Creating a Kerberos realm configuration

You can use System Manager to create a Kerberos realm configuration, which enables Vservers to use Kerberos security services for NFS. The Kerberos realm must be configured at the cluster level before you can associate a Kerberos realm configuration with a Vserver.

Before you begin

•	CIFS license must be installed if CIFS shares are used, and NFS license must be installed if LDAP server is used.

•	Active Directory (Windows 2003 or Windows 2008) with DES MD5 encryption capability must be available.

•	You must have set the time zone and synchronized the time across the cluster by configuring NTP.

This prevents authentication errors, and ensures that timestamps in log files are consistent across the cluster.

About this task

While creating a Kerberos realm, you have to set the following attributes in the Create Kerberos Realm wizard:

•	Name of the Kerberos realm configuration

•	Kerberos realm

•	Kerberos Key Distribution Center (KDC) vendor

•	KDC IP address and port number.

The default port number is 88.

•	Password server IP address

•	Active Directory server name and IP address if the KDC vendor is Microsoft

•	Administrative server IP address if the KDC vendor is not Microsoft

For more information about Kerberos Version 5 setup and configuration in the Cluster-Mode environment, see Technical Report 4073: Kerberos Implementation with Data ONTAP 8.1 Cluster-Mode and Windows Server 2008 R2 Active Directory.

Steps

1.	From the Home tab, double-click the appropriate storage system.

2.	Expand the Cluster hierarchy in the left navigation pane.

3.	Click Configuration > Services > Kerberos.

4.	Click Create.

5.	Type or select information as prompted by the wizard.

6.	Confirm the details and click Finish to complete the wizard.

Related tasks

Setting the time zone for a cluster