netapp.ontap.na_ontap_vserver_cifs_security – NetApp ONTAP vserver CIFS security modification
Note
This plugin is part of the netapp.ontap collection (version 20.12.0).
To install it use: ansible-galaxy collection install netapp.ontap.
To use it in a playbook, specify: netapp.ontap.na_ontap_vserver_cifs_security.
New in version 2.9.0: of netapp.ontap
Synopsis
- modify vserver CIFS security.
 
Requirements
The below requirements are needed on the host that executes this module.
- A physical or virtual clustered Data ONTAP system. The modules support Data ONTAP 9.1 and onward.
 - REST support requires ONTAP 9.6 or later.
 - Ansible 2.6
 - Ansible 2.9 or later is strongly recommended as it enables the new collection delivery system.
 - Python2 netapp-lib (2017.10.30) or later. Install using ‘pip install netapp-lib’
 - Python3 netapp-lib (2018.11.13) or later. Install using ‘pip install netapp-lib’
 - netapp-lib 2020.3.12 is strongly recommended as it provides better error reporting for connection issues.
 - To enable http on the cluster you must run the following commands ‘set -privilege advanced;’ ‘system services web modify -http-enabled true;’
 
Parameters
| Parameter | Choices/Defaults | Comments | 
|---|---|---|
|   cert_filepath    string    added in 20.6.0 of netapp.ontap    |    path to SSL client cert file (.pem).  not supported with python 2.6.   |  |
|   feature_flags    dictionary    added in 20.5.0 of netapp.ontap    |    Enable or disable a new feature.  This can be used to enable an experimental feature or disable a new feature that breaks backward compatibility.  Supported keys and values are subject to change without notice. Unknown keys are ignored.   |  |
|   hostname    string / required    |    The hostname or IP address of the ONTAP instance.   |  |
|   http_port    integer    |    Override the default port (80 or 443) with this port   |  |
|   https    boolean    |   
  |    Enable and disable https.  Ignored when using REST as only https is supported.  Ignored when using SSL certificate authentication as it requires SSL.   |  
|   is_aes_encryption_enabled    boolean    |   
  |    Determine whether AES-128 and AES-256 encryption mechanisms are enabled for Kerberos-related CIFS communication.   |  
|   is_password_complexity_required    boolean    |   
  |    Determine whether password complexity is required for local users.   |  
|   is_signing_required    boolean    |   
  |    Determine whether signing is required for incoming CIFS traffic.   |  
|   is_smb_encryption_required    boolean    |   
  |    Determine whether SMB encryption is required for incoming CIFS traffic.   |  
|   kerberos_clock_skew    integer    |    The clock skew in minutes is the tolerance for accepting tickets with time stamps that do not exactly match the host's system clock.   |  |
|   kerberos_kdc_timeout    integer    |    Determine the timeout value in seconds for KDC connections.   |  |
|   kerberos_renew_age    integer    |    Determine the maximum amount of time in days for which a ticket can be renewed.   |  |
|   kerberos_ticket_age    integer    |    Determine the maximum amount of time in hours that a user's ticket may be used for the purpose of Kerberos authentication.   |  |
|   key_filepath    string    added in 20.6.0 of netapp.ontap    |    path to SSL client key file.   |  |
|   lm_compatibility_level    string    |   
  |    Determine the LM compatibility level.   |  
|   ontapi    integer    |    The ontap api version to use   |  |
|   password    string    |    Password for the specified user.  aliases: pass  |  |
|   referral_enabled_for_ad_ldap    boolean    |   
  |    Determine whether LDAP referral chasing is enabled or not for AD LDAP connections.   |  
|   session_security_for_ad_ldap    string    |   
  |    Determine the level of security required for LDAP communications.   |  
|   smb1_enabled_for_dc_connections    string    |   
  |    Determine if SMB version 1 is used for connections to domain controllers.   |  
|   smb2_enabled_for_dc_connections    string    |   
  |    Determine if SMB version 2 is used for connections to domain controllers.   |  
|   use_rest    string    |   Default: "auto"   |    REST API if supported by the target system for all the resources and attributes the module requires. Otherwise will revert to ZAPI.  always -- will always use the REST API  never -- will always use the ZAPI  auto -- will try to use the REST Api   |  
|   use_start_tls_for_ad_ldap    boolean    |   
  |    Determine whether to use start_tls for AD LDAP connections.   |  
|   username    string    |    This can be a Cluster-scoped or SVM-scoped account, depending on whether a Cluster-level or SVM-level API is required.  For more information, please read the documentation https://mysupport.netapp.com/NOW/download/software/nmsdk/9.4/.  Two authentication methods are supported  1. basic authentication, using username and password,  2. SSL certificate authentication, using a ssl client cert file, and optionally a private key file.  To use a certificate, the certificate must have been installed in the ONTAP cluster, and cert authentication must have been enabled.  aliases: user  |  |
|   validate_certs    boolean    |   
  |    If set to   no, the SSL certificates will not be validated.This should only set to   False used on personally controlled sites using self-signed certificates. |  
|   vserver    string / required    |    name of the vserver.   |  
Notes
Note
- The modules prefixed with na\_ontap are built to support the ONTAP storage platform.
 
Examples
- name: modify cifs security
  na_ontap_vserver_cifs_security:
    hostname: "{{ hostname }}"
    username: username
    password: password
    vserver: ansible
    is_aes_encryption_enabled: false
    lm_compatibility_level: lm_ntlm_ntlmv2_krb
    smb1_enabled_for_dc_connections: system_default
    smb2_enabled_for_dc_connections: system_default
    use_start_tls_for_ad_ldap: false
    referral_enabled_for_ad_ldap: false
    session_security_for_ad_ldap: none
    is_signing_required: false
    is_password_complexity_required: false
- name: modify cifs security is_smb_encryption_required
  na_ontap_vserver_cifs_security:
    hostname: "{{ hostname }}"
    username: username
    password: password
    vserver: ansible
    is_smb_encryption_required: false
- name: modify cifs security int options
  na_ontap_vserver_cifs_security:
    hostname: "{{ hostname }}"
    username: username
    password: password
    vserver: ansible
    kerberos_clock_skew: 10
    kerberos_ticket_age: 10
    kerberos_renew_age: 5
    kerberos_kdc_timeout: 3
  Authors
- NetApp Ansible Team (@carchi8py) <ng-ansibleteam@netapp.com>
 
    © 2012–2018 Michael DeHaan
© 2018–2019 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
    https://docs.ansible.com/ansible/2.10/collections/netapp/ontap/na_ontap_vserver_cifs_security_module.html