Gentoo/MIT Kerberos Windows Domain

Page last edited 3,450 days ago
From Alon Bar-Lev's Site
Jump to navigation Jump to search

MIT Kerberos Windows Domain Integration


  1. Make sure you have ntpd setup operational. NOTE: You cannot use Windows SNTP as clock source for NTP.
    However you can do the other way around, having NTP host which is the clock source of Windows SNTP.
  2. DNS and Reverse-DNS lookup must be operational, make sure both your domain controller and the designated host are available in both modes.

Setup kerberos

File: /etc/portage/package.use/samba.conf
net-fs/samba ads ldap
emerge app-crypt/mit-krb5 net-fs/samba
File: /etc/krb5.conf
        default_realm = MY_DOMAIN.COM
        forwardable = true



        kdc = FILE:/var/log/krb5kdc.log
        admin_server = FILE:/var/log/kadmin.log
        default = FILE:/var/log/krb5lib.log
Note: The forwardable true is optional, however having this makes *NIX behaves more like windows in delegated authentication


kinit user

Joining Domain

File: /etc/samba/smb.conf
workgroup = MY_WORKGROUP
security = ads
kerberos method = system keytab
client use spnego = yes
net ads join -U Administrator
net ads testjoin
Join is OK
net ads keytab create -U Administrator

Integrating Apache Web Server


Note: Integrating Apache Web Server does not require any pam/nss integration
emerge www-apache/mod_auth_kerb
net ads keytab add HTTP -U Administrator

Optional, test ticket

klist -k /etc/krb5.keytab
kinit -kt /etc/krb5.keytab -S HTTP/ 'SERVER$'

Enable apache access

chgrp apache /etc/krb5.keytab
chmod g+r /etc/krb5.keytab


File: /etc/apache2/11_mod_auth_kerb.conf
<IfDefine AUTH_KERB>
LoadModule auth_kerb_module modules/

<Directory "/var/www/private">
        AuthType Kerberos
        AuthName "Kerberos Login"
        Krb5Keytab /etc/krb5.keytab
        KrbAuthRealms MY_DOMAIN.COM
        Require valid-user

Integrating pam/nss


File: /etc/portage/package.use/pam.conf
sys-auth/pambase pam_krb5
emerge --update --deep --newuse @world
emerge sys-auth/nss_ldap


File: /etc/ldap.conf
base DC=mydomain,DC=com
uri ldap://
binddn CN=ldapbind,CN=Users,DC=mydomain,DC=com
bindpw secret
scope sub
nss_paged_results yes
nss_schema rfc2307bis
# RFC 2307 (AD) mappings
nss_map_objectclass posixAccount user
nss_map_objectclass shadowAccount user
nss_map_attribute uid sAMAccountName
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_attribute shadowLastChange pwdLastSet
nss_map_objectclass posixGroup group
nss_map_attribute uniqueMember member
pam_login_attribute sAMAccountName
pam_filter objectclass=User
pam_password ad
sasl_secprops maxssf=0


File: /etc/nssswitch.conf
passwd:      files ldap
shadow:      files ldap
group:       files ldap
netgroup:    ldap files


id user1
uid=10012(user1) gid=100(users) groups=100(users)

Login to user1 with domain password using ssh.

Integrating sshd

First integrate pam/nss.


File: /etc/ssh/sshd_config
GSSAPIAuthentication yes

Integrating Samba Server

First integrate pam/nss.

net ads keytab add cifs -U Administrator

Set all to system-remote-login:

File: /etc/pam.d/samba
auth       include      system-remote-login
account    include      system-remote-login
session    include      system-remote-login
password   include      system-remote-login


Integrate apache.

Go to Administration->Parameters->User Authentication, set:

auth_env_id = REMOTE_USER
auth_env_email = REMOTE_USER
user_info_class = Env
requirelogin = On


Note: Setup client does not require any system wide modification (pam/nss), nor joining the domain.

First authenticate using kinit

kinit user

Validate ticket:



  1. Go to about:config
  2. Set network.negotiate-auth.trusted-uris to
  3. Use only fully qualified DNS names to access internal web sites.

Samba Client


File: ~/.smb/smb.conf
        workgroup = MY_DOMAIN
        realm = MY_DOMAIN.COM
        security = ads
        client use spnego = yes


smbclient -k //server/share


Alon Bar-Lev


Originally written by: Alon Bar-Lev - 2011-11-17

Authors are people who have worked on this document and have made significant changes to its content. If you have edited this article and wish to add yourself to the authors list please read "Who are Authors".