Configuring an authentication style

About configuring an authentication style

You can configure one of the following authentication styles for the FTP service on your storage system:

UNIX
NTLM
Mixed

By default, the authentication style is set to Mixed when the FTP service is enabled.

For more information about these authentication styles, see Authentication database for the FTP service.

Limitations of NTLM authentication style

Data ONTAP allows only lowercase names for user home directories. Even if you specify the user name in uppercase, you must make sure that a lowercase name is specified for the user's home directory; otherwise, the user will not be able to access files after logging in.

NTLMv2 relies on domain controller-based services which do not exist on the storage system. For this reason, only NTLMv1 and earlier can be used to connect to NetApp storage systems operating in workgroup mode.

Workgroup storage system Windows clients that use NTLM authentication should have "LAN Manager authentication level" set to a level other than "NTLMv2 Only." Setting this option changes the registry value for "LMCompatibilitylevel" to 0, 1, or 2. These are the only NTLM settings supported by the storage system for workgroup environments.

Though domain-based clients in an Active Directory environment can authenticate using NTLMv2 (because requests are passed along from the storage system to the domain controller), no connection information for local storage system accounts is available to the domain controller. For this reason, local storage system accounts would fail authentication during attempts to connect to a storage system in such an environment.

Configuring the UNIX authentication style

To configure the UNIX authentication style for the FTP service on your storage system, complete the following step.

Step	Action
1	If...	Then...
	You want to use only the /etc/passwd file for authentication and have NIS disabled on your storage system	Enter the following command: options ftpd.auth_style unix
	You want to use only the /etc/passwd file for authentication and have NIS enabled on your storage system	Enter the following command: options ftpd.auth_style unix In the /etc/nsswitch.conf file, edit the passwd map as follows: passwd: files

	You want to use only NIS for authentication	Enter the following commands: options ftpd.auth_style unix options nis.enable on In the /etc/nsswitch.conf file, edit the passwd map as follows: passwd: nis
	You want to use only NIS for authentication
	You want to use both /etc/passwd and NIS for authentication	Enter the following commands: options ftpd.auth_style unix options nis.enable on In the /etc/nsswitch.conf file, edit the passwd map as follows: passwd: files nis
	You want to use both /etc/passwd and NIS for authentication

Configuring the NTLM authentication style

To configure the NTLM authentication style for the FTP service on your storage system, complete the following steps.

Step	Action
1	Specify the CIFS home directory in the /etc/cifs_homedir.cfg file. Note The home directory of a user is a combination of the path specified in /etc/cifs_homedir.cfg and the user ID of the user. The path specified in /etc/cifs_homedir.cfg is case-sensitive; however, the user ID is not case-sensitive. For example, if the path is \home and the user name is JOHN, the home directory for the user is \home\john.
2	Enter the following command: cifs homedir load

Step

Action

Specify the CIFS home directory in the /etc/cifs_homedir.cfg file.

Note
The home directory of a user is a combination of the path specified in /etc/cifs_homedir.cfg and the user ID of the user. The path specified in /etc/cifs_homedir.cfg is case-sensitive; however, the user ID is not case-sensitive. For example, if the path is \home and the user name is JOHN, the home directory for the user is \home\john.

Enter the following command:

cifs homedir load

Configuring the Mixed authentication style

To configure the Mixed authentication style on your storage system, complete the following step.

Step	Action
1	Enter the following command: options ftpd.auth_style mixed

Note
If you want to use NIS for authentication of users specifying their user name without a domain name, make sure that the nis.enable option on your storage system is set to On. For more information, see Authentication database for the FTP service and Configuring the UNIX authentication style.