| 1 | <?xml version="1.0" encoding="iso-8859-1"?>
|
|---|
| 2 | <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
|
|---|
| 3 | <chapter id="pam">
|
|---|
| 4 | <chapterinfo>
|
|---|
| 5 | &author.jht;
|
|---|
| 6 | <author>
|
|---|
| 7 | <firstname>Stephen</firstname><surname>Langasek</surname>
|
|---|
| 8 | <affiliation>
|
|---|
| 9 | <address><email>vorlon@netexpress.net</email></address>
|
|---|
| 10 | </affiliation>
|
|---|
| 11 | </author>
|
|---|
| 12 | <pubdate>May 31, 2003</pubdate>
|
|---|
| 13 | </chapterinfo>
|
|---|
| 14 |
|
|---|
| 15 | <title>PAM-Based Distributed Authentication</title>
|
|---|
| 16 |
|
|---|
| 17 | <para>
|
|---|
| 18 | <indexterm><primary>PAM-enabled</primary></indexterm>
|
|---|
| 19 | <indexterm><primary>Winbind</primary></indexterm>
|
|---|
| 20 | <indexterm><primary>ADS</primary></indexterm>
|
|---|
| 21 | <indexterm><primary>Winbind-based authentication</primary></indexterm>
|
|---|
| 22 | This chapter should help you to deploy Winbind-based authentication on any PAM-enabled
|
|---|
| 23 | UNIX/Linux system. Winbind can be used to enable user-level application access authentication
|
|---|
| 24 | from any MS Windows NT domain, MS Windows 200x Active Directory-based
|
|---|
| 25 | domain, or any Samba-based domain environment. It will also help you to configure PAM-based local host access
|
|---|
| 26 | controls that are appropriate to your Samba configuration.
|
|---|
| 27 | </para>
|
|---|
| 28 |
|
|---|
| 29 | <para>
|
|---|
| 30 | <indexterm><primary>PAM management</primary></indexterm>
|
|---|
| 31 | <indexterm><primary>pam_smbpass.so</primary></indexterm>
|
|---|
| 32 | In addition to knowing how to configure Winbind into PAM, you will learn generic PAM management
|
|---|
| 33 | possibilities and in particular how to deploy tools like <filename>pam_smbpass.so</filename> to your advantage.
|
|---|
| 34 | </para>
|
|---|
| 35 |
|
|---|
| 36 | <note><para>
|
|---|
| 37 | The use of Winbind requires more than PAM configuration alone.
|
|---|
| 38 | Please refer to <link linkend="winbind">Winbind: Use of Domain Accounts</link>, for further information regarding Winbind.
|
|---|
| 39 | </para></note>
|
|---|
| 40 |
|
|---|
| 41 | <sect1>
|
|---|
| 42 | <title>Features and Benefits</title>
|
|---|
| 43 |
|
|---|
| 44 | <para>
|
|---|
| 45 | <indexterm><primary>Sun Solaris</primary></indexterm>
|
|---|
| 46 | <indexterm><primary>xxxxBSD</primary></indexterm>
|
|---|
| 47 | <indexterm><primary>Linux</primary></indexterm>
|
|---|
| 48 | <indexterm><primary>Pluggable Authentication Modules</primary><see>PAM</see></indexterm>
|
|---|
| 49 | <indexterm><primary>/etc/passwd</primary></indexterm>
|
|---|
| 50 | <indexterm><primary>login</primary></indexterm>
|
|---|
| 51 | <indexterm><primary>passwd</primary></indexterm>
|
|---|
| 52 | <indexterm><primary>chown</primary></indexterm>
|
|---|
| 53 | A number of UNIX systems (e.g., Sun Solaris), as well as the xxxxBSD family and Linux,
|
|---|
| 54 | now utilize the Pluggable Authentication Modules (PAM) facility to provide all authentication,
|
|---|
| 55 | authorization, and resource control services. Prior to the introduction of PAM, a decision
|
|---|
| 56 | to use an alternative to the system password database (<filename>/etc/passwd</filename>)
|
|---|
| 57 | would require the provision of alternatives for all programs that provide security services.
|
|---|
| 58 | Such a choice would involve provision of alternatives to programs such as <command>login</command>,
|
|---|
| 59 | <command>passwd</command>, <command>chown</command>, and so on.
|
|---|
| 60 | </para>
|
|---|
| 61 |
|
|---|
| 62 | <para>
|
|---|
| 63 | <indexterm><primary>PAM</primary></indexterm>
|
|---|
| 64 | <indexterm><primary>/etc/pam.conf</primary></indexterm>
|
|---|
| 65 | <indexterm><primary>Solaris</primary></indexterm>
|
|---|
| 66 | <indexterm><primary>/etc/pam.d</primary></indexterm>
|
|---|
| 67 | PAM provides a mechanism that disconnects these security programs from the underlying
|
|---|
| 68 | authentication/authorization infrastructure. PAM is configured by making appropriate modifications to one file,
|
|---|
| 69 | <filename>/etc/pam.conf</filename> (Solaris), or by editing individual control files that are
|
|---|
| 70 | located in <filename>/etc/pam.d</filename>.
|
|---|
| 71 | </para>
|
|---|
| 72 |
|
|---|
| 73 | <para>
|
|---|
| 74 | <indexterm><primary>PAM-enabled</primary></indexterm>
|
|---|
| 75 | <indexterm><primary>dynamically loadable library modules</primary></indexterm>
|
|---|
| 76 | On PAM-enabled UNIX/Linux systems, it is an easy matter to configure the system to use any
|
|---|
| 77 | authentication backend so long as the appropriate dynamically loadable library modules
|
|---|
| 78 | are available for it. The backend may be local to the system or may be centralized on a
|
|---|
| 79 | remote server.
|
|---|
| 80 | </para>
|
|---|
| 81 |
|
|---|
| 82 | <para>
|
|---|
| 83 | PAM support modules are available for:
|
|---|
| 84 | </para>
|
|---|
| 85 |
|
|---|
| 86 | <variablelist>
|
|---|
| 87 | <varlistentry><term><filename>/etc/passwd</filename></term><listitem>
|
|---|
| 88 | <para>
|
|---|
| 89 | <indexterm><primary>/etc/passwd</primary></indexterm>
|
|---|
| 90 | <indexterm><primary>PAM modules</primary></indexterm>
|
|---|
| 91 | <indexterm><primary>pam_unix.so</primary></indexterm>
|
|---|
| 92 | <indexterm><primary>pam_unix2.so</primary></indexterm>
|
|---|
| 93 | <indexterm><primary>pam_pwdb.so</primary></indexterm>
|
|---|
| 94 | <indexterm><primary>pam_userdb.so</primary></indexterm>
|
|---|
| 95 | There are several PAM modules that interact with this standard UNIX user database. The most common are called
|
|---|
| 96 | <filename>pam_unix.so</filename>, <filename>pam_unix2.so</filename>, <filename>pam_pwdb.so</filename> and
|
|---|
| 97 | <filename>pam_userdb.so</filename>.
|
|---|
| 98 | </para>
|
|---|
| 99 | </listitem></varlistentry>
|
|---|
| 100 |
|
|---|
| 101 | <varlistentry><term>Kerberos</term><listitem>
|
|---|
| 102 | <para>
|
|---|
| 103 | <indexterm><primary>pam_krb5.so</primary></indexterm>
|
|---|
| 104 | <indexterm><primary>Kerberos</primary></indexterm>
|
|---|
| 105 | <indexterm><primary>Heimdal</primary></indexterm>
|
|---|
| 106 | <indexterm><primary>MIT Kerberos</primary></indexterm>
|
|---|
| 107 | <indexterm><primary>ADS</primary></indexterm>
|
|---|
| 108 | The <filename>pam_krb5.so</filename> module allows the use of any Kerberos-compliant server.
|
|---|
| 109 | This tool is used to access MIT Kerberos, Heimdal Kerberos, and potentially
|
|---|
| 110 | Microsoft Active Directory (if enabled).
|
|---|
| 111 | </para>
|
|---|
| 112 | </listitem></varlistentry>
|
|---|
| 113 |
|
|---|
| 114 | <varlistentry><term>LDAP</term><listitem>
|
|---|
| 115 | <para>
|
|---|
| 116 | <indexterm><primary>LDAP</primary></indexterm>
|
|---|
| 117 | <indexterm><primary>pam_ldap.so</primary></indexterm>
|
|---|
| 118 | <indexterm><primary>OpenLDAP</primary></indexterm>
|
|---|
| 119 | <indexterm><primary>Sun ONE iDentity server</primary></indexterm>
|
|---|
| 120 | <indexterm><primary>Novell eDirectory server</primary></indexterm>
|
|---|
| 121 | <indexterm><primary>Microsoft Active Directory</primary></indexterm>
|
|---|
| 122 | The <filename>pam_ldap.so</filename> module allows the use of any LDAP v2- or v3-compatible backend
|
|---|
| 123 | server. Commonly used LDAP backend servers include OpenLDAP v2.0 and v2.1,
|
|---|
| 124 | Sun ONE iDentity server, Novell eDirectory server, and Microsoft Active Directory.
|
|---|
| 125 | </para>
|
|---|
| 126 | </listitem></varlistentry>
|
|---|
| 127 |
|
|---|
| 128 | <varlistentry><term>NetWare Bindery</term><listitem>
|
|---|
| 129 | <para>
|
|---|
| 130 | <indexterm><primary>NetWare Bindery</primary></indexterm>
|
|---|
| 131 | <indexterm><primary>pam_ncp_auth.so</primary></indexterm>
|
|---|
| 132 | <indexterm><primary>bindery-enabled</primary></indexterm>
|
|---|
| 133 | <indexterm><primary>NetWare Core Protocol-based server</primary></indexterm>
|
|---|
| 134 | The <filename>pam_ncp_auth.so</filename> module allows authentication off any bindery-enabled
|
|---|
| 135 | NetWare Core Protocol-based server.
|
|---|
| 136 | </para>
|
|---|
| 137 | </listitem></varlistentry>
|
|---|
| 138 |
|
|---|
| 139 | <varlistentry><term>SMB Password</term><listitem>
|
|---|
| 140 | <para>
|
|---|
| 141 | <indexterm><primary>SMB Password</primary></indexterm>
|
|---|
| 142 | <indexterm><primary>pam_smbpass.so</primary></indexterm>
|
|---|
| 143 | <indexterm><primary>passdb backend</primary></indexterm>
|
|---|
| 144 | This module, called <filename>pam_smbpass.so</filename>, allows user authentication of
|
|---|
| 145 | the passdb backend that is configured in the Samba &smb.conf; file.
|
|---|
| 146 | </para>
|
|---|
| 147 | </listitem></varlistentry>
|
|---|
| 148 |
|
|---|
| 149 | <varlistentry><term>SMB Server</term><listitem>
|
|---|
| 150 | <para>
|
|---|
| 151 | <indexterm><primary>SMB Server</primary></indexterm>
|
|---|
| 152 | <indexterm><primary>pam_smb_auth.so</primary></indexterm>
|
|---|
| 153 | The <filename>pam_smb_auth.so</filename> module is the original MS Windows networking authentication
|
|---|
| 154 | tool. This module has been somewhat outdated by the Winbind module.
|
|---|
| 155 | </para>
|
|---|
| 156 | </listitem></varlistentry>
|
|---|
| 157 |
|
|---|
| 158 | <varlistentry><term>Winbind</term><listitem>
|
|---|
| 159 | <para>
|
|---|
| 160 | <indexterm><primary>Winbind</primary></indexterm>
|
|---|
| 161 | <indexterm><primary>pam_winbind.so</primary></indexterm>
|
|---|
| 162 | <indexterm><primary>domain controller</primary></indexterm>
|
|---|
| 163 | <indexterm><primary>authentication</primary></indexterm>
|
|---|
| 164 | The <filename>pam_winbind.so</filename> module allows Samba to obtain authentication from any
|
|---|
| 165 | MS Windows domain controller. It can just as easily be used to authenticate
|
|---|
| 166 | users for access to any PAM-enabled application.
|
|---|
| 167 | </para>
|
|---|
| 168 | </listitem></varlistentry>
|
|---|
| 169 |
|
|---|
| 170 | <varlistentry><term>RADIUS</term><listitem>
|
|---|
| 171 | <para>
|
|---|
| 172 | <indexterm><primary>Remote Access Dial-In User Service</primary><see>RADIUS</see></indexterm>
|
|---|
| 173 | There is a PAM RADIUS (Remote Access Dial-In User Service) authentication
|
|---|
| 174 | module. In most cases, administrators need to locate the source code
|
|---|
| 175 | for this tool and compile and install it themselves. RADIUS protocols are
|
|---|
| 176 | used by many routers and terminal servers.
|
|---|
| 177 | </para>
|
|---|
| 178 | </listitem></varlistentry>
|
|---|
| 179 | </variablelist>
|
|---|
| 180 |
|
|---|
| 181 | <para>
|
|---|
| 182 | <indexterm><primary>pam_smbpasswd.so</primary></indexterm>
|
|---|
| 183 | <indexterm><primary>pam_winbind.so</primary></indexterm>
|
|---|
| 184 | Of the modules listed, Samba provides the <filename>pam_smbpasswd.so</filename> and the
|
|---|
| 185 | <filename>pam_winbind.so</filename> modules alone.
|
|---|
| 186 | </para>
|
|---|
| 187 |
|
|---|
| 188 | <para>
|
|---|
| 189 | <indexterm><primary>wide-area network bandwidth</primary></indexterm>
|
|---|
| 190 | <indexterm><primary>efficient authentication</primary></indexterm>
|
|---|
| 191 | <indexterm><primary>PAM-capable</primary></indexterm>
|
|---|
| 192 | <indexterm><primary>centrally managed</primary></indexterm>
|
|---|
| 193 | Once configured, these permit a remarkable level of flexibility in the location and use
|
|---|
| 194 | of distributed Samba domain controllers that can provide wide-area network bandwidth,
|
|---|
| 195 | efficient authentication services for PAM-capable systems. In effect, this allows the
|
|---|
| 196 | deployment of centrally managed and maintained distributed authentication from a
|
|---|
| 197 | single-user account database.
|
|---|
| 198 | </para>
|
|---|
| 199 |
|
|---|
| 200 | </sect1>
|
|---|
| 201 |
|
|---|
| 202 | <sect1>
|
|---|
| 203 | <title>Technical Discussion</title>
|
|---|
| 204 |
|
|---|
| 205 | <para>
|
|---|
| 206 | <indexterm><primary>PAM</primary></indexterm>
|
|---|
| 207 | <indexterm><primary>privilege-granting applications</primary></indexterm>
|
|---|
| 208 | <indexterm><primary>/etc/pam.conf</primary></indexterm>
|
|---|
| 209 | <indexterm><primary>/etc/pam.d/</primary></indexterm>
|
|---|
| 210 | PAM is designed to provide system administrators with a great deal of flexibility in
|
|---|
| 211 | configuration of the privilege-granting applications of their system. The local
|
|---|
| 212 | configuration of system security controlled by PAM is contained in one of two places:
|
|---|
| 213 | either the single system file <filename>/etc/pam.conf</filename> or the
|
|---|
| 214 | <filename>/etc/pam.d/</filename> directory.
|
|---|
| 215 | </para>
|
|---|
| 216 |
|
|---|
| 217 | <sect2>
|
|---|
| 218 | <title>PAM Configuration Syntax</title>
|
|---|
| 219 |
|
|---|
| 220 | <para>
|
|---|
| 221 | <indexterm><primary>PAM-specific tokens</primary></indexterm>
|
|---|
| 222 | <indexterm><primary>case sensitivity</primary></indexterm>
|
|---|
| 223 | In this section we discuss the correct syntax of and generic options respected by entries to these files.
|
|---|
| 224 | PAM-specific tokens in the configuration file are case insensitive. The module paths, however, are case
|
|---|
| 225 | sensitive, since they indicate a file's name and reflect the case dependence of typical file systems. The
|
|---|
| 226 | case sensitivity of the arguments to any given module is defined for each module in turn.
|
|---|
| 227 | </para>
|
|---|
| 228 |
|
|---|
| 229 | <para>
|
|---|
| 230 | In addition to the lines described below, there are two special characters provided for the convenience
|
|---|
| 231 | of the system administrator: comments are preceded by a <quote>#</quote> and extend to the next end-of-line; also,
|
|---|
| 232 | module specification lines may be extended with a <quote>\</quote>-escaped newline.
|
|---|
| 233 | </para>
|
|---|
| 234 |
|
|---|
| 235 | <para>
|
|---|
| 236 | <indexterm><primary>PAM authentication module</primary></indexterm>
|
|---|
| 237 | <indexterm><primary>/lib/security</primary></indexterm>
|
|---|
| 238 | If the PAM authentication module (loadable link library file) is located in the
|
|---|
| 239 | default location, then it is not necessary to specify the path. In the case of
|
|---|
| 240 | Linux, the default location is <filename>/lib/security</filename>. If the module
|
|---|
| 241 | is located outside the default, then the path must be specified as:
|
|---|
| 242 | <programlisting>
|
|---|
| 243 | auth required /other_path/pam_strange_module.so
|
|---|
| 244 | </programlisting>
|
|---|
| 245 | </para>
|
|---|
| 246 |
|
|---|
| 247 | <sect3>
|
|---|
| 248 | <title>Anatomy of <filename>/etc/pam.d</filename> Entries</title>
|
|---|
| 249 |
|
|---|
| 250 | <para>
|
|---|
| 251 | The remaining information in this subsection was taken from the documentation of the Linux-PAM
|
|---|
| 252 | project. For more information on PAM, see
|
|---|
| 253 | <ulink url="http://ftp.kernel.org/pub/linux/libs/pam/">the Official Linux-PAM home page</ulink>.
|
|---|
| 254 | </para>
|
|---|
| 255 |
|
|---|
| 256 | <para>
|
|---|
| 257 | <indexterm><primary>/etc/pam.conf</primary></indexterm>
|
|---|
| 258 | A general configuration line of the <filename>/etc/pam.conf</filename> file has the following form:
|
|---|
| 259 | <programlisting>
|
|---|
| 260 | service-name module-type control-flag module-path args
|
|---|
| 261 | </programlisting>
|
|---|
| 262 | </para>
|
|---|
| 263 |
|
|---|
| 264 | <para>
|
|---|
| 265 | We explain the meaning of each of these tokens. The second (and more recently adopted)
|
|---|
| 266 | way of configuring Linux-PAM is via the contents of the <filename>/etc/pam.d/</filename> directory.
|
|---|
| 267 | Once we have explained the meaning of the tokens, we describe this method.
|
|---|
| 268 | </para>
|
|---|
| 269 |
|
|---|
| 270 | <variablelist>
|
|---|
| 271 | <varlistentry><term>service-name</term><listitem>
|
|---|
| 272 | <para>
|
|---|
| 273 | <indexterm><primary>ftpd</primary></indexterm>
|
|---|
| 274 | <indexterm><primary>rlogind</primary></indexterm>
|
|---|
| 275 | <indexterm><primary>su</primary></indexterm>
|
|---|
| 276 | The name of the service associated with this entry. Frequently, the service-name is the conventional
|
|---|
| 277 | name of the given application &smbmdash; for example, <command>ftpd</command>, <command>rlogind</command> and
|
|---|
| 278 | <command>su</command>, and so on.
|
|---|
| 279 | </para>
|
|---|
| 280 |
|
|---|
| 281 | <para>
|
|---|
| 282 | There is a special service-name reserved for defining a default authentication mechanism. It has
|
|---|
| 283 | the name <parameter>OTHER</parameter> and may be specified in either lower- or uppercase characters.
|
|---|
| 284 | Note, when there is a module specified for a named service, the <parameter>OTHER</parameter>
|
|---|
| 285 | entries are ignored.
|
|---|
| 286 | </para>
|
|---|
| 287 | </listitem>
|
|---|
| 288 | </varlistentry>
|
|---|
| 289 |
|
|---|
| 290 | <varlistentry><term>module-type</term><listitem>
|
|---|
| 291 | <para>
|
|---|
| 292 | One of (currently) four types of module. The four types are as follows:
|
|---|
| 293 | </para>
|
|---|
| 294 |
|
|---|
| 295 | <itemizedlist>
|
|---|
| 296 | <listitem><para>
|
|---|
| 297 | <indexterm><primary>auth</primary></indexterm>
|
|---|
| 298 | <indexterm><primary>/etc/groups</primary></indexterm>
|
|---|
| 299 | <parameter>auth:</parameter> This module type provides two aspects of authenticating the user.
|
|---|
| 300 | It establishes that the user is who he or she claims to be by instructing the application
|
|---|
| 301 | to prompt the user for a password or other means of identification. Second, the module can
|
|---|
| 302 | grant group membership (independently of the <filename>/etc/groups</filename> file)
|
|---|
| 303 | or other privileges through its credential-granting properties.
|
|---|
| 304 | </para></listitem>
|
|---|
| 305 |
|
|---|
| 306 | <listitem><para>
|
|---|
| 307 | <indexterm><primary>account</primary></indexterm>
|
|---|
| 308 | <indexterm><primary>non-authentication-based account management</primary></indexterm>
|
|---|
| 309 | <parameter>account:</parameter> This module performs non-authentication-based account management.
|
|---|
| 310 | It is typically used to restrict/permit access to a service based on the time of day, currently
|
|---|
| 311 | available system resources (maximum number of users), or perhaps the location of the user
|
|---|
| 312 | login. For example, the <quote>root</quote> login may be permitted only on the console.
|
|---|
| 313 | </para></listitem>
|
|---|
| 314 |
|
|---|
| 315 | <listitem><para>
|
|---|
| 316 | <indexterm><primary>session</primary></indexterm>
|
|---|
| 317 | <parameter>session:</parameter> Primarily, this module is associated with doing things that need
|
|---|
| 318 | to be done for the user before and after he or she can be given service. Such things include logging
|
|---|
| 319 | information concerning the opening and closing of some data exchange with a user, mounting
|
|---|
| 320 | directories, and so on.
|
|---|
| 321 | </para></listitem>
|
|---|
| 322 |
|
|---|
| 323 | <listitem><para>
|
|---|
| 324 | <indexterm><primary>password</primary></indexterm>
|
|---|
| 325 | <parameter>password:</parameter> This last module type is required for updating the authentication
|
|---|
| 326 | token associated with the user. Typically, there is one module for each
|
|---|
| 327 | <quote>challenge/response</quote> authentication <parameter>(auth)</parameter> module type.
|
|---|
| 328 | </para></listitem>
|
|---|
| 329 | </itemizedlist>
|
|---|
| 330 | </listitem>
|
|---|
| 331 | </varlistentry>
|
|---|
| 332 |
|
|---|
| 333 | <varlistentry><term>control-flag</term><listitem>
|
|---|
| 334 | <para>
|
|---|
| 335 | The control-flag is used to indicate how the PAM library will react to the success or failure of the
|
|---|
| 336 | module it is associated with. Since modules can be stacked (modules of the same type execute in series,
|
|---|
| 337 | one after another), the control-flags determine the relative importance of each module. The application
|
|---|
| 338 | is not made aware of the individual success or failure of modules listed in the
|
|---|
| 339 | <filename>/etc/pam.conf</filename> file. Instead, it receives a summary success or fail response from
|
|---|
| 340 | the Linux-PAM library. The order of execution of these modules is that of the entries in the
|
|---|
| 341 | <filename>/etc/pam.conf</filename> file; earlier entries are executed before later ones.
|
|---|
| 342 | As of Linux-PAM v0.60, this control-flag can be defined with one of two syntaxes.
|
|---|
| 343 | </para>
|
|---|
| 344 |
|
|---|
| 345 | <para>
|
|---|
| 346 | <indexterm><primary>required</primary></indexterm>
|
|---|
| 347 | <indexterm><primary>requisite</primary></indexterm>
|
|---|
| 348 | <indexterm><primary>sufficient</primary></indexterm>
|
|---|
| 349 | <indexterm><primary>optional</primary></indexterm>
|
|---|
| 350 | The simpler (and historical) syntax for the control-flag is a single keyword defined to indicate the
|
|---|
| 351 | severity of concern associated with the success or failure of a specific module. There are four such
|
|---|
| 352 | keywords: <parameter>required</parameter>, <parameter>requisite</parameter>,
|
|---|
| 353 | <parameter>sufficient</parameter>, and <parameter>optional</parameter>.
|
|---|
| 354 | </para>
|
|---|
| 355 |
|
|---|
| 356 | <para>
|
|---|
| 357 | The Linux-PAM library interprets these keywords in the following manner:
|
|---|
| 358 | </para>
|
|---|
| 359 |
|
|---|
| 360 | <itemizedlist>
|
|---|
| 361 | <listitem><para>
|
|---|
| 362 | <parameter>required:</parameter> This indicates that the success of the module is required for the
|
|---|
| 363 | module-type facility to succeed. Failure of this module will not be apparent to the user until all
|
|---|
| 364 | of the remaining modules (of the same module-type) have been executed.
|
|---|
| 365 | </para></listitem>
|
|---|
| 366 |
|
|---|
| 367 | <listitem><para>
|
|---|
| 368 | <parameter>requisite:</parameter> Like required, except that if such a module returns a
|
|---|
| 369 | failure, control is directly returned to the application. The return value is that associated with
|
|---|
| 370 | the first required or requisite module to fail. This flag can be used to protect against the
|
|---|
| 371 | possibility of a user getting the opportunity to enter a password over an unsafe medium. It is
|
|---|
| 372 | conceivable that such behavior might inform an attacker of valid accounts on a system. This
|
|---|
| 373 | possibility should be weighed against the not insignificant concerns of exposing a sensitive
|
|---|
| 374 | password in a hostile environment.
|
|---|
| 375 | </para></listitem>
|
|---|
| 376 |
|
|---|
| 377 | <listitem><para>
|
|---|
| 378 | <parameter>sufficient:</parameter> The success of this module is deemed <parameter>sufficient</parameter> to satisfy
|
|---|
| 379 | the Linux-PAM library that this module-type has succeeded in its purpose. In the event that no
|
|---|
| 380 | previous required module has failed, no more <quote>stacked</quote> modules of this type are invoked.
|
|---|
| 381 | (In this case, subsequent required modules are not invoked). A failure of this module is not deemed
|
|---|
| 382 | as fatal to satisfying the application that this module-type has succeeded.
|
|---|
| 383 | </para></listitem>
|
|---|
| 384 |
|
|---|
| 385 | <listitem><para>
|
|---|
| 386 | <parameter>optional:</parameter> As its name suggests, this control-flag marks the module as not
|
|---|
| 387 | being critical to the success or failure of the user's application for service. In general,
|
|---|
| 388 | Linux-PAM ignores such a module when determining if the module stack will succeed or fail.
|
|---|
| 389 | However, in the absence of any definite successes or failures of previous or subsequent stacked
|
|---|
| 390 | modules, this module will determine the nature of the response to the application. One example of
|
|---|
| 391 | this latter case is when the other modules return something like PAM_IGNORE.
|
|---|
| 392 | </para></listitem>
|
|---|
| 393 | </itemizedlist>
|
|---|
| 394 |
|
|---|
| 395 | <para>
|
|---|
| 396 | The more elaborate (newer) syntax is much more specific and gives the administrator a great deal of control
|
|---|
| 397 | over how the user is authenticated. This form of the control-flag is delimited with square brackets and
|
|---|
| 398 | consists of a series of <parameter>value=action</parameter> tokens:
|
|---|
| 399 | </para>
|
|---|
| 400 |
|
|---|
| 401 | <para><programlisting>
|
|---|
| 402 | [value1=action1 value2=action2 ...]
|
|---|
| 403 | </programlisting></para>
|
|---|
| 404 |
|
|---|
| 405 | <para>
|
|---|
| 406 | Here, <parameter>value1</parameter> is one of the following return values:
|
|---|
| 407 | <screen>
|
|---|
| 408 | <parameter>success; open_err; symbol_err; service_err; system_err; buf_err;</parameter>
|
|---|
| 409 | <parameter>perm_denied; auth_err; cred_insufficient; authinfo_unavail;</parameter>
|
|---|
| 410 | <parameter>user_unknown; maxtries; new_authtok_reqd; acct_expired; session_err;</parameter>
|
|---|
| 411 | <parameter>cred_unavail; cred_expired; cred_err; no_module_data; conv_err;</parameter>
|
|---|
| 412 | <parameter>authtok_err; authtok_recover_err; authtok_lock_busy;</parameter>
|
|---|
| 413 | <parameter>authtok_disable_aging; try_again; ignore; abort; authtok_expired;</parameter>
|
|---|
| 414 | <parameter>module_unknown; bad_item;</parameter> and <parameter>default</parameter>.
|
|---|
| 415 | </screen>
|
|---|
| 416 | </para>
|
|---|
| 417 |
|
|---|
| 418 | <para>
|
|---|
| 419 | The last of these (<parameter>default</parameter>) can be used to set the action for those return values that are not explicitly defined.
|
|---|
| 420 | </para>
|
|---|
| 421 |
|
|---|
| 422 | <para>
|
|---|
| 423 | The <parameter>action1</parameter> can be a positive integer or one of the following tokens:
|
|---|
| 424 | <parameter>ignore</parameter>; <parameter>ok</parameter>; <parameter>done</parameter>;
|
|---|
| 425 | <parameter>bad</parameter>; <parameter>die</parameter>; and <parameter>reset</parameter>.
|
|---|
| 426 | A positive integer, J, when specified as the action, can be used to indicate that the next J modules of the
|
|---|
| 427 | current module-type will be skipped. In this way, the administrator can develop a moderately sophisticated
|
|---|
| 428 | stack of modules with a number of different paths of execution. Which path is taken can be determined by the
|
|---|
| 429 | reactions of individual modules.
|
|---|
| 430 | </para>
|
|---|
| 431 |
|
|---|
| 432 | <itemizedlist>
|
|---|
| 433 | <listitem><para>
|
|---|
| 434 | <parameter>ignore:</parameter> When used with a stack of modules, the module's return status will not
|
|---|
| 435 | contribute to the return code the application obtains.
|
|---|
| 436 | </para></listitem>
|
|---|
| 437 |
|
|---|
| 438 | <listitem><para>
|
|---|
| 439 | <parameter>bad:</parameter> This action indicates that the return code should be thought of as indicative
|
|---|
| 440 | of the module failing. If this module is the first in the stack to fail, its status value will be used
|
|---|
| 441 | for that of the whole stack.
|
|---|
| 442 | </para></listitem>
|
|---|
| 443 |
|
|---|
| 444 | <listitem><para>
|
|---|
| 445 | <parameter>die:</parameter> Equivalent to bad with the side effect of terminating the module stack and
|
|---|
| 446 | PAM immediately returning to the application.
|
|---|
| 447 | </para></listitem>
|
|---|
| 448 |
|
|---|
| 449 | <listitem><para>
|
|---|
| 450 | <parameter>ok:</parameter> This tells PAM that the administrator thinks this return code should
|
|---|
| 451 | contribute directly to the return code of the full stack of modules. In other words, if the former
|
|---|
| 452 | state of the stack would lead to a return of PAM_SUCCESS, the module's return code will override
|
|---|
| 453 | this value. Note, if the former state of the stack holds some value that is indicative of a module's
|
|---|
| 454 | failure, this <parameter>ok</parameter> value will not be used to override that value.
|
|---|
| 455 | </para></listitem>
|
|---|
| 456 |
|
|---|
| 457 | <listitem><para>
|
|---|
| 458 | <parameter>done:</parameter> Equivalent to <parameter>ok</parameter> with the side effect of terminating the module stack and
|
|---|
| 459 | PAM immediately returning to the application.
|
|---|
| 460 | </para></listitem>
|
|---|
| 461 |
|
|---|
| 462 | <listitem><para>
|
|---|
| 463 | <parameter>reset:</parameter> Clears all memory of the state of the module stack and starts again with
|
|---|
| 464 | the next stacked module.
|
|---|
| 465 | </para></listitem>
|
|---|
| 466 | </itemizedlist>
|
|---|
| 467 |
|
|---|
| 468 | <para>
|
|---|
| 469 | Each of the four keywords, <parameter>required</parameter>; <parameter>requisite</parameter>;
|
|---|
| 470 | <parameter>sufficient</parameter>; and <parameter>optional</parameter>, have an equivalent expression in terms
|
|---|
| 471 | of the [...] syntax. They are as follows:
|
|---|
| 472 | </para>
|
|---|
| 473 |
|
|---|
| 474 | <para>
|
|---|
| 475 | <itemizedlist>
|
|---|
| 476 | <listitem><para>
|
|---|
| 477 | <parameter>required</parameter> is equivalent to <parameter>[success=ok new_authtok_reqd=ok ignore=ignore default=bad]</parameter>.
|
|---|
| 478 | </para></listitem>
|
|---|
| 479 |
|
|---|
| 480 | <listitem><para>
|
|---|
| 481 | <parameter>requisite</parameter> is equivalent to <parameter>[success=ok new_authtok_reqd=ok ignore=ignore default=die]</parameter>.
|
|---|
| 482 | </para></listitem>
|
|---|
| 483 |
|
|---|
| 484 | <listitem><para>
|
|---|
| 485 | <parameter>sufficient</parameter> is equivalent to <parameter>[success=done new_authtok_reqd=done default=ignore]</parameter>.
|
|---|
| 486 | </para></listitem>
|
|---|
| 487 |
|
|---|
| 488 | <listitem><para>
|
|---|
| 489 | <parameter>optional</parameter> is equivalent to <parameter>[success=ok new_authtok_reqd=ok default=ignore]</parameter>.
|
|---|
| 490 | </para></listitem>
|
|---|
| 491 | </itemizedlist>
|
|---|
| 492 | </para>
|
|---|
| 493 |
|
|---|
| 494 | <para>
|
|---|
| 495 | Just to get a feel for the power of this new syntax, here is a taste of what you can do with it. With Linux-PAM-0.63,
|
|---|
| 496 | the notion of client plug-in agents was introduced. This makes it possible for PAM to support
|
|---|
| 497 | machine-machine authentication using the transport protocol inherent to the client/server application. With the
|
|---|
| 498 | <parameter>[ ... value=action ... ]</parameter> control syntax, it is possible for an application to be configured
|
|---|
| 499 | to support binary prompts with compliant clients, but to gracefully fail over into an alternative authentication
|
|---|
| 500 | mode for legacy applications.
|
|---|
| 501 | </para>
|
|---|
| 502 | </listitem>
|
|---|
| 503 | </varlistentry>
|
|---|
| 504 |
|
|---|
| 505 | <varlistentry><term>module-path</term><listitem>
|
|---|
| 506 | <para>
|
|---|
| 507 | The pathname of the dynamically loadable object file; the pluggable module itself. If the first character of the
|
|---|
| 508 | module path is <quote>/</quote>, it is assumed to be a complete path. If this is not the case, the given module path is appended
|
|---|
| 509 | to the default module path: <filename>/lib/security</filename> (but see the previous notes).
|
|---|
| 510 | </para>
|
|---|
| 511 |
|
|---|
| 512 | <para>
|
|---|
| 513 | The arguments are a list of tokens that are passed to the module when it is invoked, much like arguments to a typical
|
|---|
| 514 | Linux shell command. Generally, valid arguments are optional and are specific to any given module. Invalid arguments
|
|---|
| 515 | are ignored by a module; however, when encountering an invalid argument, the module is required to write an error
|
|---|
| 516 | to syslog(3). For a list of generic options, see the next section.
|
|---|
| 517 | </para>
|
|---|
| 518 |
|
|---|
| 519 | <para>
|
|---|
| 520 | If you wish to include spaces in an argument, you should surround that argument with square brackets. For example:
|
|---|
| 521 | </para>
|
|---|
| 522 |
|
|---|
| 523 | <para><programlisting>
|
|---|
| 524 | squid auth required pam_mysql.so user=passwd_query passwd=mada \
|
|---|
| 525 | db=eminence [query=select user_name from internet_service where \
|
|---|
| 526 | user_name=<quote>%u</quote> and password=PASSWORD(<quote>%p</quote>) and service=<quote>web_proxy</quote>]
|
|---|
| 527 | </programlisting></para>
|
|---|
| 528 |
|
|---|
| 529 | <para>
|
|---|
| 530 | When using this convention, you can include <quote>[</quote> characters inside the string, and if you wish to have a <quote>]</quote>
|
|---|
| 531 | character inside the string that will survive the argument parsing, you should use <quote>\[</quote>. In other words,
|
|---|
| 532 | </para>
|
|---|
| 533 |
|
|---|
| 534 | <para><programlisting>
|
|---|
| 535 | [..[..\]..] --> ..[..]..
|
|---|
| 536 | </programlisting></para>
|
|---|
| 537 |
|
|---|
| 538 | <para>
|
|---|
| 539 | Any line in one of the configuration files that is not formatted correctly will generally tend (erring on the
|
|---|
| 540 | side of caution) to make the authentication process fail. A corresponding error is written to the system log files
|
|---|
| 541 | with a call to syslog(3).
|
|---|
| 542 | </para>
|
|---|
| 543 | </listitem>
|
|---|
| 544 | </varlistentry>
|
|---|
| 545 | </variablelist>
|
|---|
| 546 |
|
|---|
| 547 | </sect3>
|
|---|
| 548 |
|
|---|
| 549 | </sect2>
|
|---|
| 550 |
|
|---|
| 551 | <sect2>
|
|---|
| 552 | <title>Example System Configurations</title>
|
|---|
| 553 |
|
|---|
| 554 | <para>
|
|---|
| 555 | The following is an example <filename>/etc/pam.d/login</filename> configuration file.
|
|---|
| 556 | This example had all options uncommented and is probably not usable
|
|---|
| 557 | because it stacks many conditions before allowing successful completion
|
|---|
| 558 | of the login process. Essentially, all conditions can be disabled
|
|---|
| 559 | by commenting them out, except the calls to <filename>pam_pwdb.so</filename>.
|
|---|
| 560 | </para>
|
|---|
| 561 |
|
|---|
| 562 | <sect3>
|
|---|
| 563 | <title>PAM: Original Login Config</title>
|
|---|
| 564 |
|
|---|
| 565 | <para>
|
|---|
| 566 | <programlisting>
|
|---|
| 567 | #%PAM-1.0
|
|---|
| 568 | # The PAM configuration file for the <quote>login</quote> service
|
|---|
| 569 | #
|
|---|
| 570 | auth required pam_securetty.so
|
|---|
| 571 | auth required pam_nologin.so
|
|---|
| 572 | # auth required pam_dialup.so
|
|---|
| 573 | # auth optional pam_mail.so
|
|---|
| 574 | auth required pam_pwdb.so shadow md5
|
|---|
| 575 | # account requisite pam_time.so
|
|---|
| 576 | account required pam_pwdb.so
|
|---|
| 577 | session required pam_pwdb.so
|
|---|
| 578 | # session optional pam_lastlog.so
|
|---|
| 579 | # password required pam_cracklib.so retry=3
|
|---|
| 580 | password required pam_pwdb.so shadow md5
|
|---|
| 581 | </programlisting>
|
|---|
| 582 | </para>
|
|---|
| 583 |
|
|---|
| 584 | </sect3>
|
|---|
| 585 |
|
|---|
| 586 | <sect3>
|
|---|
| 587 | <title>PAM: Login Using <filename>pam_smbpass</filename></title>
|
|---|
| 588 |
|
|---|
| 589 | <para>
|
|---|
| 590 | PAM allows use of replaceable modules. Those available on a sample system include:
|
|---|
| 591 | </para>
|
|---|
| 592 |
|
|---|
| 593 | <para><prompt>$</prompt><userinput>/bin/ls /lib/security</userinput>
|
|---|
| 594 | <programlisting>
|
|---|
| 595 | pam_access.so pam_ftp.so pam_limits.so
|
|---|
| 596 | pam_ncp_auth.so pam_rhosts_auth.so pam_stress.so
|
|---|
| 597 | pam_cracklib.so pam_group.so pam_listfile.so
|
|---|
| 598 | pam_nologin.so pam_rootok.so pam_tally.so
|
|---|
| 599 | pam_deny.so pam_issue.so pam_mail.so
|
|---|
| 600 | pam_permit.so pam_securetty.so pam_time.so
|
|---|
| 601 | pam_dialup.so pam_lastlog.so pam_mkhomedir.so
|
|---|
| 602 | pam_pwdb.so pam_shells.so pam_unix.so
|
|---|
| 603 | pam_env.so pam_ldap.so pam_motd.so
|
|---|
| 604 | pam_radius.so pam_smbpass.so pam_unix_acct.so
|
|---|
| 605 | pam_wheel.so pam_unix_auth.so pam_unix_passwd.so
|
|---|
| 606 | pam_userdb.so pam_warn.so pam_unix_session.so
|
|---|
| 607 | </programlisting></para>
|
|---|
| 608 |
|
|---|
| 609 | <para>
|
|---|
| 610 | The following example for the login program replaces the use of
|
|---|
| 611 | the <filename>pam_pwdb.so</filename> module that uses the system
|
|---|
| 612 | password database (<filename>/etc/passwd</filename>,
|
|---|
| 613 | <filename>/etc/shadow</filename>, <filename>/etc/group</filename>) with
|
|---|
| 614 | the module <filename>pam_smbpass.so</filename>, which uses the Samba
|
|---|
| 615 | database containing the Microsoft MD4 encrypted password
|
|---|
| 616 | hashes. This database is stored either in
|
|---|
| 617 | <filename>/usr/local/samba/private/smbpasswd</filename>,
|
|---|
| 618 | <filename>/etc/samba/smbpasswd</filename> or in
|
|---|
| 619 | <filename>/etc/samba.d/smbpasswd</filename>, depending on the
|
|---|
| 620 | Samba implementation for your UNIX/Linux system. The
|
|---|
| 621 | <filename>pam_smbpass.so</filename> module is provided by
|
|---|
| 622 | Samba version 2.2.1 or later. It can be compiled by specifying the
|
|---|
| 623 | <option>--with-pam_smbpass</option> options when running Samba's
|
|---|
| 624 | <command>configure</command> script. For more information
|
|---|
| 625 | on the <filename>pam_smbpass</filename> module, see the documentation
|
|---|
| 626 | in the <filename>source/pam_smbpass</filename> directory of the Samba
|
|---|
| 627 | source distribution.
|
|---|
| 628 | </para>
|
|---|
| 629 |
|
|---|
| 630 | <para>
|
|---|
| 631 | <programlisting>
|
|---|
| 632 | #%PAM-1.0
|
|---|
| 633 | # The PAM configuration file for the <quote>login</quote> service
|
|---|
| 634 | #
|
|---|
| 635 | auth required pam_smbpass.so nodelay
|
|---|
| 636 | account required pam_smbpass.so nodelay
|
|---|
| 637 | session required pam_smbpass.so nodelay
|
|---|
| 638 | password required pam_smbpass.so nodelay
|
|---|
| 639 | </programlisting></para>
|
|---|
| 640 |
|
|---|
| 641 | <para>
|
|---|
| 642 | The following is the PAM configuration file for a particular
|
|---|
| 643 | Linux system. The default condition uses <filename>pam_pwdb.so</filename>.
|
|---|
| 644 | </para>
|
|---|
| 645 |
|
|---|
| 646 | <para>
|
|---|
| 647 | <programlisting>
|
|---|
| 648 | #%PAM-1.0
|
|---|
| 649 | # The PAM configuration file for the <quote>samba</quote> service
|
|---|
| 650 | #
|
|---|
| 651 | auth required pam_pwdb.so nullok nodelay shadow audit
|
|---|
| 652 | account required pam_pwdb.so audit nodelay
|
|---|
| 653 | session required pam_pwdb.so nodelay
|
|---|
| 654 | password required pam_pwdb.so shadow md5
|
|---|
| 655 | </programlisting></para>
|
|---|
| 656 |
|
|---|
| 657 | <para>
|
|---|
| 658 | In the following example, the decision has been made to use the
|
|---|
| 659 | <command>smbpasswd</command> database even for basic Samba authentication. Such a
|
|---|
| 660 | decision could also be made for the <command>passwd</command> program and would
|
|---|
| 661 | thus allow the <command>smbpasswd</command> passwords to be changed using the
|
|---|
| 662 | <command>passwd</command> program:
|
|---|
| 663 | </para>
|
|---|
| 664 |
|
|---|
| 665 | <para>
|
|---|
| 666 | <programlisting>
|
|---|
| 667 | #%PAM-1.0
|
|---|
| 668 | # The PAM configuration file for the <quote>samba</quote> service
|
|---|
| 669 | #
|
|---|
| 670 | auth required pam_smbpass.so nodelay
|
|---|
| 671 | account required pam_pwdb.so audit nodelay
|
|---|
| 672 | session required pam_pwdb.so nodelay
|
|---|
| 673 | password required pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf
|
|---|
| 674 | </programlisting>
|
|---|
| 675 | </para>
|
|---|
| 676 |
|
|---|
| 677 | <note><para>PAM allows stacking of authentication mechanisms. It is
|
|---|
| 678 | also possible to pass information obtained within one PAM module through
|
|---|
| 679 | to the next module in the PAM stack. Please refer to the documentation for
|
|---|
| 680 | your particular system implementation for details regarding the specific
|
|---|
| 681 | capabilities of PAM in this environment. Some Linux implementations also
|
|---|
| 682 | provide the <filename>pam_stack.so</filename> module that allows all
|
|---|
| 683 | authentication to be configured in a single central file. The
|
|---|
| 684 | <filename>pam_stack.so</filename> method has some devoted followers
|
|---|
| 685 | on the basis that it allows for easier administration. As with all issues in
|
|---|
| 686 | life, though, every decision has trade-offs, so you may want to examine the
|
|---|
| 687 | PAM documentation for further helpful information.
|
|---|
| 688 | </para></note>
|
|---|
| 689 |
|
|---|
| 690 | </sect3>
|
|---|
| 691 |
|
|---|
| 692 | </sect2>
|
|---|
| 693 |
|
|---|
| 694 | <sect2>
|
|---|
| 695 | <title>&smb.conf; PAM Configuration</title>
|
|---|
| 696 |
|
|---|
| 697 | <para>
|
|---|
| 698 | There is an option in &smb.conf; called <smbconfoption name="obey pam restrictions"/>.
|
|---|
| 699 | The following is from the online help for this option in SWAT:
|
|---|
| 700 | </para>
|
|---|
| 701 |
|
|---|
| 702 | <blockquote>
|
|---|
| 703 | <para>
|
|---|
| 704 | When Samba is configured to enable PAM support (i.e., <option>--with-pam</option>), this parameter will
|
|---|
| 705 | control whether or not Samba should obey PAM's account and session management directives. The default behavior
|
|---|
| 706 | is to use PAM for clear-text authentication only and to ignore any account or session management. Samba always
|
|---|
| 707 | ignores PAM for authentication in the case of <smbconfoption name="encrypt passwords">yes</smbconfoption>.
|
|---|
| 708 | The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB
|
|---|
| 709 | password encryption.
|
|---|
| 710 | </para>
|
|---|
| 711 |
|
|---|
| 712 | <para>Default: <smbconfoption name="obey pam restrictions">no</smbconfoption></para>
|
|---|
| 713 | </blockquote>
|
|---|
| 714 |
|
|---|
| 715 | </sect2>
|
|---|
| 716 |
|
|---|
| 717 | <sect2>
|
|---|
| 718 | <title>Remote CIFS Authentication Using <filename>winbindd.so</filename></title>
|
|---|
| 719 |
|
|---|
| 720 | <para>
|
|---|
| 721 | All operating systems depend on the provision of user credentials acceptable to the platform.
|
|---|
| 722 | UNIX requires the provision of a user identifier (UID) as well as a group identifier (GID).
|
|---|
| 723 | These are both simple integer numbers that are obtained from a password backend such
|
|---|
| 724 | as <filename>/etc/passwd</filename>.
|
|---|
| 725 | </para>
|
|---|
| 726 |
|
|---|
| 727 | <para>
|
|---|
| 728 | Users and groups on a Windows NT server are assigned a relative ID (RID) which is unique for
|
|---|
| 729 | the domain when the user or group is created. To convert the Windows NT user or group into
|
|---|
| 730 | a UNIX user or group, a mapping between RIDs and UNIX user and group IDs is required. This
|
|---|
| 731 | is one of the jobs that winbind performs.
|
|---|
| 732 | </para>
|
|---|
| 733 |
|
|---|
| 734 | <para>
|
|---|
| 735 | As winbind users and groups are resolved from a server, user and group IDs are allocated
|
|---|
| 736 | from a specified range. This is done on a first come, first served basis, although all
|
|---|
| 737 | existing users and groups will be mapped as soon as a client performs a user or group
|
|---|
| 738 | enumeration command. The allocated UNIX IDs are stored in a database file under the Samba
|
|---|
| 739 | lock directory and will be remembered.
|
|---|
| 740 | </para>
|
|---|
| 741 |
|
|---|
| 742 | <para>
|
|---|
| 743 | The astute administrator will realize from this that the combination of <filename>pam_smbpass.so</filename>,
|
|---|
| 744 | <command>winbindd</command>, and a distributed <smbconfoption name="passdb backend"></smbconfoption>
|
|---|
| 745 | such as <parameter>ldap</parameter> will allow the establishment of a centrally managed, distributed user/password
|
|---|
| 746 | database that can also be used by all PAM-aware (e.g., Linux) programs and applications. This arrangement can have
|
|---|
| 747 | particularly potent advantages compared with the use of Microsoft Active Directory Service (ADS) insofar as
|
|---|
| 748 | the reduction of wide-area network authentication traffic.
|
|---|
| 749 | </para>
|
|---|
| 750 |
|
|---|
| 751 | <warning><para>
|
|---|
| 752 | The RID to UNIX ID database is the only location where the user and group mappings are
|
|---|
| 753 | stored by <command>winbindd</command>. If this file is deleted or corrupted, there is no way for <command>winbindd</command>
|
|---|
| 754 | to determine which user and group IDs correspond to Windows NT user and group RIDs.
|
|---|
| 755 | </para></warning>
|
|---|
| 756 |
|
|---|
| 757 | </sect2>
|
|---|
| 758 |
|
|---|
| 759 | <sect2>
|
|---|
| 760 | <title>Password Synchronization Using <filename>pam_smbpass.so</filename></title>
|
|---|
| 761 |
|
|---|
| 762 | <para>
|
|---|
| 763 | <filename>pam_smbpass</filename> is a PAM module that can be used on conforming systems to
|
|---|
| 764 | keep the <filename>smbpasswd</filename> (Samba password) database in sync with the UNIX
|
|---|
| 765 | password file. PAM is an API supported
|
|---|
| 766 | under some UNIX operating systems, such as Solaris, HPUX, and Linux, that provides a
|
|---|
| 767 | generic interface to authentication mechanisms.
|
|---|
| 768 | </para>
|
|---|
| 769 |
|
|---|
| 770 | <para>
|
|---|
| 771 | This module authenticates a local <filename>smbpasswd</filename> user database. If you require
|
|---|
| 772 | support for authenticating against a remote SMB server, or if you are
|
|---|
| 773 | concerned about the presence of SUID root binaries on your system, it is
|
|---|
| 774 | recommended that you use <filename>pam_winbind</filename> instead.
|
|---|
| 775 | </para>
|
|---|
| 776 |
|
|---|
| 777 | <para>
|
|---|
| 778 | Options recognized by this module are shown in <link linkend="smbpassoptions">next table</link>.
|
|---|
| 779 | <table frame="all" id="smbpassoptions">
|
|---|
| 780 | <title>Options recognized by <parameter>pam_smbpass</parameter></title>
|
|---|
| 781 | <tgroup cols="2" align="left">
|
|---|
| 782 | <colspec align="left"/>
|
|---|
| 783 | <colspec align="justify" colwidth="1*"/>
|
|---|
| 784 | <tbody>
|
|---|
| 785 | <row><entry>debug</entry><entry>Log more debugging info.</entry></row>
|
|---|
| 786 | <row><entry>audit</entry><entry>Like debug, but also logs unknown usernames.</entry></row>
|
|---|
| 787 | <row><entry>use_first_pass</entry><entry>Do not prompt the user for passwords; take them from PAM_ items instead.</entry></row>
|
|---|
| 788 | <row><entry>try_first_pass</entry><entry>Try to get the password from a previous PAM module; fall back to prompting the user.</entry></row>
|
|---|
| 789 | <row><entry>use_authtok</entry>
|
|---|
| 790 | <entry>Like try_first_pass, but *fail* if the new PAM_AUTHTOK has not been previously set (intended for stacking password modules only).</entry></row>
|
|---|
| 791 | <row><entry>not_set_pass</entry><entry>Do not make passwords used by this module available to other modules.</entry></row>
|
|---|
| 792 | <row><entry>nodelay</entry><entry>dDo not insert ~1-second delays on authentication failure.</entry></row>
|
|---|
| 793 | <row><entry>nullok</entry><entry>Null passwords are allowed.</entry></row>
|
|---|
| 794 | <row><entry>nonull</entry><entry>Null passwords are not allowed. Used to override the Samba configuration.</entry></row>
|
|---|
| 795 | <row><entry>migrate</entry><entry>Only meaningful in an <quote>auth</quote> context; used to update smbpasswd file with a password used for successful authentication.</entry></row>
|
|---|
| 796 | <row><entry>smbconf=<replaceable>file</replaceable></entry><entry>Specify an alternate path to the &smb.conf; file.</entry></row>
|
|---|
| 797 | </tbody>
|
|---|
| 798 | </tgroup>
|
|---|
| 799 | </table>
|
|---|
| 800 | </para>
|
|---|
| 801 |
|
|---|
| 802 | <para>
|
|---|
| 803 | The following are examples of the use of <filename>pam_smbpass.so</filename> in the format of the Linux
|
|---|
| 804 | <filename>/etc/pam.d/</filename> files structure. Those wishing to implement this
|
|---|
| 805 | tool on other platforms will need to adapt this appropriately.
|
|---|
| 806 | </para>
|
|---|
| 807 |
|
|---|
| 808 | <sect3>
|
|---|
| 809 | <title>Password Synchronization Configuration</title>
|
|---|
| 810 |
|
|---|
| 811 | <para>
|
|---|
| 812 | The following is a sample PAM configuration that shows the use of pam_smbpass to make
|
|---|
| 813 | sure <filename>private/smbpasswd</filename> is kept in sync when <filename>/etc/passwd (/etc/shadow)</filename>
|
|---|
| 814 | is changed. It is useful when an expired password might be changed by an
|
|---|
| 815 | application (such as <command>ssh</command>).
|
|---|
| 816 | </para>
|
|---|
| 817 |
|
|---|
| 818 | <para>
|
|---|
| 819 | <programlisting>
|
|---|
| 820 | #%PAM-1.0
|
|---|
| 821 | # password-sync
|
|---|
| 822 | #
|
|---|
| 823 | auth requisite pam_nologin.so
|
|---|
| 824 | auth required pam_unix.so
|
|---|
| 825 | account required pam_unix.so
|
|---|
| 826 | password requisite pam_cracklib.so retry=3
|
|---|
| 827 | password requisite pam_unix.so shadow md5 use_authtok try_first_pass
|
|---|
| 828 | password required pam_smbpass.so nullok use_authtok try_first_pass
|
|---|
| 829 | session required pam_unix.so
|
|---|
| 830 | </programlisting></para>
|
|---|
| 831 | </sect3>
|
|---|
| 832 |
|
|---|
| 833 | <sect3>
|
|---|
| 834 | <title>Password Migration Configuration</title>
|
|---|
| 835 |
|
|---|
| 836 | <para>
|
|---|
| 837 | The following PAM configuration shows the use of <filename>pam_smbpass</filename> to migrate
|
|---|
| 838 | from plaintext to encrypted passwords for Samba. Unlike other methods,
|
|---|
| 839 | this can be used for users who have never connected to Samba shares:
|
|---|
| 840 | password migration takes place when users <command>ftp</command> in, login using <command>ssh</command>, pop
|
|---|
| 841 | their mail, and so on.
|
|---|
| 842 | </para>
|
|---|
| 843 |
|
|---|
| 844 | <para>
|
|---|
| 845 | <programlisting>
|
|---|
| 846 | #%PAM-1.0
|
|---|
| 847 | # password-migration
|
|---|
| 848 | #
|
|---|
| 849 | auth requisite pam_nologin.so
|
|---|
| 850 | # pam_smbpass is called IF pam_unix succeeds.
|
|---|
| 851 | auth requisite pam_unix.so
|
|---|
| 852 | auth optional pam_smbpass.so migrate
|
|---|
| 853 | account required pam_unix.so
|
|---|
| 854 | password requisite pam_cracklib.so retry=3
|
|---|
| 855 | password requisite pam_unix.so shadow md5 use_authtok try_first_pass
|
|---|
| 856 | password optional pam_smbpass.so nullok use_authtok try_first_pass
|
|---|
| 857 | session required pam_unix.so
|
|---|
| 858 | </programlisting></para>
|
|---|
| 859 | </sect3>
|
|---|
| 860 |
|
|---|
| 861 | <sect3>
|
|---|
| 862 | <title>Mature Password Configuration</title>
|
|---|
| 863 |
|
|---|
| 864 | <para>
|
|---|
| 865 | The following is a sample PAM configuration for a mature <filename>smbpasswd</filename> installation.
|
|---|
| 866 | <filename>private/smbpasswd</filename> is fully populated, and we consider it an error if
|
|---|
| 867 | the SMB password does not exist or does not match the UNIX password.
|
|---|
| 868 | </para>
|
|---|
| 869 |
|
|---|
| 870 | <para>
|
|---|
| 871 | <programlisting>
|
|---|
| 872 | #%PAM-1.0
|
|---|
| 873 | # password-mature
|
|---|
| 874 | #
|
|---|
| 875 | auth requisite pam_nologin.so
|
|---|
| 876 | auth required pam_unix.so
|
|---|
| 877 | account required pam_unix.so
|
|---|
| 878 | password requisite pam_cracklib.so retry=3
|
|---|
| 879 | password requisite pam_unix.so shadow md5 use_authtok try_first_pass
|
|---|
| 880 | password required pam_smbpass.so use_authtok use_first_pass
|
|---|
| 881 | session required pam_unix.so
|
|---|
| 882 | </programlisting></para>
|
|---|
| 883 | </sect3>
|
|---|
| 884 |
|
|---|
| 885 | <sect3>
|
|---|
| 886 | <title>Kerberos Password Integration Configuration</title>
|
|---|
| 887 |
|
|---|
| 888 | <para>
|
|---|
| 889 | The following is a sample PAM configuration that shows <parameter>pam_smbpass</parameter> used together with
|
|---|
| 890 | <parameter>pam_krb5</parameter>. This could be useful on a Samba PDC that is also a member of
|
|---|
| 891 | a Kerberos realm.
|
|---|
| 892 | </para>
|
|---|
| 893 |
|
|---|
| 894 | <para>
|
|---|
| 895 | <programlisting>
|
|---|
| 896 | #%PAM-1.0
|
|---|
| 897 | # kdc-pdc
|
|---|
| 898 | #
|
|---|
| 899 | auth requisite pam_nologin.so
|
|---|
| 900 | auth requisite pam_krb5.so
|
|---|
| 901 | auth optional pam_smbpass.so migrate
|
|---|
| 902 | account required pam_krb5.so
|
|---|
| 903 | password requisite pam_cracklib.so retry=3
|
|---|
| 904 | password optional pam_smbpass.so nullok use_authtok try_first_pass
|
|---|
| 905 | password required pam_krb5.so use_authtok try_first_pass
|
|---|
| 906 | session required pam_krb5.so
|
|---|
| 907 | </programlisting></para>
|
|---|
| 908 |
|
|---|
| 909 | </sect3>
|
|---|
| 910 |
|
|---|
| 911 | </sect2>
|
|---|
| 912 |
|
|---|
| 913 | </sect1>
|
|---|
| 914 |
|
|---|
| 915 | <sect1>
|
|---|
| 916 | <title>Common Errors</title>
|
|---|
| 917 |
|
|---|
| 918 | <para>
|
|---|
| 919 | PAM can be fickle and sensitive to configuration glitches. Here we look at a few cases from
|
|---|
| 920 | the Samba mailing list.
|
|---|
| 921 | </para>
|
|---|
| 922 |
|
|---|
| 923 | <sect2>
|
|---|
| 924 | <title>pam_winbind Problem</title>
|
|---|
| 925 |
|
|---|
| 926 | <para>
|
|---|
| 927 | A user reported, <emphasis>I have the following PAM configuration</emphasis>:
|
|---|
| 928 | </para>
|
|---|
| 929 |
|
|---|
| 930 | <para>
|
|---|
| 931 | <programlisting>
|
|---|
| 932 | auth required /lib/security/pam_securetty.so
|
|---|
| 933 | auth sufficient /lib/security/pam_winbind.so
|
|---|
| 934 | auth sufficient /lib/security/pam_unix.so use_first_pass nullok
|
|---|
| 935 | auth required /lib/security/pam_stack.so service=system-auth
|
|---|
| 936 | auth required /lib/security/pam_nologin.so
|
|---|
| 937 | account required /lib/security/pam_stack.so service=system-auth
|
|---|
| 938 | account required /lib/security/pam_winbind.so
|
|---|
| 939 | password required /lib/security/pam_stack.so service=system-auth
|
|---|
| 940 | </programlisting>
|
|---|
| 941 | </para>
|
|---|
| 942 |
|
|---|
| 943 | <para>
|
|---|
| 944 | <emphasis>When I open a new console with [ctrl][alt][F1], I can't log in with my user <quote>pitie.</quote>
|
|---|
| 945 | I have tried with user <quote>scienceu\pitie</quote> also.</emphasis>
|
|---|
| 946 | </para>
|
|---|
| 947 |
|
|---|
| 948 | <para>
|
|---|
| 949 | The problem may lie with the inclusion of <parameter>pam_stack.so
|
|---|
| 950 | service=system-auth</parameter>. That file often contains a lot of stuff that may
|
|---|
| 951 | duplicate what you are already doing. Try commenting out the <parameter>pam_stack</parameter> lines
|
|---|
| 952 | for <parameter>auth</parameter> and <parameter>account</parameter> and see if things work. If they do, look at
|
|---|
| 953 | <filename>/etc/pam.d/system-auth</filename> and copy only what you need from it into your
|
|---|
| 954 | <filename>/etc/pam.d/login</filename> file. Alternatively, if you want all services to use
|
|---|
| 955 | Winbind, you can put the Winbind-specific stuff in <filename>/etc/pam.d/system-auth</filename>.
|
|---|
| 956 | </para>
|
|---|
| 957 |
|
|---|
| 958 | </sect2>
|
|---|
| 959 |
|
|---|
| 960 | <sect2>
|
|---|
| 961 | <title>Winbind Is Not Resolving Users and Groups</title>
|
|---|
| 962 |
|
|---|
| 963 | <para>
|
|---|
| 964 | <quote>
|
|---|
| 965 | My &smb.conf; file is correctly configured. I have specified
|
|---|
| 966 | <smbconfoption name="idmap uid">12000</smbconfoption>
|
|---|
| 967 | and <smbconfoption name="idmap gid">3000-3500,</smbconfoption>
|
|---|
| 968 | and <command>winbind</command> is running. When I do the following it all works fine.
|
|---|
| 969 | </quote>
|
|---|
| 970 | </para>
|
|---|
| 971 |
|
|---|
| 972 | <para><screen>
|
|---|
| 973 | &rootprompt;<userinput>wbinfo -u</userinput>
|
|---|
| 974 | MIDEARTH\maryo
|
|---|
| 975 | MIDEARTH\jackb
|
|---|
| 976 | MIDEARTH\ameds
|
|---|
| 977 | ...
|
|---|
| 978 | MIDEARTH\root
|
|---|
| 979 |
|
|---|
| 980 | &rootprompt;<userinput>wbinfo -g</userinput>
|
|---|
| 981 | MIDEARTH\Domain Users
|
|---|
| 982 | MIDEARTH\Domain Admins
|
|---|
| 983 | MIDEARTH\Domain Guests
|
|---|
| 984 | ...
|
|---|
| 985 | MIDEARTH\Accounts
|
|---|
| 986 |
|
|---|
| 987 | &rootprompt;<userinput>getent passwd</userinput>
|
|---|
| 988 | root:x:0:0:root:/root:/bin/bash
|
|---|
| 989 | bin:x:1:1:bin:/bin:/bin/bash
|
|---|
| 990 | ...
|
|---|
| 991 | maryo:x:15000:15003:Mary Orville:/home/MIDEARTH/maryo:/bin/false
|
|---|
| 992 | </screen></para>
|
|---|
| 993 |
|
|---|
| 994 | <para>
|
|---|
| 995 | <quote>
|
|---|
| 996 | But this command fails:
|
|---|
| 997 | </quote>
|
|---|
| 998 | <screen>
|
|---|
| 999 | &rootprompt;<userinput>chown maryo a_file</userinput>
|
|---|
| 1000 | chown: 'maryo': invalid user
|
|---|
| 1001 | </screen>
|
|---|
| 1002 | <quote>This is driving me nuts! What can be wrong?</quote>
|
|---|
| 1003 | </para>
|
|---|
| 1004 |
|
|---|
| 1005 | <para>
|
|---|
| 1006 | Your system is likely running <command>nscd</command>, the name service
|
|---|
| 1007 | caching daemon. Shut it down, do not restart it! You will find your problem resolved.
|
|---|
| 1008 | </para>
|
|---|
| 1009 |
|
|---|
| 1010 | </sect2>
|
|---|
| 1011 | </sect1>
|
|---|
| 1012 |
|
|---|
| 1013 | </chapter>
|
|---|
