Configure ONTAP Mediator attributes
Suggest changes
PDFs
You can configure ONTAP Mediator host-side attributes, including certificate-related settings and configuration overrides.
ONTAP Mediator configurable settings
ONTAP Mediator supports several configurable settings. The default values for these settings are provided in a low_space_threshold_mib: 10 read-only file. The file is located at:
/opt/netapp/lib/ontap_mediator/ontap_mediator/server_config/ontap_mediator.user_config.yaml
All values that are placed in the ontap_mediator.user_config.yaml will override the default values and be maintained across all ONTAP Mediator upgrades.
After you modify ontap_mediator.user_config.yaml, restart ONTAP Mediator:
systemctl restart ontap_mediatorThe ONTAP Mediator attributes described in this section can be modified if required.
|
Other default values in the ontap_mediator.config.yaml should not be changed because modified values are not maintained during ONTAP Mediator upgrades.
|
You modify ONTAP Mediator attributes by copying the required variables to the ontap_mediator.user_config.yaml file to override the default settings.
Install third-party SSL certificates
You can replace the default self-signed certificates with third-party SSL certificates by modifying the ONTAP Mediator configuration files.
To replace the default self-signed certificates with third-party SSL certificates, you modify certain attributes in the following files:
-
/opt/netapp/lib/ontap_mediator/ontap_mediator/server_config/ontap_mediator.config.yaml -
/opt/netapp/lib/ontap_mediator/uwsgi/ontap_mediator.ini
The variables in these files are used to control the certificate files used by ONTAP Mediator.
The default variables listed in the following table are included in the /opt/netapp/lib/ontap_mediator/ontap_mediator/server_config/ontap_mediator.config.yaml file.
| Variable | Path |
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
-
cert_valid_daysis used to set the expiration of client certificates. The maximum value is three years (1095 days). -
x509_passin_pwdis the passphrase for the signed client certificate.
The default variables listed in the following table are included in the /opt/netapp/lib/ontap_mediator/uwsgi/ontap_mediator.ini file.
| Variable | Path |
|---|---|
|
|
|
|
|
|
The default variables listed in the following table are included in the /opt/netapp/lib/ontap_mediator/ontap_mediator/server_config/ontap_mediator.config.yaml file.
| Variable | Path |
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
-
cert_valid_daysis used to set the expiration of client certificates. The maximum value is three years (1095 days). -
x509_passin_pwdis the passphrase for the signed client certificate.
The default variables listed in the following table are included in the /opt/netapp/lib/ontap_mediator/uwsgi/ontap_mediator.ini file.
| Variable | Path |
|---|---|
|
|
|
|
|
|
If you modify these attributes, restart ONTAP Mediator to apply the changes. For detailed instructions on how to replace default certificates with third-party certificates, refer to Replace self-signed certificates with trusted third-party certificates.
Configure password attack protection
The following settings provide protection against brute-force password guessing attacks.
To enable the feature, set a value for the window_seconds and the retry_limit.
-
Provide a 5-minute window for guesses, and then reset the count to zero failures:
authentication_lock_window_seconds: 300 -
Lock the account if five failures occur within the window timeframe:
authentication_retry_limit: 5 -
Reduce the impact of brute-force password guessing attacks by setting a delay that occurs prior to rejecting each attempt, which slows the attacks.
authentication_failure_delay_seconds: 5authentication_failure_delay_seconds: 0 # seconds (float) to delay failed auth attempts prior to response, 0 = no delay authentication_lock_window_seconds: null # seconds (int) since the oldest failure before resetting the retry counter, null = no window authentication_retry_limit: null # number of retries to allow before locking API access, null = unlimited
Configure password complexity rules
The following fields control the password complexity rules of the ONTAP Mediator API user account.
password_min_length: 8 password_max_length: 64 password_uppercase_chars: 0 # min. uppercase characters password_lowercase_chars: 1 # min. lowercase character password_special_chars: 1 # min. non-letter, non-digit password_nonletter_chars: 2 # min. non-letter characters (digits, specials, anything)
Configure ONTAP Mediator disk and log space settings, including the free-space threshold and reserved log space.
Configure the free-space threshold
There are settings that control the required free space on the /opt/netapp/lib/ontap_mediator disk.
If the space is lower than the set threshold, the service issues a warning event.
low_space_threshold_mib: 10
Configure reserved log space
The RESERVE_LOG_SPACE feature is controlled by specific settings. By default, the ONTAP Mediator installation creates a separate disk space for the logs. The installer creates a new fixed-size file with a total of 700MB of disk space to be used explicitly for ONTAP Mediator logging.
To disable this feature and use the default disk space, perform the following steps:
-
Change the value of RESERVE_LOG_SPACE from 1 to 0 in the following file:
/opt/netapp/lib/ontap_mediator/tools/mediator_env-
Run the following command:
cat /opt/netapp/lib/ontap_mediator/tools/mediator_env | grep "RESERVE_LOG_SPACE"RESERVE_LOG_SPACE=0
-
Restart ONTAP Mediator:
systemctl restart ontap_mediator
-
To re-enable the feature, change the value from 0 to 1 and restart the Mediator.
|
|
Toggling between disk spaces does not purge existing logs. All previous logs are backed up and then moved to the current disk space after toggling and restarting the Mediator. |