This post is more than 5 years old
3 Posts
0
3363
May 14th, 2015 08:00
Isilion issue with kerberos authenticating via IP address
Hello all,
I am new to EMC in general and built a test isilon simulator for my company for testing. ijust had one issue with the setup where after ijoined the Isilon server to a domain, it is able to authenticate via kerberos when using FQDN however, when using a different computer off of the domain and access the smb share via IP address ihave to use the local credentials of isilon I.E( root). I was wondering in my setup where can I correct my issue in allowing Kerberos authentication via IP address instead of only IP address how can ido it?
No Events found!
scott_owens
60 Posts
0
May 15th, 2015 14:00
What version of OneFS are you using?
Are you aware if your Domain Controllers were recently updated with Microsoft security update MS15-027?
https://support.microsoft.com/en-us/kb/3002657
If so, we need to make sure you cluster is updated to address the issue documented below.
199379 : ETA 199379:
UPDATE: Isilon OneFS: Microsoft security update MS15-027 may cause data to be
unavailable to SMB clients that are authenticated to Isilon clusters through an
Active Directory server that relies on the NTLM authentication protocol
https://support.emc.com/kb/199379
scott_owens
60 Posts
1
May 14th, 2015 09:00
That is by design. If you connect to a share via IP address, NTLM is utilized.
Here is a KB from Microsoft
https://support.microsoft.com/en-us/kb/322979/
In the above KB, you will see
When a client uses Kerberos to authenticate itself to a server, the client requests a session ticket for the Service Principal Name (SPN). IP addresses are not names, so Kerberos is not used. After this occurs, the server goes through the list of the other supported security providers.
ksaintvil
3 Posts
0
May 14th, 2015 10:00
Thank you very much scott, then is it possible to have ntlm authenticate with active directory in isilon? if so how do you do it? i tried passing the credentials and it doesnt work however when using the local username credentials i am able to log into the smb shares.
ksaintvil
3 Posts
0
May 18th, 2015 08:00
Thank you very much Scott this is just for my test environment for the isilon simulator and the issue was the Microsoft update you mentioned. i uninstalled the update and it works fine now. thank you