FreeNAS: Why do usernames and passwords have to match the client system?

Question

I'm transitioning from a ReadyNAS server to a FreeNAS server. On our current ReadyNAS, we have one user account that every person in our office can use to access the server. Everyone has a unique username/password on their PC.

According to the FreeNAS wiki, you have to set up usernames/passwords to match the client system (AKA Windows logins in my case):

http://doc.freenas.org/index.php/Users

http://doc.freenas.org/index.php/Windows_(CIFS)_Shares#Configuring_Local_User_Access

Is it possible to set up FreeNAS for only one username/password that multiple people can use (without matching credentials on their client PC)?

Answer 1

What you see is a requirement, or should I say a feature of NTLM. Here is what happens (taken here with some editing).

1. A user accesses a client computer and provides a user name and password. The client computes a cryptographic hash of the password and discards the actual password.
2. The client sends the user name to the server (in plaintext).
3. The server generates a 16-byte random number, called a challenge or nonce, and sends it to the client.
4. The client encrypts this challenge with the hash of the user's password and returns the result to the server. This is called the response.
5. The server (FreeNAS) decrypt the response. If the original number is obtained, access is granted.

You don't absolutely need matching accounts and passwords. But if you do, you will get single sign-on for free (as in beer). This method does not scale because users will be confused when they change their password on the domain but the FreeNAS won`t follow.

You can either map a network drive and provide a password for a local account or set up Samba to query your ActiveDirectory to perform step 5 above. My personal preference is to use Kerberos. It has a learning curve but now that I know it, I find it easier to do and it works the same every where.