I've configured NAS4Free, It is running so far. Next step I'd like to take is join an AD domain (Windows 2012 Server). I've filled in "Access -> Active Directory" and clicked save. It seems to save the config, but does not do anything more than that.
From a shell:
Code: Select all
# net ads testjoin
ads_connect: No logon servers
Join to domain is not valid: No logon servers
#
Code: Select all
# getent passwd
root:[::removed::]:0:0:Charlie &:/root:/bin/tcsh
toor:*:0:0:Bourne-again Superuser:/root:
daemon:*:1:1:Owner of many system processes:/root:/usr/sbin/nologin
operator:*:2:5:System &:/:/usr/sbin/nologin
bin:*:3:7:Binaries Commands and Source:/:/usr/sbin/nologin
tty:*:4:65533:Tty Sandbox:/:/usr/sbin/nologin
kmem:*:5:65533:KMem Sandbox:/:/usr/sbin/nologin
games:*:7:13:Games pseudo-user:/usr/games:/usr/sbin/nologin
news:*:8:8:News Subsystem:/:/usr/sbin/nologin
man:*:9:9:Mister Man Pages:/usr/share/man:/usr/sbin/nologin
sshd:*:22:22:Secure Shell Daemon:/var/empty:/usr/sbin/nologin
smmsp:*:25:25:Sendmail Submission User:/var/spool/clientmqueue:/usr/sbin/nologin
mailnull:*:26:26:Sendmail Default User:/var/spool/mqueue:/usr/sbin/nologin
bind:*:53:53:Bind Sandbox:/:/usr/sbin/nologin
proxy:*:62:62:Packet Filter pseudo-user:/nonexistent:/usr/sbin/nologin
_pflogd:*:64:64:pflogd privsep user:/var/empty:/usr/sbin/nologin
_dhcp:*:65:65:dhcp programs:/var/empty:/usr/sbin/nologin
pop:*:68:6:Post Office Owner:/nonexistent:/usr/sbin/nologin
www:*:80:80:World Wide Web Owner:/nonexistent:/usr/sbin/nologin
hast:*:845:845:HAST unprivileged user:/var/empty:/usr/sbin/nologin
nobody:*:65534:65534:Unprivileged user:/nonexistent:/usr/sbin/nologin
ftp:*:21:50:FTP user:/mnt:/sbin/nologin
uucp:*:66:66:UUCP pseudo-user:/var/empty:/usr/sbin/nologin
transmission:[::removed::]:999:999:User &:/home/transmission:/bin/tcsh
#
Same for groups:
Code: Select all
# getent group
wheel:*:0:root
daemon:*:1
kmem:*:2
sys:*:3
tty:*:4
operator:*:5:root
mail:*:6
bin:*:7
news:*:8
man:*:9
games:*:13
staff:*:20
sshd:*:22
smmsp:*:25
mailnull:*:26
guest:*:31
bind:*:53
proxy:*:62
authpf:*:63
_pflogd:*:64
_dhcp:*:65
uucp:*:66
dialer:*:68
network:*:69
audit:*:77
www:*:80
hast:*:845
nogroup:*:65533
nobody:*:65534
ftp:*:50:transmission
transmission:*:999
admin:*:1000
#
Code: Select all
# getent passwd <domain-user>
# getent group <domain-group>
#
Code: Select all
# cat /var/etc/smb4.conf
[global]
server role = standalone
encrypt passwords = yes
netbios name = SERVER
workgroup = DOMAIN
server string = NAS4Free Server
security = ads
max protocol = SMB2
dns proxy = no
# Settings to enhance performance:
strict locking = no
read raw = yes
write raw = yes
oplocks = yes
max xmit = 65535
deadtime = 15
getwd cache = yes
socket options = TCP_NODELAY SO_SNDBUF=128480 SO_RCVBUF=128480
# End of performance section
password server = ad.local.local
unix charset = UTF-8
store dos attributes = yes
local master = no
domain master = no
preferred master = no
os level = 0
time server = no
guest account = ftp
map to guest = Bad User
max log size = 100
syslog only = yes
syslog = 1
load printers = no
printing = bsd
printcap name = /dev/null
disable spoolss = yes
log level = 1
dos charset = CP437
smb passwd file = /var/etc/private/smbpasswd
private dir = /var/etc/private
passdb backend = tdbsam
allow trusted domains = no
idmap config * : backend = tdb
idmap config * : range = 10000-39999
idmap config BFS : backend = rid
idmap config BFS : range = 10000-39999
realm = BFS
winbind enum users = yes
winbind enum groups = yes
winbind use default domain = yes
winbind normalize names = yes
template homedir = /mnt
template shell = /bin/sh
winbind normalize names = no
[Q]
comment = Q
path = /mnt/zpool/Q
writeable = yes
printable = no
veto files = /.snap/.sujournal/
hide dot files = yes
guest ok = no
inherit permissions = yes
inherit acls = yes
vfs objects = shadow_copy2 zfsacl recycle aio_pthread
nfs4:mode = special
nfs4:acedup = merge
nfs4:chown = yes
recycle:repository = .recycle/%U
recycle:keeptree = yes
recycle:versions = yes
recycle:touch = yes
recycle:directory_mode = 0777
recycle:subdir_mode = 0700
shadow:format = auto-%Y%m%d-%H%M%S
shadow:snapdir = .zfs/snapshot
shadow:sort = desc
shadow:localtime = yes
veto files = /.zfs/
winbind normalize names = no
Code: Select all
group: files winbind
group_compat: nis
hosts: files dns
networks: files
passwd: files winbind
passwd_compat: nis
shells: files
services: compat
services_compat: nis
protocols: files
rpc: files
Missing are:
- Kerberos setup (/etc/krb5.conf, /etc/krb5.keytab)
- OpenLDAP setup (/etc/openldap/ldap.conf or /etc/ldap/ldap.conf)
- PAM-Setup (pam-ldap-setup or sssd-setup)
So here my questions:
- does NAS4Free at all join an AD domain spawned by Windows Server 2012?
- does it set up necessary kerberos configuration and acquire kerberos keytabs as necessary?
- does it at all set up configuration for kerberized LDAP as necessary to fully access an Windows Server 2012 AD?
- does it, besides starting winbindd, set up credentials caching?
Some hints:
* http://serverfault.com/questions/599200 ... urity-sssd (Handles kerberos, sssd, nssswitch setup for FreeBSD 9, 10, CURRENT)
Since I've set up some systems before to handle authentication and authorization by Windows Server 2012 AD here is what is found within the various configuration files on such a system (examples from CentOS 6.7):
* /etc/krb5.config
Code: Select all
# cat /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = DOMAIN
default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md4 des-cbc-md5 des3-cbc-sha1 arcfour-hmac-md5 aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96
default_tkt_enctypes = arcfour-hmac-md5 des-cbc-md5 des3-hmac-sha1 des-cbc-crc des-cbc-md4 des3-cbc-sha1 aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96
permitted_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md4 des-cbc-md5 des3-cbc-sha1 arcfour-hmac-md5 aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
proxiable = true
kdc_timesync = 1
rdns = false
krb4_get_tickets = no
allow_weak_crypto = true
[realms]
DOMAIN = {
kdc = <ad.local.local-ip-address>
admin_server = ad.local.local
kpasswd_server = ad.local.local
}
[domain_realm]
.bfs.de = DOMAIN
bfs.de = DOMAIN
#
Code: Select all
# ktutil
ktutil: rkt /etc/krb5.keytab
ktutil: list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
1 1 host/ad.local.local@DOMAIN
2 1 ad.local.local@DOMAIN
3 1 host/ad.local.local@DOMAIN
4 1 ad.local.local@DOMAIN
5 1 host/ad.local.local@DOMAIN
6 1 ad.local.local@DOMAIN
7 1 host/ad.local.local@DOMAIN
8 1 ad.local.local@DOMAIN
9 1 host/ad.local.local@DOMAIN
10 1 ad.local.local@DOMAIN
ktutil: q
#
Code: Select all
# klist
klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_0)
[root@imis-tsrv02 ~]# kinit <domain-user>
Password for <domain-user>@DOMAIN:
Warning: Your password will expire in 78 days on Thu Nov 26 01:47:24 2015
# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: <domain-user>@DOMAIN
Valid starting Expires Service principal
09/08/15 14:19:55 09/09/15 00:19:55 krbtgt/DOMAIN@DOMAIN
renew until 09/15/15 14:19:50
# kdestroy
# klist
klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_0)
#
Code: Select all
# cat /etc/openldap/ldap.conf
#
# LDAP Defaults
#
# See ldap.conf(5) for details
# This file should be world readable but not world writable.
#BASE dc=example, dc=com
#URI ldap://ldap.example.com ldap://ldap-master.example.com:666
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
uri ldap://ad.local.local/
base dc=bfs,dc=de
URI ldaps://ad.local.local:<port>
BASE dc=local,dc=local
TLS_CACERTDIR /etc/openldap/cacerts
#
Code: Select all
# ldapsearch -x | wc -l
[lists the whole seachbase, counting lines]
583730
Code: Select all
# cat /etc/sssd/sssd.conf
[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains = DOMAIN, default
#debug_level = 0x0270
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
entry_cache_timeout = 300
entry_cache_nowait_percentage = 75
#debug_level = 0x0270
[pam]
reconnection_retries = 3
offline_credentials_expiration = 2
offline_failed_login_attempts = 5
offline_failed_login_delay = 5
#debug_level = 0x0270
[autofs]
[ssh]
[domain/DOMAIN]
enumerate = true
cache_credentials = true
id_provider = ad
auth_provider = ad
chpass_provider = ad
access_provider = ad
krb5_kdcip = <ad.local.local-address>
krb5_realm = DOMAIN
krb5_server = ad.local.local
krb5_kpasswd = ad.local.local
krb5_canonicalize = false
ldap_uri = ldaps://ad.local.local:<port>
ldap_search_base = dc=local,dc=local
ldap_tls_reqcert = demand
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_tls_cacert = /etc/openldap/cacerts/authconfig_downloaded.pem
ldap_sasl_mech = GSSAPI
#ldap_sasl_authid = <ucase-hostname>$@DOMAIN
#ldap_default_bind_dn = cn=<hostname>,cn=clients,cn=computers,dc=local,dc=local
#ldap_default_authtok_type = password
#ldap_default_authtok = <password>
#ldap_schema = rfc2307bis
ldap_access_order = expire
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = true
#ldap_user_search_base = dc=local,dc=local
#ldap_user_object_class = user
#ldap_user_name =sAMAccountName
#ldap_user_fullname = displayName
#ldap_user_home_directory = unixHomeDirectory
#ldap_user_principal = userPrincipalName
#debug_level = 0x0270
[domain/default]
ldap_id_use_start_tls = False
ldap_search_base = dc=local,dc=local
krb5_realm = DOMAIN
krb5_kdcip = <ad.local.local-address>
id_provider = ad
auth_provider = ad
chpass_provider = ad
ldap_uri = ldaps://ad.local.local:<port>
krb5_kpasswd = ad.local.local
cache_credentials = True
ldap_tls_cacertdir = /etc/openldap/cacerts
#
Code: Select all
# cat /etc/nsswitch.conf
#
# /etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Valid entries include:
#
# nisplus Use NIS+ (NIS version 3)
# nis Use NIS (NIS version 2), also called YP
# dns Use DNS (Domain Name Service)
# files Use the local files
# db Use the local database (.db) files
# compat Use NIS on compat mode
# hesiod Use Hesiod for user lookups
# [NOTFOUND=return] Stop searching if not found so far
#
# To use db, put the "db" in front of "files" for entries you want to be
# looked up first in the databases
#
# Example:
#passwd: db files nisplus nis
#shadow: db files nisplus nis
#group: db files nisplus nis
passwd: files sss
shadow: files sss
group: files sss
#hosts: db files nisplus nis dns
hosts: files dns
# Example - obey only what nisplus tells us...
#services: nisplus [NOTFOUND=return] files
#networks: nisplus [NOTFOUND=return] files
#protocols: nisplus [NOTFOUND=return] files
#rpc: nisplus [NOTFOUND=return] files
#ethers: nisplus [NOTFOUND=return] files
#netmasks: nisplus [NOTFOUND=return] files
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files
netgroup: files ldap
publickey: nisplus
automount: files ldap
aliases: files nisplus
#
Testing sssd:
Code: Select all
# getent passwd | wc -l
3775
# getent group | wc -l
995
#
Code: Select all
# cat /etc/pam.d/password-auth-ac
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_krb5.so use_first_pass
auth sufficient pam_sss.so use_first_pass
auth required pam_deny.so
account required pam_access.so
account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account [default=bad success=ok user_unknown=ignore] pam_krb5.so
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3 type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password sufficient pam_krb5.so use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session optional pam_oddjob_mkhomedir.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_krb5.so
session optional pam_sss.so
#
Code: Select all
# ssh -l <domain-user> localhost
<domain-user>@localhost's password: <type domain users password here>
Warning: Your password will expire in 78 days on Thu Nov 26 01:47:24 2015
Last login: Tue Sep 8 12:31:49 2015 from localhost
$ klist
Ticket cache: FILE:/tmp/krb5cc_10947_NivRZA
Default principal: <domain-user>@DOMAIN
Valid starting Expires Service principal
09/08/15 14:32:31 09/09/15 00:32:31 krbtgt/DOMAIN@DOMAIN
renew until 09/15/15 14:32:31
$
