Gentoo/MIT Kerberos Windows Domain

Page last edited 1,042 days 7 hours ago
From Alon Bar-Lev's Site
Jump to: navigation, search

MIT Kerberos Windows Domain Integration

Prerequisites

  1. Make sure you have ntpd setup operational. NOTE: You cannot use Windows SNTP as clock source for NTP.
    However you can do the other way around, having NTP host which is the clock source of Windows SNTP.
  2. DNS and Reverse-DNS lookup must be operational, make sure both your domain controller and the designated host are available in both modes.
dig host.name.com
host ip.add.re.s

Setup kerberos

File: /etc/portage/package.use/samba.conf
net-fs/samba ads ldap
emerge app-crypt/mit-krb5 net-fs/samba
File: /etc/krb5.conf
[libdefaults]
        default_realm = MY_DOMAIN.COM
        forwardable = true

[realms]

[domain_realm]

[logging]
        kdc = FILE:/var/log/krb5kdc.log
        admin_server = FILE:/var/log/kadmin.log
        default = FILE:/var/log/krb5lib.log
Note: The forwardable true is optional, however having this makes *NIX behaves more like windows in delegated authentication

Testing:

kinit user

Joining Domain

File: /etc/samba/smb.conf
workgroup = MY_WORKGROUP
security = ads
kerberos method = system keytab
client use spnego = yes
realm = MY_DOMAIN.COM
net ads join -U Administrator
net ads testjoin
Join is OK
net ads keytab create -U Administrator

Integrating Apache Web Server

Setup

Note: Integrating Apache Web Server does not require any pam/nss integration
emerge www-apache/mod_auth_kerb
net ads keytab add HTTP -U Administrator

Optional, test ticket

klist -k /etc/krb5.keytab
kinit -kt /etc/krb5.keytab -S HTTP/server.name@MY_DOMAIN.COM 'SERVER$'

Enable apache access

chgrp apache /etc/krb5.keytab
chmod g+r /etc/krb5.keytab

Configuration

File: /etc/apache2/11_mod_auth_kerb.conf
<IfDefine AUTH_KERB>
LoadModule auth_kerb_module modules/mod_auth_kerb.so

<Directory "/var/www/private">
        AuthType Kerberos
        AuthName "Kerberos Login"
        Krb5Keytab /etc/krb5.keytab
        KrbAuthRealms MY_DOMAIN.COM
        Require valid-user
</Directory>
</IfDefine>

Integrating pam/nss

Setup

File: /etc/portage/package.use/pam.conf
sys-auth/pambase pam_krb5
emerge --update --deep --newuse @world
emerge sys-auth/nss_ldap

Update:

File: /etc/ldap.conf
#host 127.0.0.1
base DC=mydomain,DC=com
uri ldap://dc.mydomain.com/
binddn CN=ldapbind,CN=Users,DC=mydomain,DC=com
bindpw secret
scope sub
nss_paged_results yes
nss_schema rfc2307bis
# RFC 2307 (AD) mappings
nss_map_objectclass posixAccount user
nss_map_objectclass shadowAccount user
nss_map_attribute uid sAMAccountName
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_attribute shadowLastChange pwdLastSet
nss_map_objectclass posixGroup group
nss_map_attribute uniqueMember member
pam_login_attribute sAMAccountName
pam_filter objectclass=User
pam_password ad
sasl_secprops maxssf=0

Update:

File: /etc/nssswitch.conf
passwd:      files ldap
shadow:      files ldap
group:       files ldap
netgroup:    ldap files

Test

id user1
uid=10012(user1) gid=100(users) groups=100(users)

Login to user1 with domain password using ssh.

Integrating sshd

First integrate pam/nss.

Update:

File: /etc/ssh/sshd_config
GSSAPIAuthentication yes

Integrating Samba Server

First integrate pam/nss.

net ads keytab add cifs -U Administrator

Set all to system-remote-login:

File: /etc/pam.d/samba
auth       include      system-remote-login
account    include      system-remote-login
session    include      system-remote-login
password   include      system-remote-login

Bugzilla

Integrate apache.

Go to Administration->Parameters->User Authentication, set:

auth_env_id = REMOTE_USER
auth_env_email = REMOTE_USER
user_info_class = Env
requirelogin = On

Clients

Note: Setup client does not require any system wide modification (pam/nss), nor joining the domain.

First authenticate using kinit

kinit user

Validate ticket:

klist

Firefox

  1. Go to about:config
  2. Set network.negotiate-auth.trusted-uris to .my_domain.com
  3. Use only fully qualified DNS names to access internal web sites.

Samba Client

Environment

File: ~/.smb/smb.conf
[global]
        workgroup = MY_DOMAIN
        realm = MY_DOMAIN.COM
        security = ads
        client use spnego = yes

Test

smbclient -k //server/share

Maintainer

Alon Bar-Lev

Authors

Originally written by: Alon Bar-Lev - 2011-11-17


Authors are people who have worked on this document and have made significant changes to its content. If you have edited this article and wish to add yourself to the authors list please read "Who are Authors".