いままでも「SMB2 Enabled for DC Connections設定に起因する接続できない問題」というのがあったが、先日話題になった「Active Directoryサーバのセキュリティ強化アップデート(CVE-2022-38023)に伴うONTAPファイルサーバへの影響」で、2023年7月以降のActive Directory環境ではONTAP をCIFSに新規作成しようとした場合にエラーがでる、という問題が出ていた。
「Is AES Encryption Enabled設定」と「AES session key enabled for NetLogon channel設定」の2つの設定を変更する必要がある。
前者はONTAP 9.12.1から初期値変更、後者はONTAP 9.10.1から初期値変更となっているので、最近導入している場合は問題が発生しないのだが、以前のバージョンからアップデートしているような環境の場合は以前の値のままとなっているため注意が必要となっている。
その1: Is AES Encryption Enabled 設定
以前からONTAPを使っていてアップデートしているような環境では、SMB内部接続での暗号化形式でAESを使わない、という設定になっているせいで、下記の様なエラーとなる。
netapp9101::> vserver cifs create -vserver svm3 -cifs-server svm3 -domain adosakana.local
In order to create an Active Directory machine account for the CIFS server, you must supply the name and password of a Windows account with
sufficient privileges to add computers to the "CN=Computers" container within the "ADOSAKANA.LOCAL" domain.
Enter the user name: administrator
Enter the password:
Error: Machine account creation procedure failed
[ 47] Loaded the preliminary configuration.
[ 130] Created a machine account in the domain
[ 130] SID to name translations of Domain Users and Admins
completed successfully
[ 131] Successfully connected to ip 172.17.44.49, port 88 using
TCP
[ 142] Successfully connected to ip 172.17.44.49, port 464 using
TCP
[ 233] Kerberos password set for 'SVM3$@ADOSAKANA.LOCAL' succeeded
[ 233] Set initial account password
[ 244] Successfully connected to ip 172.17.44.49, port 445 using
TCP
[ 276] Successfully connected to ip 172.17.44.49, port 88 using
TCP
[ 311] Successfully authenticated with DC
adserver.adosakana.local
[ 324] Unable to connect to NetLogon service on
adserver.adosakana.local (Error:
RESULT_ERROR_GENERAL_FAILURE)
**[ 324] FAILURE: Unable to make a connection
** (NetLogon:ADOSAKANA.LOCAL), result: 3
[ 324] Unable to make a NetLogon connection to
adserver.adosakana.local using the new machine account
[ 346] Deleted existing account
'CN=SVM3,CN=Computers,DC=adosakana,DC=local'
Error: command failed: Failed to create the Active Directory machine account "SVM3". Reason: general failure.
netapp9101::>
この問題はマニュアルの「Enable or disable AES encryption for Kerberos-based communication」に記載されているように「is-aes-encryption-enabled」設定をtrueに変更することで解決する。
netapp9101::> vserver cifs security modify -vserver svm3 -is-aes-encryption-enabled true
netapp9101::> vserver cifs security show -fields is-aes-encryption-enabled
vserver is-aes-encryption-enabled
------- -------------------------
Cluster -
Snapmirror-WAN
-
netapp9101
-
netapp9101-01
-
svm0 true
svm2 false
svm3 true
7 entries were displayed.
netapp9101::>
その2: AES session key enabled for NetLogon channel 設定
上記を設定しても、下記の様なエラーとなった。
netapp9101::> vserver cifs create -vserver svm3 -cifs-server svm3 -domain vm2.adosakana.local
In order to create an Active Directory machine account for the CIFS server, you must supply the name and password of
a Windows account with sufficient privileges to add computers to the "CN=Computers" container within the
"ADOSAKANA.LOCAL" domain.
Enter the user name: administrator
Enter the password:
Error: Machine account creation procedure failed
[ 43] Loaded the preliminary configuration.
[ 133] Created a machine account in the domain
[ 133] SID to name translations of Domain Users and Admins
completed successfully
[ 134] Successfully connected to ip 172.17.44.49, port 88 using
TCP
[ 144] Successfully connected to ip 172.17.44.49, port 464 using
TCP
[ 226] Kerberos password set for 'SVM3$@ADOSAKANA.LOCAL' succeeded
[ 226] Set initial account password
[ 253] Successfully connected to ip 172.17.44.49, port 445 using
TCP
[ 284] Successfully connected to ip 172.17.44.49, port 88 using
TCP
[ 316] Successfully authenticated with DC
adserver.adosakana.local
[ 323] Encountered NT error (NT_STATUS_PENDING) for SMB command
Read
[ 327] Unable to connect to NetLogon service on
adserver.adosakana.local (Error:
RESULT_ERROR_GENERAL_FAILURE)
**[ 327] FAILURE: Unable to make a connection
** (NetLogon:ADOSAKANA.LOCAL), result: 3
[ 327] Unable to make a NetLogon connection to
adserver.adosakana.local using the new machine account
[ 344] Deleted existing account
'CN=SVM3,CN=Computers,DC=ADOSAKANA,DC=local'
Error: command failed: Failed to create the Active Directory machine account "SVM3". Reason: general failure.
netapp9101::>
この状況となった環境のActive Directoryサーバはsambaで作成しているため /usr/local/samba/var/log.samba を確認してみると下記のエラーがでていた。
[2023/10/20 14:48:22.301935, 0] ../../source4/rpc_server/netlogon/dcerpc_netlogon.c:281(dcesrv_netr_ServerAuthenticate3_check_downgrade)
CVE-2022-38023: client_account[SVM3$] computer_name[SVM3] schannel_type[2] client_negotiate_flags[0x741ff] real_account[SVM3$] NT_STATUS_DOWNGRADE_DETECTED reject_des[0] reject_md5[1]
[2023/10/20 14:48:22.302215, 0] ../../source4/rpc_server/netlogon/dcerpc_netlogon.c:291(dcesrv_netr_ServerAuthenticate3_check_downgrade)
CVE-2022-38023: Check if option 'server reject md5 schannel:SVM3$ = no' might be needed for a legacy client.
[2023/10/20 14:48:22.304539, 0] ../../source4/rpc_server/netlogon/dcerpc_netlogon.c:281(dcesrv_netr_ServerAuthenticate3_check_downgrade)
CVE-2022-38023: client_account[SVM3$] computer_name[SVM3] schannel_type[2] client_negotiate_flags[0x701ff] real_account[SVM3$] NT_STATUS_DOWNGRADE_DETECTED reject_des[1] reject_md5[1]
[2023/10/20 14:48:22.304600, 0] ../../source4/rpc_server/netlogon/dcerpc_netlogon.c:291(dcesrv_netr_ServerAuthenticate3_check_downgrade)
CVE-2022-38023: Check if option 'server reject md5 schannel:SVM3$ = no' might be needed for a legacy client.
[2023/10/20 14:48:22.304638, 0] ../../source4/rpc_server/netlogon/dcerpc_netlogon.c:298(dcesrv_netr_ServerAuthenticate3_check_downgrade)
CVE-2022-38023: Check if option 'allow nt4 crypto:SVM3$ = yes' might be needed for a legacy client.
もしやkerneberosではなくNTLMで接続されてたりする？と lm-compatibility-level をkrb に設定しても同じ結果となった。
netapp9101::> vserver cifs security modify -vserver svm3 -lm-compatibility-level krb
netapp9101::> vserver cifs security show -fields lm-compatibility-level
vserver lm-compatibility-level
------- ----------------------
Cluster -
Snapmirror-WAN -
netapp9101 -
netapp9101-01 -
svm0 lm-ntlm-ntlmv2-krb
svm2 lm-ntlm-ntlmv2-krb
svm3 krb
7 entries were displayed.
netapp9101::>
さらに調べると「Configure Active Directory domain controller access overview」に、Netlogon にAESを使いたい場合は「aes-enabled-for-netlogon-channel」をtrueに設定する、と書いてあった
netapp9101::> vserver cifs security show -fields aes-enabled-for-netlogon-channel
vserver aes-enabled-for-netlogon-channel
------- --------------------------------
Cluster -
Snapmirror-WAN -
netapp9101 -
netapp9101-01 -
svm0 false
svm2 false
svm3 false
7 entries were displayed.
netapp9101::> vserver cifs security modify -vserver svm3 -aes-enabled-for-netlogon-channel true
netapp9101::> vserver cifs security show -fields aes-enabled-for-netlogon-channel
vserver aes-enabled-for-netlogon-channel
------- --------------------------------
Cluster -
Snapmirror-WAN -
netapp9101 -
netapp9101-01 -
svm0 false
svm2 false
svm3 true
7 entries were displayed.
netapp9101::>
設定変更後に再実行したところ、Active Directory参加に成功した。
netapp9101::> vserver cifs create -vserver svm3 -cifs-server svm3 -domain adosakana.local
In order to create an Active Directory machine account for the CIFS server, you must supply the name and password of
a Windows account with sufficient privileges to add computers to the "CN=Computers" container within the
"ADOSAKANA.LOCAL" domain.
Enter the user name: administrator
Enter the password:
Notice: SMB1 protocol version is obsolete and considered insecure. Therefore it is deprecated and disabled on this
CIFS server. Support for SMB1 might be removed in a future release. If required, use the (privilege: advanced)
"vserver cifs options modify -vserver svm3 -smb1-enabled true" to enable it.
netapp9101::>
↑のSMB1を有効にするかどうか、というところについては、複合機の出力先として指定されている、とか、LinuxサーバからCIFSでマウントしている、とか、Windowsワークグループからアクセスしている、という場合には有効にする、というような形となる。