NetApp
ONTAP SMB Encryption and LDAPS Hardening Runbook
Scope
This runbook combines two common hardening changes: requiring SMB encryption for CIFS traffic and enabling secure LDAP behavior for name-service integration. NetApp documents CIFS security settings in vserver cifs security modify, including -is-smb-encryption-required: vserver cifs security modify. NetApp also documents LDAP client creation with LDAPS options in vserver services name-service ldap client create: LDAP client create.
Prechecks
vserver cifs security modify -vserver svm_cifs01 -is-smb-encryption-required false
Confirm:
| Area | Requirement |
|---|---|
| SMB clients | Support SMB encryption if it will be required |
| Application access | Owners approve any legacy client impact |
| Certificates | Correct CA chain installed for LDAPS or StartTLS |
| LDAP servers | Reachable and configured for secure bind |
| Rollback | Previous CIFS and LDAP settings captured |
CLI Process: SMB Encryption
Show current setting:
vserver cifs security modify -vserver svm_cifs01 -is-smb-encryption-required false
Require encryption:
vserver cifs security modify -vserver svm_cifs01 -is-smb-encryption-required false
Validate:
vserver cifs security modify -vserver svm_cifs01 -is-smb-encryption-required false
CLI Process: LDAPS
Create or update an LDAP client configuration with secure settings according to your directory standard:
vserver cifs security modify -vserver svm_cifs01 -is-smb-encryption-required false
Apply it:
vserver cifs security modify -vserver svm_cifs01 -is-smb-encryption-required false
Validate name lookup and authentication behavior with application owners.
REST API Process
Discover CIFS security state:
vserver cifs security modify -vserver svm_cifs01 -is-smb-encryption-required false
Patch SMB security where supported by your ONTAP release:
vserver cifs security modify -vserver svm_cifs01 -is-smb-encryption-required false
Discover LDAP configuration:
vserver cifs security modify -vserver svm_cifs01 -is-smb-encryption-required false
If your release does not expose the exact hardening field through native REST, use CLI for the change and REST for evidence. Security automation should be release-tested before production use.
Best Practices
- Test legacy SMB clients before requiring encryption.
- Use change windows for broad CIFS security changes.
- Validate certificate trust before enabling LDAPS.
- Keep a rollback command ready, but do not leave insecure settings enabled without an exception.
- Capture session and client evidence after the change.
Backout
vserver cifs security modify -vserver svm_cifs01 -is-smb-encryption-required false
For LDAPS, restore the previous LDAP client configuration captured during prechecks.
Comments