Storage systems usually store data critical for organization like databases, mailboxes, employee files, etc. Typically you don’t provide access to NAS from Internet. If Filer has real IP address to provide CIFS or NFS access inside organization you can just close all incoming connections from outside world on frontier firewall. But what if networking engineer mess up firewall configuration? If you don’t take even simple security measures then all your organization data is at risk.
Here I’d like to describe basic means to secure NetApp Filer:
- Disable rsh:
options rsh.enable off
- Disable telnet:
options telnet.enable off
- Restrict SSH access to particular IP addresses. Take into consideration that if you enabled AD authentication Administrator user and Administrators group will implicitly have access to ssh.
options ssh.access host=ip_address_1,ip_address_2
- You can configure Filer to allow files access via HTTP protocol. If you don’t have HTTP license or you don’t use HTTP then disable it:
options http.enable off
- Even if you don’t have HTTP license you can access NetApp FilerView web interface to manage Filer. You can access it via SSL or plain connection, apparently SSL is more secure:
options http.admin.enable off
options http.admin.ssl.enable on
- Restrict access to FilerView:
options httpd.admin.access host=ip_address_1,ip_address_2
- If you don’t use SNMP then disable it:
options snmp.enable off
- I’m using NDMP to backup Filer’s data. It’s done through virtual network. I restrict NDMP to work only between Filers (we have two of them) and backup server and only through particular virtual interface:
On Filer1:
options ndmpd.access “host=backup_server_ip,filer2_ip_address AND if=interface_name”
options ndmpd.preferred_interface interface_name
On Filer2:
options ndmpd.access “host=backup_server_ip,filer1_ip_address AND if=interface_name”
options ndmpd.preferred_interface interface_name
- Disable other services you don’t use:
options snapmirror.enable off
options snapvault.enable off
- Module which is responsible for SSH and FilerView SSL connections is called SecureAdmin. You probably won’t need to configure it since it’s enabled by default. You can verify if ssh2 and ssl connections are enabled by:
secureadmin status
- Make sure all built-in users have strong passwords. You can list built-in users by:
useradmin user list
- By default Filer has home directory CIFS shares for all users. If you don’t use them, disable them by deleting:
/etc/cifs_homedir.cfg
- Filer also has ETC$ and C$ default shares. I’d highly recommend to restrict access to these shares only to local Filer Administrator user. In fact, if you enabled AD authentication then also domain Administrator user and Administrators group will implicitly have access to these shares, even if you don’t specify them in ACL. Delete all existing permissions and add:
cifs access share etc$ filer_system_name\Administrator Full Control
cifs access share c$ filer_system_name\Administrator Full Control
Basically this is it. Now you can say that you know hot to configure simple NetApp security.
Niktips's Blog 