topic Re: ntap 8.11 cluster mode in Network and Storage Protocols

ntap 8.11 cluster mode

carldubois — Fri, 14 Sep 2012 18:00:16 GMT

Hi All,

And Thanks in advance for the assistance.

Trying to probe a cifs share on a cmode simulator. As I understand it a cifs share with acl Everyone FULL should suffice.

Win XP seems to net use fine with ntlm or v2 auth to the DC in the secd.log.

Trying to do the same when probe from my application (F5 ARX), filer keeps returning STATUS_UNSUCCESSFUL.

From the looks of secd.log looks like it fails when attempting to call doAuthWithDC as pkt capture shows that a connection was not made to the DC.

Anyone have an idea as to why or what this Unexpected State is below?

0000000c.0016e890 0029dd4c Fri Sep 14 2012 17:56:14 +00:00 [kern_secd:info:2878] | [000.000.936] ERR : User Authentication procedure failed!

0000000c.0016e891 0029dd4c Fri Sep 14 2012 17:56:14 +00:00 [kern_secd:info:2878] | [000.000.943] ERR : [ 0 ms] Login attempt by domain user 'ARX\arxproxy' using NTLMv2 style security

0000000c.0016e892 0029dd4c Fri Sep 14 2012 17:56:14 +00:00 [kern_secd:info:2878] | [000.000.949] ERR : **[ 0] FAILURE: Unexpected state: Error 6978 at file:authentication/secd_seclibglue.cpp func:doAuthenticateWithDC line:733

Re: ntap 8.11 cluster mode

scottgelb — Fri, 14 Sep 2012 18:19:32 GMT

I remember seeing something about ARX not support SMB 2 yet (but that may have been added since then) but that may be related.

The -smb2-enabled option is enabled by default... does it work if you turn off smb2?

vserver cifs options modify -vserver vsname -smb2-enabled false

Re: ntap 8.11 cluster mode

carldubois — Fri, 14 Sep 2012 18:29:18 GMT

Hi Scott,

You are correct ARX does no support SMB2 as of yet.

The pkt trace indicates that XP is using SMB1 and ARX is using SMB1 as well. I tryed to turn SMB2 off as you suggested. The end result was the same. Net use via XP is fine. ARX can't probe. Crazy.

Any other thoughts?

beenz# probe authentication ntlmv2 external-filer SH_1_Filer proxy-user CertProxy_1

IP address : 10.90.67.142

SPN : VSERVER-CIFS_1@ARX.COM

User : ARX\arxproxy

Protocol : NTLMv2

Status : STATUS_UNSUCCESSFUL

Re: ntap 8.11 cluster mode

carldubois — Fri, 14 Sep 2012 18:31:35 GMT

One other note to add.

I know I saw this working with the 8.1 simulator so I am going to revist this.

Anyone have release notes between 8.1 and 8.1.1 cmode?

Thank You

Re: ntap 8.11 cluster mode

scottgelb — Fri, 14 Sep 2012 18:36:38 GMT

The 8.1.1 relnotes show support for SMB 2.1 which seems to be the major cifs change...but the client is using SMB1..unless a change or interaction issue with ARX.. Is there an F5 case open?

Re: ntap 8.11 cluster mode

carldubois — Fri, 14 Sep 2012 18:56:20 GMT

Yes, I have an internal PD bug open. This is an interop issue between the filer and ARX. Working with Engineer's in India with little response. No fault of there own considering the time difference and the fact that XP, 7 clients do work.

I can probe the DC from the filer.

ONTAP-CLUS-81::*> diag secd authentication login-cifs -node ONTAP-CLUS-81-01 -vserver vserver1 -user interopproxy

Enter the password:
Windows User: interopproxy Domain: ENGSMOKE Privs: a7
Primary Grp: S-1-5-21-448539723-1844237615-725345543-513
      Domain: S-1-5-21-448539723-1844237615-725345543 Rids: 30841, 512, 513, 519, 1221
      Domain: S-1-1 Rids: 0
      Domain: S-1-5 Rids: 11, 2
     Unix ID: 0, GID: 1
       Flags: 1
   Domain ID: 0
Other GIDs:
Authentication Succeeded.

Re: ntap 8.11 cluster mode

carldubois — Fri, 14 Sep 2012 19:14:28 GMT

Same thing with 8.1 cmode sim. Something small I am overlooking here.

Is it OK to use root as the default cifs unix user?

Re: ntap 8.11 cluster mode

scottgelb — Fri, 14 Sep 2012 19:17:10 GMT

Most use pcuser but we have had root set in some installs...as long as there is a mapping that is what is needed. You can modify the default to pcuser and make sure the unixuser exists for pcuser but doesn't sound like the cause.

Re: ntap 8.11 cluster mode

carldubois — Fri, 14 Sep 2012 19:22:11 GMT

Thanks Scott, I'll try. I assumed that would not work becuase of UID / GID being 65534 65534. I think root squash. Could be way off here.

Does cifs options default user = pcuser sufficent enough for mapping win user to unix user?

Re: ntap 8.11 cluster mode

carldubois — Fri, 14 Sep 2012 19:25:22 GMT

Same behavior using pcuser for default unix user.

Missing something small here.

Re: ntap 8.11 cluster mode

scottgelb — Fri, 14 Sep 2012 19:28:06 GMT

ONTAP just requires a mapping for default unix_user for cifs.. odd but just used to it for years now. Or unless you had explicit mappings for each user...but when native cifs it isn't using the 65534 uid for access.

Re: ntap 8.11 cluster mode

carldubois — Fri, 14 Sep 2012 19:34:34 GMT

No explicit name mappings, just cifs default unix user. Acl is FULL / Everyone. Hmm, I am missing something. What if I extend to ACL to give FULL access to Domain Users and Domain Admins.

Re: ntap 8.11 cluster mode

scottgelb — Fri, 14 Sep 2012 19:43:28 GMT

Worth a try... odd that XP works and not the ARX.... Can you try using the same username on XP and ARX with the same result ?

Re: ntap 8.11 cluster mode

carldubois — Fri, 14 Sep 2012 19:45:00 GMT

Is there a Local Administrators Group on the Filer? Created a folder and owner is CIFS_SERVER\Administrators. If so how do I add a user to it?

Re: ntap 8.11 cluster mode

scottgelb — Fri, 14 Sep 2012 19:47:01 GMT

In 7-mode we can create local groups/users but not in cluster-mode....so has to be on the domain.

Re: ntap 8.11 cluster mode

carldubois — Fri, 14 Sep 2012 20:34:20 GMT

OK, Thanks. Tryed to extend add an ACE for the ACL via windows and on the filer. No Luck.

Crazy.

Re: ntap 8.11 cluster mode

carldubois — Fri, 14 Sep 2012 20:59:18 GMT

Got kerberos working

IP address : 10.63.133.80

SPN : cifs-server_1@engsmoke.acopianet.com

User : interopproxy@ENGSMOKE.ACOPIANET.COM

Protocol : Kerberos

Status : STATUS_SUCCESS

Not sure why ntlm or v2 is not working.

Re: ntap 8.11 cluster mode

artik — Tue, 04 Oct 2016 20:24:30 GMT

hi carl, how did you pull it off? struggling with the same problem to test an ARX decomm POC..

thx in advance

Re: ntap 8.11 cluster mode

Bug2 — Wed, 26 Oct 2016 13:21:45 GMT

Hi Artik,

Got any lucjK? I've got the same problem.

Re: ntap 8.11 cluster mode

artik — Wed, 26 Oct 2016 15:07:34 GMT

we found an authentication error with a packet trace.

the filer is reporting "KRB5KRB_AP_ERR_MODIFIED" and "STATUS_MORE_PROCESSING_REQUIRED" in the same packet.

Unresolved.