Gentoo/MIT Kerberos Windows Domain
Page last edited 3,862 days ago
From Alon Bar-Lev's Site
< Gentoo
Jump to navigation
Jump to search
MIT Kerberos Windows Domain Integration
Prerequisites
- Make sure you have ntpd setup operational. NOTE: You cannot use Windows SNTP as clock source for NTP.
- However you can do the other way around, having NTP host which is the clock source of Windows SNTP.
- DNS and Reverse-DNS lookup must be operational, make sure both your domain controller and the designated host are available in both modes.
dig host.name.com
host ip.add.re.s
Setup kerberos
File: /etc/portage/package.use/samba.conf
net-fs/samba ads ldap
emerge app-crypt/mit-krb5 net-fs/samba
File: /etc/krb5.conf
[libdefaults] default_realm = MY_DOMAIN.COM forwardable = true [realms] [domain_realm] [logging] kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmin.log default = FILE:/var/log/krb5lib.log
Note: The forwardable true is optional, however having this makes *NIX behaves more like windows in delegated authentication
Testing:
kinit user
Joining Domain
File: /etc/samba/smb.conf
workgroup = MY_WORKGROUP security = ads kerberos method = system keytab client use spnego = yes realm = MY_DOMAIN.COM
net ads join -U Administrator
net ads testjoin
Join is OK
net ads keytab create -U Administrator
Integrating Apache Web Server
Setup
Note: Integrating Apache Web Server does not require any pam/nss integration
emerge www-apache/mod_auth_kerb
net ads keytab add HTTP -U Administrator
Optional, test ticket
klist -k /etc/krb5.keytab
kinit -kt /etc/krb5.keytab -S HTTP/server.name@MY_DOMAIN.COM 'SERVER$'
Enable apache access
chgrp apache /etc/krb5.keytab
chmod g+r /etc/krb5.keytab
Configuration
File: /etc/apache2/11_mod_auth_kerb.conf
<IfDefine AUTH_KERB> LoadModule auth_kerb_module modules/mod_auth_kerb.so <Directory "/var/www/private"> AuthType Kerberos AuthName "Kerberos Login" Krb5Keytab /etc/krb5.keytab KrbAuthRealms MY_DOMAIN.COM Require valid-user </Directory> </IfDefine>
Integrating pam/nss
Setup
File: /etc/portage/package.use/pam.conf
sys-auth/pambase pam_krb5
emerge --update --deep --newuse @world
emerge sys-auth/nss_ldap
Update:
File: /etc/ldap.conf
#host 127.0.0.1 base DC=mydomain,DC=com uri ldap://dc.mydomain.com/ binddn CN=ldapbind,CN=Users,DC=mydomain,DC=com bindpw secret scope sub nss_paged_results yes nss_schema rfc2307bis # RFC 2307 (AD) mappings nss_map_objectclass posixAccount user nss_map_objectclass shadowAccount user nss_map_attribute uid sAMAccountName nss_map_attribute homeDirectory unixHomeDirectory nss_map_attribute shadowLastChange pwdLastSet nss_map_objectclass posixGroup group nss_map_attribute uniqueMember member pam_login_attribute sAMAccountName pam_filter objectclass=User pam_password ad sasl_secprops maxssf=0
Update:
File: /etc/nssswitch.conf
passwd: files ldap shadow: files ldap group: files ldap netgroup: ldap files
Test
id user1
uid=10012(user1) gid=100(users) groups=100(users)
Login to user1 with domain password using ssh.
Integrating sshd
First integrate pam/nss.
Update:
File: /etc/ssh/sshd_config
GSSAPIAuthentication yes
Integrating Samba Server
First integrate pam/nss.
net ads keytab add cifs -U Administrator
Set all to system-remote-login:
File: /etc/pam.d/samba
auth include system-remote-login account include system-remote-login session include system-remote-login password include system-remote-login
Bugzilla
Integrate apache.
Go to Administration->Parameters->User Authentication, set:
auth_env_id = REMOTE_USER auth_env_email = REMOTE_USER user_info_class = Env requirelogin = On
Clients
Note: Setup client does not require any system wide modification (pam/nss), nor
joining the domain.
First authenticate using kinit
kinit user
Validate ticket:
klist
Firefox
- Go to about:config
- Set network.negotiate-auth.trusted-uris to .my_domain.com
- Use only fully qualified DNS names to access internal web sites.
Samba Client
Environment
File: ~/.smb/smb.conf
[global] workgroup = MY_DOMAIN realm = MY_DOMAIN.COM security = ads client use spnego = yes
Test
smbclient -k //server/share
Maintainer
Authors
Originally written by: Alon Bar-Lev - 2011-11-17
Authors are people who have worked on this document and have made significant changes to its content. If you have edited this article and wish to add yourself to the authors list please read "Who are Authors".