Dell PowerFlex 4.5.x Administration Guide

Kerberos

• Using Kerberos with NFS requires that DNS and a UDS, are configured for the NAS server and that all members of the Kerberos realm are registered in the DNS server.
• For authentication Kerberos can be configured with either a custom realm, or with Active Directory (AD).
• The storage system must be configured with an NTP server. Kerberos relies on the correct time synchronization between the KDC, servers, and the client network.

Configuring Kerberos for Secure NFS

If you are configuring Kerberos for Secure NFS, be aware of the following:

• If configuring the NAS server for NFS only, you must configure the NAS server with a custom realm. If you have configured the NAS server with NFS and SMB, you can use either the AD or custom realm.
• Using LDAPS or LDAP with Kerberos is recommended for increased security.
• A DNS server must be configured at the NAS-server level. All members of the Kerberos realm, including the KDC, NFS server, and NFS clients, must be registered in the DNS server.
• The NFS client hostname FQDN and NAS server FQDN must be registered in the DNS server. Clients and servers must be able to resolve any member of the Kerberos realm's FQDNs to an IP address.
• The FQDN part of the NFS client SPN must be registered in the DNS server.
• A keytab file must be uploaded to your NAS server when configuring Secure NFS.

Antivirus (Common AntiVirus Agent (CAVA))

Available for SMB servers only.

Common AntiVirus Agent (CAVA) provides an antivirus solution to clients using a NAS server. It uses an industry-standard SMB protocol in a Microsoft Windows Server environment. CAVA uses third-party antivirus software to identify and eliminate known viruses before they infect files on the storage system.

Antivirus software is important because the storage system is resistant to the invasion of viruses because of its architecture. The NAS server runs data access in real-time using an embedded operating system. Third parties are unable to run programs containing viruses on this operating system. Although the operating system software is resistant to viruses, Windows clients that access the storage system require virus protection. Virus protection on clients reduces the chance that they will store an infected file on the server, and protects them if they open an infected file. This antivirus solution consists of a combination of the operating system software, CAVA agent, and a third-party antivirus engine. The CAVA software and a third-party antivirus engine must be installed on a Windows Server in the domain.

Antivirus support for CAVA is disabled by default. To enable CAVA:

1. Click the Disabled button and click Apply.
2. If you do not have a current CAVA configuration file available:
   1. Click Retrieve Current Configuration.
   2. Complete the CAVA configuration file template.
3. Upload the CAVA current configuration file.
4. Click Enabled to start antivirus support.