Null session access provides permissions for network resources, such as storage system data, to client-based services running under the local system. A null session occurs when a client process uses the "system" account to access a network resource.
In Kerberos implementations, clients that run local processes using the "system" account assign those processes to the machine account when accessing remote resources. The machine account is assigned the computer name registered with the domain controller, followed by a dollar sign ($). Machine accounts are subjected to the same Kerberos authentication as user accounts, so they do not need to be mapped on the storage system.
Because null session shares do not require authentication, clients that require null session access must have their IP addresses mapped on the storage system. By default, unmapped null session clients can access certain Data ONTAP system services, such as share enumeration, but they are restricted from accessing any storage system data.
Unless otherwise configured, a client running a local process that requests storage system access through a null session is a member only of non-restrictive groups, such as "everyone." To limit null session access to selected storage system resources, you might want to create a group to which all null session clients belong; creating this group enables you to restrict storage system access and to set storage system resource permissions that apply specifically to null session clients.
To allow access to your storage system resources by null session clients, configure your network by performing the following tasks:
On the storage system, you grant null session access to resources by performing the following tasks:
Data ONTAP provides a mapping syntax in the /etc/usermap.cfg file to specify the IP address of clients allowed access to storage system resources using a null user session. Once you create a group for null users, you can specify access restrictions for storage system resources and resource permissions that apply only to null sessions.
Attention
Any null user accessing the storage system from a mapped IP address is granted mapped user permissions. Consider appropriate precautions to prevent unauthorized access to storage systems mapped with null users. For maximum protection, place the storage system and all clients requiring null user storage system access on a separate network, to eliminate the possibility of IP address "spoofing."
To configure the /etc/usermap.cfg file with null users so they have access to null session shares, complete the following steps.
Copyright © 1994-2005, Network Appliance, Inc. All rights
reserved.
Part No. 210-01086_B0
File: 3cifs49.htm
Last updated: 08-Dec-2005 13:19:35