Search <book_title>...

Veritas Data Insight Administrator's Guide

Last Published: 2020-07-14

Product(s): Data Insight (6.1.5)

Preparing the NetApp cluster for SSL authentication

You must install the signed digital certificate with the associated private key (<yourKeyFileName>.key) on the NetApp Admin Vserver

Installing the SSL certificate on cluster mode NetApp device

To install the certificate on the NetApp Admin Vserver

Log on to the Admin Vserver, and manually copy over the .key file to the server.
From the command prompt window, navigate to the location where you have saved the .key file.
Run the following command:
security certificate install -type client-ca -vserver <Host name of AdminVserver>
Note:
: If you have a CA-signed SSL certificate, install the root certificate and each intermediate certificate of the CA that signed the certificate by using the command security certificate install command with - type client-ca parameter.
To verify whether the certificate is installed, run the following command:
security certificate show - vserver <Host name of AdminVserver>

Note:

You should keep a copy of your certificate and private key for future reference. If you revert or downgrade to an earlier release, you must first delete the certificate and private key.

Creating security roles

You must security roles for ONTAPI access with the common name that you have mentioned in the certificate.

Note:

Authentication of a domain user credentials using SSL for monitoring NFS exports is not supported.

To create the security roles

From the command prompt on the Storage Virtual Machine (SVM), run the following commands:
security login role create -role testrole -cmddirname "version"-access all
security login role create -role testrole -cmddirname "vserver cifs"-access readonly
security login role create -role testrole -cmddirname "vserver"-access readonly
security login role create -role testrole -cmddirname "volume"-access readonly
security login role create -role testrole - cmddirname "vserver fpolicy policy" -access all
security login role create -role testrole - cmddirname "vserver fpolicy" -access readonly
security login role create -role testrole - cmddirname "vserver fpolicy enable" -access all
security login role create -role testrole - cmddirname "vserver fpolicy disable" -access all
security login role create -role testrole - cmddirname "statistics" -access readonly
security login role create -role testrole -cmddirname "vserver nfs" -access all
security login role create -role testorle -cmddirname "network interface show" -access readonly
The network interface show privilege automatically assigns the following privileges to the role:
- network interface create
- network interface modify
- network interface modify
To view the security roles that were created, run the following command:
security login role show - vserver <Host name of AdminVserver>

Creating a security logon

You must create two security logon credentials - one with authmethod as cert and another with authmethod as password.

To create a security logon

Create a security logon with the common name that you have mentioned in the certificate. For the purpose of this procedure, let us assume that the common name is ditest. Run the following commands:
security login create -username ditest -application ontapi -authmethod cert -role ditest -vserver <Host name of AdminVserver>
security login create -username ditest -application ontapi -authmethod password -role ditest -vserver <Host name of AdminVserver>
To view the security logon that you created, run the following command:
security login show - vserver Host name of AdminVserver>

Enabling client authentication on the NetApp cluster

To enable client authentication

Run the following command:
security ssl modify - vserver <Host name of AdminVserver>
For example -security ssl modify - vserver < name of admin vserver > -ca < default ontap cert > -serial <default ontap cert> -common-name <default cert name> -server-enabled true -client-enabled true
Note:
Default values can be obtained by pressing tab key from Ontap management interface command prompt.
To check the status, run the following command:
>> security ssl show - vserver <Host name of AdminVserver>

After you install all required certificates, create the appropriate role and logon credentials, and enable client authentication, you can add the NetApp cluster to the Data Insight configuration.