mjzraz
2 Iron

How do I add SPNs to use kerberos for a DNS name for a Unity Nas Server?

Jump to solution

I need to use a DNS name that is different from the NAS Server name to connect and use kerberos. Anyone else doing this? We have done it on vnx for 4 years with no issues, worked great. 

We have a major application that uses a DNS FQDN that is different from the name of the vnx CIFS server joined to the domain.

We have pre-copied 4 TB and 26 shares to Unity and when we cutover we will need to use the existing DNS FQDN.

I tried as a test to create an A record DNS name with the same IP as a test NAS Server on the Unity. It will connect using the DNS name, the IP, or the actual NAS server name, but for the IP or DNS it defaults to NTLM security protocol not kerberos. If I add the SPNs to the AD computer account, and try to connect using that name, I am prompted for a username and password and get access denied.

On Isilon, we just go to the computer object, attribute editor tab, and add the SPNs in there and right away it works using kerberos.

On VNX, we run the server_cifs test_vdm -setspn -add command and it works.

Here is what I see for this UNITY test computer account and spn:

setspn -q host/unityspntest.nas.co.edu

Checking domain DC=win,DC=ad,DC=co,DC=edu

CN=unitytest,OU=ProductionNAS,OU=File Services,OU=Systems,OU=CLOUD,DC=win,DC=ad,DC=co,DC=edu

        cifs/unityspntest.nas.co.edu

        host/unityspntest.nas.co.edu

        RestrictedKrbHost/unitytest.win.ad.co.edu

        RestrictedKrbHost/UNITYTEST

        host/unitytest.win.ad.co.edu

        host/UNITYTEST

Here is what I see for the prod NAS name for the VNX. It’s a DNS name appnasprd.es.co.edu

setspn -q host/appnasprd.es.co.edu

Checking domain DC=win,DC=ad,DC=co,DC=edu

CN=nasep1,OU=Production,OU=File Services,OU=Systems,OU=CLOUD,DC=win,DC=ad,DC=co,DC=edu

        host/appnasprd.es.co.edu

        cifs/appnasprd.es.co.edu

        host/nasep1.win.ad.co.edu

        host/nasep1

The obvious difference is the “RestrictedKrbHost” entries on the computer object from the Unity NAS but I don’t know if that matters I tried removing them and it made no difference.

When I am prompted for credentials trying to connect to the DNS name on the Unity NAS Server, I get the following entries in the security event log for the NAS Server:

Event ID 537

Failure Logon/Logoff

User: NT Authority\System

Computer: UNITYTEST

Logon Failure, Reason, An unexpected error occurred during logon
Username  Null Session

Logon Type 3

Logon Process: CIFS  error: DC AUTH ERROR

and

Event ID 681

Failure Account Logon

User: NT Authority\System

Computer: UNITYTEST

The Logon to account: Null Session

by: EMC CIFS with KERBEROS

Failed: The Error code was CIFS  error: DC AUTH ERROR

I opened and SR and they said there are no server_cifs spn commands in unity, you have to do it in AD and contact Microsoft. This morning I contacted one of our local EMC guys and he put me in touch with a guy who had a VSA Unity in a lab and he did the same setup as we did and got the same access denied prompting for credentials.

We were supposed to be doing this migration at 3AM tomorrow morning, but with this issue we postponing. It's frustrating because this was relatively easy on the other platforms.

0 Kudos
1 Solution

Accepted Solutions
maniemc
3 Argentium

Re: How do I add SPNs to use kerberos for a DNS name for a Unity Nas Server?

Jump to solution

"svc_cifsssuport -setspn" will be available on the upcoming 4.2 version, but contact the Dell EMC Support for immediate support.

0 Kudos
9 Replies
mjzraz
2 Iron

Re: How do I add SPNs to use kerberos for a DNS name for a Unity Nas Server?

Jump to solution

Update - So because I knew this worked on vnx, I tried setting up another test using a DNS A Record to connect to a cifs server on the vnx. I tried just running the commands to add the SPNs to Active Directory and it didn't work, I got the same prompt for a username and password.
Then I deleted the SPNs and tried running the commands from the vnx itself using the server_cifs -setspn command and it worked, I was able to connect to the shares using the DNS name.

So to me there is something that is configured locally by running these commands. We just need to see how we can do that on Unity

0 Kudos
mjzraz
2 Iron

Re: How do I add SPNs to use kerberos for a DNS name for a Unity Nas Server?

Jump to solution

Anyone using a DNS name to connect to a Unity?

It will work with NTLM - I don't know the impact of that either on the Unity or the DC's

Last update I got was there is a command in the service CLI but no one has told me what code version it will be in...

It's not in the VSA

UnityOS

4.1.2.9257522

4/11/2017

Here is the "rumored" command:

16:50:38 service@none spa:~> svc_cifssupport NASServer -setspn

Handle security principals of a joined computer name.

Usage: svc_cifssupport {<NAS_server_name> | ALL} -setspn

    -list -compname <comp_name>

        Display all Service Principal Names (SPN) for the specified FQDN server,

        both for the SMB server and for the KDC Windows Active Directory entry.

    | -add <SPN> -compname <comp_name> -domain <full_domain_name> -admin <admin_name>

        Add the specified SPN to both NAS server and Active Directory.

    | -delete <SPN> -compname <comp_name> -domain <full_domain_name> -admin <admin_name>}

        Delete the specified SPN to both NAS server and Active Directory.

Note :  It is required to add SPNs for disjoint domain configurations where the DNS domain is

different than authentication domain (Kerberos Realm). For example, if the DNS server zone

includes a DNS CNAME record which maps the compname.<domain1 FQDN> to compname.<servers domain FQDN>,

then the SPN host/compname.<domain1 FQDN> must be added for the compname.

0 Kudos
maniemc
3 Argentium

Re: How do I add SPNs to use kerberos for a DNS name for a Unity Nas Server?

Jump to solution

"svc_cifsssuport -setspn" will be available on the upcoming 4.2 version, but contact the Dell EMC Support for immediate support.

0 Kudos
Rainer_EMC
5 Osmium

Re: How do I add SPNs to use kerberos for a DNS name for a Unity Nas Server?

Jump to solution

As Mani said - if you cant wait a few weeks for 4.2 open a service request and customer service should be able to do that via a dialin on your system and current OE

mjzraz
2 Iron

Re: How do I add SPNs to use kerberos for a DNS name for a Unity Nas Server?

Jump to solution

Yeah, so they were able to run the command for me.

It requires root, which we as customers can't get so now I have to schedule a downtime for this huge application and hope that I can get someone online with me at the right time.

Basically I have:

DNS Name ---> old VNX cifs server IP

migrating to

DNS Name ----> New Unity NAS Server

I am going to try removing the SPNs from AD for the VNX computer account, but leave the keytab entries and see if we can just use NTLM for the middle of the night cutover and then work with support to add the spn's during the day.

0 Kudos
maniemc
3 Argentium

Re: How do I add SPNs to use kerberos for a DNS name for a Unity Nas Server?

Jump to solution

Hi mizraz,

If you cant get downtime in the near future, you may as well wait for the 4.2 and you can do this yourself.

It is always good to test this out by creating a new NAS Server. (spare IP address, domain join rights are required). That way, you can test the setspn requirement (with or without dell emc support) and be ready for the actual cifs server.

0 Kudos
Rainer_EMC
5 Osmium

Re: How do I add SPNs to use kerberos for a DNS name for a Unity Nas Server?

Jump to solution

I agree - always a good idea to test and with Unity its really easy to setup a small test NAS server
r

0 Kudos
Highlighted
rajans
1 Copper

Re: How do I add SPNs to use kerberos for a DNS name for a Unity Nas Server?

Jump to solution

Does Unity data import support Alias ?

There is no option to specify Alias like we had in VNX or celerra.

0 Kudos
mikko1
1 Copper

Re: How do I add SPNs to use kerberos for a DNS name for a Unity Nas Server?

Jump to solution

Hi,

We also have different DNS and AD domain name and some of the NAS shares are accessed with DNS names. As we now have upgraded to the 4.2 series we have the possibility to add the SPN DNS names to the unity's NAS to enable the kerberos authentication. As the EMC documentation / KB articles are still bit lacking here is the procedure we used to test this in unity VSA. (Production will be done in next maintenance window.) This is a combination of old VNX command and instructions and unitys manual and kb entries.

Example below has been modified to use emc as a domain name insted of our domain name.

Problem description:

- DNS Domain name and AD domain name of the NAS servers are different. NAS is accessed with DNS name not AD domain name

- Authentication works, but it is using NTLM not kerberos ticket when accessing share with DNS name (use  svc_cifssupport VDM-name -audit to see if kerberos or ntlm is used)

- svc_cifssupport shows warning on the possible SPN mismatches.

Example of warning:

svc_cifssupport  [nas server name] -audit

|||| WARNING: Possible SPN mismatches for the following servers. An SPN mismatch occurs when NTLM authentication is used, but Kerberos authentication should have been possible.

||| Server(servername AD domain), Requested Server(servername FQDN), CntFrmReboot=4

To fix this and enable kerberos authentication to the share when using domain name you need to add a manual SPN record for the DNS domain name to the NAS server.

Here is an example of the command used to add the new SPN record when:

AD domain emc.local, DNS domain emc.com for a nas server name unity-vsa .

Register CIFS before host entry (KB 503643)

svc_cifssupport unity-vsa -setspn -add cifs/unity-vsa.emc.com@EMC.LOCAL -compname unity-vsa -domain emc.local -admin Administrator

svc_cifssupport unity-vsa -setspn -add host/unity-vsa.emc.com@EMC.LOCAL -compname unity-vsa -domain emc.local -admin Administrator

This is what we are currently testing on our test unity VSA environment and it seems to work as now kerberos is used to authenticat users when connecting with DNS name to the share. (Masked DNS and AD domain names to emc from our domain names).

Hopefully this is helpful for the next user needing to configure SPN records and they don't need to spend hours of going through manuals and kb entries.

0 Kudos