BlueXP Services

Altavault Having issues accessing CIFS/SMB

Chiatan
4,091 Views

Hello All,

Need a bit of help, we have recently installed AltaVault (4.4), we are having issues accesing CIFS shares, here are errors we are seeing.

 

an 16 14:12:28 localhost smbd[4484]: [function/auth.WARN] (5003) [UserLogin] oem_auth_handover: Unsupported NTLMv1 authentication (user attempting login:chaitanc)
Jan 16 14:12:28 localhost smbd[4484]: [function/auth.INFO] (5003) [UserLogin] oem_auth_handover: NTLMv2 user (mfladm-chaitanc) login status 0xc0000022
Jan 16 14:12:28 localhost smbd[4484]: [handler/base.INFO] (18464) NetBiosTransport [0x19865e0] getBytes: sockFD: 21 errno: 104
Jan 16 14:12:28 localhost smbd[4484]: [handler/base.INFO] (18464) NetBiosTransport [0x19865e0] terminate: sockFD: 21
Jan 16 14:12:28 localhost smbd[4484]: [object/connection.INFO] (18464) Connection [0x19d4000] receiveWorker: connection terminated. status: 0xc000020d
Jan 16 14:12:28 localhost smbd[4484]: [object/connection.INFO] (18464) Connection [0x19d4000] receiveWorker: start termination
Jan 16 14:12:28 localhost smbd[4484]: [object/connection.INFO] (18465) Connection [0x19d4000] sendWorker: terminated
Jan 16 14:12:28 localhost smbd[4484]: [object/connection.INFO] (18464) Connection [0x19d4000] receiveWorker: terminated
Jan 16 14:12:33 localhost statsd[5803]: event_pending: event has no event_base set.

 

I have followed this, but no help.. 

 

How to ensure Kerberos connections to AltaVault data interfaces
Document ID HO1008 Description
 
How to accomplish Kerberos-based connections to AltaVault data interfaces.
 
It is often found that AltaVault is joined to a domain using the management interface and that creates a DNS entry for the management interface.
While backup applications can still connect to the data interfaces, close observation shows that this connection to data interfaces is using the NTLM protocol.
 
In some situations, connections over NTLM are considered undesirable
Example:
 
 
Assume the management interface is used to domain join. This creates a DNS entry for the management interface.
To enable Kerberos, for EACH data interface:
  • You MUST manually add a DNS entry (for each data interface)
  • You MUST manually add an SPN (for each data interface) 
  • You MUST manually flush the SMB client cache (reboot the Windows client(s) or logoff and logon (from the Windows client(s))

Anyone had similar problem ?

 

Thanks

Chaitan

1 ACCEPTED SOLUTION

chriswong
4,045 Views

Hi,

When you map the share, you should be using the FQDN of the share and AVA interface. For example, if I've set the share called share1, and an interface e0a to an IP address 10.20.30.40, then you should have a corresponding DNS entry like AVA_e0a mapping to 10.20.30.40. Then, when you map a drive in Windows Explorer, you can use the path \\AVA_e0a\share1. NTLM only occurs if you're unable to use kerberos, such as when calling a share by IP and not DNS name.

 

Does that help?

 

Regards,

Chris

View solution in original post

2 REPLIES 2

chriswong
4,046 Views

Hi,

When you map the share, you should be using the FQDN of the share and AVA interface. For example, if I've set the share called share1, and an interface e0a to an IP address 10.20.30.40, then you should have a corresponding DNS entry like AVA_e0a mapping to 10.20.30.40. Then, when you map a drive in Windows Explorer, you can use the path \\AVA_e0a\share1. NTLM only occurs if you're unable to use kerberos, such as when calling a share by IP and not DNS name.

 

Does that help?

 

Regards,

Chris

Chiatan
3,992 Views

Thanks a lot Chris, it worked with DNS.

 

Thanks

Chaitan

Public