| 1 | <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 11. Active Directory, Kerberos, and Security</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="RefSection.html" title="Part III. Reference Section"><link rel="next" href="DomApps.html" title="Chapter 12. Integrating Additional Services"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 11. Active Directory, Kerberos, and Security</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="RefSection.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="DomApps.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="kerberos"></a>Chapter 11. Active Directory, Kerberos, and Security</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="kerberos.html#id2610586">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2611237">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2611253">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2611650">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2613280">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2613629">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2614242">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2614655">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2615382">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2615516">Questions and Answers</a></span></dt></dl></div><p><a class="indexterm" name="id2610522"></a>
|
|---|
| 2 | By this point in the book, you have been exposed to many Samba-3 features and capabilities.
|
|---|
| 3 | More importantly, if you have implemented the examples given, you are well on your way to becoming
|
|---|
| 4 | a Samba-3 networking guru who knows a lot about Microsoft Windows. If you have taken the time to
|
|---|
| 5 | practice, you likely have thought of improvements and scenarios with which you can experiment. You
|
|---|
| 6 | are rather well plugged in to the many flexible ways Samba can be used.
|
|---|
| 7 | </p><p><a class="indexterm" name="id2610541"></a>
|
|---|
| 8 | This is a book about Samba-3. Understandably, its intent is to present it in a positive light.
|
|---|
| 9 | The casual observer might conclude that this book is one-eyed about Samba. It is what
|
|---|
| 10 | would you expect? This chapter exposes some criticisms that have been raised concerning
|
|---|
| 11 | the use of Samba. For each criticism, there are good answers and appropriate solutions.
|
|---|
| 12 | </p><p>
|
|---|
| 13 | Some criticism always comes from deep inside ranks that one would expect to be supportive of a particular
|
|---|
| 14 | decision. Criticism can be expected from the outside. Let's see how the interesting dynamic of
|
|---|
| 15 | criticism develops with respect to Abmas.
|
|---|
| 16 | </p><p><a class="indexterm" name="id2610569"></a>
|
|---|
| 17 | This chapter provides a shameless self-promotion of Samba-3. The objections raised were not pulled
|
|---|
| 18 | out of thin air. They were drawn from comments made by Samba users and from criticism during
|
|---|
| 19 | discussions with Windows network administrators. The tone of the objections reflects as closely
|
|---|
| 20 | as possible that of the original. The case presented is a straw-man example that is designed to
|
|---|
| 21 | permit each objection to be answered as it might occur in real life.
|
|---|
| 22 | </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2610586"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id2610593"></a><a class="indexterm" name="id2610601"></a><a class="indexterm" name="id2610609"></a><a class="indexterm" name="id2610616"></a><a class="indexterm" name="id2610624"></a>
|
|---|
| 23 | Abmas is continuing its meteoric growth with yet further acquisitions. The investment community took
|
|---|
| 24 | note of the spectacular projection of Abmas onto the global business stage. Abmas is building an
|
|---|
| 25 | interesting portfolio of companies that includes accounting services, financial advice, investment
|
|---|
| 26 | portfolio management, property insurance, risk assessment, and the recent addition of a a video rental
|
|---|
| 27 | business. The pieces do not always appear to fit together, but Mr. Meany is certainly executing an
|
|---|
| 28 | interesting business growth and development plan. Abmas Video Rentals was recently acquired.
|
|---|
| 29 | During the time that the acquisition was closing, the Video Rentals business upgraded its Windows
|
|---|
| 30 | NT4-based network to Windows 2003 Server and Active Directory.
|
|---|
| 31 | </p><p><a class="indexterm" name="id2610649"></a>
|
|---|
| 32 | You have accepted the fact that Abmas Video Rentals will use Microsoft Active Directory.
|
|---|
| 33 | The IT team, led by Stan Soroka, is committed to Samba-3 and to maintaining a uniform technology platform.
|
|---|
| 34 | Stan Soroka's team voiced its disapproval over the decision to permit this business to continue to
|
|---|
| 35 | operate with a solution that is viewed by Christine and her group as “<span class="quote">an island of broken
|
|---|
| 36 | technologies.</span>” This comment was made by one of Christine's staff as they were installing a new
|
|---|
| 37 | Samba-3 server at the new business.
|
|---|
| 38 | </p><p><a class="indexterm" name="id2610672"></a><a class="indexterm" name="id2610680"></a>
|
|---|
| 39 | Abmas Video Rentals' head of IT heard of this criticism. He was offended that a junior engineer
|
|---|
| 40 | should make such a comment. He felt that he had to prepare in case he might be criticized for his
|
|---|
| 41 | decision to use Active Directory. He decided he would defend his decision by hiring the services
|
|---|
| 42 | of an outside security systems consultant to report<sup>[<a name="id2610695" href="#ftn.id2610695" class="footnote">12</a>]</sup> on his unit's operations
|
|---|
| 43 | and to investigate the role of Samba at his site. Here are key extracts from this hypothetical
|
|---|
| 44 | report:
|
|---|
| 45 | </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id2610706"></a><a class="indexterm" name="id2610714"></a><a class="indexterm" name="id2610721"></a><a class="indexterm" name="id2610729"></a>
|
|---|
| 46 | ... the implementation of Microsoft Active Directory at the Abmas Video Rentals, Bamingsham site,
|
|---|
| 47 | has been examined. We find no evidence to support a notion that vulnerabilities exist at your site.
|
|---|
| 48 | ... we took additional steps to validate the integrity of the installation and operation of Active
|
|---|
| 49 | Directory and are pleased that your staff are following sound practices.
|
|---|
| 50 | </p><p>
|
|---|
| 51 | ...
|
|---|
| 52 | </p><p><a class="indexterm" name="id2610750"></a><a class="indexterm" name="id2610762"></a><a class="indexterm" name="id2610773"></a><a class="indexterm" name="id2610781"></a><a class="indexterm" name="id2610789"></a><a class="indexterm" name="id2610797"></a>
|
|---|
| 53 | User and group accounts, and respective privileges, have been well thought out. File system shares are
|
|---|
| 54 | appropriately secured. Backup and disaster recovery plans are well managed and validated regularly, and
|
|---|
| 55 | effective off-site storage practices are considered to exceed industry norms.
|
|---|
| 56 | </p><p><a class="indexterm" name="id2610813"></a><a class="indexterm" name="id2610821"></a><a class="indexterm" name="id2610829"></a>
|
|---|
| 57 | Your staff are justifiably concerned that the use of Samba may compromise their good efforts to maintain
|
|---|
| 58 | a secure network.
|
|---|
| 59 | </p><p><a class="indexterm" name="id2610846"></a><a class="indexterm" name="id2610853"></a><a class="indexterm" name="id2610861"></a><a class="indexterm" name="id2610869"></a>
|
|---|
| 60 | The recently installed Linux file and application server uses a tool called <code class="literal">winbind</code>
|
|---|
| 61 | that is indiscriminate about security. All user accounts in Active Directory can be used to access data
|
|---|
| 62 | stored on the Linux system. We are alarmed that secure information is accessible to staff who should
|
|---|
| 63 | not even be aware that it exists. We share the concerns of your network management staff who have gone
|
|---|
| 64 | to great lengths to set fine-grained controls that limit information access to those who need access.
|
|---|
| 65 | It seems incongruous to us that Samba winbind should be permitted to be used considering that it voids this fine work.
|
|---|
| 66 | </p><p><a class="indexterm" name="id2610909"></a><a class="indexterm" name="id2610917"></a><a class="indexterm" name="id2610925"></a>
|
|---|
| 67 | Graham Judd [head of network administration] has locked down the security of all systems and is following
|
|---|
| 68 | the latest Microsoft guidelines. ... null session connections have been disabled ... the internal network
|
|---|
| 69 | is isolated from the outside world, the [product name removed] firewall is under current contract
|
|---|
| 70 | maintenance support from [the manufacturer]. ... our attempts to penetrate security of your systems
|
|---|
| 71 | failed to find problems common to Windows networking sites. We commend your staff on their attention to
|
|---|
| 72 | detail and for following Microsoft recommended best practices.
|
|---|
| 73 | </p><p>
|
|---|
| 74 | ...
|
|---|
| 75 | </p><p><a class="indexterm" name="id2610949"></a><a class="indexterm" name="id2610957"></a><a class="indexterm" name="id2610965"></a><a class="indexterm" name="id2610973"></a>
|
|---|
| 76 | Regarding the use of Samba, we offer the following comments: Samba is in use in nearly half of
|
|---|
| 77 | all sites we have surveyed. ... It is our opinion that Samba offers no better security than Microsoft
|
|---|
| 78 | ... what worries us regarding Samba is the need to disable essential Windows security features such as
|
|---|
| 79 | secure channel support, digital sign'n'seal on all communication traffic, and running Active Directory in
|
|---|
| 80 | mixed mode so that Samba clients and servers can authenticate all of it. Additionally, we are concerned that
|
|---|
| 81 | Samba is not at the full capabilities of Microsoft Windows NT4 server. Microsoft has moved well beyond that
|
|---|
| 82 | with trusted computing initiatives that the Samba developers do not participate in.
|
|---|
| 83 | </p><p><a class="indexterm" name="id2610996"></a><a class="indexterm" name="id2611004"></a><a class="indexterm" name="id2611012"></a><a class="indexterm" name="id2611020"></a><a class="indexterm" name="id2611028"></a><a class="indexterm" name="id2611036"></a><a class="indexterm" name="id2611044"></a>
|
|---|
| 84 | One wonders about the integrity of an open source program that is developed by a team of hackers
|
|---|
| 85 | who cannot be held accountable for the flaws in their code. The sheer number of updates and bug
|
|---|
| 86 | fixes they have released should ring alarm bells in any business.
|
|---|
| 87 | </p><p><a class="indexterm" name="id2611059"></a><a class="indexterm" name="id2611067"></a><a class="indexterm" name="id2611075"></a>
|
|---|
| 88 | Another factor that should be considered is that buying Microsoft products and services helps to
|
|---|
| 89 | provide employment in the IT industry. Samba and Open Source software place those jobs at risk.
|
|---|
| 90 | </p></blockquote></div><p><a class="indexterm" name="id2611089"></a><a class="indexterm" name="id2611097"></a>
|
|---|
| 91 | This is also a challenge to rise above the trouble spot. You call Stan's team together for a simple
|
|---|
| 92 | discussion, but it gets further out of hand. When you return to your office, you find the following
|
|---|
| 93 | email in your in-box:
|
|---|
| 94 | </p><p>
|
|---|
| 95 | Good afternoon,
|
|---|
| 96 | </p><div class="blockquote"><table border="0" width="100%" cellspacing="0" cellpadding="0" class="blockquote" summary="Block quote"><tr><td width="10%" valign="top"> </td><td width="80%" valign="top"><p>
|
|---|
| 97 | I apologize for the leak of internal discussions to the new business. It reflects poorly on our
|
|---|
| 98 | professionalism and has put you in an unpleasant position. I regret the incident.
|
|---|
| 99 | </p><p>
|
|---|
| 100 | I also wish to advise that two of the recent recruits want to implement Kerberos authentication
|
|---|
| 101 | across all systems. I concur with the desire to improve security. One of the new guys who is championing
|
|---|
| 102 | the move to Kerberos was responsible for the comment that caused the embarrassment.
|
|---|
| 103 | </p><p><a class="indexterm" name="id2611134"></a><a class="indexterm" name="id2611142"></a><a class="indexterm" name="id2611150"></a><a class="indexterm" name="id2611158"></a>
|
|---|
| 104 | I am experiencing difficulty in handling the sharp push for Kerberos. He claims that Kerberos, OpenLDAP,
|
|---|
| 105 | plus Samba-3 will seamlessly replace Microsoft Active Directory. I am a little out of my depth with respect
|
|---|
| 106 | to the feasibility of such a move, but have taken steps to pull both of them into line. With your consent,
|
|---|
| 107 | I would like to hire the services of a well-known Samba consultant to set the record straight.
|
|---|
| 108 | </p><p><a class="indexterm" name="id2611176"></a><a class="indexterm" name="id2611184"></a><a class="indexterm" name="id2611192"></a><a class="indexterm" name="id2611200"></a><a class="indexterm" name="id2611208"></a><a class="indexterm" name="id2611216"></a>
|
|---|
| 109 | I intend to use this report to answer the criticism raised and would like to establish a policy that we
|
|---|
| 110 | will approve the use of Microsoft Windows Servers (and Active Directory) subject to all costs being covered
|
|---|
| 111 | out of the budget of the division that wishes to go its own way. I propose that dissenters will still remain
|
|---|
| 112 | responsible to meet the budgeted contribution to IT operations as a whole. I believe we should not coerce
|
|---|
| 113 | use of any centrally proposed standards, but make all noncompliance the financial responsibility of the
|
|---|
| 114 | out-of-step division. Hopefully, this will encourage all divisions to walk with us and not alone.
|
|---|
| 115 | </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Stan</span></td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2611237"></a>Assignment Tasks</h3></div></div></div><p>
|
|---|
| 116 | You agreed with Stan's recommendations and hired a consultant to help defuse the powder
|
|---|
| 117 | keg. The consultant's task is to provide a tractable answer to each of the issues raised. The consultant must be able
|
|---|
| 118 | to support his or her claims, keep emotions to the side, and answer technically.
|
|---|
| 119 | </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2611253"></a>Dissection and Discussion</h2></div></div></div><p><a class="indexterm" name="id2611260"></a><a class="indexterm" name="id2611268"></a><a class="indexterm" name="id2611276"></a><a class="indexterm" name="id2611284"></a><a class="indexterm" name="id2611291"></a><a class="indexterm" name="id2611299"></a><a class="indexterm" name="id2611307"></a>
|
|---|
| 120 | Samba-3 is a tool. No one is pounding your door to make you use Samba. That is a choice that you are free to
|
|---|
| 121 | make or reject. It is likely that your decision to use Samba can greatly benefit your company.
|
|---|
| 122 | The Samba Team obviously believes that the Samba software is a worthy choice.
|
|---|
| 123 | If you hire a consultant to assist with the installation and/or deployment of Samba, or if you hire
|
|---|
| 124 | someone to help manage your Samba installation, you can create income and employment. Alternately,
|
|---|
| 125 | money saved by not spending in the IT area can be spent elsewhere in the business. All money saved
|
|---|
| 126 | or spent creates employment.
|
|---|
| 127 | </p><p><a class="indexterm" name="id2611329"></a><a class="indexterm" name="id2611337"></a><a class="indexterm" name="id2611345"></a><a class="indexterm" name="id2611353"></a><a class="indexterm" name="id2611361"></a>
|
|---|
| 128 | In the long term, the use of Samba must be economically sustainable. In some situations, Samba is adopted
|
|---|
| 129 | purely to provide file and print service interoperability on platforms that otherwise cannot provide
|
|---|
| 130 | access to data and to printers for Microsoft Windows clients. Samba is used by some businesses to
|
|---|
| 131 | effect a reduction in the cost of providing IT services. Obviously, it is also used by some as an
|
|---|
| 132 | alternative to the use of a Microsoft file and print serving platforms with no consideration of costs.
|
|---|
| 133 | </p><p><a class="indexterm" name="id2611381"></a><a class="indexterm" name="id2611389"></a><a class="indexterm" name="id2611397"></a><a class="indexterm" name="id2611405"></a>
|
|---|
| 134 | It would be foolish to adopt a technology that might put any data or users at risk. Security affects
|
|---|
| 135 | everyone. The Samba-Team is fully cognizant of the responsibility they have to their users.
|
|---|
| 136 | The Samba documentation clearly reveals that full responsibility is accepted to fix anything
|
|---|
| 137 | that is broken.
|
|---|
| 138 | </p><p><a class="indexterm" name="id2611421"></a><a class="indexterm" name="id2611429"></a><a class="indexterm" name="id2611437"></a><a class="indexterm" name="id2611445"></a><a class="indexterm" name="id2611456"></a><a class="indexterm" name="id2611464"></a><a class="indexterm" name="id2611472"></a><a class="indexterm" name="id2611480"></a><a class="indexterm" name="id2611488"></a><a class="indexterm" name="id2611496"></a><a class="indexterm" name="id2611504"></a>
|
|---|
| 139 | There is a mistaken perception in the IT industry that commercial software providers are fully
|
|---|
| 140 | accountable for the defects in products. Open Source software comes with no warranty, so it is
|
|---|
| 141 | often assumed that its use confers a higher degree of risk. Everyone should read commercial software
|
|---|
| 142 | End User License Agreements (EULAs). You should determine what real warranty is offered and the
|
|---|
| 143 | extent of liability that is accepted. Doing so soon dispels the popular notion that
|
|---|
| 144 | commercial software vendors are willingly accountable for product defects. In many cases, the
|
|---|
| 145 | commercial vendor accepts liability only to reimburse the price paid for the software.
|
|---|
| 146 | </p><p><a class="indexterm" name="id2611526"></a><a class="indexterm" name="id2611534"></a><a class="indexterm" name="id2611542"></a><a class="indexterm" name="id2611550"></a><a class="indexterm" name="id2611558"></a><a class="indexterm" name="id2611566"></a>
|
|---|
| 147 | The real issues that a consumer (like you) needs answered are What is the way of escape from technical
|
|---|
| 148 | problems, and how long will it take? The average problem turnaround time in the Open Source community is
|
|---|
| 149 | approximately 48 hours. What does the EULA offer? What is the track record in the commercial software
|
|---|
| 150 | industry? What happens when your commercial vendor decides to cease providing support?
|
|---|
| 151 | </p><p><a class="indexterm" name="id2611591"></a><a class="indexterm" name="id2611598"></a><a class="indexterm" name="id2611606"></a><a class="indexterm" name="id2611614"></a><a class="indexterm" name="id2611622"></a><a class="indexterm" name="id2611630"></a><a class="indexterm" name="id2611638"></a>
|
|---|
| 152 | Open Source software at least puts you in possession of the source code. This means that when
|
|---|
| 153 | all else fails, you can hire a programmer to solve the problem.
|
|---|
| 154 | </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2611650"></a>Technical Issues</h3></div></div></div><p>
|
|---|
| 155 | Each issue is now discussed and, where appropriate, example implementation steps are
|
|---|
| 156 | provided.
|
|---|
| 157 | </p><div class="variablelist"><dl><dt><span class="term">Winbind and Security</span></dt><dd><p><a class="indexterm" name="id2611671"></a><a class="indexterm" name="id2611679"></a><a class="indexterm" name="id2611687"></a><a class="indexterm" name="id2611698"></a><a class="indexterm" name="id2611706"></a><a class="indexterm" name="id2611714"></a><a class="indexterm" name="id2611722"></a><a class="indexterm" name="id2611730"></a><a class="indexterm" name="id2611738"></a><a class="indexterm" name="id2611746"></a>
|
|---|
| 158 | Windows network administrators may be dismayed to find that <code class="literal">winbind</code>
|
|---|
| 159 | exposes all domain users so that they may use their domain account credentials to
|
|---|
| 160 | log on to a UNIX/Linux system. The fact that all users in the domain can see the
|
|---|
| 161 | UNIX/Linux server in their Network Neighborhood and can browse the shares on the
|
|---|
| 162 | server seems to excite them further.
|
|---|
| 163 | </p><p><a class="indexterm" name="id2611770"></a><a class="indexterm" name="id2611778"></a><a class="indexterm" name="id2611786"></a><a class="indexterm" name="id2611794"></a>
|
|---|
| 164 | <code class="literal">winbind</code> provides for the UNIX/Linux domain member server or
|
|---|
| 165 | client, the same as one would obtain by adding a Microsoft Windows server or
|
|---|
| 166 | client to the domain. The real objection is the fact that Samba is not MS Windows
|
|---|
| 167 | and therefore requires handling a little differently from the familiar Windows systems.
|
|---|
| 168 | One must recognize fear of the unknown.
|
|---|
| 169 | </p><p><a class="indexterm" name="id2611817"></a><a class="indexterm" name="id2611825"></a><a class="indexterm" name="id2611833"></a><a class="indexterm" name="id2611841"></a><a class="indexterm" name="id2611848"></a><a class="indexterm" name="id2611860"></a>
|
|---|
| 170 | Windows network administrators need to recognize that <code class="literal">winbind</code> does
|
|---|
| 171 | not, and cannot, override account controls set using the Active Directory management
|
|---|
| 172 | tools. The control is the same. Have no fear.
|
|---|
| 173 | </p><p><a class="indexterm" name="id2611881"></a><a class="indexterm" name="id2611888"></a><a class="indexterm" name="id2611900"></a><a class="indexterm" name="id2611908"></a><a class="indexterm" name="id2611916"></a><a class="indexterm" name="id2611923"></a><a class="indexterm" name="id2611931"></a><a class="indexterm" name="id2611939"></a><a class="indexterm" name="id2611947"></a><a class="indexterm" name="id2611955"></a>
|
|---|
| 174 | Where Samba and the ADS domain account information obtained through the use of
|
|---|
| 175 | <code class="literal">winbind</code> permits access, by browsing or by the drive mapping to
|
|---|
| 176 | a share, to data that should be better protected. This can only happen when security
|
|---|
| 177 | controls have not been properly implemented. Samba permits access controls to be set
|
|---|
| 178 | on:
|
|---|
| 179 | </p><div class="itemizedlist"><ul type="disc"><li><p>Shares themselves (i.e., the logical share itself)</p></li><li><p>The share definition in <code class="filename">smb.conf</code></p></li><li><p>The shared directories and files using UNIX permissions</p></li><li><p>Using Windows 2000 ACLs if the file system is POSIX enabled</p></li></ul></div><p>
|
|---|
| 180 | Examples of each are given in <a class="link" href="kerberos.html#ch10expl" title="Implementation">“Implementation”</a>.
|
|---|
| 181 | </p></dd><dt><span class="term">User and Group Controls</span></dt><dd><p><a class="indexterm" name="id2612029"></a><a class="indexterm" name="id2612037"></a><a class="indexterm" name="id2612049"></a><a class="indexterm" name="id2612060"></a><a class="indexterm" name="id2612068"></a><a class="indexterm" name="id2612075"></a><a class="indexterm" name="id2612083"></a><a class="indexterm" name="id2612091"></a><a class="indexterm" name="id2612099"></a>
|
|---|
| 182 | User and group management facilities as known in the Windows ADS environment may be
|
|---|
| 183 | used to provide equivalent access control constraints or to provide equivalent
|
|---|
| 184 | permissions and privileges on Samba servers. Samba offers greater flexibility in the
|
|---|
| 185 | use of user and group controls because it has additional layers of control compared to
|
|---|
| 186 | Windows 200x/XP. For example, access controls on a Samba server may be set within
|
|---|
| 187 | the share definition in a manner for which Windows has no equivalent.
|
|---|
| 188 | </p><p><a class="indexterm" name="id2612119"></a><a class="indexterm" name="id2612127"></a><a class="indexterm" name="id2612135"></a><a class="indexterm" name="id2612143"></a><a class="indexterm" name="id2612154"></a><a class="indexterm" name="id2612162"></a><a class="indexterm" name="id2612170"></a>
|
|---|
| 189 | In any serious analysis of system security, it is important to examine the safeguards
|
|---|
| 190 | that remain when all other protective measures fail. An administrator may inadvertently
|
|---|
| 191 | set excessive permissions on the file system of a shared resource, or he may set excessive
|
|---|
| 192 | privileges on the share itself. If that were to happen in a Windows 2003 Server environment,
|
|---|
| 193 | the data would indeed be laid bare to abuse. Yet, within a Samba share definition, it is
|
|---|
| 194 | possible to guard against that by enforcing controls on the share definition itself. You
|
|---|
| 195 | see a practical example of this a little later in this chapter.
|
|---|
| 196 | </p><p><a class="indexterm" name="id2612192"></a><a class="indexterm" name="id2612200"></a>
|
|---|
| 197 | The report that is critical of Samba really ought to have exercised greater due
|
|---|
| 198 | diligence: the real weakness is on the side of a Microsoft Windows environment.
|
|---|
| 199 | </p></dd><dt><span class="term">Security Overall</span></dt><dd><p><a class="indexterm" name="id2612222"></a>
|
|---|
| 200 | Samba is designed in such a manner that weaknesses inherent in the design of
|
|---|
| 201 | Microsoft Windows networking ought not to expose the underlying UNIX/Linux file
|
|---|
| 202 | system in any way. All software has potential defects, and Samba is no exception.
|
|---|
| 203 | What matters more is how defects that are discovered get dealt with.
|
|---|
| 204 | </p><p><a class="indexterm" name="id2612238"></a><a class="indexterm" name="id2612246"></a><a class="indexterm" name="id2612254"></a><a class="indexterm" name="id2612262"></a>
|
|---|
| 205 | The Samba Team totally agrees with the necessity to observe and fully implement
|
|---|
| 206 | every security facility to provide a level of protection and security that is necessary
|
|---|
| 207 | and that the end user (or network administrator) needs. Never would the Samba Team
|
|---|
| 208 | recommend a compromise to system security, nor would deliberate defoliation of
|
|---|
| 209 | security be publicly condoned; yet this is the practice by many Windows network
|
|---|
| 210 | administrators just to make happy users who have no notion of consequential risk.
|
|---|
| 211 | </p><p><a class="indexterm" name="id2612282"></a><a class="indexterm" name="id2612290"></a><a class="indexterm" name="id2612298"></a><a class="indexterm" name="id2612306"></a><a class="indexterm" name="id2612314"></a><a class="indexterm" name="id2612322"></a><a class="indexterm" name="id2612330"></a>
|
|---|
| 212 | The report condemns Samba for releasing updates and security fixes, yet Microsoft
|
|---|
| 213 | online updates need to be applied almost weekly. The answer to the criticism
|
|---|
| 214 | lies in the fact that Samba development is continuing, documentation is improving,
|
|---|
| 215 | user needs are being increasingly met or exceeded, and security updates are issued
|
|---|
| 216 | with a short turnaround time.
|
|---|
| 217 | </p><p><a class="indexterm" name="id2612347"></a><a class="indexterm" name="id2612355"></a><a class="indexterm" name="id2612363"></a><a class="indexterm" name="id2612371"></a><a class="indexterm" name="id2612379"></a>
|
|---|
| 218 | The release of Samba-4 is expected around late 2004 to early 2005 and involves a near
|
|---|
| 219 | complete rewrite to permit extensive modularization and to prepare Samba for new
|
|---|
| 220 | functionality planned for addition during the next-generation series. The Samba Team
|
|---|
| 221 | is responsible and can be depended upon; the history to date suggests a high
|
|---|
| 222 | degree of dependability and on charter development consistent with published
|
|---|
| 223 | roadmap projections.
|
|---|
| 224 | </p><p><a class="indexterm" name="id2612409"></a><a class="indexterm" name="id2612417"></a><a class="indexterm" name="id2612429"></a><a class="indexterm" name="id2612440"></a><a class="indexterm" name="id2612448"></a><a class="indexterm" name="id2612456"></a><a class="indexterm" name="id2612464"></a>
|
|---|
| 225 | Not well published is the fact that Microsoft was a foundation member of
|
|---|
| 226 | the Common Internet File System (CIFS) initiative, together with the participation
|
|---|
| 227 | of the network attached storage (NAS) industry. Unfortunately, for the past few years,
|
|---|
| 228 | Microsoft has been absent from active involvement at CIFS conferences and has
|
|---|
| 229 | not exercised the leadership expected of a major force in the networking technology
|
|---|
| 230 | space. The Samba Team has maintained consistent presence and leadership at all
|
|---|
| 231 | CIFS conferences and at the interoperability laboratories run concurrently with
|
|---|
| 232 | them.
|
|---|
| 233 | </p></dd><dt><span class="term">Cryptographic Controls (schannel, sign'n'seal)</span></dt><dd><p><a class="indexterm" name="id2612494"></a><a class="indexterm" name="id2612502"></a><a class="indexterm" name="id2612510"></a>
|
|---|
| 234 | The report correctly mentions that Samba did not support the most recent
|
|---|
| 235 | <code class="constant">schannel</code> and <code class="constant">digital sign'n'seal</code> features
|
|---|
| 236 | of Microsoft Windows NT/200x/XPPro products. This is one of the key features
|
|---|
| 237 | of the Samba-3 release. Market research reports take so long to generate that they are
|
|---|
| 238 | seldom a reflection of current practice, and in many respects reports are like a
|
|---|
| 239 | pathology report they reflect accurately (at best) status at a snapshot in time.
|
|---|
| 240 | Meanwhile, the world moves on.
|
|---|
| 241 | </p><p><a class="indexterm" name="id2612540"></a><a class="indexterm" name="id2612548"></a><a class="indexterm" name="id2612555"></a><a class="indexterm" name="id2612563"></a><a class="indexterm" name="id2612571"></a><a class="indexterm" name="id2612586"></a><a class="indexterm" name="id2612594"></a>
|
|---|
| 242 | It should be pointed out that had clear public specifications for the protocols
|
|---|
| 243 | been published, it would have been much easier to implement these features and would have
|
|---|
| 244 | taken less time to do. The sole mechanism used to find an algorithm that is compatible
|
|---|
| 245 | with the methods used by Microsoft has been based on observation of network traffic
|
|---|
| 246 | and trial-and-error implementation of potential techniques. The real value of public
|
|---|
| 247 | and defensible standards is obvious to all and would have enabled more secure networking
|
|---|
| 248 | for everyone.
|
|---|
| 249 | </p><p><a class="indexterm" name="id2612614"></a><a class="indexterm" name="id2612622"></a>
|
|---|
| 250 | Critics of Samba often ignore fundamental problems that may plague (or may have plagued)
|
|---|
| 251 | the users of Microsoft's products also. Those who are first to criticize Samba
|
|---|
| 252 | for not rushing into release of <code class="constant">digital sign'n'seal</code> support
|
|---|
| 253 | often dismiss the problems that Microsoft has
|
|---|
| 254 | <a class="ulink" href="http://support.microsoft.com/default.aspx?kbid=321733" target="_top">acknowledged</a>
|
|---|
| 255 | and for which a fix was provided. In fact,
|
|---|
| 256 | <a class="ulink" href="http://www.tangent-systems.com/support/delayedwrite.html" target="_top">Tangent Systems</a>
|
|---|
| 257 | have documented a significant problem with delays writes that can be connected with the
|
|---|
| 258 | implementation of sign'n'seal. They provide a work-around that is not trivial for many
|
|---|
| 259 | Windows networking sites. From notes such as this it is clear that there are benefits
|
|---|
| 260 | from not rushing new technology out of the door too soon.
|
|---|
| 261 | </p><p><a class="indexterm" name="id2612662"></a><a class="indexterm" name="id2612670"></a><a class="indexterm" name="id2612678"></a><a class="indexterm" name="id2612686"></a><a class="indexterm" name="id2612694"></a><a class="indexterm" name="id2612702"></a><a class="indexterm" name="id2612710"></a><a class="indexterm" name="id2612718"></a><a class="indexterm" name="id2612726"></a>
|
|---|
| 262 | One final comment is warranted. If companies want more secure networking protocols,
|
|---|
| 263 | the most effective method by which this can be achieved is by users seeking
|
|---|
| 264 | and working together to help define open and publicly refereed standards. The
|
|---|
| 265 | development of closed source, proprietary methods that are developed in a
|
|---|
| 266 | clandestine framework of secrecy, under claims of digital rights protection, does
|
|---|
| 267 | not favor the diffusion of safe networking protocols and certainly does not
|
|---|
| 268 | help the consumer to make a better choice.
|
|---|
| 269 | </p></dd><dt><span class="term">Active Directory Replacement with Kerberos, LDAP, and Samba</span></dt><dd><p>
|
|---|
| 270 | </p><div class="literallayout"><p> </p></div><p>
|
|---|
| 271 | The Microsoft networking protocols extensively make use of remote procedure call (RPC)
|
|---|
| 272 | technology. Active Directory is not a simple mixture of LDAP and Kerberos together
|
|---|
| 273 | with file and print services, but rather is a complex, intertwined implementation
|
|---|
| 274 | of them that uses RPCs that are not supported by any of these component technologies
|
|---|
| 275 | and yet by which they are made to interoperate in ways that the components do not
|
|---|
| 276 | support.
|
|---|
| 277 | </p><p><a class="indexterm" name="id2612814"></a><a class="indexterm" name="id2612825"></a><a class="indexterm" name="id2612833"></a><a class="indexterm" name="id2612841"></a><a class="indexterm" name="id2612849"></a>
|
|---|
| 278 | In order to make the popular request for Samba to be an Active Directory Server a
|
|---|
| 279 | reality, it is necessary to add to OpenLDAP, Kerberos, as well as Samba, RPC calls
|
|---|
| 280 | that are not presently supported. The Samba Team has not been able to gain critical
|
|---|
| 281 | overall support for all project maintainers to work together on the complex
|
|---|
| 282 | challenge of developing and integrating the necessary technologies. Therefore, if
|
|---|
| 283 | the Samba Team does not make it a priority to absorb Kerberos and LDAP functionality
|
|---|
| 284 | into the Samba project, this dream request cannot become a reality.
|
|---|
| 285 | </p><p><a class="indexterm" name="id2612880"></a><a class="indexterm" name="id2612888"></a><a class="indexterm" name="id2612896"></a><a class="indexterm" name="id2612907"></a><a class="indexterm" name="id2612914"></a>
|
|---|
| 286 | At this time, the integration of LDAP, Kerberos, and the missing RPCs is not on the
|
|---|
| 287 | Samba development roadmap. If it is not on the published roadmap, it cannot be delivered
|
|---|
| 288 | anytime soon. Ergo, ADS server support is not a current goal for Samba development.
|
|---|
| 289 | The Samba Team is most committed to permitting Samba to be a full ADS domain member
|
|---|
| 290 | that is increasingly capable of being managed using Microsoft Windows MMC tools.
|
|---|
| 291 | </p></dd></dl></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2612934"></a>Kerberos Exposed</h4></div></div></div><p><a class="indexterm" name="id2612941"></a><a class="indexterm" name="id2612949"></a><a class="indexterm" name="id2612957"></a>
|
|---|
| 292 | Kerberos is a network authentication protocol that provides secure authentication for
|
|---|
| 293 | client-server applications by using secret-key cryptography. Firewalls are an insufficient
|
|---|
| 294 | barrier mechanism in today's networking world; at best they only restrict incoming network
|
|---|
| 295 | traffic but cannot prevent network traffic that comes from authorized locations from
|
|---|
| 296 | performing unauthorized activities.
|
|---|
| 297 | </p><p><a class="indexterm" name="id2612975"></a><a class="indexterm" name="id2612983"></a><a class="indexterm" name="id2612991"></a>
|
|---|
| 298 | Kerberos was created by MIT as a solution to network security problems. The Kerberos protocol uses
|
|---|
| 299 | strong cryptography so that a client can prove its identity to a server (and vice versa) across an
|
|---|
| 300 | insecure network connection. After a client and server has used Kerberos to prove their identity,
|
|---|
| 301 | they can also encrypt all of their communications to assure privacy and data integrity as they go
|
|---|
| 302 | about their business.
|
|---|
| 303 | </p><p><a class="indexterm" name="id2613009"></a><a class="indexterm" name="id2613017"></a><a class="indexterm" name="id2613025"></a><a class="indexterm" name="id2613033"></a><a class="indexterm" name="id2613044"></a>
|
|---|
| 304 | Kerberos is a trusted third-party service. That means that there is a third party (the kerberos
|
|---|
| 305 | server) that is trusted by all the entities on the network (users and services, usually called
|
|---|
| 306 | principals). All principals share a secret password (or key) with the kerberos server and this
|
|---|
| 307 | enables principals to verify that the messages from the kerberos server are authentic. Therefore,
|
|---|
| 308 | trusting the kerberos server, users and services can authenticate each other.
|
|---|
| 309 | </p><p>
|
|---|
| 310 | <a class="indexterm" name="id2613064"></a>
|
|---|
| 311 | <a class="indexterm" name="id2613071"></a>
|
|---|
| 312 | <a class="indexterm" name="id2613078"></a>
|
|---|
| 313 | Kerberos was, until recently, a technology that was restricted from being exported from the United States.
|
|---|
| 314 | For many years that hindered global adoption of more secure networking technologies both within the United States
|
|---|
| 315 | and abroad. A free and unencumbered implementation of MIT Kerberos has been produced in Europe
|
|---|
| 316 | and is available from the <a class="ulink" href="http://www.pdc.kth.se/heimdal/" target="_top">Royal Institute</a> of
|
|---|
| 317 | Technology (KTH), Sweden. It is known as the Heimdal Kerberos project. In recent times the U.S. government
|
|---|
| 318 | has removed sanctions affecting the global distribution of MIT Kerberos. It is likely that there will be a
|
|---|
| 319 | significant surge forward in the development of Kerberos-enabled applications and in the general deployment
|
|---|
| 320 | and use of Kerberos across the spectrum of the information technology industry.
|
|---|
| 321 | </p><p>
|
|---|
| 322 | <a class="indexterm" name="id2613107"></a>
|
|---|
| 323 | A storm has broken out concerning interoperability between MIT Kerberos and Microsofts' implementation
|
|---|
| 324 | of it. For example, a 2002
|
|---|
| 325 | <a class="ulink" href="http://www.idg.com.sg/idgwww.nsf/0/5DDA8D153A7505A748256BAB000D992A?OpenDocument" target="_top">IDG</a>
|
|---|
| 326 | report<sup>[<a name="id2613126" href="#ftn.id2613126" class="footnote">13</a>]</sup> by
|
|---|
| 327 | states:
|
|---|
| 328 | </p><div class="blockquote"><blockquote class="blockquote"><p>
|
|---|
| 329 | A Microsoft Corp. executive testified at the software giant's remedy hearing that the company goes to
|
|---|
| 330 | great lengths to disclose interfaces and protocols that allow third-party software products to interact
|
|---|
| 331 | with Windows. But a lawyer with the states suing Microsoft pointed out that when it comes to the company's
|
|---|
| 332 | use of the Kerberos authentication specification, not everyone agrees.
|
|---|
| 333 | </p><p>
|
|---|
| 334 | <a class="indexterm" name="id2613152"></a>
|
|---|
| 335 | Robert Short, vice president of Windows core technology at Microsoft, wrote in his direct testimony prepared
|
|---|
| 336 | before his appearance that non-Microsoft operating systems can disregard the portion of the Kerberos version
|
|---|
| 337 | 5 specification that Windows clients use for proprietary purposes and still achieve interoperability with
|
|---|
| 338 | the Microsoft OS. Microsoft takes advantage of unspecified fields in the Kerberos specification for storing
|
|---|
| 339 | Windows-specific authorization data, Short wrote. The designers of Kerberos left these fields undefined so
|
|---|
| 340 | that software developers could add their own authorization information, he said.
|
|---|
| 341 | </p></blockquote></div><p>
|
|---|
| 342 | <a class="indexterm" name="id2613176"></a>
|
|---|
| 343 | <a class="indexterm" name="id2613182"></a>
|
|---|
| 344 | It so happens that Microsoft Windows clients depend on and expect the contents of the <span class="emphasis"><em>unspecified
|
|---|
| 345 | fields</em></span> in the Kerberos 5 communications data stream for their Windows interoperability,
|
|---|
| 346 | particularly when Samba is expected to emulate a Windows Server 200x domain controller. But the interoperability
|
|---|
| 347 | issue goes far deeper than this. In the domain control protocols that are used by MS Windows XP Professional,
|
|---|
| 348 | there is a tight interdependency between the Kerberos protocols and the Microsoft distributed computing environment
|
|---|
| 349 | (DCE) RPCs that themselves are an integral part of the SMB/CIFS protocols as used by
|
|---|
| 350 | Microsoft.
|
|---|
| 351 | </p><p>
|
|---|
| 352 | Microsoft makes the following comment in a reference in a
|
|---|
| 353 | <a class="ulink" href="http://www.microsoft.com/technet/itsolutions/interop/mgmt/kerberos.asp" target="_top">
|
|---|
| 354 | technet</a> article:
|
|---|
| 355 | </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id2613217"></a><a class="indexterm" name="id2613229"></a>
|
|---|
| 356 | The DCE Security Services are also layered on the Kerberos protocol. DCE authentication services use RPC
|
|---|
| 357 | representation of Kerberos protocol messages. In addition, DCE uses the authorization data field in Kerberos
|
|---|
| 358 | tickets to convey Privilege Attribute Certificates (PACs) that define user identity and group membership.
|
|---|
| 359 | The DCE PAC is used in a similar manner as Windows NT Security IDs for user authorization and access control.
|
|---|
| 360 | Windows NT services will not be able to translate DCE PACs into Windows NT user and group identifiers. This
|
|---|
| 361 | is not an issue with Kerberos interoperability, but rather an issue of interoperability between DCE and
|
|---|
| 362 | Windows NT access control information.
|
|---|
| 363 | </p></blockquote></div></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch10expl"></a>Implementation</h2></div></div></div><p>
|
|---|
| 364 | The following procedures outline the implementation of the security measures discussed so far.
|
|---|
| 365 | </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2613280"></a>Share Access Controls</h3></div></div></div><p><a class="indexterm" name="id2613287"></a><a class="indexterm" name="id2613295"></a><a class="indexterm" name="id2613303"></a>
|
|---|
| 366 | Access control entries placed on the share itself act as a filter at the time a when CIFS/SMB client (such as
|
|---|
| 367 | Windows XP Pro) attempts to make a connection to the Samba server.
|
|---|
| 368 | </p><div class="procedure"><a name="id2613316"></a><p class="title"><b>Procedure 11.1. Create/Edit/Delete Share ACLs</b></p><ol type="1"><li><p><a class="indexterm" name="id2613327"></a><a class="indexterm" name="id2613335"></a>
|
|---|
| 369 | From a Windows 200x/XP Professional workstation, log on to the domain using the Domain Administrator
|
|---|
| 370 | account (on Samba domains, this is usually the account called <code class="constant">root</code>).
|
|---|
| 371 | </p></li><li><p>
|
|---|
| 372 | Click
|
|---|
| 373 | <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Control Panel</span> → <span class="guimenuitem">Administrative Tools</span> → <span class="guimenuitem">Computer Management</span>.
|
|---|
| 374 | </p></li><li><p>
|
|---|
| 375 | In the left panel,
|
|---|
| 376 | <span class="guimenu">[Right mouse menu item] Computer Management (Local)</span> → <span class="guimenuitem">Connect to another computer ...</span> → <span class="guimenuitem">Browse...</span> → <span class="guimenuitem">Advanced</span> → <span class="guimenuitem">Find Now</span>. In the lower panel, click on the name of the server you wish to
|
|---|
| 377 | administer. Click <span class="guimenu">OK</span> → <span class="guimenuitem">OK</span> → <span class="guimenuitem">OK</span>.<a class="indexterm" name="id2613458"></a>
|
|---|
| 378 | In the left panel, the entry <span class="guimenu">Computer Management (Local)</span> should now reflect
|
|---|
| 379 | the change made. For example, if the server you are administering is called <code class="constant">FRODO</code>,
|
|---|
| 380 | the Computer Management entry should now say <span class="guimenu">Computer Management (FRODO)</span>.
|
|---|
| 381 | </p></li><li><p>
|
|---|
| 382 | In the left panel, click <span class="guimenu">Computer Management (FRODO)</span> → <span class="guimenuitem">[+] Shared Folders</span> → <span class="guimenuitem">Shares</span>.
|
|---|
| 383 | </p></li><li><p><a class="indexterm" name="id2613522"></a><a class="indexterm" name="id2613530"></a>
|
|---|
| 384 | In the right panel, double-click on the share on which you wish to set/edit ACLs. This
|
|---|
| 385 | will bring up the Properties panel. Click the <span class="guimenu">Share Permissions</span> tab.
|
|---|
| 386 | </p></li><li><p><a class="indexterm" name="id2613553"></a><a class="indexterm" name="id2613561"></a><a class="indexterm" name="id2613569"></a><a class="indexterm" name="id2613577"></a><a class="indexterm" name="id2613585"></a><a class="indexterm" name="id2613593"></a>
|
|---|
| 387 | You may now edit/add/remove access control settings. Be very careful. Many problems have been
|
|---|
| 388 | created by people who decided that everyone should be rejected but one particular group should
|
|---|
| 389 | have full control. This is a catch-22 situation because members of that particular group also
|
|---|
| 390 | belong to the group <code class="constant">Everyone</code>, which therefore overrules any permissions
|
|---|
| 391 | set for the permitted group.
|
|---|
| 392 | </p></li><li><p>
|
|---|
| 393 | When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span>
|
|---|
| 394 | buttons.
|
|---|
| 395 | </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2613629"></a>Share Definition Controls</h3></div></div></div><p><a class="indexterm" name="id2613636"></a><a class="indexterm" name="id2613648"></a><a class="indexterm" name="id2613655"></a><a class="indexterm" name="id2613663"></a><a class="indexterm" name="id2613671"></a><a class="indexterm" name="id2613679"></a>
|
|---|
| 396 | Share-definition-based access controls can be used like a checkpoint or like a pile-driver. Just as a
|
|---|
| 397 | checkpoint can be used to require someone who wants to get through to meet certain requirements, so
|
|---|
| 398 | it is possible to require the user (or group the user belongs to) to meet specified credential-related
|
|---|
| 399 | objectives. It can be likened to a pile-driver by overriding default controls in that having met the
|
|---|
| 400 | credential-related objectives, the user can be granted powers and privileges that would not normally be
|
|---|
| 401 | available under default settings.
|
|---|
| 402 | </p><p><a class="indexterm" name="id2613699"></a><a class="indexterm" name="id2613707"></a><a class="indexterm" name="id2613715"></a><a class="indexterm" name="id2613723"></a>
|
|---|
| 403 | It must be emphasized that the controls discussed here can act as a filter or give rights of passage
|
|---|
| 404 | that act as a superstructure over normal directory and file access controls. However, share-level
|
|---|
| 405 | ACLs act at a higher level than do share definition controls because the user must filter through the
|
|---|
| 406 | share-level controls to get to the share-definition controls. The proper hierarchy of controls implemented
|
|---|
| 407 | by Samba and Windows networking consists of:
|
|---|
| 408 | </p><div class="orderedlist"><ol type="1"><li><p>Share-level ACLs</p></li><li><p>Share-definition controls</p></li><li><p>Directory and file permissions</p></li><li><p>Directory and file POSIX ACLs</p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2613769"></a>Checkpoint Controls</h4></div></div></div><p><a class="indexterm" name="id2613775"></a>
|
|---|
| 409 | Consider the following extract from a <code class="filename">smb.conf</code> file defining the share called <code class="constant">Apps</code>:
|
|---|
| 410 | </p><pre class="screen">
|
|---|
| 411 | [Apps]
|
|---|
| 412 | comment = Application Share
|
|---|
| 413 | path = /data/apps
|
|---|
| 414 | read only = Yes
|
|---|
| 415 | valid users = @Employees
|
|---|
| 416 | </pre><p>
|
|---|
| 417 | This definition permits only those who are members of the group called <code class="constant">Employees</code> to
|
|---|
| 418 | access the share.
|
|---|
| 419 | </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p><a class="indexterm" name="id2613811"></a><a class="indexterm" name="id2613822"></a><a class="indexterm" name="id2613831"></a><a class="indexterm" name="id2613839"></a><a class="indexterm" name="id2613846"></a>
|
|---|
| 420 | On domain member servers and clients, even when the <em class="parameter"><code>winbind use default domain</code></em> has
|
|---|
| 421 | been specified, the use of domain accounts in security controls requires fully qualified domain specification,
|
|---|
| 422 | for example, <a class="link" href="smb.conf.5.html#VALIDUSERS" target="_top">valid users = @"MEGANET\Northern Engineers"</a>.
|
|---|
| 423 | Note the necessity to use the double quotes to avoid having the space in the Windows group name interpreted as a
|
|---|
| 424 | delimiter.
|
|---|
| 425 | </p></div><p><a class="indexterm" name="id2613882"></a><a class="indexterm" name="id2613889"></a><a class="indexterm" name="id2613897"></a>
|
|---|
| 426 | If there is an ACL on the share itself to permit read/write access for all <code class="constant">Employees</code>
|
|---|
| 427 | as well as read/write for the group <code class="constant">Doctors</code>, both groups are permitted through
|
|---|
| 428 | to the share. However, at the moment an attempt is made to set up a connection to the share, a member of
|
|---|
| 429 | the group <code class="constant">Doctors</code>, who is not also a member of the group <code class="constant">Employees</code>,
|
|---|
| 430 | would immediately fail to validate.
|
|---|
| 431 | </p><p><a class="indexterm" name="id2613928"></a>
|
|---|
| 432 | Consider another example. In this case, you want to permit all members of the group <code class="constant">Employees</code>
|
|---|
| 433 | except the user <code class="constant">patrickj</code> to access the <code class="constant">Apps</code> share. This can be
|
|---|
| 434 | easily achieved by setting a share-level ACL permitting only <code class="constant">Employees</code> to access the share,
|
|---|
| 435 | and then in the share definition controls excluding just <code class="constant">patrickj</code>. Here is how that might
|
|---|
| 436 | be done:
|
|---|
| 437 | </p><pre class="screen">
|
|---|
| 438 | [Apps]
|
|---|
| 439 | comment = Application Share
|
|---|
| 440 | path = /data/apps
|
|---|
| 441 | read only = Yes
|
|---|
| 442 | invalid users = patrickj
|
|---|
| 443 | </pre><p>
|
|---|
| 444 | <a class="indexterm" name="id2613969"></a>
|
|---|
| 445 | Let us assume that you want to permit the user <code class="constant">gbshaw</code> to manage any file in the
|
|---|
| 446 | UNIX/Linux file system directory <code class="filename">/data/apps</code>, but you do not want to grant any write
|
|---|
| 447 | permissions beyond that directory tree. Here is one way this can be done:
|
|---|
| 448 | </p><pre class="screen">
|
|---|
| 449 | [Apps]
|
|---|
| 450 | comment = Application Share
|
|---|
| 451 | path = /data/apps
|
|---|
| 452 | read only = Yes
|
|---|
| 453 | invalid users = patrickj
|
|---|
| 454 | admin users = gbshaw
|
|---|
| 455 | </pre><p>
|
|---|
| 456 | <a class="indexterm" name="id2613999"></a>
|
|---|
| 457 | Now we have a set of controls that permits only <code class="constant">Employees</code> who are also members of
|
|---|
| 458 | the group <code class="constant">Doctors</code>, excluding the user <code class="constant">patrickj</code>, to have
|
|---|
| 459 | read-only privilege, but the user <code class="constant">gbshaw</code> is granted administrative rights.
|
|---|
| 460 | The administrative rights conferred upon the user <code class="constant">gbshaw</code> permit operation as
|
|---|
| 461 | if that user has logged in as the user <code class="constant">root</code> on the UNIX/Linux system and thus,
|
|---|
| 462 | for access to the directory tree that has been shared (exported), permit the user to override controls
|
|---|
| 463 | that apply to all other users on that resource.
|
|---|
| 464 | </p><p>
|
|---|
| 465 | There are additional checkpoint controls that may be used. For example, if for the same share we now
|
|---|
| 466 | want to provide the user <code class="constant">peters</code> with the ability to write to one directory to
|
|---|
| 467 | which he has write privilege in the UNIX file system, you can specifically permit that with the
|
|---|
| 468 | following settings:
|
|---|
| 469 | </p><pre class="screen">
|
|---|
| 470 | [Apps]
|
|---|
| 471 | comment = Application Share
|
|---|
| 472 | path = /data/apps
|
|---|
| 473 | read only = Yes
|
|---|
| 474 | invalid users = patrickj
|
|---|
| 475 | admin users = gbshaw
|
|---|
| 476 | write list = peters
|
|---|
| 477 | </pre><p>
|
|---|
| 478 | <a class="indexterm" name="id2614059"></a>
|
|---|
| 479 | This is a particularly complex example at this point, but it begins to demonstrate the possibilities.
|
|---|
| 480 | You should refer to the online manual page for the <code class="filename">smb.conf</code> file for more information regarding
|
|---|
| 481 | the checkpoint controls that Samba implements.
|
|---|
| 482 | </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2614081"></a>Override Controls</h4></div></div></div><p><a class="indexterm" name="id2614088"></a>
|
|---|
| 483 | Override controls implemented by Samba permit actions like the adoption of a different identity
|
|---|
| 484 | during file system operations, the forced overwriting of normal file and directory permissions,
|
|---|
| 485 | and so on. You should refer to the online manual page for the <code class="filename">smb.conf</code> file for more information regarding
|
|---|
| 486 | the override controls that Samba implements.
|
|---|
| 487 | </p><p>
|
|---|
| 488 | In the following example, you want to create a Windows networking share that any user can access.
|
|---|
| 489 | However, you want all read and write operations to be performed as if the user <code class="constant">billc</code>
|
|---|
| 490 | and member of the group <code class="constant">Mentors</code> read/write the files. Here is one way this
|
|---|
| 491 | can be done:
|
|---|
| 492 | </p><pre class="screen">
|
|---|
| 493 | [someshare]
|
|---|
| 494 | comment = Some Files Everyone May Overwrite
|
|---|
| 495 | path = /data/somestuff
|
|---|
| 496 | read only = No
|
|---|
| 497 | force user = billc
|
|---|
| 498 | force group = Mentors
|
|---|
| 499 | </pre><p>
|
|---|
| 500 | <a class="indexterm" name="id2614132"></a><a class="indexterm" name="id2614140"></a>
|
|---|
| 501 | That is all there is to it. Well, it is almost that simple. The downside of this method is that
|
|---|
| 502 | users are logged onto the Windows client as themselves, and then immediately before accessing the
|
|---|
| 503 | file, Samba makes system calls to change the effective user and group to the forced settings
|
|---|
| 504 | specified, completes the file transaction, and then reverts to the actually logged-on identity.
|
|---|
| 505 | This imposes significant overhead on Samba. The alternative way to effectively achieve the same result
|
|---|
| 506 | (but with lower system CPU overheads) is described next.
|
|---|
| 507 | </p><p><a class="indexterm" name="id2614160"></a><a class="indexterm" name="id2614168"></a><a class="indexterm" name="id2614176"></a><a class="indexterm" name="id2614187"></a><a class="indexterm" name="id2614195"></a>
|
|---|
| 508 | The use of the <em class="parameter"><code>force user</code></em> or the <em class="parameter"><code>force group</code></em> may
|
|---|
| 509 | also have a severe impact on system (particularly on Windows client) performance. If opportunistic
|
|---|
| 510 | locking is enabled on the share (the default), it causes an <code class="constant">oplock break</code> to be
|
|---|
| 511 | sent to the client even if the client has not opened the file. On networks that have high traffic
|
|---|
| 512 | density, or on links that are routed to a remote network segment, <code class="constant">oplock breaks</code>
|
|---|
| 513 | can be lost. This results in possible retransmission of the request, or the client may time-out while
|
|---|
| 514 | waiting for the file system transaction (read or write) to complete. The result can be a profound
|
|---|
| 515 | apparent performance degradation as the client continually attempts to reconnect to overcome the
|
|---|
| 516 | effect of the lost <code class="constant">oplock break</code>, or time-out.
|
|---|
| 517 | </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2614242"></a>Share Point Directory and File Permissions</h3></div></div></div><p><a class="indexterm" name="id2614250"></a><a class="indexterm" name="id2614257"></a><a class="indexterm" name="id2614265"></a><a class="indexterm" name="id2614273"></a>
|
|---|
| 518 | Samba has been designed and implemented so that it respects as far as is feasible the security and
|
|---|
| 519 | user privilege controls that are built into the UNIX/Linux operating system. Samba does nothing
|
|---|
| 520 | with respect to file system access that violates file system permission settings, unless it is
|
|---|
| 521 | explicitly instructed to do otherwise through share definition controls. Given that Samba obeys
|
|---|
| 522 | UNIX file system controls, this chapter does not document simple information that can be obtained
|
|---|
| 523 | from a basic UNIX training guide. Instead, one common example of a typical problem is used
|
|---|
| 524 | to demonstrate the most effective solution referred to in the immediately preceding paragraph.
|
|---|
| 525 | </p><p><a class="indexterm" name="id2614296"></a><a class="indexterm" name="id2614304"></a><a class="indexterm" name="id2614312"></a>
|
|---|
| 526 | One of the common issues that repeatedly pops up on the Samba mailing lists involves the saving of
|
|---|
| 527 | Microsoft Office files (Word and Excel) to a network drive. Here is the typical sequence:
|
|---|
| 528 | </p><div class="orderedlist"><ol type="1"><li><p>
|
|---|
| 529 | A user opens a Word document from a network drive. The file was owned by user <code class="constant">janetp</code>
|
|---|
| 530 | and [users], and was set read/write-enabled for everyone.
|
|---|
| 531 | A user opens a Word document from a network drive. The file was owned by user <code class="constant">janetp</code>
|
|---|
| 532 | and <code class="constant">users</code>, and was set read/write-enabled for everyone.
|
|---|
| 533 | </p></li><li><p>
|
|---|
| 534 | File changes and edits are made.
|
|---|
| 535 | </p></li><li><p>
|
|---|
| 536 | The file is saved, and MS Word is closed.
|
|---|
| 537 | </p></li><li><p>
|
|---|
| 538 | The file is now owned by the user <code class="constant">billc</code> and group <code class="constant">doctors</code>,
|
|---|
| 539 | and is set read/write by <code class="constant">billc</code>, read-only by <code class="constant">doctors</code>, and
|
|---|
| 540 | no access by everyone.
|
|---|
| 541 | </p></li><li><p>
|
|---|
| 542 | The original owner cannot now access her own file and is “<span class="quote">justifiably</span>” upset.
|
|---|
| 543 | </p></li></ol></div><p>
|
|---|
| 544 | There have been many postings over the years that report the same basic problem. Frequently Samba users
|
|---|
| 545 | want to know when this “<span class="quote">bug</span>” will be fixed. The fact is, this is not a bug in Samba at all.
|
|---|
| 546 | Here is the real sequence of what happens in this case.
|
|---|
| 547 | </p><p><a class="indexterm" name="id2614413"></a><a class="indexterm" name="id2614421"></a><a class="indexterm" name="id2614429"></a>
|
|---|
| 548 | When the user saves a file, MS Word creates a new (temporary) file. This file is naturally owned
|
|---|
| 549 | by the user who creates the file (<code class="constant">billc</code>) and has the permissions that follow
|
|---|
| 550 | that user's default settings within the operating system (UNIX/Linux). When MS Word has finished writing
|
|---|
| 551 | the file to disk, it then renames the new (temporary) file to the name of the old one. MS Word does not
|
|---|
| 552 | change the ownership or permissions to what they were on the original file. The file is thus a totally
|
|---|
| 553 | new file, and the old one has been deleted in the process.
|
|---|
| 554 | </p><p>
|
|---|
| 555 | Samba received a request to create a new file, and then to rename the file to a new name. The old file that
|
|---|
| 556 | has the same name is now automatically deleted. Samba has no way of knowing that the new file should
|
|---|
| 557 | perhaps have the same ownership and permissions as the old file. To Samba, these are entirely independent
|
|---|
| 558 | operations.
|
|---|
| 559 | </p><p>
|
|---|
| 560 | The question is, “<span class="quote">How can we solve the problem?</span>”
|
|---|
| 561 | </p><p>
|
|---|
| 562 | The solution is simple. Use UNIX file system permissions and controls to your advantage. Follow these
|
|---|
| 563 | simple steps to create a share in which all files will consistently be owned by the same user and the
|
|---|
| 564 | same group:
|
|---|
| 565 | </p><div class="procedure"><a name="id2614475"></a><p class="title"><b>Procedure 11.2. Using Directory Permissions to Force File User and Group Ownership</b></p><ol type="1"><li><p>
|
|---|
| 566 | Change your share definition so that it matches this pattern:
|
|---|
| 567 | </p><pre class="screen">
|
|---|
| 568 | [finance]
|
|---|
| 569 | path = /usr/data/finance
|
|---|
| 570 | browseable = Yes
|
|---|
| 571 | read only = No
|
|---|
| 572 | </pre><p>
|
|---|
| 573 | </p></li><li><p><a class="indexterm" name="id2614501"></a><a class="indexterm" name="id2614513"></a>
|
|---|
| 574 | Set consistent user and group permissions recursively down the directory tree as shown here:
|
|---|
| 575 | </p><pre class="screen">
|
|---|
| 576 | <code class="prompt">root# </code> chown -R janetp.users /usr/data/finance
|
|---|
| 577 | </pre><p>
|
|---|
| 578 | </p></li><li><p><a class="indexterm" name="id2614544"></a>
|
|---|
| 579 | Set the files and directory permissions to be read/write for owner and group, and not accessible
|
|---|
| 580 | to others (everyone), using the following command:
|
|---|
| 581 | </p><pre class="screen">
|
|---|
| 582 | <code class="prompt">root# </code> chmod ug+rwx,o-rwx /usr/data/finance
|
|---|
| 583 | </pre><p>
|
|---|
| 584 | </p></li><li><p><a class="indexterm" name="id2614574"></a>
|
|---|
| 585 | Set the SGID (supergroup) bit on all directories from the top down. This means all files
|
|---|
| 586 | can be created with the permissions of the group set on the directory. It means all users
|
|---|
| 587 | who are members of the group <code class="constant">finance</code> can read and write all files in
|
|---|
| 588 | the directory. The directory is not readable or writable by anyone who is not in the
|
|---|
| 589 | <code class="constant">finance</code> group. Simply follow this example:
|
|---|
| 590 | </p><pre class="screen">
|
|---|
| 591 | <code class="prompt">root# </code> find /usr/data/finance -type d -exec chmod ug+s {}\;
|
|---|
| 592 | </pre><p>
|
|---|
| 593 |
|
|---|
| 594 | </p></li><li><p><a class="indexterm" name="id2614614"></a><a class="indexterm" name="id2614622"></a><a class="indexterm" name="id2614630"></a>
|
|---|
| 595 | Make sure all users that must have read/write access to the directory have
|
|---|
| 596 | <code class="constant">finance</code> group membership as their primary group,
|
|---|
| 597 | for example, the group they belong to in <code class="filename">/etc/passwd</code>.
|
|---|
| 598 | </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2614655"></a>Managing Windows 200x ACLs</h3></div></div></div><p><a class="indexterm" name="id2614662"></a><a class="indexterm" name="id2614670"></a><a class="indexterm" name="id2614678"></a><a class="indexterm" name="id2614686"></a>
|
|---|
| 599 | Samba must translate Windows 2000 ACLs to UNIX POSIX ACLs. This has some interesting side effects because
|
|---|
| 600 | there is not a one-to-one equivalence between them. The as-close-as-possible ACLs match means
|
|---|
| 601 | that some transactions are not possible from MS Windows clients. One of these is to reset the ownership
|
|---|
| 602 | of directories and files. If you want to reset ownership, this must be done from a UNIX/Linux login.
|
|---|
| 603 | </p><p>
|
|---|
| 604 | There are two possible ways to set ACLs on UNIX/Linux file systems from a Windows network workstation,
|
|---|
| 605 | either via File Manager or via the Microsoft Management Console (MMC) Computer Management interface.
|
|---|
| 606 | </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2614709"></a>Using the MMC Computer Management Interface</h4></div></div></div><div class="procedure"><ol type="1"><li><p>
|
|---|
| 607 | From a Windows 200x/XP Professional workstation, log on to the domain using the Domain Administrator
|
|---|
| 608 | account (on Samba domains, this is usually the account called <code class="constant">root</code>).
|
|---|
| 609 | </p></li><li><p>
|
|---|
| 610 | Click
|
|---|
| 611 | <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Control Panel</span> → <span class="guimenuitem">Administrative Tools</span> → <span class="guimenuitem">Computer Management</span>.
|
|---|
| 612 | </p></li><li><p>
|
|---|
| 613 | In the left panel,
|
|---|
| 614 | <span class="guimenu">[Right mouse menu item] Computer Management (Local)</span> → <span class="guimenuitem">Connect to another computer ...</span> → <span class="guimenuitem">Browse...</span> → <span class="guimenuitem">Advanced</span> → <span class="guimenuitem">Find Now</span>. In the lower panel, click on the name of the server you wish to
|
|---|
| 615 | administer. Click <span class="guimenu">OK</span> → <span class="guimenuitem">OK</span> → <span class="guimenuitem">OK</span>.
|
|---|
| 616 | In the left panel, the entry <span class="guimenu">Computer Management (Local)</span> should now reflect
|
|---|
| 617 | the change made. For example, if the server you are administering is called <code class="constant">FRODO</code>,
|
|---|
| 618 | the Computer Management entry should now say: <span class="guimenu">Computer Management (FRODO)</span>.
|
|---|
| 619 | </p></li><li><p>
|
|---|
| 620 | In the left panel, click <span class="guimenu">Computer Management (FRODO)</span> → <span class="guimenuitem">[+] Shared Folders</span> → <span class="guimenuitem">Shares</span>.
|
|---|
| 621 | </p></li><li><p><a class="indexterm" name="id2614892"></a><a class="indexterm" name="id2614900"></a><a class="indexterm" name="id2614908"></a><a class="indexterm" name="id2614916"></a>
|
|---|
| 622 | In the right panel, double-click on the share on which you wish to set/edit ACLs. This
|
|---|
| 623 | brings up the Properties panel. Click the <span class="guimenu">Security</span> tab. It is best
|
|---|
| 624 | to edit ACLs using the <code class="constant">Advanced</code> editing features. Click the
|
|---|
| 625 | <span class="guimenu">Advanced</span> button. This opens a panel that has four tabs. Only the
|
|---|
| 626 | functionality under the <code class="constant">Permissions</code> tab can be utilized with respect
|
|---|
| 627 | to a Samba domain server.
|
|---|
| 628 | </p></li><li><p><a class="indexterm" name="id2614956"></a><a class="indexterm" name="id2614964"></a>
|
|---|
| 629 | You may now edit/add/remove access control settings. Be very careful. Many problems have been
|
|---|
| 630 | created by people who decided that everyone should be rejected but one particular group should
|
|---|
| 631 | have full control. This is a catch-22 situation because members of that particular group also
|
|---|
| 632 | belong to the group <code class="constant">Everyone</code>, which therefore overrules any permissions
|
|---|
| 633 | set for the permitted group.
|
|---|
| 634 | </p></li><li><p>
|
|---|
| 635 | When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span>
|
|---|
| 636 | buttons until the last panel closes.
|
|---|
| 637 | </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2615000"></a>Using MS Windows Explorer (File Manager)</h4></div></div></div><p>
|
|---|
| 638 | The following alternative method may be used from a Windows workstation. In this example we work
|
|---|
| 639 | with a domain called <code class="constant">MEGANET</code>, a server called <code class="constant">MASSIVE</code>, and a
|
|---|
| 640 | share called <code class="constant">Apps</code>. The underlying UNIX/Linux share point for this share is
|
|---|
| 641 | <code class="filename">/data/apps</code>.
|
|---|
| 642 | </p><div class="procedure"><ol type="1"><li><p>
|
|---|
| 643 | Click <span class="guimenu">Start</span> → <span class="guimenuitem">[right-click] My Computer</span> → <span class="guimenuitem">Explore</span> → <span class="guimenuitem">[left panel] [+] My Network Places</span> → <span class="guimenuitem">[+] Entire Network</span> → <span class="guimenuitem">[+] Microsoft Windows Network</span> → <span class="guimenuitem">[+] Meganet</span> → <span class="guimenuitem">[+] Massive</span> → <span class="guimenuitem">[right-click] Apps</span> → <span class="guimenuitem">Properties</span> → <span class="guimenuitem">Security</span> → <span class="guimenuitem">Advanced</span>. This opens a panel that has four tabs. Only the functionality under the
|
|---|
| 644 | <code class="constant">Permissions</code> tab can be utilized for a Samba domain server.
|
|---|
| 645 | </p></li><li><p><a class="indexterm" name="id2615125"></a><a class="indexterm" name="id2615133"></a>
|
|---|
| 646 | You may now edit/add/remove access control settings. Be very careful. Many problems have been
|
|---|
| 647 | created by people who decided that everyone should be rejected but one particular group should
|
|---|
| 648 | have full control. This is a catch-22 situation because members of that particular group also
|
|---|
| 649 | belong to the group <code class="constant">Everyone</code>, which therefore overrules any permissions
|
|---|
| 650 | set for the permitted group.
|
|---|
| 651 | </p></li><li><p>
|
|---|
| 652 | When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span>
|
|---|
| 653 | buttons until the last panel closes.
|
|---|
| 654 | </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2615172"></a>Setting Posix ACLs in UNIX/Linux</h4></div></div></div><p><a class="indexterm" name="id2615179"></a><a class="indexterm" name="id2615187"></a>
|
|---|
| 655 | Yet another alternative method for setting desired security settings on the shared resource files and
|
|---|
| 656 | directories can be achieved by logging into UNIX/Linux and setting POSIX ACLs directly using command-line
|
|---|
| 657 | tools. Here is an example session on the same resource as in the immediately preceding example on a SUSE 9
|
|---|
| 658 | Linux system:
|
|---|
| 659 | </p><div class="procedure"><ol type="1"><li><p>
|
|---|
| 660 | Log into the Linux system as the user <code class="constant">root</code>.
|
|---|
| 661 | </p></li><li><p>
|
|---|
| 662 | Change directory to the location of the exported (shared) Windows file share (Apps), which is in
|
|---|
| 663 | the directory <code class="filename">/data</code>. Execute the following:
|
|---|
| 664 | </p><pre class="screen">
|
|---|
| 665 | <code class="prompt">root# </code> cd /data
|
|---|
| 666 | </pre><p>
|
|---|
| 667 | Retrieve the existing POSIX ACLs entry by executing:
|
|---|
| 668 | </p><pre class="screen">
|
|---|
| 669 | <code class="prompt">root# </code> getfacl apps
|
|---|
| 670 | # file: apps
|
|---|
| 671 | # owner: root
|
|---|
| 672 | # group: root
|
|---|
| 673 | user::rwx
|
|---|
| 674 | group::rwx
|
|---|
| 675 | other::r-x
|
|---|
| 676 | </pre><p>
|
|---|
| 677 | </p></li><li><p><a class="indexterm" name="id2615261"></a>
|
|---|
| 678 | You want to add permission for <code class="constant">AppsMgrs</code> to enable them to
|
|---|
| 679 | manage the applications (apps) share. It is important to set the ACL recursively
|
|---|
| 680 | so that the AppsMgrs have this capability throughout the directory tree that is
|
|---|
| 681 | being shared. This is done using the <code class="constant">-R</code> option as shown.
|
|---|
| 682 | Execute the following:
|
|---|
| 683 | </p><pre class="screen">
|
|---|
| 684 | <code class="prompt">root# </code> setfacl -m -R group:AppsMgrs:rwx /data/apps
|
|---|
| 685 | </pre><p>
|
|---|
| 686 | Because setting an ACL does not provide a response, you immediately validate the command executed
|
|---|
| 687 | as follows:
|
|---|
| 688 | </p><pre class="screen">
|
|---|
| 689 | <code class="prompt">root# </code> getfacl /data/apps
|
|---|
| 690 | # file: apps
|
|---|
| 691 | # owner: root
|
|---|
| 692 | # group: root
|
|---|
| 693 | user::rwx
|
|---|
| 694 | group::rwx
|
|---|
| 695 | group:AppsMgrs:rwx
|
|---|
| 696 | mask::rwx
|
|---|
| 697 | other::r-x
|
|---|
| 698 | </pre><p>
|
|---|
| 699 | This confirms that the change of POSIX ACL permissions has been effective.
|
|---|
| 700 | </p></li><li><p><a class="indexterm" name="id2615316"></a><a class="indexterm" name="id2615324"></a><a class="indexterm" name="id2615332"></a><a class="indexterm" name="id2615340"></a><a class="indexterm" name="id2615348"></a>
|
|---|
| 701 | It is highly recommended that you read the online manual page for the <code class="literal">setfacl</code>
|
|---|
| 702 | and <code class="literal">getfacl</code> commands. This provides information regarding how to set/read the default
|
|---|
| 703 | ACLs and how that may be propagated through the directory tree. In Windows ACLs terms, this is the equivalent
|
|---|
| 704 | of setting <code class="constant">inheritance</code> properties.
|
|---|
| 705 | </p></li></ol></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2615382"></a>Key Points Learned</h3></div></div></div><p>
|
|---|
| 706 | The mish-mash of issues were thrown together into one chapter because it seemed like a good idea.
|
|---|
| 707 | Looking back, this chapter could be broken into two, but it's too late now. It has been done.
|
|---|
| 708 | The highlights covered are as follows:
|
|---|
| 709 | </p><div class="itemizedlist"><ul type="disc"><li><p><a class="indexterm" name="id2615399"></a><a class="indexterm" name="id2615407"></a><a class="indexterm" name="id2615415"></a><a class="indexterm" name="id2615423"></a>
|
|---|
| 710 | Winbind honors and does not override account controls set in Active Directory.
|
|---|
| 711 | This means that password change, logon hours, and so on, are (or soon will be) enforced
|
|---|
| 712 | by Samba winbind. At this time, an out-of-hours login is denied and password
|
|---|
| 713 | change is enforced. At this time, if logon hours expire, the user is not forcibly
|
|---|
| 714 | logged off. That may be implemented at some later date.
|
|---|
| 715 | </p></li><li><p><a class="indexterm" name="id2615442"></a><a class="indexterm" name="id2615450"></a>
|
|---|
| 716 | Sign'n'seal (plus schannel support) has been implemented in Samba-3. Beware of potential
|
|---|
| 717 | problems acknowledged by Microsoft as having been fixed but reported by some as still
|
|---|
| 718 | possibly an open issue.
|
|---|
| 719 | </p></li><li><p><a class="indexterm" name="id2615466"></a><a class="indexterm" name="id2615473"></a><a class="indexterm" name="id2615481"></a><a class="indexterm" name="id2615489"></a>
|
|---|
| 720 | The combination of Kerberos 5, plus OpenLDAP, plus Samba, cannot replace Microsoft
|
|---|
| 721 | Active Directory. The possibility to do this is not planned in the current Samba-3
|
|---|
| 722 | roadmap. Samba-3 does aim to provide further improvements in interoperability so that
|
|---|
| 723 | UNIX/Linux systems may be fully integrated into Active Directory domains.
|
|---|
| 724 | </p></li><li><p>
|
|---|
| 725 | This chapter reviewed mechanisms by which Samba servers may be kept secure. Each of
|
|---|
| 726 | the four key methodologies was reviewed with specific reference to example deployment
|
|---|
| 727 | techniques.
|
|---|
| 728 | </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2615516"></a>Questions and Answers</h2></div></div></div><p>
|
|---|
| 729 | </p><div class="qandaset"><dl><dt> <a href="kerberos.html#id2615532">
|
|---|
| 730 | Does Samba-3 require the Sign'n'seal registry hacks needed by Samba-2?
|
|---|
| 731 | </a></dt><dt> <a href="kerberos.html#id2615602">
|
|---|
| 732 | Does Samba-3 support Active Directory?
|
|---|
| 733 | </a></dt><dt> <a href="kerberos.html#id2615633">
|
|---|
| 734 | When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was
|
|---|
| 735 | necessary with Samba-2?
|
|---|
| 736 | </a></dt><dt> <a href="kerberos.html#id2615672">
|
|---|
| 737 | Is it safe to set share-level access controls in Samba?
|
|---|
| 738 | </a></dt><dt> <a href="kerberos.html#id2615701">
|
|---|
| 739 | Is it mandatory to set share ACLs to get a secure Samba-3 server?
|
|---|
| 740 | </a></dt><dt> <a href="kerberos.html#id2615778">
|
|---|
| 741 | The valid users did not work on the [homes].
|
|---|
| 742 | Has this functionality been restored yet?
|
|---|
| 743 | </a></dt><dt> <a href="kerberos.html#id2615844">
|
|---|
| 744 | Is the bias against use of the force user and force group
|
|---|
| 745 | really warranted?
|
|---|
| 746 | </a></dt><dt> <a href="kerberos.html#id2615907">
|
|---|
| 747 | The example given for file and directory access control forces all files to be owned by one
|
|---|
| 748 | particular user. I do not like that. Is there any way I can see who created the file?
|
|---|
| 749 | </a></dt><dt> <a href="kerberos.html#id2615955">
|
|---|
| 750 | In the book, “The Official Samba-3 HOWTO and Reference Guide”, you recommended use
|
|---|
| 751 | of the Windows NT4 Server Manager (part of the SRVTOOLS.EXE) utility. Why
|
|---|
| 752 | have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility?
|
|---|
| 753 | </a></dt><dt> <a href="kerberos.html#id2616022">
|
|---|
| 754 | I tried to set valid users = @Engineers, but it does not work. My Samba
|
|---|
| 755 | server is an Active Directory domain member server. Has this been fixed now?
|
|---|
| 756 | </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2615532"></a><a name="id2615534"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615537"></a><a class="indexterm" name="id2615545"></a>
|
|---|
| 757 | Does Samba-3 require the <code class="constant">Sign'n'seal</code> registry hacks needed by Samba-2?
|
|---|
| 758 | </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2615564"></a><a class="indexterm" name="id2615572"></a><a class="indexterm" name="id2615580"></a>
|
|---|
| 759 | No. Samba-3 fully supports <code class="constant">Sign'n'seal</code> as well as <code class="constant">schannel</code>
|
|---|
| 760 | operation. The registry change should not be applied when Samba-3 is used as a domain controller.
|
|---|
| 761 | </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2615602"></a><a name="id2615604"></a></td><td align="left" valign="top"><p>
|
|---|
| 762 | Does Samba-3 support Active Directory?
|
|---|
| 763 | </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2615615"></a>
|
|---|
| 764 | Yes. Samba-3 can be a fully participating native mode Active Directory client. Samba-3 does not
|
|---|
| 765 | provide Active Directory services. It cannot be used to replace a Microsoft Active Directory
|
|---|
| 766 | server implementation. Samba-3 can function as an Active Directory client (workstation) toolkit,
|
|---|
| 767 | and it can function as an Active Directory domain member server.
|
|---|
| 768 | </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2615633"></a><a name="id2615635"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615639"></a>
|
|---|
| 769 | When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was
|
|---|
| 770 | necessary with Samba-2?
|
|---|
| 771 | </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2615655"></a>
|
|---|
| 772 | No. Samba-3 can be used with NetBIOS over TCP/IP disabled, just as can be done with Windows 200x
|
|---|
| 773 | Server and 200x/XPPro client products. It is no longer necessary to run mixed-mode operation,
|
|---|
| 774 | because Samba-3 can join a native Windows 2003 Server ADS domain.
|
|---|
| 775 | </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2615672"></a><a name="id2615674"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615677"></a>
|
|---|
| 776 | Is it safe to set share-level access controls in Samba?
|
|---|
| 777 | </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
|
|---|
| 778 | Yes. Share-level access controls have been supported since early versions of Samba-2. This is
|
|---|
| 779 | very mature technology. Not enough sites make use of this powerful capability, neither on
|
|---|
| 780 | Windows server or with Samba servers.
|
|---|
| 781 | </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2615701"></a><a name="id2615703"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615706"></a>
|
|---|
| 782 | Is it mandatory to set share ACLs to get a secure Samba-3 server?
|
|---|
| 783 | </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2615722"></a><a class="indexterm" name="id2615730"></a><a class="indexterm" name="id2615738"></a><a class="indexterm" name="id2615746"></a><a class="indexterm" name="id2615754"></a>
|
|---|
| 784 | No. Samba-3 honors UNIX/Linux file system security, supports Windows 200x ACLs, and provides
|
|---|
| 785 | means of securing shares through share definition controls in the <code class="filename">smb.conf</code> file. The additional
|
|---|
| 786 | support for share-level ACLs is like frosting on the cake. It adds to security but is not essential
|
|---|
| 787 | to it.
|
|---|
| 788 | </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2615778"></a><a name="id2615780"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615783"></a>
|
|---|
| 789 | The <em class="parameter"><code>valid users</code></em> did not work on the <em class="parameter"><code>[homes]</code></em>.
|
|---|
| 790 | Has this functionality been restored yet?
|
|---|
| 791 | </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2615810"></a>
|
|---|
| 792 | Yes. This was fixed in Samba-3.0.2. The use of this parameter is strongly recommended as a safeguard
|
|---|
| 793 | on the <em class="parameter"><code>[homes]</code></em> meta-service. The correct way to specify this is:
|
|---|
| 794 | <a class="link" href="smb.conf.5.html#VALIDUSERS" target="_top">valid users = %S</a>.
|
|---|
| 795 | </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2615844"></a><a name="id2615846"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615849"></a><a class="indexterm" name="id2615856"></a><a class="indexterm" name="id2615864"></a>
|
|---|
| 796 | Is the bias against use of the <em class="parameter"><code>force user</code></em> and <em class="parameter"><code>force group</code></em>
|
|---|
| 797 | really warranted?
|
|---|
| 798 | </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2615892"></a>
|
|---|
| 799 | There is no bias. There is a determination to recommend the right tool for the task at hand.
|
|---|
| 800 | After all, it is better than putting users through performance problems, isn't it?
|
|---|
| 801 | </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2615907"></a><a name="id2615909"></a></td><td align="left" valign="top"><p>
|
|---|
| 802 | The example given for file and directory access control forces all files to be owned by one
|
|---|
| 803 | particular user. I do not like that. Is there any way I can see who created the file?
|
|---|
| 804 | </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2615922"></a>
|
|---|
| 805 | Sure. You do not have to set the SUID bit on the directory. Simply execute the following command
|
|---|
| 806 | to permit file ownership to be retained by the user who created it:
|
|---|
| 807 | </p><pre class="screen">
|
|---|
| 808 | <code class="prompt">root# </code> find /usr/data/finance -type d -exec chmod g+s {}\;
|
|---|
| 809 | </pre><p>
|
|---|
| 810 | Note that this required no more than removing the <code class="constant">u</code> argument so that the
|
|---|
| 811 | SUID bit is not set for the owner.
|
|---|
| 812 | </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2615955"></a><a name="id2615957"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615960"></a>
|
|---|
| 813 | In the book, “<span class="quote">The Official Samba-3 HOWTO and Reference Guide</span>”, you recommended use
|
|---|
| 814 | of the Windows NT4 Server Manager (part of the <code class="filename">SRVTOOLS.EXE</code>) utility. Why
|
|---|
| 815 | have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility?
|
|---|
| 816 | </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2615988"></a><a class="indexterm" name="id2615996"></a>
|
|---|
| 817 | Either tool can be used with equal effect. There is no benefit of one over the other, except that
|
|---|
| 818 | the MMC utility is present on all Windows 200x/XP systems and does not require additional software
|
|---|
| 819 | to be downloaded and installed. Note that if you want to manage user and group accounts in your
|
|---|
| 820 | Samba-controlled domain, the only tool that permits that is the NT4 Domain User Manager, which
|
|---|
| 821 | is provided as part of the <code class="filename">SRVTOOLS.EXE</code> utility.
|
|---|
| 822 | </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2616022"></a><a name="id2616024"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2616027"></a><a class="indexterm" name="id2616035"></a><a class="indexterm" name="id2616043"></a>
|
|---|
| 823 | I tried to set <em class="parameter"><code>valid users = @Engineers</code></em>, but it does not work. My Samba
|
|---|
| 824 | server is an Active Directory domain member server. Has this been fixed now?
|
|---|
| 825 | </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
|
|---|
| 826 | The use of this parameter has always required the full specification of the domain account, for
|
|---|
| 827 | example, <em class="parameter"><code>valid users = @"MEGANET2\Domain Admins"</code></em>.
|
|---|
| 828 | </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"></div><div class="footnote"><a class="ulink" href="http://199.105.191.226/Man/2699/020430msdoj/" target="_top"><sup>[<a name="ftn.id2613126" href="#id2613126" class="ulink">13</a>] </sup>ITWorld.com</a></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="RefSection.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="RefSection.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="DomApps.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Part III. Reference Section </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 12. Integrating Additional Services</td></tr></table></div></body></html>
|
|---|
