SecD 错误：启用 AES 时无可用服务器，因为缺少根 CA 证书

最后更新
另存为PDF

Views:: 198

Visibility:: Public

Votes:: 0

Category:: ontap-9

Specialty:: nas

Last Updated:

适用于

ONTAP 9
CIFS
Advanced Encryption Standard (AES)

问题

在 CIFS SVM 上启用 AES 加密：
- ONTAP 9.12.1 及更早版本

Cluster::> cifs security modify -vserver vserver_name -is-aes-encryption-enabled true Info: In order to enable CIFS AES encryption, the password for the CIFS server machine account must be reset. Enter the username and password for the CIFS domain "DC_Name". Enter your user ID: administrator Enter your password: Error: command failed: Password update failed. Reason: SecD Error: no server available.

- 当前 ONTAP 版本（9.12.1 及更高版本），使用当前 AES 命令语法会发生相同的故障：

cluster::> vserver cifs security modify -vserver <svm> -advertised-enc-types aes-256,aes-128

Info: In order to enable CIFS AES encryption, the password for the CIFS server machine account must be reset. Enter the username and password for the CIFS domain "<domain>".

Enter your user ID: administrator
Enter your password:
Error: command failed: Password update failed. Reason: SecD Error: no connections available.

注： ONTAP 9.12.1 及更高版本已弃用 -is-aes-encryption-enabled 选项；请改用 -advertised-enc-types 。

在验证首选 DC 状态时：

::> vserver cifs domain preferred-dc check -vserver SVM

Vserver: SVM

Domain Name DC Address Status Status Details ----------------------- ----------------- ------ ---------------------- svm.com 10.108.128.25 down Not part of domain svm.com 10.108.128.26 down Not part of domain svm.com 10.109.140.66 down Not part of domain

如果启用了域发现，EMS 会定期记录：

Sun Jun 01 22:07:22 +0800 [NODE: secd: secd.conn.auth.failure:notice]: Vserver (svm) could not authenticate over the network to server (some_server). Error: Can't contact LDAP server (Service: LDAP (Active Directory), Operation: SiteDiscovery).

注意：较新的 ONTAP 版本还将出现下列 EMS 错误：

secd.ldap.noServers, secd.ldap.trust.noServers, secd.unexpectedFailure, secd.conn.auth.failure

SECD 日志：

Cluster::> event log show -message-name *secd*

Time Node Severity Event

------------------- ---------------- ------------- ---------------------------

12/9/2022 10:43:08  node_01          DEBUG         secd.unexpectedFailure: vserver (vserver_name) Unexpected failure.

Error: CIFS server password reset procedure failed

...

[ 59] Successfully connected to ip xx.xx.20.69, port 389 using TCP

[ 80] Hostname found in Name Service Cache

[ 81] Successfully connected to ip xx.xx.20.71, port 389 using TCP

[ 86] Required certificate with CA Entrust Root Certification Authority - G2 is not installed

[ 86] Unable to start TLS: Connect error

[ 86] Additional info: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed

[ 86] Unable to connect to LDAP (Active Directory) service on DC_Name

[ 87] Successfully connected to ip xx.xx.20.69, port 389 using TCP

[ 92] Required certificate with CA Entrust Root Certification Authority - G2 is not installed

[ 93] Unable to start TLS: Connect error

[ 93] Additional info: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed

[ 93] Unable to connect to LDAP (Active Directory) service on DC_Name

[ 93] Successfully connected to ip xx.xx.20.72, port 389 using TCP

[ 98] Required certificate with CA Entrust Root Certification Authority - G2 is not installed

[ 98] Unable to start TLS: Connect error

[ 98] Additional info: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed

[ 98] Unable to connect to LDAP (Active Directory) service on DC_Name

[ 99] Successfully connected to ip xx.xx.20.67, port 389 using TCP

[ 104] Required certificate with CA Entrust Root Certification Authority - G2 is not installed

[ 104] Unable to start TLS: Connect error

[ 104] Additional info: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed

[ 105] Unable to connect to LDAP (Active Directory) service on DC_Name

[ 105] N...[Please refer to secd log for more detail!]