Dell VNX2 Configuring and Managing CIFS on VNX VNX1-VNX2 - Page 20

Kerberos SPN Mismatch, password change.

Get Dell VNX2 PDF manuals and user guides View all Dell VNX2 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 20 highlights

Concepts Kerberos authentication uses a KDC to confirm the identity of a CIFS server that is attempting to communicate with a domain or trying to access Windows network services. Every computer, server, or client joined to a domain has a unique password associated with a computer account in the active directory (AD). A password authenticates the identity of a CIFS server that attempts to communicate with a domain controller. After you join a CIFS server to a domain or change the computer account password of a CIFS server, Kerberos generates a set of encryption and decryption keys that it shares with the domain controller. When the KDC receives an authentication request from a CIFS server, it performs authentication by decrypting the preauthentication data sent by the Data Mover with the decryption keys. If the decryption succeeds and the preauthentication data is accurate, the CIFS server is authenticated. After a CIFS server is authenticated, the KDC generates an initial ticket called the Ticket-granting Ticket (TGT), as shown in Figure 2 on page 20. The TGT is a special ticket that enables the CIFS server to request services to the KDC. Figure 2 Kerberos authentication CIFS server 1 Domain controller 2 (KDC) 1 Presents key for authentication 2 Verifies CIFS server and provides TGT CNS-000735 The Microsoft website provides a detailed description of Kerberos authentication. For domain configurations with multiple domain controllers, computer accounts and passwords are replicated to all domain controllers during AD replication. Because AD replication occurs at scheduled intervals, a delay in updating all the domain controllers with a new password can occur, possibly causing failed authentication attempts. The Data Mover retains a history of the new and old passwords of each CIFS server. When a Windows client attempts to open a new session with a Data Mover, the service ticket sent by the client is decrypted using the decryption key generated from the CIFS server computer account password. If the decryption fails, another attempt is made by using the key generated from the previous passwords. When a password is updated twice on the same domain controller or on different domain controllers without AD replication, the Data Mover only uses the first password update; it does not recognize the second password change. Set maximum number of passwords to retain in Kerberos authentication on page 66 provides procedural information. Kerberos SPN Mismatch CIFS allows Windows clients to connect to the Data Movers and mount shares. For Windows Server domains, Kerberos authentication is used as an authentication mechanism, although NTLM (pre-Windows 2000) authentication is still available, for backwards compatibility. When Kerberos authentication is not used or fails, the use of NTLM authentication significantly increases the load on the Windows domain controller. In addition, NTLM authentication is not considered to be as secure as Kerberos authentication. The Kerberos Workstream feature addresses this. If Kerberos is not configured correctly, that is, if SPNs do not exist or are out of sync and do not match the DNS hostname entries, the Kerberos authentication fails and the client may revert to NTLM to connect to the Data Mover. If this happens, the user has to be notified to diagnose and fix the issue. 20 EMC VNX Series VNX1, VNX2 Configuring and Managing CIFS on VNX

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
Kerberos authentication uses a KDC to confirm the identity of a CIFS server that is
attempting to communicate with a domain or trying to access Windows network services.
Every computer, server, or client joined to a domain has a unique password associated
with a computer account in the active directory (AD). A password authenticates the
identity of a CIFS server that attempts to communicate with a domain controller.
After you join a CIFS server to a domain or change the computer account password of a
CIFS server, Kerberos generates a set of encryption and decryption keys that it shares
with the domain controller. When the KDC receives an authentication request from a CIFS
server, it performs authentication by decrypting the preauthentication data sent by the
Data Mover with the decryption keys. If the decryption succeeds and the pre-
authentication data is accurate, the CIFS server is authenticated. After a CIFS server is
authenticated, the KDC generates an initial ticket called the Ticket-granting Ticket (TGT),
as shown in
Figure 2 on page 20
. The TGT is a special ticket that enables the CIFS server
to request services to the KDC.
Figure 2
Kerberos authentication
1
2
1
2
CIFS server
Domain controller
(KDC)
Presents key for authentication
Verifies CIFS server and provides TGT
CNS-000735
The Microsoft website provides a detailed description of Kerberos authentication.
For domain configurations with multiple domain controllers, computer accounts and
passwords are replicated to all domain controllers during AD replication. Because AD
replication occurs at scheduled intervals, a delay in updating all the domain controllers
with a new password can occur, possibly causing failed authentication attempts. The
Data Mover retains a history of the new and old passwords of each CIFS server. When a
Windows client attempts to open a new session with a Data Mover, the service ticket sent
by the client is decrypted using the decryption key generated from the CIFS server
computer account password. If the decryption fails, another attempt is made by using the
key generated from the previous passwords. When a password is updated twice on the
same domain controller or on different domain controllers without AD replication, the
Data Mover only uses the first password update; it does not recognize the second
password change.
Set maximum number of passwords to retain in Kerberos authentication on page 66
provides procedural information.
Kerberos SPN Mismatch
CIFS allows Windows clients to connect to the Data Movers and mount shares. For
Windows Server domains, Kerberos authentication is used as an authentication
mechanism, although NTLM (pre-Windows 2000) authentication is still available, for
backwards compatibility.
When Kerberos authentication is not used or fails, the use of NTLM authentication
significantly increases the load on the Windows domain controller. In addition, NTLM
authentication is not considered to be as secure as Kerberos authentication.
The Kerberos Workstream feature addresses this. If Kerberos is not configured correctly,
that is, if SPNs do not exist or are out of sync and do not match the DNS hostname
entries, the Kerberos authentication fails and the client may revert to NTLM to connect to
the Data Mover. If this happens, the user has to be notified to diagnose and fix the issue.
Concepts
20
EMC VNX Series
VNX1, VNX2
Configuring and Managing CIFS on VNX