HNAS SMB Auto-Barring and Barred-Client Commands

Initial Configuration

No initial configuration of the feature is required.

Managing the barred clients' list is done using the following commands; check the man pages for more details on each command.

smb-barred-client-add (add a client to the SMB barred client list)

smb-barred-client-remove (remove a client from the SMB barred client list)

smb-barred-clients-list (display the SMB barred clients list)

smb-barred-clients-clear (clear the SMB barred client list)  

• Clients are barred based on their IP address, so each IPv4 and IPv6 (if configured) address will need to be considered a separate entry. Once a client is barred, that client can't connect over SMB regardless of the credentials used – manual removal from the 'barred' list is required. A maximum of 512 client IP addresses per security context can be barred.
• The output from the smb-barred-clients-list is included in the showall.txt log file in the HNAS diags.

A workaround (where SMB Barring does not apply) is for a client to use Kerberos. It will communicate directly to the DC(s) for authentication, not through the HNAS.

To View the Current Settings

Use the following commands to view the current setting values

•  for-each-evs set-smb-auto-barring-mean-interval-threshold-in-seconds
• for-each-evs set-smb-auto-barring-sample-size
  
  

  4080:$ for-each-evs set-smb-auto-barring-mean-interval-threshold-in-seconds
  EVS 1 (4080-EVS01):
  smb-auto-barring-mean-interval-threshold-in-seconds = '0x2'(2)
  EVS 2 (4080-EVS02):
  smb-auto-barring-mean-interval-threshold-in-seconds = '0x2'(2)
  EVS 3 (4080-EVS03):
  smb-auto-barring-mean-interval-threshold-in-seconds = '0x2'(2)
  EVS 4 (4080-EVS04):
  smb-auto-barring-mean-interval-threshold-in-seconds = '0x2'(2)
  
  4080:$ for-each-evs set-smb-auto-barring-sample-size
  EVS 1 (4080-EVS01):
  smb-auto-barring-sample-size = '0x15'(21)
  EVS 2 (4080-EVS02):
  smb-auto-barring-sample-size = '0x15'(21)
  EVS 3 (4080-EVS03):
  smb-auto-barring-sample-size = '0x15'(21)
  EVS 4 (4080-EVS04):

  
  
  
  

Tuning the auto-barring parameters

Before disabling auto-barring, the customer may choose to tune the command parameters.

•    set-smb-auto-barring-mean-interval-threshold-in-seconds - This commands sets the SMB
client auto-barring mean interval threshold - a given client attempting connections with an
incorrect password more frequently than this will be barred.

Default value: 2 (seconds)
Configurable range: 1 to 120 seconds in 1 second intervals

•    set-smb-auto-barring-sample-size - This command sets the SMB client auto- barring
sample size - i.e., the number of instances a client can fail to connect with an
incorrect password before being evaluated against the above interval for banning.

Default value: 21
Configurable range 21 to 512

How do these parameters affect auto-barring? 

Varying set-smb-auto-barring-sample-size allows you to change how many bad connection attempts can be made before a client is considered for auto-barring.  For example,

$ set-smb-auto-barring-sample-size 42

would allow 42 connection attempts before the client was considered for auto-barring.

Varying set-smb-auto-barring-mean-interval-threshold-in-seconds allows you to change the frequency at which a client can attempt to connect before being barred.  For example,

$ set-smb-auto-barring-mean-interval-threshold-in-seconds 4

would not add a client to the barred list unless it was attempting to connect more frequently than once every 4 seconds (on average).

The default values were carefully selected to avoid clients being auto-barred unnecessarily.  If you choose to vary them, it is suggested starting with small adjustments and observing the results.  Setting too large a threshold or sample size can reduce the auto-barring feature's effectiveness.

Warning:

• If Barring is disabled globally, the entire HNAS can get denied access to the DC(s) if there are too many wrong login attempts from a single user.
• Blocking the client from which the 'bad' user comes prevents this and allows all other clients to continue access.

From the CLI

Use the following procedure to enable SMB Barring on an Individual EVS Context if Multi-Tenancy is enabled.

1. Establish an ssh session with the vSMU.
2. Login as manager; provide the current password.
3. In the menu, type the number of the system to be configured.
4. Run the command: evs-security list
   
   

   <evs-security list for admin vnode>
   
   EVS id     Per EVS security status     
   ------     ------'----------'-----     
        1                      global     
        2                      global     
        3                      global     
        4                      global     
        5                      global   
        6                      global     
        8                      global     
       10               '      global    
       11                      global     
       12                      global     
       13                  individual     <---Global disable will not turn off this 'individual' EVS Security Context
       15                      global

   
   Note: The system may or may not have EVS(s) designated in a particular security context.
    
5. To disable the SMB barring functionality on the 'global' context, run this command:
   $ set smb-auto-barring false 
6. To enable the SMB barring functionality on the 'individual' EVS, run this command:
   $ vn <EVS ID>
   $ set-for-evs smb-auto-barring -a true
   Note: If an EVS in an Individual Context.
7. To disable the SMB barring functionality on the 'individual' EVS, run this command:
   $ vn <EVS ID>
   $ set-for-evs smb-auto-barring -a false
   Note: If an EVS in an Individual Context.

Manual Search for 'Bad Actor(s)

  Here are some steps to identify the 'bad actor(s).

1. Connect to the System Management Unit using the Putty application:
2. Login as: manager
3. Password: <enter the current manager password>
4. The server menu appears
   
   

   Available servers:
   ==================
      1)  10.0.2.210       HNASDEMO
   Please choose a server, or type 'q' to exit to a bash Shell.
   
   

5. Select the appropriate Cluster/Server: 1
6. Type the following commands:
   nolog for-each-evs smb-barred-clients-list (Displays the list of client addresses barred from SMB access.)
7. nolog pn all dblog | grep "10.123.xx.xx" (Check the dblog for the IP(s) found in step 1 that are of interest.)
   nolog pn all logtrace dump paced-event-logger | grep "10.123.xx.xx (The paced-event-logger gives the recent output of events that spam the dblog.)
   nolog pn all dblog | grep "10.123.xx.xx" | grep "failed to logon" (Check for failed logons.)
   nolog pn all logtrace dump paced-event-logger | grep "10.123.xx.xx" | grep “failed to logon”

There are several words and phrases to key on when grepping the dblog and paced-event-logger - here are a few more common ones:

• NT_STATUS_WRONG_PASSWORD
• NT_STATUS_ACCOUNT_LOCKED_OUT
• NT_STATUS_NO_SUCH_USER
• NT_STATUS_PASSWORD_EXPIRED
• NT_STATUS_ACCESS_DENIED

Automated Procedure for Customers to collect diagnostics and search for the events above from the downloaded diagnostics.

1. In the vSMU GUI, verify that the system has been configured to send emails.
   1. Navigate to Home > Status & Monitoring > Email Alerts Setup
      Check that an SMTP Server and the From Address have been configured to send emails.
2. Create a cron job on one of the nodes in the cluster to download daily node diagnostics, using the following example.
   crontab add "00 08 * * *" "pn all diagemail  <customer email address>"
3. Download and copy the attached PowerShell script to a directory on a Windows machine.
   FAILED-LOGIN_v4
4. Copy the diagnostics into the same directory.
5. Run the following PowerShell scripts: (You need 7zip installed on your PC).
   1. FAILED-LOGIN_v4
6. This script produces two .txt files
   1. failed-login.txt to get the user name and IP address of the users with failed logins.
   2. wrong-login-per-day.txt to see the trend of the failed logins per day of both nodes.