TMA-FLASHARRAY-3.3
Ensure native Active Directory integration is used for NFS and SMB identity and authentication
설명
FlashArray supports native integration with Active Directory domains in order to enable LDAP lookups for authorization, and Kerberos authentication, for both NFS and SMB file access. FlashArray does this by creating a computer account in the domain to represent itself and generate kerberos keys. A unique AD account may be created for each server on the array that needs one. Manual review in the Purity//FA GUI or CLI (organization-specific or per-object evidence).
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
From the CLI: ; Check the Active Directory domain join status by running the command puread account list. ; Review the output to verify that your file server's AD account is listed and the Domain field is correct.
조치 방법
조치 방식: 가이드 또는 인프라 패치
To align with the security recommendations, join the FlashArray file server to your Active Directory domain. From the GUI: ; Navigate to Storage > Servers and click your file server to access its settings. ; In the Remote Directory Service panel, click the Edit Configuration icon to the right and select Active Directory. ; In the Configure Remote Directory Service window, enter a Name, the Domain DNS Name, and the Computer Name for the array. ; Enter the AD User and AD Password for an Active Directory account with permission to create a new computer account (or select the Use Existing Account toggle if pre-created by your AD admin). ; Ensure TLS Mode is set to required.
속성
- 운영 체제
- 모두
- 태그
- flasharraystoragefile-services
- 참고 자료
- CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 3.3 Ensure native Active Directory integration is used for NFS and SMB identity and authentication