CONFIGURING IBM STORWIZE. for Metadata Framework 6.3

Transcription

1 CONFIGURING IBM STORWIZE for Metadata Framework 6.3

2 Publishing Information Software version Document version 4 Publication date May 22, 2017 Copyright Varonis Systems Inc. All rights reserved. This information shall only be used in conjunction with services contracted for with Varonis Systems, Inc. and shall not be used to the detriment of Varonis Systems, Inc. in any manner. User agrees not to copy, reproduce, sell, license, or transfer this information without prior written consent of Varonis Systems, Inc. Other brands and products are trademarks of their respective holders.

3 CONTENTS Chapter 1: Configuring IBM Storwize V7000 Unified...1 Authentication and ID Mapping...2 IP Addresses... 2 Solution Topology...3 Network Communication...3 Supported Versions...4 Capabilities of V7000U with the Metadata Framework... 4 Configuring V7000U...5 Creating SSH Keys... 5 Preparing V7000U by Running the cfgfileaudit CLI Command...6 Creating an Administrative Export...7 Configuring the IDU Server...7 Activating the Audit Agent... 7 Configuring the IDU Server...7 Adding a Samba Domain to Support ADWalk...7 Adding the Unix Samba File Server...8 Maintenance... 9 Software Update of V7000U Code...9 Reinstalling the Varonis Agent...9 Updating or Replacing the SSH Keys...9 Updating the Password Updating or Changing the IP Address of the IDU Server...10 Removing the Varonis Agent...10 CONFIGURING IBM STORWIZE FOR METADATA FRAMEWORK 6.3 iii

4 1 CONFIGURING IBM STORWIZE V7000 UNIFIED The V7000U is a unified storage product offering Fibre-Channel, iscsi and NAS support. V7000U is based on the Storwize family V7000 block-storage product, with dual controller File Modules directly attached via 4 of the V7000 s 8 fibre channel ports. V7000U provides the user with the following: File Interfaces Physical 2 X 10 Gb Ethernet ports per file module (4 total) 6 X 1 Gb Ethernet ports per file module (12 total; earlier models 4 total) Logical - Support for any of the following: NFSv3 SMB 1.0 and 2.0 (also known as CIFS) SCP HTTPS FTP Block Interfaces Physical 2 X 8 Gb Fibre Channel ports per controller node (4 total) 2 X 10 Gb iscsi ports per controller node (4 total) 2 X 1 Gb iscsi ports per controller node (4 total) Logical Block-level SCSI-3 protocol support The file modules run the distributed file-system General Parallel File System (GPFS) as well as file protocol stacks (for example, SMB, NFS and HTTPS). Additionally, the file modules present a combined management interface (GUI and CLI) for both file and block configuration. The following image illustrates how clients are connected to the file modules through a switch. Each module publishes one or more IP addresses, depending on the configuration of the public network. A public IP address must be associated with every file module to ensure that work is sent to both modules. The lsnwinterface -r command can be used to determine which IP address is assigned to which module for NAS client access. CONFIGURING IBM STORWIZE FOR METADATA FRAMEWORK 6.3 1

5 The 1Gb Ethernet link between the two file modules communicates changes made on the file system from one module to the other. This ensures that both modules remain synchronized. Authentication and ID Mapping IBM Storwize V7000 Unified supports a variety of authentication methods and ID mapping configurations. This document provides instructions on how to configure the V7000U 1.4 system with Active Directory (using the cfgad command). ID mapping must be configured either with "auto" or SFU/rfc2307. This can be verified with the V7000U CLI command "lsauth" : "idmappingmethod = auto" which represents Samba configuration "idmap config * : backend = autorid". IP Addresses V7000U uses separate IP addresses by function. Some of the configuration is changed in the following steps. Service IP1: Access to physical file module 1 for repair or service activity, SSH port 1602 Service IP2: Access to physical file module 2 for repair or service activity, SSH port 1602 Management IP (A): Access to Unified CLI via SSH on port 22, for all management and administration; GUI via HTTPS on port 443 Note: This IP is floating; it may be started on physical file module 1 or on physical file module 2. Public IP addresses: A group of IP addresses that enable access to NFS, SMB, FTP and other NAS protocols. Automatically distributed by the clustering between the two physical machines. All SMB and NFS clients use these IP addresses to connect, with the exception of the Metadata Framework FileWalk job. In addition there is an internal network that links the two file modules directly. The combined solution only uses Service IP1, Service IP2 and Management IP (A). CONFIGURING IBM STORWIZE FOR METADATA FRAMEWORK 6.3 2

6 These IP addresses can be queried from the V7000U by running the lsnwmgt CLI: [kd66t4t.ibm]$ lsnwmgt Interface Service IP Node1 Service IP Node2 Management IP Network Gateway VLAN ID ethx EFSSG1000I The command completed successfully. The term management network is used for these IP addresses. Record the IP address of the server(s) hosting the IDU and Probe/Collector. Solution Topology The Metadata Framework uses a central server (IDU Server) for the data center, and individual agents that run on the resources being audited. For a working setup with V7000U: The Varonis Server. The setup may be split into the IDU Server, Probe Server and Collector. A V7000 Unified with special configuration changes and the Varonis agent running on the V7000 file modules: Network Communication The setup requires that all communication between the IDU/Probe Server and the V7000 Unified use the management network of V7000 Unified. The management network of V7000 Unified consists of threeip Addresses. The network setup (firewalls, routing) must allow communication from the IDU/Probe Server to these IP addresses. All communication is initiated from the IDU/Probe Server (initiator) to the V7000 Unified (listener). CONFIGURING IBM STORWIZE FOR METADATA FRAMEWORK 6.3 3

7 Supported Versions The joint solution requires: Metadata Framework 6.2 or higher v7000 Unified Capabilities of V7000U with the Metadata Framework With the Varonis agent installed on V7000U and connected to the Metadata Framework IDU Server: Events are sent by V7000 for all file access attempts that match the settings in the Metadata Framework, for SMB, NFS*, HTTP, FTP and SCP. Events are generated by both V7000 file modules. User IO is not affected (except for a minimal performance penalty). V7000U operates exactly as if no agent were present. All audit settings can be maintained in the Metadata Framework. File auditing can be combined with Async Replication for DR, TSM/HSM backup/ilm, NDMP backup, AV-scanning, file sets, multiple file systems, snapshots, quotas and Active Cloud Engine.** Communication issues between the Varonis agent on V7000U and the IDU Server do not affect NAS IO. Event collection continues when individual file module nodes are restarted/suspended. Events include Read, Write, Delete, Rename, permission and permission set change, and show the user name as defined in Active Directory. Known limitations Some performance impact is expected. The Varonis software minimizes such impact in terms of CPU and memory usage. A broken communication link or overload on the Varonis Probe leads to loss of audit events. V7000U continues to allow file access and does not display errors related to this communication issue. Monitoring of the audit, permission set and ID map collection can only be performed using the Metadata Framework. Auditing is limited to NAS file IO. None of the V7000U configuration changes (via CLI, Management UI, or Microsoft Management Console) are audited with this solution. Unified configuration changes can be reviewed with the lsaudit CLI command or the corresponding UI page. Software updates to V7000U with the function enabled may disable auditing and may create error messages in the Metadata Framework. The file audit function is limited to the file systems managed by the file modules of V7000U. Use of the block function (fiber channel, iscsi, FCOE) of V7000U disks is not part of the audit function. CONFIGURING IBM STORWIZE FOR METADATA FRAMEWORK 6.3 4

8 Changes to permission sets from the CLI/UI (chacl command) generate audit events logged as root user. User information for these is only available with the lsaudit command on V7000U. The set of file systems, directories and files that are monitored depends on the settings in the Metadata Framework. Security permission sets (SACL) are not supported. The user that is created on V7000U to control the agent is not visible in the user management of V7000U. ** Setups with Active Cloud Engine remote caching need to run the Metadata Framework on the cache site. If the Metadata Framework is run in the home site, events caused by access from the cache site show as originated from the root user. Protocol-specific limitations SMB - Multiple events may be generated, where only a single event is expected. NFS - The IDU Server may not be able to resolve NFS user names for Linux UIDs that have no ID map information. *NFSv4 - The IBM NFSv4 implementation is not intended to be used in combination with this RPQ. It is the intent to lift this restriction in a future release. Configuring V7000U The overall configuration workflow for V7000U is: 1. On the V7000U machine, run the cfgfileaudit command to prepare the machine. 2. Create and administrative export. 3. Configure the Metadata Framework. 4. Rerun cfgfileaudit to activate the audit agent. Creating SSH Keys Skip this step if SSH keys are already available. The IDU Server uses SSH connections to control the event collection agent and to access the ID map data on V7000 Unified. SSH keys allow password-less login. They consist of a private key as the "key" and a public key that can be used to verify the "key". The IDU Server expects the private key in puttyformat. V7000U needs the public key in openssh format. The Windows tool puttygencan be used to create both keys in the needed formats at the same time. 1. On a Windows machine (for example, the IDU Server machine), run the puttygen command. 2. Generate a public/private key pair, without providing a password. 3. Copy the public key displayed from the text field (openssh format), starting with ssh-rsa, into a text file. It will be used to drive the CLI command later on. CONFIGURING IBM STORWIZE FOR METADATA FRAMEWORK 6.3 5

9 4. Click Save private key for later use in the IDU configuration. Do not create a password for access to the key file. (Upload this private key file to the IDU later on.) Preparing V7000U by Running the cfgfileaudit CLI Command 1. Log on to the V7000U CLI. 2. Run the cfgfileaudit CLI with the following parameters: -k: The openssh public key, in quotation marks. -s: The IP of the IDU Server (or the comma-separated list of two IP addresses for the IDU Server and the Probe/Collector). -u: The user name without the domain prefix. -p: The password for that user name. cfgfileaudit -k 'ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAgJmkirvi2Pk6DKNnQqIUOwskvDHKaca5pFAuOo7WZdtK +Sy+Wx9G/258/KDmcSMPzsH7SYaH pc0icn1fv1wmd08wywqi5r2tkzegzoehkwnajnoux3a3tjfzr37aohhwrof/ nzfi3dtesgkzvi65qro/8c6dfy+uwlga09kgcseu ZVRs3LpD7sX1J1mfYYQSan3DvZbiyMXz5qT7SOR7W4nv/MTBykFJFK3w350mK5// gvy3rwgu4z83cqds1hkrh24cpijo120ccrvo JOTLm9YzX/ dasav9ii8kiyioznyrq0fpppalzigxpp6dtmp4ya6lz6q9ehealjirucn5aq== rsa-key ' -s CONFIGURING IBM STORWIZE FOR METADATA FRAMEWORK 6.3 6

10 ' , ' -u varonis -p abcd4567 Creating an Administrative Export To create an administrative export: 1. Run the following commands: mkexport adminshare '/ibm/gpfs0' --cifs chexport adminshare --cifs 'access control=domain\varonis:allowed:full' chexport adminshare --cifs 'admin users=domain\varonis' 2. If you intend to monitor more than one file system, each file system requires a similar administrative export. Configuring the IDU Server Follow the steps outlined below to place the agent code on the V7000U machine. This agent code is required for the next step. Activating the Audit Agent 1. Log on to the V7000U CLI. 2. Run the cfgfileaudit CLI with the following parameters: -install cfgfileaudit install This command installs the agent that was received in the previous step. Configuring the IDU Server Prior to configuring the IDU Server, ensure you have completed the following sections: Preparing V7000U by Running the cfgfileaudit CLI Command Creating an Administrative Export Adding a Samba Domain to Support ADWalk To add a Samba (SMB) domain to support ADWalk: CONFIGURING IBM STORWIZE FOR METADATA FRAMEWORK 6.3 7

11 Note: The following procedure can be performed through the Installer or the Management Console. For more information on how to add a Samba domain, see the Management Console User Guide. 1. In the Domain Properties window, select Samba from the Domain Type drop-down list. 2. Define the following parameters: Server - Enter the management IP address. Authentication - Select SSH-keys. User name - Set the name of the user that was created for the Varonis agent. Set just the user name, without the domain prefix. SSH file - Set the private key file (puttgen format). Password - Type the user's password. 3. Click Install. Adding the Unix Samba File Server To add a Unix Samba file server: Note: The following procedure can be performed through the Installer or the Management Console. For more information on how to add a Unix Samba file server, see the Management Console User Guide. 1. From the File Server Wizard, click Common and then set the following parameters: File Server Details File server name - Enter the DNS entry for the management IP address (A) or the numeric IP address. FileWalk Credentials Authentication - Select SSH-keys. User name - Enter the Active Directory user that has a matching local user (see above), i.e., domain\varonis. SSH file - Enter the path to the SSH private key file. SSH file/user password - Type the password for the SSH private key file. File Server Type Select file server type - Select Unix SMB. Varonis Filter Agent Installation Click Agent Deployment and set the following parameters from the Agent Deployment Options window: Agent Installation Credentials - Select Use FileWalk credentials for agent installation. Physical Machines - Type or browse to service IP1 and service IP2 and then click Add. 2. Select the Shares tab and specify the administrative share created in Creating an Administrative Export. CONFIGURING IBM STORWIZE FOR METADATA FRAMEWORK 6.3 8

12 Note: If a message appears stating Unix mounts could not be enumerated, ignore it. 3. From the Configuration tab of the File Server Wizard, set the following parameter: Unix Domain Select the affiliated Unix user repository for this file server or Samba domain - From the drop-down list, select the predefined Unix Samba domain. Note: Be sure to define this domain prior to defining the file server. 4. Click Install. The file server is installed. Maintenance Software Update of V7000U Code The version of the V7000U operating system kernel and the Varonis agent need to match. Before attempting a software update, inquire with IBM or Varonis Support to determine whether a new Varonis agent is required. If no new Varonis agent is required, the V7000U software update process can be run as usual. Audit events are generated both during and after the update. If a new Varonis agent is required, audit events will stop as file module nodes start with the new software version. The user must install the updated agent code using the Varonis Management Console. Reinstalling the Varonis Agent If a new version of the filter agent is required, use the Varonis Management Console to deploy it on the V7000U machine. The V7000U cfgfileaudit command can be run to reinstall or update the Varonis agent. To run cfgfileaudit: cfgfileaudit --install Updating or Replacing the SSH Keys SSH keys can be repaired or updated by running cfgfileaudit with only the -k option: cfgfileaudit -k 'ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAgJmkirvi2Pk6DKNnQqIUOwskvDHKaca5pFAuOo7WZdtK +Sy+Wx9G/258/KDmcSMPzsH7SYaH pc0icn1fv1wmd08wywqi5r2tkzegzoehkwnajnoux3a3tjfzr37aohhwrof/ nzfi3dtesgkzvi65qro/8c6dfy+uwlga09kgcseu ZVRs3LpD7sX1J1mfYYQSan3DvZbiyMXz5qT7SOR7W4nv/MTBykFJFK3w350mK5// gvy3rwgu4z83cqds1hkrh24cpijo120ccrvo CONFIGURING IBM STORWIZE FOR METADATA FRAMEWORK 6.3 9

13 JOTLm9YzX/ dasav9ii8kiyioznyrq0fpppalzigxpp6dtmp4ya6lz6q9ehealjirucn5aq== rsakey ' Note: This disables access that uses the previous key. Updating the Password The user's password can be repaired or updated by running cfgfileaudit with only the -p option: cfgfileaudit -p abcd4567 Note: This disables access that uses the previous password. Updating or Changing the IP Address of the IDU Server The IP address of the IDU Server can be changed by running cfgfileaudit with only the -s option: cfgfileaudit -s Or cfgfileaudit -s , Note: This disables access by the IDU Server from any other IP address. Removing the Varonis Agent If the system will no longer be monitored by the Metadata Framework, the Varonis agent, user and special settings can be removed from the V7000U by running the following: cfgfileaudit remove The file server definition and Samba domain pointing to this V7000U must be removed in the IDU Server. CONFIGURING IBM STORWIZE FOR METADATA FRAMEWORK