| 1 | <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 11. Active Directory, Kerberos, and Security</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="RefSection.html" title="Part III. Reference Section"><link rel="next" href="DomApps.html" title="Chapter 12. Integrating Additional Services"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 11. Active Directory, Kerberos, and Security</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="RefSection.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="DomApps.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="kerberos"></a>Chapter 11. Active Directory, Kerberos, and Security</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="kerberos.html#id2610496">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2611138">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2611154">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2611545">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2613169">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2613518">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2614131">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2614530">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2615257">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2615391">Questions and Answers</a></span></dt></dl></div><p><a class="indexterm" name="id2610431"></a>
|
|---|
| 2 | By this point in the book, you have been exposed to many Samba-3 features and capabilities.
|
|---|
| 3 | More importantly, if you have implemented the examples given, you are well on your way to becoming
|
|---|
| 4 | a Samba-3 networking guru who knows a lot about Microsoft Windows. If you have taken the time to
|
|---|
| 5 | practice, you likely have thought of improvements and scenarios with which you can experiment. You
|
|---|
| 6 | are rather well plugged in to the many flexible ways Samba can be used.
|
|---|
| 7 | </p><p><a class="indexterm" name="id2610450"></a>
|
|---|
| 8 | This is a book about Samba-3. Understandably, its intent is to present it in a positive light.
|
|---|
| 9 | The casual observer might conclude that this book is one-eyed about Samba. It is what
|
|---|
| 10 | would you expect? This chapter exposes some criticisms that have been raised concerning
|
|---|
| 11 | the use of Samba. For each criticism, there are good answers and appropriate solutions.
|
|---|
| 12 | </p><p>
|
|---|
| 13 | Some criticism always comes from deep inside ranks that one would expect to be supportive of a particular
|
|---|
| 14 | decision. Criticism can be expected from the outside. Let's see how the interesting dynamic of
|
|---|
| 15 | criticism develops with respect to Abmas.
|
|---|
| 16 | </p><p><a class="indexterm" name="id2610478"></a>
|
|---|
| 17 | This chapter provides a shameless self-promotion of Samba-3. The objections raised were not pulled
|
|---|
| 18 | out of thin air. They were drawn from comments made by Samba users and from criticism during
|
|---|
| 19 | discussions with Windows network administrators. The tone of the objections reflects as closely
|
|---|
| 20 | as possible that of the original. The case presented is a straw-man example that is designed to
|
|---|
| 21 | permit each objection to be answered as it might occur in real life.
|
|---|
| 22 | </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2610496"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id2610502"></a><a class="indexterm" name="id2610510"></a><a class="indexterm" name="id2610518"></a><a class="indexterm" name="id2610526"></a><a class="indexterm" name="id2610534"></a>
|
|---|
| 23 | Abmas is continuing its meteoric growth with yet further acquisitions. The investment community took
|
|---|
| 24 | note of the spectacular projection of Abmas onto the global business stage. Abmas is building an
|
|---|
| 25 | interesting portfolio of companies that includes accounting services, financial advice, investment
|
|---|
| 26 | portfolio management, property insurance, risk assessment, and the recent addition of a a video rental
|
|---|
| 27 | business. The pieces do not always appear to fit together, but Mr. Meany is certainly executing an
|
|---|
| 28 | interesting business growth and development plan. Abmas Video Rentals was recently acquired.
|
|---|
| 29 | During the time that the acquisition was closing, the Video Rentals business upgraded its Windows
|
|---|
| 30 | NT4-based network to Windows 2003 Server and Active Directory.
|
|---|
| 31 | </p><p><a class="indexterm" name="id2610558"></a>
|
|---|
| 32 | You have accepted the fact that Abmas Video Rentals will use Microsoft Active Directory.
|
|---|
| 33 | The IT team, led by Stan Soroka, is committed to Samba-3 and to maintaining a uniform technology platform.
|
|---|
| 34 | Stan Soroka's team voiced its disapproval over the decision to permit this business to continue to
|
|---|
| 35 | operate with a solution that is viewed by Christine and her group as “<span class="quote">an island of broken
|
|---|
| 36 | technologies.</span>” This comment was made by one of Christine's staff as they were installing a new
|
|---|
| 37 | Samba-3 server at the new business.
|
|---|
| 38 | </p><p><a class="indexterm" name="id2610581"></a><a class="indexterm" name="id2610589"></a>
|
|---|
| 39 | Abmas Video Rentals' head of IT heard of this criticism. He was offended that a junior engineer
|
|---|
| 40 | should make such a comment. He felt that he had to prepare in case he might be criticized for his
|
|---|
| 41 | decision to use Active Directory. He decided he would defend his decision by hiring the services
|
|---|
| 42 | of an outside security systems consultant to report<sup>[<a name="id2610604" href="#ftn.id2610604" class="footnote">12</a>]</sup> on his unit's operations
|
|---|
| 43 | and to investigate the role of Samba at his site. Here are key extracts from this hypothetical
|
|---|
| 44 | report:
|
|---|
| 45 | </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id2610616"></a><a class="indexterm" name="id2610624"></a><a class="indexterm" name="id2610632"></a><a class="indexterm" name="id2610640"></a>
|
|---|
| 46 | ... the implementation of Microsoft Active Directory at the Abmas Video Rentals, Bamingsham site,
|
|---|
| 47 | has been examined. We find no evidence to support a notion that vulnerabilities exist at your site.
|
|---|
| 48 | ... we took additional steps to validate the integrity of the installation and operation of Active
|
|---|
| 49 | Directory and are pleased that your staff are following sound practices.
|
|---|
| 50 | </p><p>
|
|---|
| 51 | ...
|
|---|
| 52 | </p><p><a class="indexterm" name="id2610661"></a><a class="indexterm" name="id2610672"></a><a class="indexterm" name="id2610683"></a><a class="indexterm" name="id2610691"></a><a class="indexterm" name="id2610699"></a><a class="indexterm" name="id2610707"></a>
|
|---|
| 53 | User and group accounts, and respective privileges, have been well thought out. File system shares are
|
|---|
| 54 | appropriately secured. Backup and disaster recovery plans are well managed and validated regularly, and
|
|---|
| 55 | effective off-site storage practices are considered to exceed industry norms.
|
|---|
| 56 | </p><p><a class="indexterm" name="id2610723"></a><a class="indexterm" name="id2610731"></a><a class="indexterm" name="id2610739"></a>
|
|---|
| 57 | Your staff are justifiably concerned that the use of Samba may compromise their good efforts to maintain
|
|---|
| 58 | a secure network.
|
|---|
| 59 | </p><p><a class="indexterm" name="id2610756"></a><a class="indexterm" name="id2610764"></a><a class="indexterm" name="id2610772"></a><a class="indexterm" name="id2610779"></a>
|
|---|
| 60 | The recently installed Linux file and application server uses a tool called <code class="literal">winbind</code>
|
|---|
| 61 | that is indiscriminate about security. All user accounts in Active Directory can be used to access data
|
|---|
| 62 | stored on the Linux system. We are alarmed that secure information is accessible to staff who should
|
|---|
| 63 | not even be aware that it exists. We share the concerns of your network management staff who have gone
|
|---|
| 64 | to great lengths to set fine-grained controls that limit information access to those who need access.
|
|---|
| 65 | It seems incongruous to us that Samba winbind should be permitted to be used considering that it voids this fine work.
|
|---|
| 66 | </p><p><a class="indexterm" name="id2610810"></a><a class="indexterm" name="id2610818"></a><a class="indexterm" name="id2610826"></a>
|
|---|
| 67 | Graham Judd [head of network administration] has locked down the security of all systems and is following
|
|---|
| 68 | the latest Microsoft guidelines. ... null session connections have been disabled ... the internal network
|
|---|
| 69 | is isolated from the outside world, the [product name removed] firewall is under current contract
|
|---|
| 70 | maintenance support from [the manufacturer]. ... our attempts to penetrate security of your systems
|
|---|
| 71 | failed to find problems common to Windows networking sites. We commend your staff on their attention to
|
|---|
| 72 | detail and for following Microsoft recommended best practices.
|
|---|
| 73 | </p><p>
|
|---|
| 74 | ...
|
|---|
| 75 | </p><p><a class="indexterm" name="id2610851"></a><a class="indexterm" name="id2610859"></a><a class="indexterm" name="id2610866"></a><a class="indexterm" name="id2610874"></a>
|
|---|
| 76 | Regarding the use of Samba, we offer the following comments: Samba is in use in nearly half of
|
|---|
| 77 | all sites we have surveyed. ... It is our opinion that Samba offers no better security than Microsoft
|
|---|
| 78 | ... what worries us regarding Samba is the need to disable essential Windows security features such as
|
|---|
| 79 | secure channel support, digital sign'n'seal on all communication traffic, and running Active Directory in
|
|---|
| 80 | mixed mode so that Samba clients and servers can authenticate all of it. Additionally, we are concerned that
|
|---|
| 81 | Samba is not at the full capabilities of Microsoft Windows NT4 server. Microsoft has moved well beyond that
|
|---|
| 82 | with trusted computing initiatives that the Samba developers do not participate in.
|
|---|
| 83 | </p><p><a class="indexterm" name="id2610898"></a><a class="indexterm" name="id2610906"></a><a class="indexterm" name="id2610913"></a><a class="indexterm" name="id2610921"></a><a class="indexterm" name="id2610929"></a><a class="indexterm" name="id2610937"></a><a class="indexterm" name="id2610945"></a>
|
|---|
| 84 | One wonders about the integrity of an open source program that is developed by a team of hackers
|
|---|
| 85 | who cannot be held accountable for the flaws in their code. The sheer number of updates and bug
|
|---|
| 86 | fixes they have released should ring alarm bells in any business.
|
|---|
| 87 | </p><p><a class="indexterm" name="id2610960"></a><a class="indexterm" name="id2610968"></a><a class="indexterm" name="id2610976"></a>
|
|---|
| 88 | Another factor that should be considered is that buying Microsoft products and services helps to
|
|---|
| 89 | provide employment in the IT industry. Samba and Open Source software place those jobs at risk.
|
|---|
| 90 | </p></blockquote></div><p><a class="indexterm" name="id2610991"></a><a class="indexterm" name="id2610999"></a>
|
|---|
| 91 | This is also a challenge to rise above the trouble spot. You call Stan's team together for a simple
|
|---|
| 92 | discussion, but it gets further out of hand. When you return to your office, you find the following
|
|---|
| 93 | email in your in-box:
|
|---|
| 94 | </p><p>
|
|---|
| 95 | Good afternoon,
|
|---|
| 96 | </p><div class="blockquote"><table border="0" width="100%" cellspacing="0" cellpadding="0" class="blockquote" summary="Block quote"><tr><td width="10%" valign="top"> </td><td width="80%" valign="top"><p>
|
|---|
| 97 | I apologize for the leak of internal discussions to the new business. It reflects poorly on our
|
|---|
| 98 | professionalism and has put you in an unpleasant position. I regret the incident.
|
|---|
| 99 | </p><p>
|
|---|
| 100 | I also wish to advise that two of the recent recruits want to implement Kerberos authentication
|
|---|
| 101 | across all systems. I concur with the desire to improve security. One of the new guys who is championing
|
|---|
| 102 | the move to Kerberos was responsible for the comment that caused the embarrassment.
|
|---|
| 103 | </p><p><a class="indexterm" name="id2611036"></a><a class="indexterm" name="id2611043"></a><a class="indexterm" name="id2611051"></a><a class="indexterm" name="id2611059"></a>
|
|---|
| 104 | I am experiencing difficulty in handling the sharp push for Kerberos. He claims that Kerberos, OpenLDAP,
|
|---|
| 105 | plus Samba-3 will seamlessly replace Microsoft Active Directory. I am a little out of my depth with respect
|
|---|
| 106 | to the feasibility of such a move, but have taken steps to pull both of them into line. With your consent,
|
|---|
| 107 | I would like to hire the services of a well-known Samba consultant to set the record straight.
|
|---|
| 108 | </p><p><a class="indexterm" name="id2611078"></a><a class="indexterm" name="id2611085"></a><a class="indexterm" name="id2611093"></a><a class="indexterm" name="id2611101"></a><a class="indexterm" name="id2611109"></a><a class="indexterm" name="id2611117"></a>
|
|---|
| 109 | I intend to use this report to answer the criticism raised and would like to establish a policy that we
|
|---|
| 110 | will approve the use of Microsoft Windows Servers (and Active Directory) subject to all costs being covered
|
|---|
| 111 | out of the budget of the division that wishes to go its own way. I propose that dissenters will still remain
|
|---|
| 112 | responsible to meet the budgeted contribution to IT operations as a whole. I believe we should not coerce
|
|---|
| 113 | use of any centrally proposed standards, but make all noncompliance the financial responsibility of the
|
|---|
| 114 | out-of-step division. Hopefully, this will encourage all divisions to walk with us and not alone.
|
|---|
| 115 | </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Stan</span></td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2611138"></a>Assignment Tasks</h3></div></div></div><p>
|
|---|
| 116 | You agreed with Stan's recommendations and hired a consultant to help defuse the powder
|
|---|
| 117 | keg. The consultant's task is to provide a tractable answer to each of the issues raised. The consultant must be able
|
|---|
| 118 | to support his or her claims, keep emotions to the side, and answer technically.
|
|---|
| 119 | </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2611154"></a>Dissection and Discussion</h2></div></div></div><p><a class="indexterm" name="id2611161"></a><a class="indexterm" name="id2611169"></a><a class="indexterm" name="id2611177"></a><a class="indexterm" name="id2611185"></a><a class="indexterm" name="id2611193"></a><a class="indexterm" name="id2611201"></a><a class="indexterm" name="id2611209"></a>
|
|---|
| 120 | Samba-3 is a tool. No one is pounding your door to make you use Samba. That is a choice that you are free to
|
|---|
| 121 | make or reject. It is likely that your decision to use Samba can greatly benefit your company.
|
|---|
| 122 | The Samba Team obviously believes that the Samba software is a worthy choice.
|
|---|
| 123 | If you hire a consultant to assist with the installation and/or deployment of Samba, or if you hire
|
|---|
| 124 | someone to help manage your Samba installation, you can create income and employment. Alternately,
|
|---|
| 125 | money saved by not spending in the IT area can be spent elsewhere in the business. All money saved
|
|---|
| 126 | or spent creates employment.
|
|---|
| 127 | </p><p><a class="indexterm" name="id2611230"></a><a class="indexterm" name="id2611238"></a><a class="indexterm" name="id2611246"></a><a class="indexterm" name="id2611254"></a><a class="indexterm" name="id2611262"></a>
|
|---|
| 128 | In the long term, the use of Samba must be economically sustainable. In some situations, Samba is adopted
|
|---|
| 129 | purely to provide file and print service interoperability on platforms that otherwise cannot provide
|
|---|
| 130 | access to data and to printers for Microsoft Windows clients. Samba is used by some businesses to
|
|---|
| 131 | effect a reduction in the cost of providing IT services. Obviously, it is also used by some as an
|
|---|
| 132 | alternative to the use of a Microsoft file and print serving platforms with no consideration of costs.
|
|---|
| 133 | </p><p><a class="indexterm" name="id2611282"></a><a class="indexterm" name="id2611290"></a><a class="indexterm" name="id2611298"></a><a class="indexterm" name="id2611306"></a>
|
|---|
| 134 | It would be foolish to adopt a technology that might put any data or users at risk. Security affects
|
|---|
| 135 | everyone. The Samba-Team is fully cognizant of the responsibility they have to their users.
|
|---|
| 136 | The Samba documentation clearly reveals that full responsibility is accepted to fix anything
|
|---|
| 137 | that is broken.
|
|---|
| 138 | </p><p><a class="indexterm" name="id2611322"></a><a class="indexterm" name="id2611330"></a><a class="indexterm" name="id2611338"></a><a class="indexterm" name="id2611346"></a><a class="indexterm" name="id2611358"></a><a class="indexterm" name="id2611366"></a><a class="indexterm" name="id2611374"></a><a class="indexterm" name="id2611382"></a><a class="indexterm" name="id2611389"></a><a class="indexterm" name="id2611397"></a><a class="indexterm" name="id2611405"></a>
|
|---|
| 139 | There is a mistaken perception in the IT industry that commercial software providers are fully
|
|---|
| 140 | accountable for the defects in products. Open Source software comes with no warranty, so it is
|
|---|
| 141 | often assumed that its use confers a higher degree of risk. Everyone should read commercial software
|
|---|
| 142 | End User License Agreements (EULAs). You should determine what real warranty is offered and the
|
|---|
| 143 | extent of liability that is accepted. Doing so soon dispels the popular notion that
|
|---|
| 144 | commercial software vendors are willingly accountable for product defects. In many cases, the
|
|---|
| 145 | commercial vendor accepts liability only to reimburse the price paid for the software.
|
|---|
| 146 | </p><p><a class="indexterm" name="id2611428"></a><a class="indexterm" name="id2611435"></a><a class="indexterm" name="id2611443"></a><a class="indexterm" name="id2611451"></a><a class="indexterm" name="id2611459"></a><a class="indexterm" name="id2611467"></a>
|
|---|
| 147 | The real issues that a consumer (like you) needs answered are What is the way of escape from technical
|
|---|
| 148 | problems, and how long will it take? The average problem turnaround time in the Open Source community is
|
|---|
| 149 | approximately 48 hours. What does the EULA offer? What is the track record in the commercial software
|
|---|
| 150 | industry? What happens when your commercial vendor decides to cease providing support?
|
|---|
| 151 | </p><p><a class="indexterm" name="id2611485"></a><a class="indexterm" name="id2611493"></a><a class="indexterm" name="id2611501"></a><a class="indexterm" name="id2611509"></a><a class="indexterm" name="id2611517"></a><a class="indexterm" name="id2611524"></a><a class="indexterm" name="id2611532"></a>
|
|---|
| 152 | Open Source software at least puts you in possession of the source code. This means that when
|
|---|
| 153 | all else fails, you can hire a programmer to solve the problem.
|
|---|
| 154 | </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2611545"></a>Technical Issues</h3></div></div></div><p>
|
|---|
| 155 | Each issue is now discussed and, where appropriate, example implementation steps are
|
|---|
| 156 | provided.
|
|---|
| 157 | </p><div class="variablelist"><dl><dt><span class="term">Winbind and Security</span></dt><dd><p><a class="indexterm" name="id2611566"></a><a class="indexterm" name="id2611574"></a><a class="indexterm" name="id2611582"></a><a class="indexterm" name="id2611593"></a><a class="indexterm" name="id2611601"></a><a class="indexterm" name="id2611609"></a><a class="indexterm" name="id2611617"></a><a class="indexterm" name="id2611625"></a><a class="indexterm" name="id2611633"></a><a class="indexterm" name="id2611641"></a>
|
|---|
| 158 | Windows network administrators may be dismayed to find that <code class="literal">winbind</code>
|
|---|
| 159 | exposes all domain users so that they may use their domain account credentials to
|
|---|
| 160 | log on to a UNIX/Linux system. The fact that all users in the domain can see the
|
|---|
| 161 | UNIX/Linux server in their Network Neighborhood and can browse the shares on the
|
|---|
| 162 | server seems to excite them further.
|
|---|
| 163 | </p><p><a class="indexterm" name="id2611664"></a><a class="indexterm" name="id2611673"></a><a class="indexterm" name="id2611680"></a><a class="indexterm" name="id2611688"></a>
|
|---|
| 164 | <code class="literal">winbind</code> provides for the UNIX/Linux domain member server or
|
|---|
| 165 | client, the same as one would obtain by adding a Microsoft Windows server or
|
|---|
| 166 | client to the domain. The real objection is the fact that Samba is not MS Windows
|
|---|
| 167 | and therefore requires handling a little differently from the familiar Windows systems.
|
|---|
| 168 | One must recognize fear of the unknown.
|
|---|
| 169 | </p><p><a class="indexterm" name="id2611711"></a><a class="indexterm" name="id2611719"></a><a class="indexterm" name="id2611727"></a><a class="indexterm" name="id2611735"></a><a class="indexterm" name="id2611743"></a><a class="indexterm" name="id2611755"></a>
|
|---|
| 170 | Windows network administrators need to recognize that <code class="literal">winbind</code> does
|
|---|
| 171 | not, and cannot, override account controls set using the Active Directory management
|
|---|
| 172 | tools. The control is the same. Have no fear.
|
|---|
| 173 | </p><p><a class="indexterm" name="id2611775"></a><a class="indexterm" name="id2611783"></a><a class="indexterm" name="id2611794"></a><a class="indexterm" name="id2611802"></a><a class="indexterm" name="id2611810"></a><a class="indexterm" name="id2611818"></a><a class="indexterm" name="id2611826"></a><a class="indexterm" name="id2611834"></a><a class="indexterm" name="id2611842"></a><a class="indexterm" name="id2611850"></a>
|
|---|
| 174 | Where Samba and the ADS domain account information obtained through the use of
|
|---|
| 175 | <code class="literal">winbind</code> permits access, by browsing or by the drive mapping to
|
|---|
| 176 | a share, to data that should be better protected. This can only happen when security
|
|---|
| 177 | controls have not been properly implemented. Samba permits access controls to be set
|
|---|
| 178 | on:
|
|---|
| 179 | </p><div class="itemizedlist"><ul type="disc"><li><p>Shares themselves (i.e., the logical share itself)</p></li><li><p>The share definition in <code class="filename">smb.conf</code></p></li><li><p>The shared directories and files using UNIX permissions</p></li><li><p>Using Windows 2000 ACLs if the file system is POSIX enabled</p></li></ul></div><p>
|
|---|
| 180 | Examples of each are given in <a class="link" href="kerberos.html#ch10expl" title="Implementation">“Implementation”</a>.
|
|---|
| 181 | </p></dd><dt><span class="term">User and Group Controls</span></dt><dd><p><a class="indexterm" name="id2611924"></a><a class="indexterm" name="id2611932"></a><a class="indexterm" name="id2611943"></a><a class="indexterm" name="id2611954"></a><a class="indexterm" name="id2611962"></a><a class="indexterm" name="id2611970"></a><a class="indexterm" name="id2611978"></a><a class="indexterm" name="id2611986"></a><a class="indexterm" name="id2611994"></a>
|
|---|
| 182 | User and group management facilities as known in the Windows ADS environment may be
|
|---|
| 183 | used to provide equivalent access control constraints or to provide equivalent
|
|---|
| 184 | permissions and privileges on Samba servers. Samba offers greater flexibility in the
|
|---|
| 185 | use of user and group controls because it has additional layers of control compared to
|
|---|
| 186 | Windows 200x/XP. For example, access controls on a Samba server may be set within
|
|---|
| 187 | the share definition in a manner for which Windows has no equivalent.
|
|---|
| 188 | </p><p><a class="indexterm" name="id2612014"></a><a class="indexterm" name="id2612022"></a><a class="indexterm" name="id2612030"></a><a class="indexterm" name="id2612037"></a><a class="indexterm" name="id2612049"></a><a class="indexterm" name="id2612057"></a><a class="indexterm" name="id2612065"></a>
|
|---|
| 189 | In any serious analysis of system security, it is important to examine the safeguards
|
|---|
| 190 | that remain when all other protective measures fail. An administrator may inadvertently
|
|---|
| 191 | set excessive permissions on the file system of a shared resource, or he may set excessive
|
|---|
| 192 | privileges on the share itself. If that were to happen in a Windows 2003 Server environment,
|
|---|
| 193 | the data would indeed be laid bare to abuse. Yet, within a Samba share definition, it is
|
|---|
| 194 | possible to guard against that by enforcing controls on the share definition itself. You
|
|---|
| 195 | see a practical example of this a little later in this chapter.
|
|---|
| 196 | </p><p><a class="indexterm" name="id2612097"></a><a class="indexterm" name="id2612105"></a>
|
|---|
| 197 | The report that is critical of Samba really ought to have exercised greater due
|
|---|
| 198 | diligence: the real weakness is on the side of a Microsoft Windows environment.
|
|---|
| 199 | </p></dd><dt><span class="term">Security Overall</span></dt><dd><p><a class="indexterm" name="id2612127"></a>
|
|---|
| 200 | Samba is designed in such a manner that weaknesses inherent in the design of
|
|---|
| 201 | Microsoft Windows networking ought not to expose the underlying UNIX/Linux file
|
|---|
| 202 | system in any way. All software has potential defects, and Samba is no exception.
|
|---|
| 203 | What matters more is how defects that are discovered get dealt with.
|
|---|
| 204 | </p><p><a class="indexterm" name="id2612144"></a><a class="indexterm" name="id2612151"></a><a class="indexterm" name="id2612159"></a><a class="indexterm" name="id2612167"></a>
|
|---|
| 205 | The Samba Team totally agrees with the necessity to observe and fully implement
|
|---|
| 206 | every security facility to provide a level of protection and security that is necessary
|
|---|
| 207 | and that the end user (or network administrator) needs. Never would the Samba Team
|
|---|
| 208 | recommend a compromise to system security, nor would deliberate defoliation of
|
|---|
| 209 | security be publicly condoned; yet this is the practice by many Windows network
|
|---|
| 210 | administrators just to make happy users who have no notion of consequential risk.
|
|---|
| 211 | </p><p><a class="indexterm" name="id2612187"></a><a class="indexterm" name="id2612195"></a><a class="indexterm" name="id2612203"></a><a class="indexterm" name="id2612211"></a><a class="indexterm" name="id2612219"></a><a class="indexterm" name="id2612227"></a><a class="indexterm" name="id2612235"></a>
|
|---|
| 212 | The report condemns Samba for releasing updates and security fixes, yet Microsoft
|
|---|
| 213 | online updates need to be applied almost weekly. The answer to the criticism
|
|---|
| 214 | lies in the fact that Samba development is continuing, documentation is improving,
|
|---|
| 215 | user needs are being increasingly met or exceeded, and security updates are issued
|
|---|
| 216 | with a short turnaround time.
|
|---|
| 217 | </p><p><a class="indexterm" name="id2612252"></a><a class="indexterm" name="id2612260"></a><a class="indexterm" name="id2612268"></a><a class="indexterm" name="id2612276"></a><a class="indexterm" name="id2612284"></a>
|
|---|
| 218 | The release of Samba-4 is expected around late 2004 to early 2005 and involves a near
|
|---|
| 219 | complete rewrite to permit extensive modularization and to prepare Samba for new
|
|---|
| 220 | functionality planned for addition during the next-generation series. The Samba Team
|
|---|
| 221 | is responsible and can be depended upon; the history to date suggests a high
|
|---|
| 222 | degree of dependability and on charter development consistent with published
|
|---|
| 223 | roadmap projections.
|
|---|
| 224 | </p><p><a class="indexterm" name="id2612307"></a><a class="indexterm" name="id2612315"></a><a class="indexterm" name="id2612326"></a><a class="indexterm" name="id2612338"></a><a class="indexterm" name="id2612346"></a><a class="indexterm" name="id2612354"></a><a class="indexterm" name="id2612362"></a>
|
|---|
| 225 | Not well published is the fact that Microsoft was a foundation member of
|
|---|
| 226 | the Common Internet File System (CIFS) initiative, together with the participation
|
|---|
| 227 | of the network attached storage (NAS) industry. Unfortunately, for the past few years,
|
|---|
| 228 | Microsoft has been absent from active involvement at CIFS conferences and has
|
|---|
| 229 | not exercised the leadership expected of a major force in the networking technology
|
|---|
| 230 | space. The Samba Team has maintained consistent presence and leadership at all
|
|---|
| 231 | CIFS conferences and at the interoperability laboratories run concurrently with
|
|---|
| 232 | them.
|
|---|
| 233 | </p></dd><dt><span class="term">Cryptographic Controls (schannel, sign'n'seal)</span></dt><dd><p><a class="indexterm" name="id2612391"></a><a class="indexterm" name="id2612399"></a><a class="indexterm" name="id2612407"></a>
|
|---|
| 234 | The report correctly mentions that Samba did not support the most recent
|
|---|
| 235 | <code class="constant">schannel</code> and <code class="constant">digital sign'n'seal</code> features
|
|---|
| 236 | of Microsoft Windows NT/200x/XPPro products. This is one of the key features
|
|---|
| 237 | of the Samba-3 release. Market research reports take so long to generate that they are
|
|---|
| 238 | seldom a reflection of current practice, and in many respects reports are like a
|
|---|
| 239 | pathology report they reflect accurately (at best) status at a snapshot in time.
|
|---|
| 240 | Meanwhile, the world moves on.
|
|---|
| 241 | </p><p><a class="indexterm" name="id2612437"></a><a class="indexterm" name="id2612445"></a><a class="indexterm" name="id2612453"></a><a class="indexterm" name="id2612460"></a><a class="indexterm" name="id2612468"></a><a class="indexterm" name="id2612483"></a><a class="indexterm" name="id2612491"></a>
|
|---|
| 242 | It should be pointed out that had clear public specifications for the protocols
|
|---|
| 243 | been published, it would have been much easier to implement these features and would have
|
|---|
| 244 | taken less time to do. The sole mechanism used to find an algorithm that is compatible
|
|---|
| 245 | with the methods used by Microsoft has been based on observation of network traffic
|
|---|
| 246 | and trial-and-error implementation of potential techniques. The real value of public
|
|---|
| 247 | and defensible standards is obvious to all and would have enabled more secure networking
|
|---|
| 248 | for everyone.
|
|---|
| 249 | </p><p><a class="indexterm" name="id2612512"></a><a class="indexterm" name="id2612520"></a>
|
|---|
| 250 | Critics of Samba often ignore fundamental problems that may plague (or may have plagued)
|
|---|
| 251 | the users of Microsoft's products also. Those who are first to criticize Samba
|
|---|
| 252 | for not rushing into release of <code class="constant">digital sign'n'seal</code> support
|
|---|
| 253 | often dismiss the problems that Microsoft has
|
|---|
| 254 | <a class="ulink" href="http://support.microsoft.com/default.aspx?kbid=321733" target="_top">acknowledged</a>
|
|---|
| 255 | and for which a fix was provided. In fact,
|
|---|
| 256 | <a class="ulink" href="http://www.tangent-systems.com/support/delayedwrite.html" target="_top">Tangent Systems</a>
|
|---|
| 257 | have documented a significant problem with delays writes that can be connected with the
|
|---|
| 258 | implementation of sign'n'seal. They provide a work-around that is not trivial for many
|
|---|
| 259 | Windows networking sites. From notes such as this it is clear that there are benefits
|
|---|
| 260 | from not rushing new technology out of the door too soon.
|
|---|
| 261 | </p><p><a class="indexterm" name="id2612560"></a><a class="indexterm" name="id2612568"></a><a class="indexterm" name="id2612576"></a><a class="indexterm" name="id2612584"></a><a class="indexterm" name="id2612592"></a><a class="indexterm" name="id2612600"></a><a class="indexterm" name="id2612608"></a><a class="indexterm" name="id2612616"></a><a class="indexterm" name="id2612624"></a>
|
|---|
| 262 | One final comment is warranted. If companies want more secure networking protocols,
|
|---|
| 263 | the most effective method by which this can be achieved is by users seeking
|
|---|
| 264 | and working together to help define open and publicly refereed standards. The
|
|---|
| 265 | development of closed source, proprietary methods that are developed in a
|
|---|
| 266 | clandestine framework of secrecy, under claims of digital rights protection, does
|
|---|
| 267 | not favor the diffusion of safe networking protocols and certainly does not
|
|---|
| 268 | help the consumer to make a better choice.
|
|---|
| 269 | </p></dd><dt><span class="term">Active Directory Replacement with Kerberos, LDAP, and Samba
|
|---|
| 270 | <a class="indexterm" name="id2612649"></a><a class="indexterm" name="id2612661"></a><a class="indexterm" name="id2612669"></a><a class="indexterm" name="id2612677"></a>
|
|---|
| 271 |
|
|---|
| 272 | </span></dt><dd><p>
|
|---|
| 273 | </p><div class="literallayout"><p> </p></div><p>
|
|---|
| 274 | The Microsoft networking protocols extensively make use of remote procedure call (RPC)
|
|---|
| 275 | technology. Active Directory is not a simple mixture of LDAP and Kerberos together
|
|---|
| 276 | with file and print services, but rather is a complex, intertwined implementation
|
|---|
| 277 | of them that uses RPCs that are not supported by any of these component technologies
|
|---|
| 278 | and yet by which they are made to interoperate in ways that the components do not
|
|---|
| 279 | support.
|
|---|
| 280 | </p><p><a class="indexterm" name="id2612711"></a><a class="indexterm" name="id2612723"></a><a class="indexterm" name="id2612731"></a><a class="indexterm" name="id2612739"></a><a class="indexterm" name="id2612747"></a>
|
|---|
| 281 | In order to make the popular request for Samba to be an Active Directory Server a
|
|---|
| 282 | reality, it is necessary to add to OpenLDAP, Kerberos, as well as Samba, RPC calls
|
|---|
| 283 | that are not presently supported. The Samba Team has not been able to gain critical
|
|---|
| 284 | overall support for all project maintainers to work together on the complex
|
|---|
| 285 | challenge of developing and integrating the necessary technologies. Therefore, if
|
|---|
| 286 | the Samba Team does not make it a priority to absorb Kerberos and LDAP functionality
|
|---|
| 287 | into the Samba project, this dream request cannot become a reality.
|
|---|
| 288 | </p><p><a class="indexterm" name="id2612768"></a><a class="indexterm" name="id2612776"></a><a class="indexterm" name="id2612784"></a><a class="indexterm" name="id2612795"></a><a class="indexterm" name="id2612802"></a>
|
|---|
| 289 | At this time, the integration of LDAP, Kerberos, and the missing RPCs is not on the
|
|---|
| 290 | Samba development roadmap. If it is not on the published roadmap, it cannot be delivered
|
|---|
| 291 | anytime soon. Ergo, ADS server support is not a current goal for Samba development.
|
|---|
| 292 | The Samba Team is most committed to permitting Samba to be a full ADS domain member
|
|---|
| 293 | that is increasingly capable of being managed using Microsoft Windows MMC tools.
|
|---|
| 294 | </p></dd></dl></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2612822"></a>Kerberos Exposed</h4></div></div></div><p><a class="indexterm" name="id2612829"></a><a class="indexterm" name="id2612837"></a><a class="indexterm" name="id2612845"></a>
|
|---|
| 295 | Kerberos is a network authentication protocol that provides secure authentication for
|
|---|
| 296 | client-server applications by using secret-key cryptography. Firewalls are an insufficient
|
|---|
| 297 | barrier mechanism in today's networking world; at best they only restrict incoming network
|
|---|
| 298 | traffic but cannot prevent network traffic that comes from authorized locations from
|
|---|
| 299 | performing unauthorized activities.
|
|---|
| 300 | </p><p><a class="indexterm" name="id2612863"></a><a class="indexterm" name="id2612871"></a><a class="indexterm" name="id2612879"></a>
|
|---|
| 301 | Kerberos was created by MIT as a solution to network security problems. The Kerberos protocol uses
|
|---|
| 302 | strong cryptography so that a client can prove its identity to a server (and vice versa) across an
|
|---|
| 303 | insecure network connection. After a client and server has used Kerberos to prove their identity,
|
|---|
| 304 | they can also encrypt all of their communications to assure privacy and data integrity as they go
|
|---|
| 305 | about their business.
|
|---|
| 306 | </p><p><a class="indexterm" name="id2612897"></a><a class="indexterm" name="id2612905"></a><a class="indexterm" name="id2612913"></a><a class="indexterm" name="id2612921"></a><a class="indexterm" name="id2612932"></a>
|
|---|
| 307 | Kerberos is a trusted third-party service. That means that there is a third party (the kerberos
|
|---|
| 308 | server) that is trusted by all the entities on the network (users and services, usually called
|
|---|
| 309 | principals). All principals share a secret password (or key) with the kerberos server and this
|
|---|
| 310 | enables principals to verify that the messages from the kerberos server are authentic. Therefore,
|
|---|
| 311 | trusting the kerberos server, users and services can authenticate each other.
|
|---|
| 312 | </p><p>
|
|---|
| 313 | <a class="indexterm" name="id2612952"></a>
|
|---|
| 314 | <a class="indexterm" name="id2612959"></a>
|
|---|
| 315 | <a class="indexterm" name="id2612966"></a>
|
|---|
| 316 | Kerberos was, until recently, a technology that was restricted from being exported from the United States.
|
|---|
| 317 | For many years that hindered global adoption of more secure networking technologies both within the United States
|
|---|
| 318 | and abroad. A free and unencumbered implementation of MIT Kerberos has been produced in Europe
|
|---|
| 319 | and is available from the <a class="ulink" href="http://www.pdc.kth.se/heimdal/" target="_top">Royal Institute</a> of
|
|---|
| 320 | Technology (KTH), Sweden. It is known as the Heimdal Kerberos project. In recent times the U.S. government
|
|---|
| 321 | has removed sanctions affecting the global distribution of MIT Kerberos. It is likely that there will be a
|
|---|
| 322 | significant surge forward in the development of Kerberos-enabled applications and in the general deployment
|
|---|
| 323 | and use of Kerberos across the spectrum of the information technology industry.
|
|---|
| 324 | </p><p>
|
|---|
| 325 | <a class="indexterm" name="id2612995"></a>
|
|---|
| 326 | A storm has broken out concerning interoperability between MIT Kerberos and Microsofts' implementation
|
|---|
| 327 | of it. For example, a 2002
|
|---|
| 328 | <a class="ulink" href="http://www.idg.com.sg/idgwww.nsf/0/5DDA8D153A7505A748256BAB000D992A?OpenDocument" target="_top">IDG</a>
|
|---|
| 329 | report<sup>[<a name="id2613014" href="#ftn.id2613014" class="footnote">13</a>]</sup> by
|
|---|
| 330 | states:
|
|---|
| 331 | </p><div class="blockquote"><blockquote class="blockquote"><p>
|
|---|
| 332 | A Microsoft Corp. executive testified at the software giant's remedy hearing that the company goes to
|
|---|
| 333 | great lengths to disclose interfaces and protocols that allow third-party software products to interact
|
|---|
| 334 | with Windows. But a lawyer with the states suing Microsoft pointed out that when it comes to the company's
|
|---|
| 335 | use of the Kerberos authentication specification, not everyone agrees.
|
|---|
| 336 | </p><p>
|
|---|
| 337 | <a class="indexterm" name="id2613041"></a>
|
|---|
| 338 | Robert Short, vice president of Windows core technology at Microsoft, wrote in his direct testimony prepared
|
|---|
| 339 | before his appearance that non-Microsoft operating systems can disregard the portion of the Kerberos version
|
|---|
| 340 | 5 specification that Windows clients use for proprietary purposes and still achieve interoperability with
|
|---|
| 341 | the Microsoft OS. Microsoft takes advantage of unspecified fields in the Kerberos specification for storing
|
|---|
| 342 | Windows-specific authorization data, Short wrote. The designers of Kerberos left these fields undefined so
|
|---|
| 343 | that software developers could add their own authorization information, he said.
|
|---|
| 344 | </p></blockquote></div><p>
|
|---|
| 345 | <a class="indexterm" name="id2613065"></a>
|
|---|
| 346 | <a class="indexterm" name="id2613071"></a>
|
|---|
| 347 | It so happens that Microsoft Windows clients depend on and expect the contents of the <span class="emphasis"><em>unspecified
|
|---|
| 348 | fields</em></span> in the Kerberos 5 communications data stream for their Windows interoperability,
|
|---|
| 349 | particularly when Samba is expected to emulate a Windows Server 200x domain controller. But the interoperability
|
|---|
| 350 | issue goes far deeper than this. In the domain control protocols that are used by MS Windows XP Professional,
|
|---|
| 351 | there is a tight interdependency between the Kerberos protocols and the Microsoft distributed computing environment
|
|---|
| 352 | (DCE) RPCs that themselves are an integral part of the SMB/CIFS protocols as used by
|
|---|
| 353 | Microsoft.
|
|---|
| 354 | </p><p>
|
|---|
| 355 | Microsoft makes the following comment in a reference in a
|
|---|
| 356 | <a class="ulink" href="http://www.microsoft.com/technet/itsolutions/interop/mgmt/kerberos.asp" target="_top">
|
|---|
| 357 | technet</a> article:
|
|---|
| 358 | </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id2613106"></a><a class="indexterm" name="id2613118"></a>
|
|---|
| 359 | The DCE Security Services are also layered on the Kerberos protocol. DCE authentication services use RPC
|
|---|
| 360 | representation of Kerberos protocol messages. In addition, DCE uses the authorization data field in Kerberos
|
|---|
| 361 | tickets to convey Privilege Attribute Certificates (PACs) that define user identity and group membership.
|
|---|
| 362 | The DCE PAC is used in a similar manner as Windows NT Security IDs for user authorization and access control.
|
|---|
| 363 | Windows NT services will not be able to translate DCE PACs into Windows NT user and group identifiers. This
|
|---|
| 364 | is not an issue with Kerberos interoperability, but rather an issue of interoperability between DCE and
|
|---|
| 365 | Windows NT access control information.
|
|---|
| 366 | </p></blockquote></div></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch10expl"></a>Implementation</h2></div></div></div><p>
|
|---|
| 367 | The following procedures outline the implementation of the security measures discussed so far.
|
|---|
| 368 | </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2613169"></a>Share Access Controls</h3></div></div></div><p><a class="indexterm" name="id2613176"></a><a class="indexterm" name="id2613184"></a><a class="indexterm" name="id2613192"></a>
|
|---|
| 369 | Access control entries placed on the share itself act as a filter at the time a when CIFS/SMB client (such as
|
|---|
| 370 | Windows XP Pro) attempts to make a connection to the Samba server.
|
|---|
| 371 | </p><div class="procedure"><a name="id2613205"></a><p class="title"><b>Procedure 11.1. Create/Edit/Delete Share ACLs</b></p><ol type="1"><li><p><a class="indexterm" name="id2613216"></a><a class="indexterm" name="id2613224"></a>
|
|---|
| 372 | From a Windows 200x/XP Professional workstation, log on to the domain using the Domain Administrator
|
|---|
| 373 | account (on Samba domains, this is usually the account called <code class="constant">root</code>).
|
|---|
| 374 | </p></li><li><p>
|
|---|
| 375 | Click
|
|---|
| 376 | <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Control Panel</span> → <span class="guimenuitem">Administrative Tools</span> → <span class="guimenuitem">Computer Management</span>.
|
|---|
| 377 | </p></li><li><p>
|
|---|
| 378 | In the left panel,
|
|---|
| 379 | <span class="guimenu">[Right mouse menu item] Computer Management (Local)</span> → <span class="guimenuitem">Connect to another computer ...</span> → <span class="guimenuitem">Browse...</span> → <span class="guimenuitem">Advanced</span> → <span class="guimenuitem">Find Now</span>. In the lower panel, click on the name of the server you wish to
|
|---|
| 380 | administer. Click <span class="guimenu">OK</span> → <span class="guimenuitem">OK</span> → <span class="guimenuitem">OK</span>.<a class="indexterm" name="id2613347"></a>
|
|---|
| 381 | In the left panel, the entry <span class="guimenu">Computer Management (Local)</span> should now reflect
|
|---|
| 382 | the change made. For example, if the server you are administering is called <code class="constant">FRODO</code>,
|
|---|
| 383 | the Computer Management entry should now say <span class="guimenu">Computer Management (FRODO)</span>.
|
|---|
| 384 | </p></li><li><p>
|
|---|
| 385 | In the left panel, click <span class="guimenu">Computer Management (FRODO)</span> → <span class="guimenuitem">[+] Shared Folders</span> → <span class="guimenuitem">Shares</span>.
|
|---|
| 386 | </p></li><li><p><a class="indexterm" name="id2613411"></a><a class="indexterm" name="id2613419"></a>
|
|---|
| 387 | In the right panel, double-click on the share on which you wish to set/edit ACLs. This
|
|---|
| 388 | will bring up the Properties panel. Click the <span class="guimenu">Share Permissions</span> tab.
|
|---|
| 389 | </p></li><li><p><a class="indexterm" name="id2613442"></a><a class="indexterm" name="id2613450"></a><a class="indexterm" name="id2613458"></a><a class="indexterm" name="id2613466"></a><a class="indexterm" name="id2613474"></a><a class="indexterm" name="id2613482"></a>
|
|---|
| 390 | You may now edit/add/remove access control settings. Be very careful. Many problems have been
|
|---|
| 391 | created by people who decided that everyone should be rejected but one particular group should
|
|---|
| 392 | have full control. This is a catch-22 situation because members of that particular group also
|
|---|
| 393 | belong to the group <code class="constant">Everyone</code>, which therefore overrules any permissions
|
|---|
| 394 | set for the permitted group.
|
|---|
| 395 | </p></li><li><p>
|
|---|
| 396 | When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span>
|
|---|
| 397 | buttons.
|
|---|
| 398 | </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2613518"></a>Share Definition Controls</h3></div></div></div><p><a class="indexterm" name="id2613525"></a><a class="indexterm" name="id2613536"></a><a class="indexterm" name="id2613544"></a><a class="indexterm" name="id2613552"></a><a class="indexterm" name="id2613560"></a><a class="indexterm" name="id2613568"></a>
|
|---|
| 399 | Share-definition-based access controls can be used like a checkpoint or like a pile-driver. Just as a
|
|---|
| 400 | checkpoint can be used to require someone who wants to get through to meet certain requirements, so
|
|---|
| 401 | it is possible to require the user (or group the user belongs to) to meet specified credential-related
|
|---|
| 402 | objectives. It can be likened to a pile-driver by overriding default controls in that having met the
|
|---|
| 403 | credential-related objectives, the user can be granted powers and privileges that would not normally be
|
|---|
| 404 | available under default settings.
|
|---|
| 405 | </p><p><a class="indexterm" name="id2613588"></a><a class="indexterm" name="id2613596"></a><a class="indexterm" name="id2613604"></a><a class="indexterm" name="id2613612"></a>
|
|---|
| 406 | It must be emphasized that the controls discussed here can act as a filter or give rights of passage
|
|---|
| 407 | that act as a superstructure over normal directory and file access controls. However, share-level
|
|---|
| 408 | ACLs act at a higher level than do share definition controls because the user must filter through the
|
|---|
| 409 | share-level controls to get to the share-definition controls. The proper hierarchy of controls implemented
|
|---|
| 410 | by Samba and Windows networking consists of:
|
|---|
| 411 | </p><div class="orderedlist"><ol type="1"><li><p>Share-level ACLs</p></li><li><p>Share-definition controls</p></li><li><p>Directory and file permissions</p></li><li><p>Directory and file POSIX ACLs</p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2613658"></a>Checkpoint Controls</h4></div></div></div><p><a class="indexterm" name="id2613664"></a>
|
|---|
| 412 | Consider the following extract from a <code class="filename">smb.conf</code> file defining the share called <code class="constant">Apps</code>:
|
|---|
| 413 | </p><pre class="screen">
|
|---|
| 414 | [Apps]
|
|---|
| 415 | comment = Application Share
|
|---|
| 416 | path = /data/apps
|
|---|
| 417 | read only = Yes
|
|---|
| 418 | valid users = @Employees
|
|---|
| 419 | </pre><p>
|
|---|
| 420 | This definition permits only those who are members of the group called <code class="constant">Employees</code> to
|
|---|
| 421 | access the share.
|
|---|
| 422 | </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p><a class="indexterm" name="id2613700"></a><a class="indexterm" name="id2613711"></a><a class="indexterm" name="id2613720"></a><a class="indexterm" name="id2613728"></a><a class="indexterm" name="id2613735"></a>
|
|---|
| 423 | On domain member servers and clients, even when the <em class="parameter"><code>winbind use default domain</code></em> has
|
|---|
| 424 | been specified, the use of domain accounts in security controls requires fully qualified domain specification,
|
|---|
| 425 | for example, <a class="link" href="smb.conf.5.html#VALIDUSERS" target="_top">valid users = @"MEGANET\Northern Engineers"</a>.
|
|---|
| 426 | Note the necessity to use the double quotes to avoid having the space in the Windows group name interpreted as a
|
|---|
| 427 | delimiter.
|
|---|
| 428 | </p></div><p><a class="indexterm" name="id2613771"></a><a class="indexterm" name="id2613778"></a><a class="indexterm" name="id2613786"></a>
|
|---|
| 429 | If there is an ACL on the share itself to permit read/write access for all <code class="constant">Employees</code>
|
|---|
| 430 | as well as read/write for the group <code class="constant">Doctors</code>, both groups are permitted through
|
|---|
| 431 | to the share. However, at the moment an attempt is made to set up a connection to the share, a member of
|
|---|
| 432 | the group <code class="constant">Doctors</code>, who is not also a member of the group <code class="constant">Employees</code>,
|
|---|
| 433 | would immediately fail to validate.
|
|---|
| 434 | </p><p><a class="indexterm" name="id2613817"></a>
|
|---|
| 435 | Consider another example. In this case, you want to permit all members of the group <code class="constant">Employees</code>
|
|---|
| 436 | except the user <code class="constant">patrickj</code> to access the <code class="constant">Apps</code> share. This can be
|
|---|
| 437 | easily achieved by setting a share-level ACL permitting only <code class="constant">Employees</code> to access the share,
|
|---|
| 438 | and then in the share definition controls excluding just <code class="constant">patrickj</code>. Here is how that might
|
|---|
| 439 | be done:
|
|---|
| 440 | </p><pre class="screen">
|
|---|
| 441 | [Apps]
|
|---|
| 442 | comment = Application Share
|
|---|
| 443 | path = /data/apps
|
|---|
| 444 | read only = Yes
|
|---|
| 445 | invalid users = patrickj
|
|---|
| 446 | </pre><p>
|
|---|
| 447 | <a class="indexterm" name="id2613858"></a>
|
|---|
| 448 | Let us assume that you want to permit the user <code class="constant">gbshaw</code> to manage any file in the
|
|---|
| 449 | UNIX/Linux file system directory <code class="filename">/data/apps</code>, but you do not want to grant any write
|
|---|
| 450 | permissions beyond that directory tree. Here is one way this can be done:
|
|---|
| 451 | </p><pre class="screen">
|
|---|
| 452 | [Apps]
|
|---|
| 453 | comment = Application Share
|
|---|
| 454 | path = /data/apps
|
|---|
| 455 | read only = Yes
|
|---|
| 456 | invalid users = patrickj
|
|---|
| 457 | admin users = gbshaw
|
|---|
| 458 | </pre><p>
|
|---|
| 459 | <a class="indexterm" name="id2613888"></a>
|
|---|
| 460 | Now we have a set of controls that permits only <code class="constant">Employees</code> who are also members of
|
|---|
| 461 | the group <code class="constant">Doctors</code>, excluding the user <code class="constant">patrickj</code>, to have
|
|---|
| 462 | read-only privilege, but the user <code class="constant">gbshaw</code> is granted administrative rights.
|
|---|
| 463 | The administrative rights conferred upon the user <code class="constant">gbshaw</code> permit operation as
|
|---|
| 464 | if that user has logged in as the user <code class="constant">root</code> on the UNIX/Linux system and thus,
|
|---|
| 465 | for access to the directory tree that has been shared (exported), permit the user to override controls
|
|---|
| 466 | that apply to all other users on that resource.
|
|---|
| 467 | </p><p>
|
|---|
| 468 | There are additional checkpoint controls that may be used. For example, if for the same share we now
|
|---|
| 469 | want to provide the user <code class="constant">peters</code> with the ability to write to one directory to
|
|---|
| 470 | which he has write privilege in the UNIX file system, you can specifically permit that with the
|
|---|
| 471 | following settings:
|
|---|
| 472 | </p><pre class="screen">
|
|---|
| 473 | [Apps]
|
|---|
| 474 | comment = Application Share
|
|---|
| 475 | path = /data/apps
|
|---|
| 476 | read only = Yes
|
|---|
| 477 | invalid users = patrickj
|
|---|
| 478 | admin users = gbshaw
|
|---|
| 479 | write list = peters
|
|---|
| 480 | </pre><p>
|
|---|
| 481 | <a class="indexterm" name="id2613948"></a>
|
|---|
| 482 | This is a particularly complex example at this point, but it begins to demonstrate the possibilities.
|
|---|
| 483 | You should refer to the online manual page for the <code class="filename">smb.conf</code> file for more information regarding
|
|---|
| 484 | the checkpoint controls that Samba implements.
|
|---|
| 485 | </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2613970"></a>Override Controls</h4></div></div></div><p><a class="indexterm" name="id2613977"></a>
|
|---|
| 486 | Override controls implemented by Samba permit actions like the adoption of a different identity
|
|---|
| 487 | during file system operations, the forced overwriting of normal file and directory permissions,
|
|---|
| 488 | and so on. You should refer to the online manual page for the <code class="filename">smb.conf</code> file for more information regarding
|
|---|
| 489 | the override controls that Samba implements.
|
|---|
| 490 | </p><p>
|
|---|
| 491 | In the following example, you want to create a Windows networking share that any user can access.
|
|---|
| 492 | However, you want all read and write operations to be performed as if the user <code class="constant">billc</code>
|
|---|
| 493 | and member of the group <code class="constant">Mentors</code> read/write the files. Here is one way this
|
|---|
| 494 | can be done:
|
|---|
| 495 | </p><pre class="screen">
|
|---|
| 496 | [someshare]
|
|---|
| 497 | comment = Some Files Everyone May Overwrite
|
|---|
| 498 | path = /data/somestuff
|
|---|
| 499 | read only = No
|
|---|
| 500 | force user = billc
|
|---|
| 501 | force group = Mentors
|
|---|
| 502 | </pre><p>
|
|---|
| 503 | <a class="indexterm" name="id2614020"></a><a class="indexterm" name="id2614028"></a>
|
|---|
| 504 | That is all there is to it. Well, it is almost that simple. The downside of this method is that
|
|---|
| 505 | users are logged onto the Windows client as themselves, and then immediately before accessing the
|
|---|
| 506 | file, Samba makes system calls to change the effective user and group to the forced settings
|
|---|
| 507 | specified, completes the file transaction, and then reverts to the actually logged-on identity.
|
|---|
| 508 | This imposes significant overhead on Samba. The alternative way to effectively achieve the same result
|
|---|
| 509 | (but with lower system CPU overheads) is described next.
|
|---|
| 510 | </p><p><a class="indexterm" name="id2614049"></a><a class="indexterm" name="id2614057"></a><a class="indexterm" name="id2614065"></a><a class="indexterm" name="id2614076"></a><a class="indexterm" name="id2614084"></a>
|
|---|
| 511 | The use of the <em class="parameter"><code>force user</code></em> or the <em class="parameter"><code>force group</code></em> may
|
|---|
| 512 | also have a severe impact on system (particularly on Windows client) performance. If opportunistic
|
|---|
| 513 | locking is enabled on the share (the default), it causes an <code class="constant">oplock break</code> to be
|
|---|
| 514 | sent to the client even if the client has not opened the file. On networks that have high traffic
|
|---|
| 515 | density, or on links that are routed to a remote network segment, <code class="constant">oplock breaks</code>
|
|---|
| 516 | can be lost. This results in possible retransmission of the request, or the client may time-out while
|
|---|
| 517 | waiting for the file system transaction (read or write) to complete. The result can be a profound
|
|---|
| 518 | apparent performance degradation as the client continually attempts to reconnect to overcome the
|
|---|
| 519 | effect of the lost <code class="constant">oplock break</code>, or time-out.
|
|---|
| 520 | </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2614131"></a>Share Point Directory and File Permissions</h3></div></div></div><p><a class="indexterm" name="id2614138"></a><a class="indexterm" name="id2614146"></a><a class="indexterm" name="id2614154"></a><a class="indexterm" name="id2614162"></a>
|
|---|
| 521 | Samba has been designed and implemented so that it respects as far as is feasible the security and
|
|---|
| 522 | user privilege controls that are built into the UNIX/Linux operating system. Samba does nothing
|
|---|
| 523 | with respect to file system access that violates file system permission settings, unless it is
|
|---|
| 524 | explicitly instructed to do otherwise through share definition controls. Given that Samba obeys
|
|---|
| 525 | UNIX file system controls, this chapter does not document simple information that can be obtained
|
|---|
| 526 | from a basic UNIX training guide. Instead, one common example of a typical problem is used
|
|---|
| 527 | to demonstrate the most effective solution referred to in the immediately preceding paragraph.
|
|---|
| 528 | </p><p><a class="indexterm" name="id2614185"></a><a class="indexterm" name="id2614193"></a><a class="indexterm" name="id2614201"></a>
|
|---|
| 529 | One of the common issues that repeatedly pops up on the Samba mailing lists involves the saving of
|
|---|
| 530 | Microsoft Office files (Word and Excel) to a network drive. Here is the typical sequence:
|
|---|
| 531 | </p><div class="orderedlist"><ol type="1"><li><p>
|
|---|
| 532 | A user opens a Word document from a network drive. The file was owned by user <code class="constant">janetp</code>
|
|---|
| 533 | and <code class="constant">users</code>, and was set read/write-enabled for everyone.
|
|---|
| 534 | </p></li><li><p>
|
|---|
| 535 | File changes and edits are made.
|
|---|
| 536 | </p></li><li><p>
|
|---|
| 537 | The file is saved, and MS Word is closed.
|
|---|
| 538 | </p></li><li><p>
|
|---|
| 539 | The file is now owned by the user <code class="constant">billc</code> and group <code class="constant">doctors</code>,
|
|---|
| 540 | and is set read/write by <code class="constant">billc</code>, read-only by <code class="constant">doctors</code>, and
|
|---|
| 541 | no access by everyone.
|
|---|
| 542 | </p></li><li><p>
|
|---|
| 543 | The original owner cannot now access her own file and is “<span class="quote">justifiably</span>” upset.
|
|---|
| 544 | </p></li></ol></div><p>
|
|---|
| 545 | There have been many postings over the years that report the same basic problem. Frequently Samba users
|
|---|
| 546 | want to know when this “<span class="quote">bug</span>” will be fixed. The fact is, this is not a bug in Samba at all.
|
|---|
| 547 | Here is the real sequence of what happens in this case.
|
|---|
| 548 | </p><p><a class="indexterm" name="id2614288"></a><a class="indexterm" name="id2614296"></a><a class="indexterm" name="id2614304"></a>
|
|---|
| 549 | When the user saves a file, MS Word creates a new (temporary) file. This file is naturally owned
|
|---|
| 550 | by the user who creates the file (<code class="constant">billc</code>) and has the permissions that follow
|
|---|
| 551 | that user's default settings within the operating system (UNIX/Linux). When MS Word has finished writing
|
|---|
| 552 | the file to disk, it then renames the new (temporary) file to the name of the old one. MS Word does not
|
|---|
| 553 | change the ownership or permissions to what they were on the original file. The file is thus a totally
|
|---|
| 554 | new file, and the old one has been deleted in the process.
|
|---|
| 555 | </p><p>
|
|---|
| 556 | Samba received a request to create a new file, and then to rename the file to a new name. The old file that
|
|---|
| 557 | has the same name is now automatically deleted. Samba has no way of knowing that the new file should
|
|---|
| 558 | perhaps have the same ownership and permissions as the old file. To Samba, these are entirely independent
|
|---|
| 559 | operations.
|
|---|
| 560 | </p><p>
|
|---|
| 561 | The question is, “<span class="quote">How can we solve the problem?</span>”
|
|---|
| 562 | </p><p>
|
|---|
| 563 | The solution is simple. Use UNIX file system permissions and controls to your advantage. Follow these
|
|---|
| 564 | simple steps to create a share in which all files will consistently be owned by the same user and the
|
|---|
| 565 | same group:
|
|---|
| 566 | </p><div class="procedure"><a name="id2614351"></a><p class="title"><b>Procedure 11.2. Using Directory Permissions to Force File User and Group Ownership</b></p><ol type="1"><li><p>
|
|---|
| 567 | Change your share definition so that it matches this pattern:
|
|---|
| 568 | </p><pre class="screen">
|
|---|
| 569 | [finance]
|
|---|
| 570 | path = /usr/data/finance
|
|---|
| 571 | browseable = Yes
|
|---|
| 572 | read only = No
|
|---|
| 573 | </pre><p>
|
|---|
| 574 | </p></li><li><p><a class="indexterm" name="id2614377"></a><a class="indexterm" name="id2614388"></a>
|
|---|
| 575 | Set consistent user and group permissions recursively down the directory tree as shown here:
|
|---|
| 576 | </p><pre class="screen">
|
|---|
| 577 | <code class="prompt">root# </code> chown -R janetp.users /usr/data/finance
|
|---|
| 578 | </pre><p>
|
|---|
| 579 | </p></li><li><p><a class="indexterm" name="id2614420"></a>
|
|---|
| 580 | Set the files and directory permissions to be read/write for owner and group, and not accessible
|
|---|
| 581 | to others (everyone), using the following command:
|
|---|
| 582 | </p><pre class="screen">
|
|---|
| 583 | <code class="prompt">root# </code> chmod ug+rwx,o-rwx /usr/data/finance
|
|---|
| 584 | </pre><p>
|
|---|
| 585 | </p></li><li><p><a class="indexterm" name="id2614449"></a>
|
|---|
| 586 | Set the SGID (supergroup) bit on all directories from the top down. This means all files
|
|---|
| 587 | can be created with the permissions of the group set on the directory. It means all users
|
|---|
| 588 | who are members of the group <code class="constant">finance</code> can read and write all files in
|
|---|
| 589 | the directory. The directory is not readable or writable by anyone who is not in the
|
|---|
| 590 | <code class="constant">finance</code> group. Simply follow this example:
|
|---|
| 591 | </p><pre class="screen">
|
|---|
| 592 | <code class="prompt">root# </code> find /usr/data/finance -type d -exec chmod ug+s {}\;
|
|---|
| 593 | </pre><p>
|
|---|
| 594 |
|
|---|
| 595 | </p></li><li><p><a class="indexterm" name="id2614489"></a><a class="indexterm" name="id2614497"></a><a class="indexterm" name="id2614505"></a>
|
|---|
| 596 | Make sure all users that must have read/write access to the directory have
|
|---|
| 597 | <code class="constant">finance</code> group membership as their primary group,
|
|---|
| 598 | for example, the group they belong to in <code class="filename">/etc/passwd</code>.
|
|---|
| 599 | </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2614530"></a>Managing Windows 200x ACLs</h3></div></div></div><p><a class="indexterm" name="id2614537"></a><a class="indexterm" name="id2614545"></a><a class="indexterm" name="id2614553"></a><a class="indexterm" name="id2614561"></a>
|
|---|
| 600 | Samba must translate Windows 2000 ACLs to UNIX POSIX ACLs. This has some interesting side effects because
|
|---|
| 601 | there is not a one-to-one equivalence between them. The as-close-as-possible ACLs match means
|
|---|
| 602 | that some transactions are not possible from MS Windows clients. One of these is to reset the ownership
|
|---|
| 603 | of directories and files. If you want to reset ownership, this must be done from a UNIX/Linux login.
|
|---|
| 604 | </p><p>
|
|---|
| 605 | There are two possible ways to set ACLs on UNIX/Linux file systems from a Windows network workstation,
|
|---|
| 606 | either via File Manager or via the Microsoft Management Console (MMC) Computer Management interface.
|
|---|
| 607 | </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2614585"></a>Using the MMC Computer Management Interface</h4></div></div></div><div class="procedure"><ol type="1"><li><p>
|
|---|
| 608 | From a Windows 200x/XP Professional workstation, log on to the domain using the Domain Administrator
|
|---|
| 609 | account (on Samba domains, this is usually the account called <code class="constant">root</code>).
|
|---|
| 610 | </p></li><li><p>
|
|---|
| 611 | Click
|
|---|
| 612 | <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Control Panel</span> → <span class="guimenuitem">Administrative Tools</span> → <span class="guimenuitem">Computer Management</span>.
|
|---|
| 613 | </p></li><li><p>
|
|---|
| 614 | In the left panel,
|
|---|
| 615 | <span class="guimenu">[Right mouse menu item] Computer Management (Local)</span> → <span class="guimenuitem">Connect to another computer ...</span> → <span class="guimenuitem">Browse...</span> → <span class="guimenuitem">Advanced</span> → <span class="guimenuitem">Find Now</span>. In the lower panel, click on the name of the server you wish to
|
|---|
| 616 | administer. Click <span class="guimenu">OK</span> → <span class="guimenuitem">OK</span> → <span class="guimenuitem">OK</span>.
|
|---|
| 617 | In the left panel, the entry <span class="guimenu">Computer Management (Local)</span> should now reflect
|
|---|
| 618 | the change made. For example, if the server you are administering is called <code class="constant">FRODO</code>,
|
|---|
| 619 | the Computer Management entry should now say: <span class="guimenu">Computer Management (FRODO)</span>.
|
|---|
| 620 | </p></li><li><p>
|
|---|
| 621 | In the left panel, click <span class="guimenu">Computer Management (FRODO)</span> → <span class="guimenuitem">[+] Shared Folders</span> → <span class="guimenuitem">Shares</span>.
|
|---|
| 622 | </p></li><li><p><a class="indexterm" name="id2614768"></a><a class="indexterm" name="id2614776"></a><a class="indexterm" name="id2614783"></a><a class="indexterm" name="id2614791"></a>
|
|---|
| 623 | In the right panel, double-click on the share on which you wish to set/edit ACLs. This
|
|---|
| 624 | brings up the Properties panel. Click the <span class="guimenu">Security</span> tab. It is best
|
|---|
| 625 | to edit ACLs using the <code class="constant">Advanced</code> editing features. Click the
|
|---|
| 626 | <span class="guimenu">Advanced</span> button. This opens a panel that has four tabs. Only the
|
|---|
| 627 | functionality under the <code class="constant">Permissions</code> tab can be utilized with respect
|
|---|
| 628 | to a Samba domain server.
|
|---|
| 629 | </p></li><li><p><a class="indexterm" name="id2614831"></a><a class="indexterm" name="id2614839"></a>
|
|---|
| 630 | You may now edit/add/remove access control settings. Be very careful. Many problems have been
|
|---|
| 631 | created by people who decided that everyone should be rejected but one particular group should
|
|---|
| 632 | have full control. This is a catch-22 situation because members of that particular group also
|
|---|
| 633 | belong to the group <code class="constant">Everyone</code>, which therefore overrules any permissions
|
|---|
| 634 | set for the permitted group.
|
|---|
| 635 | </p></li><li><p>
|
|---|
| 636 | When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span>
|
|---|
| 637 | buttons until the last panel closes.
|
|---|
| 638 | </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2614876"></a>Using MS Windows Explorer (File Manager)</h4></div></div></div><p>
|
|---|
| 639 | The following alternative method may be used from a Windows workstation. In this example we work
|
|---|
| 640 | with a domain called <code class="constant">MEGANET</code>, a server called <code class="constant">MASSIVE</code>, and a
|
|---|
| 641 | share called <code class="constant">Apps</code>. The underlying UNIX/Linux share point for this share is
|
|---|
| 642 | <code class="filename">/data/apps</code>.
|
|---|
| 643 | </p><div class="procedure"><ol type="1"><li><p>
|
|---|
| 644 | Click <span class="guimenu">Start</span> → <span class="guimenuitem">[right-click] My Computer</span> → <span class="guimenuitem">Explore</span> → <span class="guimenuitem">[left panel] [+] My Network Places</span> → <span class="guimenuitem">[+] Entire Network</span> → <span class="guimenuitem">[+] Microsoft Windows Network</span> → <span class="guimenuitem">[+] Meganet</span> → <span class="guimenuitem">[+] Massive</span> → <span class="guimenuitem">[right-click] Apps</span> → <span class="guimenuitem">Properties</span> → <span class="guimenuitem">Security</span> → <span class="guimenuitem">Advanced</span>. This opens a panel that has four tabs. Only the functionality under the
|
|---|
| 645 | <code class="constant">Permissions</code> tab can be utilized for a Samba domain server.
|
|---|
| 646 | </p></li><li><p><a class="indexterm" name="id2615000"></a><a class="indexterm" name="id2615008"></a>
|
|---|
| 647 | You may now edit/add/remove access control settings. Be very careful. Many problems have been
|
|---|
| 648 | created by people who decided that everyone should be rejected but one particular group should
|
|---|
| 649 | have full control. This is a catch-22 situation because members of that particular group also
|
|---|
| 650 | belong to the group <code class="constant">Everyone</code>, which therefore overrules any permissions
|
|---|
| 651 | set for the permitted group.
|
|---|
| 652 | </p></li><li><p>
|
|---|
| 653 | When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span>
|
|---|
| 654 | buttons until the last panel closes.
|
|---|
| 655 | </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2615047"></a>Setting Posix ACLs in UNIX/Linux</h4></div></div></div><p><a class="indexterm" name="id2615054"></a><a class="indexterm" name="id2615062"></a>
|
|---|
| 656 | Yet another alternative method for setting desired security settings on the shared resource files and
|
|---|
| 657 | directories can be achieved by logging into UNIX/Linux and setting POSIX ACLs directly using command-line
|
|---|
| 658 | tools. Here is an example session on the same resource as in the immediately preceding example on a SUSE 9
|
|---|
| 659 | Linux system:
|
|---|
| 660 | </p><div class="procedure"><ol type="1"><li><p>
|
|---|
| 661 | Log into the Linux system as the user <code class="constant">root</code>.
|
|---|
| 662 | </p></li><li><p>
|
|---|
| 663 | Change directory to the location of the exported (shared) Windows file share (Apps), which is in
|
|---|
| 664 | the directory <code class="filename">/data</code>. Execute the following:
|
|---|
| 665 | </p><pre class="screen">
|
|---|
| 666 | <code class="prompt">root# </code> cd /data
|
|---|
| 667 | </pre><p>
|
|---|
| 668 | Retrieve the existing POSIX ACLs entry by executing:
|
|---|
| 669 | </p><pre class="screen">
|
|---|
| 670 | <code class="prompt">root# </code> getfacl apps
|
|---|
| 671 | # file: apps
|
|---|
| 672 | # owner: root
|
|---|
| 673 | # group: root
|
|---|
| 674 | user::rwx
|
|---|
| 675 | group::rwx
|
|---|
| 676 | other::r-x
|
|---|
| 677 | </pre><p>
|
|---|
| 678 | </p></li><li><p><a class="indexterm" name="id2615136"></a>
|
|---|
| 679 | You want to add permission for <code class="constant">AppsMgrs</code> to enable them to
|
|---|
| 680 | manage the applications (apps) share. It is important to set the ACL recursively
|
|---|
| 681 | so that the AppsMgrs have this capability throughout the directory tree that is
|
|---|
| 682 | being shared. This is done using the <code class="constant">-R</code> option as shown.
|
|---|
| 683 | Execute the following:
|
|---|
| 684 | </p><pre class="screen">
|
|---|
| 685 | <code class="prompt">root# </code> setfacl -m -R group:AppsMgrs:rwx /data/apps
|
|---|
| 686 | </pre><p>
|
|---|
| 687 | Because setting an ACL does not provide a response, you immediately validate the command executed
|
|---|
| 688 | as follows:
|
|---|
| 689 | </p><pre class="screen">
|
|---|
| 690 | <code class="prompt">root# </code> getfacl /data/apps
|
|---|
| 691 | # file: apps
|
|---|
| 692 | # owner: root
|
|---|
| 693 | # group: root
|
|---|
| 694 | user::rwx
|
|---|
| 695 | group::rwx
|
|---|
| 696 | group:AppsMgrs:rwx
|
|---|
| 697 | mask::rwx
|
|---|
| 698 | other::r-x
|
|---|
| 699 | </pre><p>
|
|---|
| 700 | This confirms that the change of POSIX ACL permissions has been effective.
|
|---|
| 701 | </p></li><li><p><a class="indexterm" name="id2615192"></a><a class="indexterm" name="id2615199"></a><a class="indexterm" name="id2615207"></a><a class="indexterm" name="id2615215"></a><a class="indexterm" name="id2615223"></a>
|
|---|
| 702 | It is highly recommended that you read the online manual page for the <code class="literal">setfacl</code>
|
|---|
| 703 | and <code class="literal">getfacl</code> commands. This provides information regarding how to set/read the default
|
|---|
| 704 | ACLs and how that may be propagated through the directory tree. In Windows ACLs terms, this is the equivalent
|
|---|
| 705 | of setting <code class="constant">inheritance</code> properties.
|
|---|
| 706 | </p></li></ol></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2615257"></a>Key Points Learned</h3></div></div></div><p>
|
|---|
| 707 | The mish-mash of issues were thrown together into one chapter because it seemed like a good idea.
|
|---|
| 708 | Looking back, this chapter could be broken into two, but it's too late now. It has been done.
|
|---|
| 709 | The highlights covered are as follows:
|
|---|
| 710 | </p><div class="itemizedlist"><ul type="disc"><li><p><a class="indexterm" name="id2615274"></a><a class="indexterm" name="id2615282"></a><a class="indexterm" name="id2615290"></a><a class="indexterm" name="id2615298"></a>
|
|---|
| 711 | Winbind honors and does not override account controls set in Active Directory.
|
|---|
| 712 | This means that password change, logon hours, and so on, are (or soon will be) enforced
|
|---|
| 713 | by Samba winbind. At this time, an out-of-hours login is denied and password
|
|---|
| 714 | change is enforced. At this time, if logon hours expire, the user is not forcibly
|
|---|
| 715 | logged off. That may be implemented at some later date.
|
|---|
| 716 | </p></li><li><p><a class="indexterm" name="id2615317"></a><a class="indexterm" name="id2615325"></a>
|
|---|
| 717 | Sign'n'seal (plus schannel support) has been implemented in Samba-3. Beware of potential
|
|---|
| 718 | problems acknowledged by Microsoft as having been fixed but reported by some as still
|
|---|
| 719 | possibly an open issue.
|
|---|
| 720 | </p></li><li><p><a class="indexterm" name="id2615341"></a><a class="indexterm" name="id2615349"></a><a class="indexterm" name="id2615356"></a><a class="indexterm" name="id2615364"></a>
|
|---|
| 721 | The combination of Kerberos 5, plus OpenLDAP, plus Samba, cannot replace Microsoft
|
|---|
| 722 | Active Directory. The possibility to do this is not planned in the current Samba-3
|
|---|
| 723 | roadmap. Samba-3 does aim to provide further improvements in interoperability so that
|
|---|
| 724 | UNIX/Linux systems may be fully integrated into Active Directory domains.
|
|---|
| 725 | </p></li><li><p>
|
|---|
| 726 | This chapter reviewed mechanisms by which Samba servers may be kept secure. Each of
|
|---|
| 727 | the four key methodologies was reviewed with specific reference to example deployment
|
|---|
| 728 | techniques.
|
|---|
| 729 | </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2615391"></a>Questions and Answers</h2></div></div></div><p>
|
|---|
| 730 | </p><div class="qandaset"><dl><dt> <a href="kerberos.html#id2615407">
|
|---|
| 731 | Does Samba-3 require the Sign'n'seal registry hacks needed by Samba-2?
|
|---|
| 732 | </a></dt><dt> <a href="kerberos.html#id2615477">
|
|---|
| 733 | Does Samba-3 support Active Directory?
|
|---|
| 734 | </a></dt><dt> <a href="kerberos.html#id2615508">
|
|---|
| 735 | When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was
|
|---|
| 736 | necessary with Samba-2?
|
|---|
| 737 | </a></dt><dt> <a href="kerberos.html#id2615547">
|
|---|
| 738 | Is it safe to set share-level access controls in Samba?
|
|---|
| 739 | </a></dt><dt> <a href="kerberos.html#id2615576">
|
|---|
| 740 | Is it mandatory to set share ACLs to get a secure Samba-3 server?
|
|---|
| 741 | </a></dt><dt> <a href="kerberos.html#id2615653">
|
|---|
| 742 | The valid users did not work on the [homes].
|
|---|
| 743 | Has this functionality been restored yet?
|
|---|
| 744 | </a></dt><dt> <a href="kerberos.html#id2615719">
|
|---|
| 745 | Is the bias against use of the force user and force group
|
|---|
| 746 | really warranted?
|
|---|
| 747 | </a></dt><dt> <a href="kerberos.html#id2615782">
|
|---|
| 748 | The example given for file and directory access control forces all files to be owned by one
|
|---|
| 749 | particular user. I do not like that. Is there any way I can see who created the file?
|
|---|
| 750 | </a></dt><dt> <a href="kerberos.html#id2615830">
|
|---|
| 751 | In the book, “The Official Samba-3 HOWTO and Reference Guide”, you recommended use
|
|---|
| 752 | of the Windows NT4 Server Manager (part of the SRVTOOLS.EXE) utility. Why
|
|---|
| 753 | have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility?
|
|---|
| 754 | </a></dt><dt> <a href="kerberos.html#id2615896">
|
|---|
| 755 | I tried to set valid users = @Engineers, but it does not work. My Samba
|
|---|
| 756 | server is an Active Directory domain member server. Has this been fixed now?
|
|---|
| 757 | </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2615407"></a><a name="id2615409"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615412"></a><a class="indexterm" name="id2615420"></a>
|
|---|
| 758 | Does Samba-3 require the <code class="constant">Sign'n'seal</code> registry hacks needed by Samba-2?
|
|---|
| 759 | </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2615440"></a><a class="indexterm" name="id2615447"></a><a class="indexterm" name="id2615455"></a>
|
|---|
| 760 | No. Samba-3 fully supports <code class="constant">Sign'n'seal</code> as well as <code class="constant">schannel</code>
|
|---|
| 761 | operation. The registry change should not be applied when Samba-3 is used as a domain controller.
|
|---|
| 762 | </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2615477"></a><a name="id2615480"></a></td><td align="left" valign="top"><p>
|
|---|
| 763 | Does Samba-3 support Active Directory?
|
|---|
| 764 | </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2615490"></a>
|
|---|
| 765 | Yes. Samba-3 can be a fully participating native mode Active Directory client. Samba-3 does not
|
|---|
| 766 | provide Active Directory services. It cannot be used to replace a Microsoft Active Directory
|
|---|
| 767 | server implementation. Samba-3 can function as an Active Directory client (workstation) toolkit,
|
|---|
| 768 | and it can function as an Active Directory domain member server.
|
|---|
| 769 | </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2615508"></a><a name="id2615511"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615514"></a>
|
|---|
| 770 | When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was
|
|---|
| 771 | necessary with Samba-2?
|
|---|
| 772 | </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2615530"></a>
|
|---|
| 773 | No. Samba-3 can be used with NetBIOS over TCP/IP disabled, just as can be done with Windows 200x
|
|---|
| 774 | Server and 200x/XPPro client products. It is no longer necessary to run mixed-mode operation,
|
|---|
| 775 | because Samba-3 can join a native Windows 2003 Server ADS domain.
|
|---|
| 776 | </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2615547"></a><a name="id2615549"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615552"></a>
|
|---|
| 777 | Is it safe to set share-level access controls in Samba?
|
|---|
| 778 | </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
|
|---|
| 779 | Yes. Share-level access controls have been supported since early versions of Samba-2. This is
|
|---|
| 780 | very mature technology. Not enough sites make use of this powerful capability, neither on
|
|---|
| 781 | Windows server or with Samba servers.
|
|---|
| 782 | </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2615576"></a><a name="id2615578"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615582"></a>
|
|---|
| 783 | Is it mandatory to set share ACLs to get a secure Samba-3 server?
|
|---|
| 784 | </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2615597"></a><a class="indexterm" name="id2615605"></a><a class="indexterm" name="id2615613"></a><a class="indexterm" name="id2615622"></a><a class="indexterm" name="id2615630"></a>
|
|---|
| 785 | No. Samba-3 honors UNIX/Linux file system security, supports Windows 200x ACLs, and provides
|
|---|
| 786 | means of securing shares through share definition controls in the <code class="filename">smb.conf</code> file. The additional
|
|---|
| 787 | support for share-level ACLs is like frosting on the cake. It adds to security but is not essential
|
|---|
| 788 | to it.
|
|---|
| 789 | </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2615653"></a><a name="id2615655"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615658"></a>
|
|---|
| 790 | The <em class="parameter"><code>valid users</code></em> did not work on the <em class="parameter"><code>[homes]</code></em>.
|
|---|
| 791 | Has this functionality been restored yet?
|
|---|
| 792 | </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2615686"></a>
|
|---|
| 793 | Yes. This was fixed in Samba-3.0.2. The use of this parameter is strongly recommended as a safeguard
|
|---|
| 794 | on the <em class="parameter"><code>[homes]</code></em> meta-service. The correct way to specify this is:
|
|---|
| 795 | <a class="link" href="smb.conf.5.html#VALIDUSERS" target="_top">valid users = %S</a>.
|
|---|
| 796 | </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2615719"></a><a name="id2615721"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615724"></a><a class="indexterm" name="id2615732"></a><a class="indexterm" name="id2615740"></a>
|
|---|
| 797 | Is the bias against use of the <em class="parameter"><code>force user</code></em> and <em class="parameter"><code>force group</code></em>
|
|---|
| 798 | really warranted?
|
|---|
| 799 | </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2615767"></a>
|
|---|
| 800 | There is no bias. There is a determination to recommend the right tool for the task at hand.
|
|---|
| 801 | After all, it is better than putting users through performance problems, isn't it?
|
|---|
| 802 | </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2615782"></a><a name="id2615784"></a></td><td align="left" valign="top"><p>
|
|---|
| 803 | The example given for file and directory access control forces all files to be owned by one
|
|---|
| 804 | particular user. I do not like that. Is there any way I can see who created the file?
|
|---|
| 805 | </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2615797"></a>
|
|---|
| 806 | Sure. You do not have to set the SUID bit on the directory. Simply execute the following command
|
|---|
| 807 | to permit file ownership to be retained by the user who created it:
|
|---|
| 808 | </p><pre class="screen">
|
|---|
| 809 | <code class="prompt">root# </code> find /usr/data/finance -type d -exec chmod g+s {}\;
|
|---|
| 810 | </pre><p>
|
|---|
| 811 | Note that this required no more than removing the <code class="constant">u</code> argument so that the
|
|---|
| 812 | SUID bit is not set for the owner.
|
|---|
| 813 | </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2615830"></a><a name="id2615832"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615835"></a>
|
|---|
| 814 | In the book, “<span class="quote">The Official Samba-3 HOWTO and Reference Guide</span>”, you recommended use
|
|---|
| 815 | of the Windows NT4 Server Manager (part of the <code class="filename">SRVTOOLS.EXE</code>) utility. Why
|
|---|
| 816 | have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility?
|
|---|
| 817 | </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2615863"></a><a class="indexterm" name="id2615870"></a>
|
|---|
| 818 | Either tool can be used with equal effect. There is no benefit of one over the other, except that
|
|---|
| 819 | the MMC utility is present on all Windows 200x/XP systems and does not require additional software
|
|---|
| 820 | to be downloaded and installed. Note that if you want to manage user and group accounts in your
|
|---|
| 821 | Samba-controlled domain, the only tool that permits that is the NT4 Domain User Manager, which
|
|---|
| 822 | is provided as part of the <code class="filename">SRVTOOLS.EXE</code> utility.
|
|---|
| 823 | </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2615896"></a><a name="id2615898"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615902"></a><a class="indexterm" name="id2615909"></a><a class="indexterm" name="id2615917"></a>
|
|---|
| 824 | I tried to set <em class="parameter"><code>valid users = @Engineers</code></em>, but it does not work. My Samba
|
|---|
| 825 | server is an Active Directory domain member server. Has this been fixed now?
|
|---|
| 826 | </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
|
|---|
| 827 | The use of this parameter has always required the full specification of the domain account, for
|
|---|
| 828 | example, <em class="parameter"><code>valid users = @"MEGANET2\Domain Admins"</code></em>.
|
|---|
| 829 | </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id2610604" href="#id2610604" class="para">12</a>] </sup>This report is entirely fictitious.
|
|---|
| 830 | Any resemblance to a factual report is purely coincidental.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2613014" href="#id2613014" class="para">13</a>] </sup>Note: This link is no longer active. The same article is still
|
|---|
| 831 | available from <a class="ulink" href="http://199.105.191.226/Man/2699/020430msdoj/" target="_top">ITWorld.com</a> (July 5, 2005)</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="RefSection.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="RefSection.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="DomApps.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Part III. Reference Section </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 12. Integrating Additional Services</td></tr></table></div></body></html>
|
|---|
