage system, the client negotiates the highest possible security level. There are two primary levels of security that can be chosen:

Basic (Windows NT-4) security, based on network services such as NT Lan Manager (NTLM), lanman, and netlogon
Extended security using Windows 2000 Kerberos implementation
Note
Extended security features are only available to clients that are members of a Windows Active Directory domain.

Preventing Kerberos passive replay attacks

Kerberos replay cache prevents passive replay attacks by storing user authenticators on the storage system for a short time, and by insuring that authenticators are not reused in subsequent Kerberos tickets. The Kerberos replay cache facility in Data ONTAP can be enabled or disabled by setting the kerberos.replay_cache.enable option.

Note
Storing and comparing Kerberos authenticators can result in a substantial performance penalty for certain storage system workloads. For this reason, the kerberos.replay_cache.enable option is set to off by default.