Contents
Does NFSv4 require Kerberos?
If possible, use NFSv4 or later if Kerberos authentication is required. NFSv3 can be used with Kerberos. However, the full security benefits of Kerberos are only realized in ONTAP deployments of NFSv4 or later.
Is NFSv4 secure?
If you use NFSv4 with sec=krb5p , then it is secure. (That means use Kerberos 5 for authentication, and encrypt the connection for privacy.) But if you use NFS v3 or NFS v4 with sys=system , then no, it’s not secure at all.
Does NFS support Kerberos authentication?
There are three different modes that nfs can operate in with Kerberos, which should be specified in the mount/export options: krb5 Use Kerberos for authentication only. krb5i Use Kerberos for authentication, and include a hash with each transaction to ensure integrity.
What is Kerberos in NFS?
NFS services use UNIX user IDs (UIDs) to identify a user and cannot directly use GSS credentials. Configure a Kerberos NFS server. Enables a server to share a file system that requires Kerberos authentication.
How does NFS authentication work?
When using UNIX authentication, an NFS server authenticates a file request by authenticating the computer making the request, but not the user. Users can protect the privacy of sensitive information by encrypting data that is sent over the network.
How does Kerberos work with LDAP?
LDAP and Kerberos together make for a great combination. Kerberos is used to manage credentials securely (authentication) while LDAP is used for holding authoritative information about the accounts, such as what they’re allowed to access (authorization), the user’s full name and uid.
What is Krb5p?
krb5p = privacy ONTAP 9.0 and later supports krb5p and AES-256 encryption. Krb5p is similar to SMB3 encryption/signing and sealing in its functionality. Krb5p is also similar to SMB3 encryption in its performance impact; doing encryption of thousands of packets is expensive and can create CPU bottlenecks, unless…
How to enable or disable Kerberos in NFSv4.1?
On the Create a Volume page, set the NFS version to NFSv4.1, and set Kerberos to Enabled. You cannot modify the Kerberos enablement selection after the volume is created. Select Export Policy to match the desired level of access and security option (Kerberos 5, Kerberos 5i, or Kerberos 5p) for the volume.
What was the impact of NFSv4 on security?
NFSv4 revolutionized NFS security by mandating the implementation of RPCSEC_GSS and the Kerberos version 5 GSS-API mechanism. However, RPCSEC_GSS and the Kerberos mechanism are also available for all versions of NFS. In FIPS mode, only FIPS-approved algorithms can be used.
What are the requirements for encryption in NFSv4.1?
The following requirements apply to NFSv4.1 client encryption: Active Directory Domain Services (AD DS) or Azure Active Directory Domain Services (AADDS) connection to facilitate Kerberos ticketing DNS A/PTR record creation for both the client and Azure NetApp Files NFS server IP addresses
What is NFS-server : / export / users on NFSv4?
So what would have been nfs-server:/export/users on NFSv3 is nfs-server:/users on NFSv4, because /export is the root directory. To make UID/GUD work as with NFSv3, set sec=sys both in the server’s /etc/export and in the client’s /etc/fstab.