mTLS Authentication for NFS

The VAST cluster supports mTLS authentication of NFSv3 and NFSv4 connections, where in addition to the client authenticating the server before establishing a secure connection, the server must also authenticate the client using a certificate.

In multi-tenant environments, you can configure the VAST NFS server to distinguish between mTLS certificates associated with particulars tenants, and thus to direct the IO to the intended tenant based on the client certificate (in addition to using the client IP or destination virtual IP for that purpose). This improves security while enforcing tenant isolation and tenant-level authorization for NFS clients.

mTLS authentication for NFS can be configured on the VAST cluster as follows:

By creating a cluster-wide configuration that includes:
- Cluster CA certificate for mTLS authentication
- Indication which OID within the otherName entry of the client certificate’s SAN extension to use for tenant identification
- Labeling of tenants with ID strings that will be used for tenant identification
At the tenant level, by adding a tenant-specific mTLS CA certificate.

You can choose whether you want to enforce mTLS authentication for NFS per view by setting a flag in the view policy.

Prerequisites

mTLS authentication for NFS requires TLS 1.3.
The VASTNFS driver is required to use mTLS certificate-based tenant identification for NFSv3. (NFSv4 does not require VASTNFS.)
TLS encryption for NFS must be configured on the VAST cluster.
For clients using multiple certificates for different NFS exports (certificate per mount), Linux kernel 6.17 or later is required.

Limitations

Revocation of an mTLS certificate by using CRL Distribution Points (CDP) is not supported.
A CRL file can contain up to 100 certificates to be revoked.
When using NFSv3, if a parent view does not have TLS or mTLS enforced, the VAST cluster allows unencrypted access to any of its child views, regardless of whether the child view has TLS or mTLS enforcement configured on it.

Client-Side Configurations

The client must have the client certificate and private key installed (in addition to the CA certificate used to validate the VAST NFS server during regular TLS handshake).
The client's /etc/tlshd.conf must have the following lines included:
```
[authenticate.client]
x509.truststore = <path the CA certificate>
x509.certificate = <path to client certificate>
x509.private_key = <path to private key>
```
The tlshd service must be up and running.
The xprtsec=mtls NFS mount option must be specified for the mount.
When using mTLS certificate-based tenant identification for NFSv3, the client must mount with mountproto=tcp.

Creating a Cluster-Wide Configuration for mTLS Authentication of NFS

Cluster-wide configuration of mTLS authentication for NFS enables certificate-based tenant identification.

The cluster-level CA certificate for mTLS authentication is used for all tenants.

Warning
The cluster-wide configuration overrides any tenant-level settings. Applying the customer-wide configuration may cause temporary disconnection of tenant clients.

Complete these steps:

In VAST Web UI:
1. Go to Settings -> Certificates , select the NFS/Kafka mTLS Auth certificate type in the Certificate for field, and click Add certificate under NFS Certificates (or under NFS and Kafka Certificates).
  - Add the CA certificate and, optionally, the CRL file in the fields provided.
  - In the Tenant association (SAN) field, specify an Object Identifier (OID) of an otherName field within certificate's Subject Alternative Name (SAN) extension that will be used for tenant identification. The cluster will compare the value within this field to the tenant's mTLS identifier (entered in the step below).
    For example: 1.3.6.1.2.1.25.2.1.2.3.4.5.6.100. This value must be unique across the SAN otherName fields.
2. For each tenant you need, open tenant settings (Element Store -> Tenants -> right-click a tenant and select Edit) and go to the Advanced Protocol Settings tab.
  - In the mTLS identifier field, enter an ID string that will be used to identify the tenant during mTLS authentication for NFS. The tenant's mTLS identifier must be unique across the cluster.
In VAST CLI:
- Run the tlscertificate create command with the --protocol NFS and --tenant-associate-param options specified. Do not include --tenant-id on the command.
- Run the tenant modify command with the --mtls-identifier option specified.

Adding an mTLS Certificate for a Tenant

A tenant-level mTLS CA certificate must be unique across all tenants.

If the tenant is configured with a CA certificate and the client sends a certificate that is not signed by this CA (or a trust chain that does not provide for the signing), access is denied.

To add an mTLS certificate for a tenant:

In VAST Web UI:
1. Open the Authentication settings for mTLS pane in tenant settings (Element Store -> Tenants -> choose to create or edit a tenant -> Advanced Protocol Settings tab).
2. Click Add Certificate under NFS Certificates or Kafka and NFS Certificates.
3. Enter a certificate with a CRL file (optional) in the fields provided.
  Up to 2 certificates can be added per tenant.
In VAST CLI:
- Run the tlscertificate create command with the --protocol NFS and --tenant-id options specified. For example:
```
tlscertificate create --protocols NFS --ca-certificate-file /cert/full-CA.pem --tenant-id 1
```

Enforcing mTLS Authentication for NFS per View

You can configure a view policy to enforce mTLS authentication for NFS clients. If the enforcement flag is set, the cluster denies access for clients that do not present a valid client certificate. This also applies to clients accessing the cluster from allowed client virtual IPs configured for the tenant or from the tenant's dedicated virtual IP pool.

View policies that span multiple tenants cannot have the enforcement flag set.

To set the mTLS authentication enforcement flag in a view policy:

In VAST Web UI, use the Enforce mTLS encryption option in view policy settings (Element Store -> View Policies -> choose to create or edit a view policy -> NFS tab).
In VAST CLI, run the create viewpolicy or modify viewpolicy command with the --nfs-enforce-mtls option specified.

Note
When using NFSv3, if a parent view does not have TLS or mTLS enforced, the VAST cluster allows unencrypted access to any of its child views, regardless of whether the child view has TLS or mTLS enforcement configured on it.

Documentation Index