cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
ztamas
Level 9
Report Inappropriate Content
Message 1 of 5

SFTP domain based authentication

Jump to solution

Hi,

Could someone tell me is it possible to authenticate the SFTP traffic basis on NTLM or Kerberos through SOCKS proxy?
I tried to connect and authenticate through the SOCKS proxy with WINSCP but it is not working.
I've found an option in the Kerberos authentication settings (SOCKS Kerberos specific parameters) but I don't know what it means. There is no information in the documentation about it.

Screen_02 Oct. 18 10.28.jpg

Thanks,
Zoltan

1 Solution

Accepted Solutions

Re: SFTP domain based authentication

Jump to solution

Hi Zoltan -

As long as you are using SOCKS v5 this is possible.

  • NTLM, LDAP, etc, will work but note that NTLM needs to have “allow basic” enabled.
  • Kerberos auth (GSS API) requires updating the keytab file to include a SPN for the RCMD service:

      

Follow the Kerberos setup guide in the community: https://community.mcafee.com/docs/DOC-2682

It is best to have a rule set specifically for SOCKS traffic, so it is isolated from normal traffic. Within this rule set is where authentication would occur. Attached is a template for SOCKs which uses NTLM authentication.

View solution in original post

4 Replies

Re: SFTP domain based authentication

Jump to solution

Hi Zoltan -

As long as you are using SOCKS v5 this is possible.

  • NTLM, LDAP, etc, will work but note that NTLM needs to have “allow basic” enabled.
  • Kerberos auth (GSS API) requires updating the keytab file to include a SPN for the RCMD service:

      

Follow the Kerberos setup guide in the community: https://community.mcafee.com/docs/DOC-2682

It is best to have a rule set specifically for SOCKS traffic, so it is isolated from normal traffic. Within this rule set is where authentication would occur. Attached is a template for SOCKs which uses NTLM authentication.

View solution in original post

akill
Level 9
Report Inappropriate Content
Message 3 of 5

Re: SFTP domain based authentication

Jump to solution

I hope in a future mcafee can support sftp or ftps natively

ztamas
Level 9
Report Inappropriate Content
Message 4 of 5

Re: SFTP domain based authentication

Jump to solution

Hi Bwallace1,

Thanks for your help! The basic authentication is working perfectly.

Could you tell me what is the RCMD service?

Thanks!

Regards,

Zoltan

Re: SFTP domain based authentication

Jump to solution

Thank you for the wonderful example rule set.

It is much more thorough than what I came up with and provides lot of tuning opportunities.

-Jasey

Want to Ask a Question?
Many members like to perform a search first in case other customers have already asked and answered a similar question. However, to ask a question, first select a forum then click on Post a Topic. You must sign in or log in with your existing credentials.

McAfee Service Portal customers please use your existing username and password to log into the community.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community