Re: Re: nss_ldap using sasl with gssapi. Kerberos credentials cache problem[Scanned]

Howard,

I would be interested in the example LDIF to add the RFC2307 Schema to 2003 
SP1. 

Thanks
Markus

BTW I was working on a patch to include the kinit into the nss_ldap code instead
of running a cronjob. You can find it at
http://netjoin.sf.net/nss_ldap-250-keytab.patch

On Thu Sep 14  7:23 , Howard Wilkinson <howard@xxxxxxxxxxx> sent:

>
>
>
>  
>
>
>This is a short set of notes on what I have had to do to get nssldap
>working with SASL/GSSAPI/Kerberos accessing Windows 2003 R2 as the
>authentication store.
>
>
>
>First get a Windows 200x environment with the RFC2307 extensions added
>to the Schema. The easiest way to do this is to use Windows 2003 R2.
>However, it is also possible to do this by using LDIF's from the wider
>community to add this to a 2003 or a 2000 schema. I can dig out an
>example of this is anybody is interested. This step is scary as in
>a production environment if you get this wrong in the right way you
>have an unrecoverable Windows environment so I recommend either a new
>forest using Windows 2003 R2 or back everything up. Note I have done
>this for a very big global domain and will hold anybodies hand if they
>are thinking of doing this in a production domain.
>
>
>
>Next assign all of your real Unix users with AD accounts - make
>the user names conform to the Posix rules (Windows samAccountName) i.e.
>8 characters starting with a letter, all in lower case. Give them
>uidNumber's and gidNumber's, loginShell and unixHomeDirectory
>attributes. I use displayName for the GECOS field.
>
>
>
>Create relevant groups in the AD I have used samAccountName for the
>groupName, you can also use CN but you have to be careful about the
>names and make sure they are valid in the Unix and Windows world I
>stick to lower case starting with a letter and no spaces in the
>samAccountName.
>
>
>
>For example: I declare a superusers group to which I add users I would
>have added to wheel and use this in sudo - you can only add users
>declared in AD to groups declared in AD. superusers is a member of
>"Domain Admins" and "Enterprise Admins" in our systems.
>
>
>
>With this you are now ready to set up the unix side of the fence. I use
>pam_krb5 to authenticate and nss_ldap to handle the maps. The pam stack
>looks like this
>
>
>
>&#35;%PAM-1.0
>
>&#35; This file is auto-generated.
>
>&#35; User changes will be destroyed the next time authconfig is run.
>
>auth        required      /lib/security/$ISA/pam_env.so
>
>auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok
>
>auth        sufficient    /lib/security/$ISA/pam_krb5.so use_first_pass
>
>auth        required      /lib/security/$ISA/pam_deny.so
>
>  
>
>account     required      /lib/security/$ISA/pam_unix.so broken_shadow
>
>account     sufficient    /lib/security/$ISA/pam_succeed_if.so uid <
>100 quiet
>
>account     [default=bad success=ok user_unknown=ignore]
>/lib/security/$ISA/pam_krb5.so
>
>account     required      /lib/security/$ISA/pam_permit.so
>
>  
>
>password    requisite     /lib/security/$ISA/pam_cracklib.so retry=3
>
>password    sufficient    /lib/security/$ISA/pam_unix.so nullok
>use_authtok md5 shadow
>
>password    sufficient    /lib/security/$ISA/pam_krb5.so use_authtok
>
>password    required      /lib/security/$ISA/pam_deny.so
>
>  
>
>session     required      /lib/security/$ISA/pam_limits.so
>
>session     required      /lib/security/$ISA/pam_unix.so
>
>session     optional      /lib/security/$ISA/pam_krb5.so
>
>
>I set up kerberos to access the active directory as follows.
>
>
>
>[logging]
>
>default = FILE:/var/log/krb5libs.log
>
>kdc = FILE:/var/log/krb5kdc.log
>
>admin_server = FILE:/var/log/kadmind.log
>
>  
>
>[libdefaults]
>
> default_realm = COHERENT.COHTECH.CO.UK
>
> dns_lookup_realm = true
>
> dns_lookup_kdc = true
>
> forwardable = false
>
>  
>
>[realms]
>
>COHERENT.COHTECH.CO.UK = {
>
>   kdc = coherent.cohtech.co.uk
>
>}
>
>  
>
>[domain_realm]
>
>city.cohtech.co.uk = COHERENT.COHTECH.CO.UK
>
>.city.cohtech.co.uk = COHERENT.COHTECH.CO.UK
>
>coherent.cohtech.co.uk = COHERENT.COHTECH.CO.UK
>
>.coherent.cohtech.co.uk = COHERENT.COHTECH.CO.UK
>
>finsbury.cohtech.co.uk = COHERENT.COHTECH.CO.UK
>
>.finsbury.cohtech.co.uk = COHERENT.COHTECH.CO.UK
>
>stokie.cohtech.co.uk = COHERENT.COHTECH.CO.UK
>
>.stokie.cohtech.co.uk = COHERENT.COHTECH.CO.UK
>
>cohtech.co.uk = COHERENT.COHTECH.CO.UK
>
>.cohtech.co.uk = COHERENT.COHTECH.CO.UK
>
>  
>
>[kdc]
>
>profile = /var/kerberos/krb5kdc/kdc.conf
>
>  
>
>[appdefaults]
>
>pam = {
>
>  debug = false
>
>  ticket_lifetime = 36000
>
>  renew_lifetime = 36000
>
>  forwardable = true
>
>  krb4_convert = false
>
>}
>
>
>
>
>And create a machine keytab using Samba - currently samba-3.0.23a. Note
>my machines are in the finsbury.cohtech.co.uk zone, while the AD is
>domain coherent.cohtech.co.uk.
>
>
>
>The nsswitch.conf file contains ... 
>
>
>
>passwd: files ldap
>
>shadow: files ldap
>
>group: files ldap
>
>
>
>
>statements.
>
>
>
>ldap.conf contains ...
>
>
>
>&#35; Set to some high number to get debug output -
>very useful if kerberos is failing
>
>
>debug 0
>
>  
>
>&#35;base set to default container inside AD for Users - have not got this
>working with multiple containers
>
>base cn=Users,dc=coherent,dc=cohtech,dc=co,dc=uk
>
>  
>
>&#35; Our servers have certificates and therefore are available over ssl
>
>&#35; Otherwise use
>
>&#35;uri ldap://coherent.cohtech.co.uk
>
>uri ldaps://coherent.cohtech.co.uk
>
>  
>
>&#35; The LDAP version to use (defaults to 3
>
>&#35; if supported by client library)
>
>&#35;ldap_version 3
>
>ldap_version 3
>
>  
>
>&#35; The distinguished name to bind to the server with.
>
>&#35; NEVER NEVER NEVER define this if using SASL it breaks the bind
>operation
>
>&#35;binddn cn=proxyuser,dc=example,dc=com
>
>  
>
>&#35; The credentials to bind with. 
>
>&#35; NEVER NEVER NEVER define this if using SASL it breaks the bind
>operation
>
>&#35;bindpw secret
>
>  
>
>&#35; The distinguished name to bind to the server with
>
>&#35; if the effective user ID is root. Password is
>
>&#35; stored in /etc/ldap.secret (mode 600)
>
>&#35;rootbinddn cn=manager,dc=example,dc=com
>
>  
>
>&#35; The port.
>
>&#35; Optional: default is 389.
>
>&#35;port 389
>
>  
>
>&#35; The search scope.
>
>&#35;scope sub
>
>&#35;scope one
>
>&#35;scope base
>
>scope sub
>
>  
>
>&#35; Search timelimit
>
>&#35;timelimit 30
>
>timelimit 120
>
>  
>
>&#35; Bind/connect timelimit
>
>&#35;bind_timelimit 30
>
>bind_timelimit 120
>
>  
>
>&#35; Reconnect policy: hard (default) will retry connecting to
>
>&#35; the software with exponential backoff, soft will fail
>
>&#35; immediately.
>
>bind_policy soft
>
>  
>
>&#35; Idle timelimit; client will close connections
>
>&#35; (nss_ldap only) if the server has not been contacted
>
>&#35; for the number of seconds specified below.
>
>&#35;idle_timelimit 3600
>
>idle_timelimit 3600
>
>  
>
>.......
>
>&#35; Just assume that there are no supplemental groups for these named
>users
>
>nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon
>
>  
>
>&#35; attribute/objectclass mapping
>
>&#35; Syntax:
>
>&#35;nss_map_attribute    rfc2307attribute    mapped_attribute
>
>&#35;nss_map_objectclass    rfc2307objectclass    mapped_objectclass
>
>  
>
>&#35; RFC 2307 (AD) mappings
>
>&#35;nss_map_objectclass posixAccount user
>
>&#35;nss_map_objectclass shadowAccount user
>
>&#35;nss_map_attribute uid sAMAccountName
>
>&#35;nss_map_attribute homeDirectory unixHomeDirectory
>
>&#35;nss_map_attribute shadowLastChange pwdLastSet
>
>&#35;nss_map_objectclass posixGroup group
>
>&#35;nss_map_attribute uniqueMember member
>
>&#35;pam_login_attribute sAMAccountName
>
>&#35;pam_filter objectclass=User
>
>&#35;pam_password ad
>
>nss_base_passwd cn=Users,dc=coherent,dc=cohtech,dc=co,dc=uk
>
>nss_base_shadow cn=Users,dc=coherent,dc=cohtech,dc=co,dc=uk
>
>nss_base_group  cn=Users,dc=coherent,dc=cohtech,dc=co,dc=uk
>
>  
>
>nss_map_objectclass posixAccount User
>
>nss_map_objectclass shadowAccount User
>
>nss_map_attribute uid samAccountName
>
>nss_map_attribute homeDirectory unixHomeDirectory
>
>nss_map_attribute shadowLastChange pwdLastSet
>
>  
>
>nss_map_attribute uidNumber uidNumber
>
>nss_map_attribute gidNumber gidNumber
>
>nss_map_attribute loginShell loginShell
>
>nss_map_attribute gecos displayName
>
>nss_map_objectclass posixGroup Group
>
>nss_map_attribute uniqueMember Member
>
>nss_map_attribute cn samAccountName
>
>nss_paged_results on
>
>  
>
>pam_login_attribute samAccountName
>
>pam_filter objectclass=user
>
>pam_member_attribute member
>
>&#35;pam_groupdn cn=unixusergroup,dc=coherent,dc=cohtech,dc=co,dc=uk
>
>pam_passwd ad
>
>  
>
>  
>
>&#35; Disable SASL security layers. This is needed for AD.
>
>&#35;sasl_secprops maxssf=0
>
>sasl_secprops maxssf=0
>
>  
>
>&#35; Override the default Kerberos ticket cache location.
>
>&#35;krb5_ccname FILE:/etc/.ldapcache
>
>krb5_ccname FILE:/etc/.ldapcache
>
>  
>
>&#35; SASL mechanism for PAM authentication - use is experimental
>
>&#35; at present and does not support password policy control
>
>&#35;pam_sasl_mech DIGEST-MD5
>
>  
>
>use_sasl on
>
>  
>
>sasl_authid nssldap/beastie.finsbury.cohtech.co.uk
>
>  
>
>rootsasl_auth_id nssldap/beastie.finsbury.cohtech.co.uk
>
>  
>
>rootuse_sasl yes
>
>  
>
>
>The key feature here is the krb5_ccname which is used to override the
>credentials passed in to the user. At present this file must have 0644
>access as the nss_ldap code always overrides with this file. I intend
>to supply a patch that will check for read access to this file and use
>it only in this circumstance. A further enhancement would be to try to
>access the directory using this file if readable, and if that fails or
>if the file is not readable then use the KRB5CCNAME environment
>variable if set and if that fails use the users credentials cache if
>that exists.
>
>
>
>The authentication ID needs to be created in the AD and exported. This
>is done by creating a user with a never expires password and then using
>the ktpass command on Windows 200x to export the key. I use
>
>
>
>ktpass -princ nssldap/<hostname>@DOMAIN -mapuser
>nss<host>@domain -crypto DES-CBC-MD5 -ptype KRB5_NT_PRINCIPAL
>-mapo- set +desonly -pass <somepassword> -out <keytabfile>
>
>
>The resulting file is copied to the target host, and I add it to the
>system keytab file. It could equally be put in a separate file and used
>from there.
>
>
>
>The final pieces of magic are setting up the openldap ldap.conf file.
>
>
>
>&#35; $OpenLDAP:
>pkg/ldap/libraries/libldap/ldap.conf,v 1.9 2000/09/04 19:57:01 kurt
>
> Exp $
>
>&#35;
>
>&#35; LDAP Defaults
>
>&#35;
>
>  
>
>&#35; See ldap.conf(5) for details
>
>&#35; This file should be world readable but not world writable.
>
>  
>
>&#35;BASE   dc=example, dc=com
>
>&#35;URI    ldap://ldap.example.com
>  ldap://ldap-master.example.com:666
>
>  
>
>&#35;SIZELIMIT      12
>
>&#35;TIMELIMIT      15
>
>&#35;DEREF          never
>
>URI ldaps://coherent.cohtech.co.uk
>
>&#35;HOST coherent.cohtech.co.uk
>
>BASE dc=coherent,dc=cohtech,dc=co,dc=uk
>
>TLS_CACERTDIR /etc/openldap/cacerts
>
>TLS_REQCERT never
>
>
>And setting up nscd to cache requests, running nscd - I set the
>environment with KRB5CCNAME=/etc/.ldapcache as a bit of belt and braces.
>
>
>
>The following script is executed every 6 hours to keep the credentials
>cache current.
>
>&#35;!/bin/sh
>
>&#35;
>
>  
>
>/usr/kerberos/bin/kinit -k -t /etc/krb5.keytab -c /etc/.ldapcache
>nssldap/beastie.finsbury.cohtech.co.uk \
>
>        && chown nscd:nscd /etc/.ldapcache \
>
>        && chmod 0644 /etc/.ldapcache
>
>  
>
>exit 0
>
>
>The 0644 will change to 0640 once I have a patch into nss_ldap. A point
>to note nscd only provide caches for individual lookups so running
>getent passwd will not work unless kerberos credentials are supplied
>some other way - hence the need for 0644 at present.
>
>
>
>Hope this all makes sense. Will try to produce a more comprehensive
>guide later when I have fixed the niggles.
>
>
>
>By the by.. This all required the latest version of openldap,
>cyrus-sasl, nss_ldap as previous versions failed to talk to Windows
>2003. These are currently drawn from fedora-development and are:
>openldap-2.3.27-2, cyrus-sasl-2.1.22-3, & nss_ldap-251-1 (with the
>enable-configurable-krb5-ccname-gssapi configuration flag turned on at
>build time).
>
>
>
>
>
>
>
>Chris Bradford wrote:
>Howard
>Wilkinson wrote: 
>
>  I have been installing nss_Ldap for sasl
>connections to a Windows 2003 R2 infrastructure and run into some
>problems. It turns out that the package distributed with FC5 and in
>development have an incorrect option set with the configuration for the
>configuration file feature krb5_ccname to work. 
>
>    
>
>The configure line currently uses --enable-configurable-krb5-ccname
>which does not do anything useful. It should either read
>--enable-configurable-krb5-ccname-env or
>--enable-configurable-krb5-ccname-gssapi to make this work. I have
>chosen the second as the first does not confer any advantage in
>allowing the environment to override in the current implementation. 
>
>    
>
>Without this setting then the calling environment must have a
>credential cache set up for the code to work - the behaviour of both
>the nscd and the general calling environment give local errors when
>there is not credentials cache defined. 
>
>-- 
>
>    
>
>Howard Wilkinson 
>
>    
>
>     
>
>    
>
>Phone: 
>
>    
>
>     
>
>    
>
>+44(20)76907075 
>
>    
>
>Coherent Technology Limited 
>
>    
>
>     
>
>    
>
>Fax: 
>
>    
>
>     
>
>    
>
>  
>
>    
>
>23 Northampton Square, 
>
>    
>
>     
>
>    
>
>Mobile: 
>
>    
>
>     
>
>    
>
>+44(7980)639379 
>
>    
>
>London, United Kingdom, EC1V 0HL 
>
>    
>
>     
>
>    
>
>Email: 
>
>    
>
>     
>
>    
>
>    howard@xxxxxxxxxxx
>    
>
>    
>
>  
>
>    
>
>    
>
>    
>
>Click here
>    <https://www.mailcontrol.com/sr/wQw0zmjPoHdJTZGyOCrrhg==>
>to
>report this email as spam. 
>
>    
>
>  
>Howard, 
>
>  
>
>Could you please post details on you you have used sasl to connect to
>AD? I am using nss_ldap to connect but not using sasl. Further details
>on this can be seen here:
>  http://cb-net.co.uk/readarticle.php?article_id=5
>  
>
>  
>
>-Chris 
>
>  
>
>
>
>
>-- 
>
>
>
>
>
>
>Signature
>
>
>
> 
>  Howard Wilkinson
>  Normal
>  Howard Wilkinson
>  6
>  1
>  2005-03-12T10:10:00Z
>  2006-05-26T11:28:00Z
>  1
>  38
>  220
>  Coherent Technology Limited
>  1
>  1
>  257
>  11.6568
> 
>
> 
>  BestFit
>  Clean
>  Clean
>  
>  false
>  false
>  false
>  MicrosoftInternetExplorer4
> 
>
> 
> 
>
>
>
>
>
>
>
>
>  
>    
>      
>      Howard Wilkinson
>      
>      
>      Phone:
>      
>      
>      +44(20)76907075
>      
>    
>    
>      
>      Coherent Technology Limited
>      
>      
>      Fax:
>      
>      
>       
>      
>    
>    
>      
>      23
>Northampton Square,
>      
>      
>      Mobile:
>      
>      
>      +44(7980)639379
>      
>    
>    
>      
>      London,
>      United Kingdom,
>EC1V 0HL
>      
>      
>      Email:
>      
>      
>      howard@xxxxxxxxxxx
>      
>    
>  
>
> 
>
>
>
>