mTLS Authentication for NFS

The VAST cluster supports mTLS authentication of NFSv3 and NFSv4 connections, where in addition to the client authenticating the server before establishing a secure connection, the server must also authenticate the client using a certificate.

In multi-tenant environments, the VAST NFS server can be configured to distinguish between mTLS certificates associated with particulars tenants, and thus to direct the IO to the intended tenant based on the client certificate (in addition to using the client IP or destination virtual IP for that purpose). This improves security while enforcing tenant isolation and tenant-level authorization for NFS clients.

Warning
If your cluster has a cluster-wide configuration of mTLS authentication for NFS, NFS mTLS certificates configured at the tenant level are not used, and the cluster authenticates NFS clients based on the cluster-wide certificate only.

You configure mTLS authentication for NFS by adding an mTLS certificate in tenant settings.

You can choose whether you want to enforce mTLS authentication for NFS per view by setting a flag in the view policy.

Prerequisites

mTLS authentication for NFS requires TLS 1.3.
The VASTNFS driver is required to use mTLS certificate-based tenant identification for NFSv3. (NFSv4 does not require VASTNFS.)
TLS encryption for NFS must be configured on the VAST cluster.
For clients using multiple certificates for different NFS exports (certificate per mount), Linux kernel 6.17 or later is required.

Limitations

Revocation of an mTLS certificate by using CRL Distribution Points (CDP) is not supported.
A CRL file can contain up to 100 certificates to be revoked.
When using NFSv3, if a parent view does not have TLS or mTLS enforced, the VAST cluster allows unencrypted access to any of its child views, regardless of whether the child view has TLS or mTLS enforcement configured on it.

Client-Side Configurations

The client must have the client certificate and private key installed (in addition to the CA certificate used to validate the VAST NFS server during regular TLS handshake).
The client's /etc/tlshd.conf must have the following lines included:
```
[authenticate.client]
x509.truststore = <path the CA certificate>
x509.certificate = <path to client certificate>
x509.private_key = <path to private key>
```
The tlshd service must be up and running.
The xprtsec=mtls NFS mount option must be specified for the mount.
When using mTLS certificate-based tenant identification for NFSv3, the client must mount with mountproto=tcp.

Adding an mTLS Certificate for a Tenant

A tenant-level mTLS CA certificate must be unique across all tenants.

If the tenant is configured with a CA certificate and the client sends a certificate that is not signed by this CA (or a trust chain that does not provide for the signing), access is denied.

To add an mTLS certificate for a tenant:

In VAST Web UI:
1. Open the Authentication settings for mTLS pane in tenant settings (Element Store -> Tenants -> choose to create or edit a tenant -> Advanced Protocol Settings tab).
2. Click Add Certificate under NFS Certificates or Kafka and NFS Certificates.
3. Enter a certificate with a CRL file (optional) in the fields provided.
  Up to 2 certificates can be added per tenant.

Enforcing mTLS Authentication for NFS per View

You can configure a view policy to enforce mTLS authentication for NFS clients. If the enforcement flag is set, the cluster denies access for clients that do not present a valid client certificate. This also applies to clients accessing the cluster from allowed client virtual IPs configured for the tenant or from the tenant's dedicated virtual IP pool.

View policies that span multiple tenants cannot have the enforcement flag set.

To set the mTLS authentication enforcement flag in a view policy:

In VAST Web UI, use the Enforce mTLS encryption option in view policy settings (Element Store -> View Policies -> choose to create or edit a view policy -> NFS tab).

Note
When using NFSv3, if a parent view does not have TLS or mTLS enforced, the VAST cluster allows unencrypted access to any of its child views, regardless of whether the child view has TLS or mTLS enforcement configured on it.