Managing NDMP security features
About NDMP security features
Data ONTAP provides the following commands to enable you to manage and monitor the security of NDMP connections to the storage system.
- The options ndmpd.access command enables you to restrict which hosts can run NDMP sessions with the storage system. For details see Specifying NDMP access by host or interface.
- The ndmpd authtype command enables you to specify the authentication method (plaintext, challenge, or both) through which users are allowed to start NDMP sessions with the storage system. For details see Specifying the NDMP authentication type.
- The options ndmpd.connectlog command allows you to enable or disable logging of NDMP connections attempts with the storage system. For details see Enabling or disabling NDMP connection logging.
- The options ndmpd.password_length command allows you specify an 8-character or 16-character NDMP password. For details see Specifying the NDMP password length.
- The ndmpd password command enables even administrators with non-root level privilege on the storage system to obtain a system-generated secure password. This is the password that will allow them to carry out NDMP operations, either through an NDMP-compliant backup application or through the storage system command-line interface (CLI) that require a password. For details see Generating an NDMP-specific password for non-root administrators.
Specifying NDMP access by host or interface
You can use the options ndmpd.access configuration to specify the hosts or interfaces through which NDMP sessions are permitted. If you use this option to list specific authorized hosts or interfaces, NDMP sessions will be refused through any host or interface that is not listed by this option. Conversely, you can also specify hosts or interfaces to block from NDMP sessions.
To specify permitted hosts or interfaces, complete the following steps.
Step
|
Action
|
|---|
|
1
|
Start a console session on the storage system to which you want to restrict NDMP access.
|
|
2
|
Enter the following command:
options ndmpd.access
{all|legacy|host[!]=hosts|if[!]=interfaces}
all is the default value, which permits NDMP sessions with any host.
legacy restores previous values in effect before a Data ONTAP version upgrade. In the case of Data ONTAP 6.2, the legacy value is equal to all.
host=hosts is a parameter string that allows a specified host or a comma-separated list of hosts to run NDMP sessions on this storage system. The hosts can be specified by either hostname or IP address.
host!=hosts is a parameter string that blocks a specified host or a comma-separated list of hosts from running NDMP sessions on this storage system. The hosts can be specified by either hostname or IP address.
if=interfaces is a parameter string that allows NDMP sessions through a specified interface or a comma-separated list of interfaces on this storage system.
if!=interfaces is a parameter string that blocks NDMP sessions through a specified interface or a comma-separated list of interfaces on this storage system.
|
Specifying the NDMP authentication type
Data ONTAP supports two methods, plaintext and challenge, for authenticating NDMP access to a storage system.
You can use the options ndmpd.authtype command to specify whether a storage system will accept plaintext, challenge, or both plaintext and challenge methods to authenticate NDMP session requests. To specify the authentication type, complete the following steps.
Step
|
Action
|
|---|
|
1
|
Start a console session on the storage system whose NDMP authentication method you want to specify.
|
|
2
|
Enter one of the following command lines:
options ndmpd.authtype challenge
options ndmpd.authtype plaintext
options ndmpd.authtype plaintext,challenge
The first command line accepts the challenge authentication method, generally the preferred and more secure authentication method.
The second command line accepts the plaintext authentication method, in which the login password is transmitted as clear text.
The third command line accepts both challenge and plaintext authentication methods.
If you are carrying out NDMP operations through a backup application, the authentication type or types you specify on this command line must include the types supported by that backup application.
|
Enabling or disabling NDMP connection logging
Data ONTAP can log NDMP connection attempts in the /etc/messages file. These entries enable an administrator to determine whether and when authorized or unauthorized individuals are attempting to start NDMP sessions. The default is off.
To enable or disable logging, complete the following steps.
Step
|
Action
|
|---|
|
1
|
Start a console session on the storage system on which you want to enable or disable NDMP connection monitoring.
|
|
2
|
Enter the following command:
options ndmpd.connectlog.enabled {on|off}
The value you set for this option will persist across storage system reboots.
|
|
3
|
If you want to check attempted NDMP connection activity, use your UNIX or Windows Admin host to view your storage system's /etc/messages file. Entries recording attempted NDMP connections or operations will display the following fields:
- time
- thread
- NDMP request and action (allow or refuse)
- NDMP version
- session ID
- source IP (address of where the NDMP request originated)
- destination IP (address of the storage system receiving the NDMP request)
- source port (port through which the NDMP request was transmitted)
- storage system port through which the NDMP request was received
Example entry
Friday Sept 13:16:45:17GMT ndmpd.access allowed for
version =4, sessid=34,
from src ip = 172.29.19.40, dst ip =172.29.19.95,
src port = 63793, dst port = 10000.
|
Specifying the NDMP password length
Administrators who have an account on a storage system but do not have root status on that storage system need to input a special NDMP-specific password when carrying out NDMP-related operations on the storage system. This password is a system-generated string derived from that administrator's regular storage system account password.
The NDMP password can be either 8 or 16 characters long. The default value is 16 characters. To specify the NDMP password length, complete the following step.
Step
|
Action
|
|---|
|
1
|
On the storage system console, enter the following command:
options ndmpd.password_length length
length is either 8 or 16. If you enter a value other than 8 or 16, the storage system prompts you with the following message:
options ndmpd.password_length: Length must be either 8 or
16
Note
If this option is set to 8, all NDMP applications managing backups for the storage system must use a 8 character password for authentication.
|
Generating an NDMP-specific password for non-root administrators
The administrator without root privilege uses this NDMP-specific password for any NDMP backup and restore operation that requires password input in either a backup application or command-line interface (CLI) environment.
Note
For information about creating accounts for administrators without root privilege, see the section about managing local user accounts in the introduction to storage system administration chapter of the System Administration Guide.
The administrator without root privilege obtains an NDMP-specific password by completing the following steps:
Step
|
Action
|
|---|
|
1
|
Start a console session on the storage system you want to access.
|
|
2
|
Enter the following command:
ndmpd password username
username is the username of the administrator.
The system returns an 8 or 16 character string, depending on the ndmpd.password_length option value. For example:
>ndmp password barbaraD
>ndmp password: QM12N%$cnaFWPBVe
You use this password in any current or future NDMP operation that requires password input.
Note
This NDMP-specific password is valid until you change the password to your regular account.
|
|
3
|
If you change the password to your regular storage system account, repeat this procedure to obtain your new system-generated NDMP-specific password.
|
Copyright © 1994-2005, Network Appliance, Inc. All rights
reserved.
Part No. 210-01080_B0
File: ndmp6.htm
Last updated: 08-Dec-2005 13:23:45