EMC® VNX® Series Security Configuration Guide for VNX

Port 21 is the control port on which the FTP service listens for incoming FTP requests.

All Data Movers run the FTP service. You can enable the FTP service by using the following command:

server_ftp <movername>
-service -start

You can disable the FTP service by using the following command:

server_ftp <movername>
-service -stop

The authentication process is defined by the FTP protocol definition (RFC 959) and cannot be changed. It is possible to authenticate by using either UNIX names or a Windows domain and username (domain\user).

Using FTP, TFTP and SFTP on VNX provides details about running and managing the FTP service on a Data Mover.

SFTP is a client/server protocol. Users can use SFTP to perform file transfers on a VNX system on the local subnet. The underlying SSH version 2 protocol provides well separated layers for secure file transfer between systems.

Using FTP, TFTP and SFTP on VNX provides details about running and managing the FTP service on a Data Mover.

Initially, TFTP listens on the UDP port 69. After a request is read on port 69, a different port is randomly chosen for the TFTP data transfer. By definition (RFC 1350), TFTP does not authenticate requests.

The TFTP service is not started by default; it must be manually started.

You can enable the TFTP service by using the following command:

server_tftp <movername>
-service -start

You can disable the TFTP service by using the following command:

server_tftp <movername>
-service -stop

Using FTP, TFTP and SFTP on VNX provides details about running and managing the FTP service on a Data Mover.

UDP

server_setup <movername>
-Protocol cifs -option start

This port can be closed by stopping CIFS services. Use the following command:

server_setup <movername>
-Protocol cifs -option stop

Note that this disables all CIFS-related services.

The NETBIOS Name Service is associated with the VNX for file CIFS file sharing services and is a core component of that feature. If CIFS services are enabled, then this port is open. It is specifically required for earlier versions of the Windows OS (pre-Windows 2000). Clients with legitimate access to VNX for file CIFS services must have network connectivity to the port for continued operation.

server_setup <movername>
-Protocol cifs -option start

This port can be closed by stopping CIFS services. Use the following command:

server_setup <movername>
-Protocol cifs -option stop

Note that this disables all CIFS-related services.

The NETBIOS Datagram Service is associated with the VNX for file CIFS file sharing services and is a core component of that feature. If CIFS services are enabled, then this port is open. It is specifically required for earlier versions of the Windows OS (pre-Windows 2000). Clients with legitimate access to VNX for file CIFS services must have network connectivity to the port for continued operation.

server_setup <movername>
-Protocol cifs -option start

This port can be closed by stopping CIFS services. Use the following command:

server_setup <movername>
-Protocol cifs -option stop

Note that this disables all CIFS-related services.

The NETBIOS Session Service is associated with the VNX for file CIFS file sharing services and is a core component of that feature. If CIFS services are enabled, then this port is open. It is specifically required for earlier versions of the Windows OS (pre-Windows 2000). Clients with legitimate access to VNX for file CIFS services must have network connectivity to the port for continued operation.

This port is used to provide Simple Network Management Protocol (SNMP), which is a management and monitoring service used by many third-party management tools. The SNMP daemon (SNMPD), which runs on the Data Mover, supports SNMPv1, SNMPv2c, and SNMPv3. SNMPv3 supports IPv4, IPv6, and enhanced security over SNMPv1 and SNMPv2c.

Authentication of SNMPv1 and v2c is based on a client system using the correct community string. The community string is "public" by default and should be changed by using the following command:

server_snmpd <movername> -modify
-community <community>

SNMPv3 uses authentication and privacy passwords which can be configured using the following command:

server_snmpd <movername> -user
-create <user> -authpw -privpw

SNMP is used for some communication between the Control Station and the Data Mover. If it is disabled, the server_netstat command will cease to function properly.

The SNMP service on a Data Mover can be disabled using the following command:

server_snmpd <movername>  
-service -stop

See Using SNMPv3 on VNX for more details on SNMP.

This port is closed by stopping CIFS services. Use the following command:

Note that this disables all CIFS-related services.

Clients with legitimate access to the VNX for file CIFS services must have network connectivity to the port for continued operation. Authentication is addressed on this port in accordance with Microsoft practices.

server_setup <movername>
-Protocol rip -option stop

This port can be opened by using the following command:

Routing Information Protocol (RIP) is a routing protocol optimized for creating routes within one organization (interior gateway protocol). RIP is a distance-vector protocol that uses hop count (max 15) as the metric. RIP-1 does not send the mask in updates. RIP-2 sends the mask in updates.

Configuring and Managing Networking on VNX explains the purpose and configuration of RIP services on the Data Mover. Instructions for disabling the service are also included.

Using FTP, TFTP and SFTP on VNX provides information about FTPS and TLS/SSL operations.

UDP

VNX File System MigrationVersion 2.0 for NFS and CIFS provides more information about file system migration operations.

Using VNX FileMover provides more information about FileMover operations.

UDP

VNX File System MigrationVersion 2.0 for NFS and CIFS provides more information about file system migration operations.

Using VNX FileMover provides more information about FileMover operations.

UDP

Configuring NFS on VNX explains several methods of controlling access to NFS exports. Authentication of users is AUTH_SYS by default. If stronger authentication is desired, Secure NFS is generally available. Secure NFS provides Kerberos authentication for end users

UDP

Configuring NFS on VNX explains several methods of controlling access to NFS exports. Authentication of users is AUTH_SYS by default. If stronger authentication is desired, Secure NFS is generally available. Secure NFS provides Kerberos authentication for end users. If AUTH_SYS authentication is used, only port 2049 need be open between VNX for file and NFSV4 clients.

UDP

This port is is used to provide FMP/notify service. This service is used by the VNX for file NFS Cluster product.

To determine if any NFS Clusters are configured, use the nas_server -l command. The cluster has the type "group." To remove any NFS clusters, use the following command:

To determine if any NFS Clusters are configured, use the nas_server -l command. The cluster has the type "group." To remove any NFS clusters, use the following command:

UDP

server_setup <movername> -Protocol mpfs -option start

For the MPFS service to work, clients must be able to contact VNX for file on the FMP port and VNX for file must be able to contact the clients on their FMP port (Port 6907 for UNIX clients and port 625 for Windows clients).

This service may be disabled if local tape backup is not used. Details on how to disable this service are in Primus under ID emc49339.

Background information on PAX is contained in the relevant EMC documentation on backups and NDMP. There are several technical modules on this topic to deal with a variety of backup tools.

Externally, NBS is used for snapshot and replication control functions.

When used for Control Station to Data Mover communication, the private VNX for file interconnection network is used.

HTTPS (HTTP over SSL) is also available on the Data Mover.

Because the HTTP transport is also used for Control Station to Data Mover interactions, the service may not be disabled. However, this only requires that the Data Mover accept the HTTP requests from the Control Station over the private network within the VNX cabinet. Access to the HTTP service by external agents is disabled by default

Managing Statistics for VNX provides information about configuring this service.

Clients (other VNX for file servers) that use the replication service must be behind the same firewall for continued operation.

The NDMP service can be disabled if NDMP tape backup is not used.

The NDMP service is authenticated with a username/password pair. The username is configurable. The NDMP documentation describes how to configure the password for a variety of environments.

UDP

This is the method by which Windows credentials (which are SID-based) are mapped to UNIX-based UID and GID values.

It is possible to close this port. The command to do this is:

server_usermapper <movername>
-disable

Configuring VNX User Mapping provides more information about configuring this service in Windows-only and multiprotocol environments.

NFS functionality

To determine if any NFS Clusters are configured, use the nas_server -l command. The cluster has the type "group." To remove any NFS clusters, use the following command:

UDP

NFS support

statd is a core VNX for file service, but it can be stopped. To stop this service:

1. Use vi to edit the following file:

   /nas/server/<server_name>/netd

2. Comment out the statd line. statd becomes #statd.
3. Restart the Data Mover.

UDP

Quota support

The rquotad daemon provides quota information to NFS clients that have mounted a file system. An NFS user who has mounted a VNX for file file system can access quota information for the file system by using the quota command. This command runs on the client side and interrogates the rquotad daemon on the Data Mover through RPC.

To use this functionality, the client must have already mounted the file system. Authentication is AUTH_SYS, similar to that used for the NFS protocol. You must have root access to the file system to get the quota information for different users. rquotad can be stopped:

1. Use vi to edit the following file:

   /nas/server/<server_name>/netd

2. Comment out the rquotad line. rquotad becomes #rquotad.
3. Restart the Data Mover.

UDP

NFS support

lockd is a core VNX for file service, but it can be stopped. To stop this service:

1. Use vi to edit the following file:

   /nas/server/<server_name>/netd

2. Comment out the lockd line. lockd becomes #lockd.
3. Restart the Data Mover.

UDP

This is a core service and cannot be stopped.