| 1 | <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 28. PAM-Based Distributed Authentication</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="The Official Samba 3.5.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="ProfileMgmt.html" title="Chapter 27. Desktop Profile Management"><link rel="next" href="integrate-ms-networks.html" title="Chapter 29. Integrating MS Windows Networks with Samba"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 28. PAM-Based Distributed Authentication</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ProfileMgmt.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="integrate-ms-networks.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 28. PAM-Based Distributed Authentication"><div class="titlepage"><div><div><h2 class="title"><a name="pam"></a>Chapter 28. PAM-Based Distributed Authentication</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Stephen</span> <span class="surname">Langasek</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:vorlon@netexpress.net">vorlon@netexpress.net</a>></code></p></div></div></div></div><div><p class="pubdate">May 31, 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="pam.html#id428310">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="pam.html#id428910">Technical Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="pam.html#id428961">PAM Configuration Syntax</a></span></dt><dt><span class="sect2"><a href="pam.html#id429866">Example System Configurations</a></span></dt><dt><span class="sect2"><a href="pam.html#id430135"><code class="filename">smb.conf</code> PAM Configuration</a></span></dt><dt><span class="sect2"><a href="pam.html#id430207">Remote CIFS Authentication Using <code class="filename">winbindd.so</code></a></span></dt><dt><span class="sect2"><a href="pam.html#id430295">Password Synchronization Using <code class="filename">pam_smbpass.so</code></a></span></dt></dl></dd><dt><span class="sect1"><a href="pam.html#id430652">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="pam.html#id430662">pam_winbind Problem</a></span></dt><dt><span class="sect2"><a href="pam.html#id430751">Winbind Is Not Resolving Users and Groups</a></span></dt></dl></dd></dl></div><p>
|
|---|
| 2 | <a class="indexterm" name="id428241"></a>
|
|---|
| 3 | <a class="indexterm" name="id428248"></a>
|
|---|
| 4 | <a class="indexterm" name="id428255"></a>
|
|---|
| 5 | <a class="indexterm" name="id428261"></a>
|
|---|
| 6 | This chapter should help you to deploy Winbind-based authentication on any PAM-enabled
|
|---|
| 7 | UNIX/Linux system. Winbind can be used to enable user-level application access authentication
|
|---|
| 8 | from any MS Windows NT domain, MS Windows 200x Active Directory-based
|
|---|
| 9 | domain, or any Samba-based domain environment. It will also help you to configure PAM-based local host access
|
|---|
| 10 | controls that are appropriate to your Samba configuration.
|
|---|
| 11 | </p><p>
|
|---|
| 12 | <a class="indexterm" name="id428275"></a>
|
|---|
| 13 | <a class="indexterm" name="id428282"></a>
|
|---|
| 14 | In addition to knowing how to configure Winbind into PAM, you will learn generic PAM management
|
|---|
| 15 | possibilities and in particular how to deploy tools like <code class="filename">pam_smbpass.so</code> to your advantage.
|
|---|
| 16 | </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 17 | The use of Winbind requires more than PAM configuration alone.
|
|---|
| 18 | Please refer to <a class="link" href="winbind.html" title="Chapter 24. Winbind: Use of Domain Accounts">Winbind: Use of Domain Accounts</a>, for further information regarding Winbind.
|
|---|
| 19 | </p></div><div class="sect1" title="Features and Benefits"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id428310"></a>Features and Benefits</h2></div></div></div><p>
|
|---|
| 20 | <a class="indexterm" name="id428317"></a>
|
|---|
| 21 | <a class="indexterm" name="id428324"></a>
|
|---|
| 22 | <a class="indexterm" name="id428331"></a>
|
|---|
| 23 | <a class="indexterm" name="id428338"></a>
|
|---|
| 24 | <a class="indexterm" name="id428347"></a>
|
|---|
| 25 | <a class="indexterm" name="id428354"></a>
|
|---|
| 26 | <a class="indexterm" name="id428360"></a>
|
|---|
| 27 | <a class="indexterm" name="id428367"></a>
|
|---|
| 28 | A number of UNIX systems (e.g., Sun Solaris), as well as the xxxxBSD family and Linux,
|
|---|
| 29 | now utilize the Pluggable Authentication Modules (PAM) facility to provide all authentication,
|
|---|
| 30 | authorization, and resource control services. Prior to the introduction of PAM, a decision
|
|---|
| 31 | to use an alternative to the system password database (<code class="filename">/etc/passwd</code>)
|
|---|
| 32 | would require the provision of alternatives for all programs that provide security services.
|
|---|
| 33 | Such a choice would involve provision of alternatives to programs such as <code class="literal">login</code>,
|
|---|
| 34 | <code class="literal">passwd</code>, <code class="literal">chown</code>, and so on.
|
|---|
| 35 | </p><p>
|
|---|
| 36 | <a class="indexterm" name="id428405"></a>
|
|---|
| 37 | <a class="indexterm" name="id428412"></a>
|
|---|
| 38 | <a class="indexterm" name="id428418"></a>
|
|---|
| 39 | <a class="indexterm" name="id428425"></a>
|
|---|
| 40 | PAM provides a mechanism that disconnects these security programs from the underlying
|
|---|
| 41 | authentication/authorization infrastructure. PAM is configured by making appropriate modifications to one file,
|
|---|
| 42 | <code class="filename">/etc/pam.conf</code> (Solaris), or by editing individual control files that are
|
|---|
| 43 | located in <code class="filename">/etc/pam.d</code>.
|
|---|
| 44 | </p><p>
|
|---|
| 45 | <a class="indexterm" name="id428449"></a>
|
|---|
| 46 | <a class="indexterm" name="id428456"></a>
|
|---|
| 47 | On PAM-enabled UNIX/Linux systems, it is an easy matter to configure the system to use any
|
|---|
| 48 | authentication backend so long as the appropriate dynamically loadable library modules
|
|---|
| 49 | are available for it. The backend may be local to the system or may be centralized on a
|
|---|
| 50 | remote server.
|
|---|
| 51 | </p><p>
|
|---|
| 52 | PAM support modules are available for:
|
|---|
| 53 | </p><div class="variablelist"><dl><dt><span class="term"><code class="filename">/etc/passwd</code></span></dt><dd><p>
|
|---|
| 54 | <a class="indexterm" name="id428483"></a>
|
|---|
| 55 | <a class="indexterm" name="id428490"></a>
|
|---|
| 56 | <a class="indexterm" name="id428497"></a>
|
|---|
| 57 | <a class="indexterm" name="id428504"></a>
|
|---|
| 58 | <a class="indexterm" name="id428510"></a>
|
|---|
| 59 | <a class="indexterm" name="id428517"></a>
|
|---|
| 60 | There are several PAM modules that interact with this standard UNIX user database. The most common are called
|
|---|
| 61 | <code class="filename">pam_unix.so</code>, <code class="filename">pam_unix2.so</code>, <code class="filename">pam_pwdb.so</code> and
|
|---|
| 62 | <code class="filename">pam_userdb.so</code>.
|
|---|
| 63 | </p></dd><dt><span class="term">Kerberos</span></dt><dd><p>
|
|---|
| 64 | <a class="indexterm" name="id428558"></a>
|
|---|
| 65 | <a class="indexterm" name="id428565"></a>
|
|---|
| 66 | <a class="indexterm" name="id428572"></a>
|
|---|
| 67 | <a class="indexterm" name="id428579"></a>
|
|---|
| 68 | <a class="indexterm" name="id428586"></a>
|
|---|
| 69 | The <code class="filename">pam_krb5.so</code> module allows the use of any Kerberos-compliant server.
|
|---|
| 70 | This tool is used to access MIT Kerberos, Heimdal Kerberos, and potentially
|
|---|
| 71 | Microsoft Active Directory (if enabled).
|
|---|
| 72 | </p></dd><dt><span class="term">LDAP</span></dt><dd><p>
|
|---|
| 73 | <a class="indexterm" name="id428610"></a>
|
|---|
| 74 | <a class="indexterm" name="id428616"></a>
|
|---|
| 75 | <a class="indexterm" name="id428623"></a>
|
|---|
| 76 | <a class="indexterm" name="id428630"></a>
|
|---|
| 77 | <a class="indexterm" name="id428637"></a>
|
|---|
| 78 | <a class="indexterm" name="id428644"></a>
|
|---|
| 79 | The <code class="filename">pam_ldap.so</code> module allows the use of any LDAP v2- or v3-compatible backend
|
|---|
| 80 | server. Commonly used LDAP backend servers include OpenLDAP v2.0 and v2.1,
|
|---|
| 81 | Sun ONE iDentity server, Novell eDirectory server, and Microsoft Active Directory.
|
|---|
| 82 | </p></dd><dt><span class="term">NetWare Bindery</span></dt><dd><p>
|
|---|
| 83 | <a class="indexterm" name="id428669"></a>
|
|---|
| 84 | <a class="indexterm" name="id428675"></a>
|
|---|
| 85 | <a class="indexterm" name="id428682"></a>
|
|---|
| 86 | <a class="indexterm" name="id428689"></a>
|
|---|
| 87 | The <code class="filename">pam_ncp_auth.so</code> module allows authentication off any bindery-enabled
|
|---|
| 88 | NetWare Core Protocol-based server.
|
|---|
| 89 | </p></dd><dt><span class="term">SMB Password</span></dt><dd><p>
|
|---|
| 90 | <a class="indexterm" name="id428713"></a>
|
|---|
| 91 | <a class="indexterm" name="id428720"></a>
|
|---|
| 92 | <a class="indexterm" name="id428726"></a>
|
|---|
| 93 | This module, called <code class="filename">pam_smbpass.so</code>, allows user authentication of
|
|---|
| 94 | the passdb backend that is configured in the Samba <code class="filename">smb.conf</code> file.
|
|---|
| 95 | </p></dd><dt><span class="term">SMB Server</span></dt><dd><p>
|
|---|
| 96 | <a class="indexterm" name="id428756"></a>
|
|---|
| 97 | <a class="indexterm" name="id428763"></a>
|
|---|
| 98 | The <code class="filename">pam_smb_auth.so</code> module is the original MS Windows networking authentication
|
|---|
| 99 | tool. This module has been somewhat outdated by the Winbind module.
|
|---|
| 100 | </p></dd><dt><span class="term">Winbind</span></dt><dd><p>
|
|---|
| 101 | <a class="indexterm" name="id428786"></a>
|
|---|
| 102 | <a class="indexterm" name="id428793"></a>
|
|---|
| 103 | <a class="indexterm" name="id428800"></a>
|
|---|
| 104 | <a class="indexterm" name="id428807"></a>
|
|---|
| 105 | The <code class="filename">pam_winbind.so</code> module allows Samba to obtain authentication from any
|
|---|
| 106 | MS Windows domain controller. It can just as easily be used to authenticate
|
|---|
| 107 | users for access to any PAM-enabled application.
|
|---|
| 108 | </p></dd><dt><span class="term">RADIUS</span></dt><dd><p>
|
|---|
| 109 | <a class="indexterm" name="id428831"></a>
|
|---|
| 110 | There is a PAM RADIUS (Remote Access Dial-In User Service) authentication
|
|---|
| 111 | module. In most cases, administrators need to locate the source code
|
|---|
| 112 | for this tool and compile and install it themselves. RADIUS protocols are
|
|---|
| 113 | used by many routers and terminal servers.
|
|---|
| 114 | </p></dd></dl></div><p>
|
|---|
| 115 | <a class="indexterm" name="id428848"></a>
|
|---|
| 116 | <a class="indexterm" name="id428855"></a>
|
|---|
| 117 | Of the modules listed, Samba provides the <code class="filename">pam_smbpasswd.so</code> and the
|
|---|
| 118 | <code class="filename">pam_winbind.so</code> modules alone.
|
|---|
| 119 | </p><p>
|
|---|
| 120 | <a class="indexterm" name="id428878"></a>
|
|---|
| 121 | <a class="indexterm" name="id428885"></a>
|
|---|
| 122 | <a class="indexterm" name="id428892"></a>
|
|---|
| 123 | <a class="indexterm" name="id428898"></a>
|
|---|
| 124 | Once configured, these permit a remarkable level of flexibility in the location and use
|
|---|
| 125 | of distributed Samba domain controllers that can provide wide-area network bandwidth,
|
|---|
| 126 | efficient authentication services for PAM-capable systems. In effect, this allows the
|
|---|
| 127 | deployment of centrally managed and maintained distributed authentication from a
|
|---|
| 128 | single-user account database.
|
|---|
| 129 | </p></div><div class="sect1" title="Technical Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id428910"></a>Technical Discussion</h2></div></div></div><p>
|
|---|
| 130 | <a class="indexterm" name="id428918"></a>
|
|---|
| 131 | <a class="indexterm" name="id428925"></a>
|
|---|
| 132 | <a class="indexterm" name="id428932"></a>
|
|---|
| 133 | <a class="indexterm" name="id428938"></a>
|
|---|
| 134 | PAM is designed to provide system administrators with a great deal of flexibility in
|
|---|
| 135 | configuration of the privilege-granting applications of their system. The local
|
|---|
| 136 | configuration of system security controlled by PAM is contained in one of two places:
|
|---|
| 137 | either the single system file <code class="filename">/etc/pam.conf</code> or the
|
|---|
| 138 | <code class="filename">/etc/pam.d/</code> directory.
|
|---|
| 139 | </p><div class="sect2" title="PAM Configuration Syntax"><div class="titlepage"><div><div><h3 class="title"><a name="id428961"></a>PAM Configuration Syntax</h3></div></div></div><p>
|
|---|
| 140 | <a class="indexterm" name="id428969"></a>
|
|---|
| 141 | <a class="indexterm" name="id428976"></a>
|
|---|
| 142 | In this section we discuss the correct syntax of and generic options respected by entries to these files.
|
|---|
| 143 | PAM-specific tokens in the configuration file are case insensitive. The module paths, however, are case
|
|---|
| 144 | sensitive, since they indicate a file's name and reflect the case dependence of typical file systems. The
|
|---|
| 145 | case sensitivity of the arguments to any given module is defined for each module in turn.
|
|---|
| 146 | </p><p>
|
|---|
| 147 | In addition to the lines described below, there are two special characters provided for the convenience
|
|---|
| 148 | of the system administrator: comments are preceded by a <span class="quote">“<span class="quote">#</span>”</span> and extend to the next end-of-line; also,
|
|---|
| 149 | module specification lines may be extended with a <span class="quote">“<span class="quote">\</span>”</span>-escaped newline.
|
|---|
| 150 | </p><p>
|
|---|
| 151 | <a class="indexterm" name="id429001"></a>
|
|---|
| 152 | <a class="indexterm" name="id429008"></a>
|
|---|
| 153 | If the PAM authentication module (loadable link library file) is located in the
|
|---|
| 154 | default location, then it is not necessary to specify the path. In the case of
|
|---|
| 155 | Linux, the default location is <code class="filename">/lib/security</code>. If the module
|
|---|
| 156 | is located outside the default, then the path must be specified as:
|
|---|
| 157 | </p><pre class="programlisting">
|
|---|
| 158 | auth required /other_path/pam_strange_module.so
|
|---|
| 159 | </pre><p>
|
|---|
| 160 | </p><div class="sect3" title="Anatomy of /etc/pam.d Entries"><div class="titlepage"><div><div><h4 class="title"><a name="id429030"></a>Anatomy of <code class="filename">/etc/pam.d</code> Entries</h4></div></div></div><p>
|
|---|
| 161 | The remaining information in this subsection was taken from the documentation of the Linux-PAM
|
|---|
| 162 | project. For more information on PAM, see
|
|---|
| 163 | <a class="ulink" href="http://ftp.kernel.org/pub/linux/libs/pam/" target="_top">the Official Linux-PAM home page</a>.
|
|---|
| 164 | </p><p>
|
|---|
| 165 | <a class="indexterm" name="id429055"></a>
|
|---|
| 166 | A general configuration line of the <code class="filename">/etc/pam.conf</code> file has the following form:
|
|---|
| 167 | </p><pre class="programlisting">
|
|---|
| 168 | service-name module-type control-flag module-path args
|
|---|
| 169 | </pre><p>
|
|---|
| 170 | </p><p>
|
|---|
| 171 | We explain the meaning of each of these tokens. The second (and more recently adopted)
|
|---|
| 172 | way of configuring Linux-PAM is via the contents of the <code class="filename">/etc/pam.d/</code> directory.
|
|---|
| 173 | Once we have explained the meaning of the tokens, we describe this method.
|
|---|
| 174 | </p><div class="variablelist"><dl><dt><span class="term">service-name</span></dt><dd><p>
|
|---|
| 175 | <a class="indexterm" name="id429096"></a>
|
|---|
| 176 | <a class="indexterm" name="id429103"></a>
|
|---|
| 177 | <a class="indexterm" name="id429110"></a>
|
|---|
| 178 | The name of the service associated with this entry. Frequently, the service-name is the conventional
|
|---|
| 179 | name of the given application for example, <code class="literal">ftpd</code>, <code class="literal">rlogind</code> and
|
|---|
| 180 | <code class="literal">su</code>, and so on.
|
|---|
| 181 | </p><p>
|
|---|
| 182 | There is a special service-name reserved for defining a default authentication mechanism. It has
|
|---|
| 183 | the name <em class="parameter"><code>OTHER</code></em> and may be specified in either lower- or uppercase characters.
|
|---|
| 184 | Note, when there is a module specified for a named service, the <em class="parameter"><code>OTHER</code></em>
|
|---|
| 185 | entries are ignored.
|
|---|
| 186 | </p></dd><dt><span class="term">module-type</span></dt><dd><p>
|
|---|
| 187 | One of (currently) four types of module. The four types are as follows:
|
|---|
| 188 | </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
|
|---|
| 189 | <a class="indexterm" name="id429174"></a>
|
|---|
| 190 | <a class="indexterm" name="id429181"></a>
|
|---|
| 191 | <em class="parameter"><code>auth:</code></em> This module type provides two aspects of authenticating the user.
|
|---|
| 192 | It establishes that the user is who he or she claims to be by instructing the application
|
|---|
| 193 | to prompt the user for a password or other means of identification. Second, the module can
|
|---|
| 194 | grant group membership (independently of the <code class="filename">/etc/groups</code> file)
|
|---|
| 195 | or other privileges through its credential-granting properties.
|
|---|
| 196 | </p></li><li class="listitem"><p>
|
|---|
| 197 | <a class="indexterm" name="id429207"></a>
|
|---|
| 198 | <a class="indexterm" name="id429213"></a>
|
|---|
| 199 | <em class="parameter"><code>account:</code></em> This module performs non-authentication-based account management.
|
|---|
| 200 | It is typically used to restrict/permit access to a service based on the time of day, currently
|
|---|
| 201 | available system resources (maximum number of users), or perhaps the location of the user
|
|---|
| 202 | login. For example, the <span class="quote">“<span class="quote">root</span>”</span> login may be permitted only on the console.
|
|---|
| 203 | </p></li><li class="listitem"><p>
|
|---|
| 204 | <a class="indexterm" name="id429237"></a>
|
|---|
| 205 | <em class="parameter"><code>session:</code></em> Primarily, this module is associated with doing things that need
|
|---|
| 206 | to be done for the user before and after he or she can be given service. Such things include logging
|
|---|
| 207 | information concerning the opening and closing of some data exchange with a user, mounting
|
|---|
| 208 | directories, and so on.
|
|---|
| 209 | </p></li><li class="listitem"><p>
|
|---|
| 210 | <a class="indexterm" name="id429256"></a>
|
|---|
| 211 | <em class="parameter"><code>password:</code></em> This last module type is required for updating the authentication
|
|---|
| 212 | token associated with the user. Typically, there is one module for each
|
|---|
| 213 | <span class="quote">“<span class="quote">challenge/response</span>”</span> authentication <em class="parameter"><code>(auth)</code></em> module type.
|
|---|
| 214 | </p></li></ul></div></dd><dt><span class="term">control-flag</span></dt><dd><p>
|
|---|
| 215 | The control-flag is used to indicate how the PAM library will react to the success or failure of the
|
|---|
| 216 | module it is associated with. Since modules can be stacked (modules of the same type execute in series,
|
|---|
| 217 | one after another), the control-flags determine the relative importance of each module. The application
|
|---|
| 218 | is not made aware of the individual success or failure of modules listed in the
|
|---|
| 219 | <code class="filename">/etc/pam.conf</code> file. Instead, it receives a summary success or fail response from
|
|---|
| 220 | the Linux-PAM library. The order of execution of these modules is that of the entries in the
|
|---|
| 221 | <code class="filename">/etc/pam.conf</code> file; earlier entries are executed before later ones.
|
|---|
| 222 | As of Linux-PAM v0.60, this control-flag can be defined with one of two syntaxes.
|
|---|
| 223 | </p><p>
|
|---|
| 224 | <a class="indexterm" name="id429313"></a>
|
|---|
| 225 | <a class="indexterm" name="id429320"></a>
|
|---|
| 226 | <a class="indexterm" name="id429326"></a>
|
|---|
| 227 | <a class="indexterm" name="id429333"></a>
|
|---|
| 228 | The simpler (and historical) syntax for the control-flag is a single keyword defined to indicate the
|
|---|
| 229 | severity of concern associated with the success or failure of a specific module. There are four such
|
|---|
| 230 | keywords: <em class="parameter"><code>required</code></em>, <em class="parameter"><code>requisite</code></em>,
|
|---|
| 231 | <em class="parameter"><code>sufficient</code></em>, and <em class="parameter"><code>optional</code></em>.
|
|---|
| 232 | </p><p>
|
|---|
| 233 | The Linux-PAM library interprets these keywords in the following manner:
|
|---|
| 234 | </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
|
|---|
| 235 | <em class="parameter"><code>required:</code></em> This indicates that the success of the module is required for the
|
|---|
| 236 | module-type facility to succeed. Failure of this module will not be apparent to the user until all
|
|---|
| 237 | of the remaining modules (of the same module-type) have been executed.
|
|---|
| 238 | </p></li><li class="listitem"><p>
|
|---|
| 239 | <em class="parameter"><code>requisite:</code></em> Like required, except that if such a module returns a
|
|---|
| 240 | failure, control is directly returned to the application. The return value is that associated with
|
|---|
| 241 | the first required or requisite module to fail. This flag can be used to protect against the
|
|---|
| 242 | possibility of a user getting the opportunity to enter a password over an unsafe medium. It is
|
|---|
| 243 | conceivable that such behavior might inform an attacker of valid accounts on a system. This
|
|---|
| 244 | possibility should be weighed against the not insignificant concerns of exposing a sensitive
|
|---|
| 245 | password in a hostile environment.
|
|---|
| 246 | </p></li><li class="listitem"><p>
|
|---|
| 247 | <em class="parameter"><code>sufficient:</code></em> The success of this module is deemed <em class="parameter"><code>sufficient</code></em> to satisfy
|
|---|
| 248 | the Linux-PAM library that this module-type has succeeded in its purpose. In the event that no
|
|---|
| 249 | previous required module has failed, no more <span class="quote">“<span class="quote">stacked</span>”</span> modules of this type are invoked.
|
|---|
| 250 | (In this case, subsequent required modules are not invoked). A failure of this module is not deemed
|
|---|
| 251 | as fatal to satisfying the application that this module-type has succeeded.
|
|---|
| 252 | </p></li><li class="listitem"><p>
|
|---|
| 253 | <em class="parameter"><code>optional:</code></em> As its name suggests, this control-flag marks the module as not
|
|---|
| 254 | being critical to the success or failure of the user's application for service. In general,
|
|---|
| 255 | Linux-PAM ignores such a module when determining if the module stack will succeed or fail.
|
|---|
| 256 | However, in the absence of any definite successes or failures of previous or subsequent stacked
|
|---|
| 257 | modules, this module will determine the nature of the response to the application. One example of
|
|---|
| 258 | this latter case is when the other modules return something like PAM_IGNORE.
|
|---|
| 259 | </p></li></ul></div><p>
|
|---|
| 260 | The more elaborate (newer) syntax is much more specific and gives the administrator a great deal of control
|
|---|
| 261 | over how the user is authenticated. This form of the control-flag is delimited with square brackets and
|
|---|
| 262 | consists of a series of <em class="parameter"><code>value=action</code></em> tokens:
|
|---|
| 263 | </p><pre class="programlisting">
|
|---|
| 264 | [value1=action1 value2=action2 ...]
|
|---|
| 265 | </pre><p>
|
|---|
| 266 | Here, <em class="parameter"><code>value1</code></em> is one of the following return values:
|
|---|
| 267 | </p><pre class="screen">
|
|---|
| 268 | <em class="parameter"><code>success; open_err; symbol_err; service_err; system_err; buf_err;</code></em>
|
|---|
| 269 | <em class="parameter"><code>perm_denied; auth_err; cred_insufficient; authinfo_unavail;</code></em>
|
|---|
| 270 | <em class="parameter"><code>user_unknown; maxtries; new_authtok_reqd; acct_expired; session_err;</code></em>
|
|---|
| 271 | <em class="parameter"><code>cred_unavail; cred_expired; cred_err; no_module_data; conv_err;</code></em>
|
|---|
| 272 | <em class="parameter"><code>authtok_err; authtok_recover_err; authtok_lock_busy;</code></em>
|
|---|
| 273 | <em class="parameter"><code>authtok_disable_aging; try_again; ignore; abort; authtok_expired;</code></em>
|
|---|
| 274 | <em class="parameter"><code>module_unknown; bad_item;</code></em> and <em class="parameter"><code>default</code></em>.
|
|---|
| 275 | </pre><p>
|
|---|
| 276 | </p><p>
|
|---|
| 277 | The last of these (<em class="parameter"><code>default</code></em>) can be used to set the action for those return values that are not explicitly defined.
|
|---|
| 278 | </p><p>
|
|---|
| 279 | The <em class="parameter"><code>action1</code></em> can be a positive integer or one of the following tokens:
|
|---|
| 280 | <em class="parameter"><code>ignore</code></em>; <em class="parameter"><code>ok</code></em>; <em class="parameter"><code>done</code></em>;
|
|---|
| 281 | <em class="parameter"><code>bad</code></em>; <em class="parameter"><code>die</code></em>; and <em class="parameter"><code>reset</code></em>.
|
|---|
| 282 | A positive integer, J, when specified as the action, can be used to indicate that the next J modules of the
|
|---|
| 283 | current module-type will be skipped. In this way, the administrator can develop a moderately sophisticated
|
|---|
| 284 | stack of modules with a number of different paths of execution. Which path is taken can be determined by the
|
|---|
| 285 | reactions of individual modules.
|
|---|
| 286 | </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
|
|---|
| 287 | <em class="parameter"><code>ignore:</code></em> When used with a stack of modules, the module's return status will not
|
|---|
| 288 | contribute to the return code the application obtains.
|
|---|
| 289 | </p></li><li class="listitem"><p>
|
|---|
| 290 | <em class="parameter"><code>bad:</code></em> This action indicates that the return code should be thought of as indicative
|
|---|
| 291 | of the module failing. If this module is the first in the stack to fail, its status value will be used
|
|---|
| 292 | for that of the whole stack.
|
|---|
| 293 | </p></li><li class="listitem"><p>
|
|---|
| 294 | <em class="parameter"><code>die:</code></em> Equivalent to bad with the side effect of terminating the module stack and
|
|---|
| 295 | PAM immediately returning to the application.
|
|---|
| 296 | </p></li><li class="listitem"><p>
|
|---|
| 297 | <em class="parameter"><code>ok:</code></em> This tells PAM that the administrator thinks this return code should
|
|---|
| 298 | contribute directly to the return code of the full stack of modules. In other words, if the former
|
|---|
| 299 | state of the stack would lead to a return of PAM_SUCCESS, the module's return code will override
|
|---|
| 300 | this value. Note, if the former state of the stack holds some value that is indicative of a module's
|
|---|
| 301 | failure, this <em class="parameter"><code>ok</code></em> value will not be used to override that value.
|
|---|
| 302 | </p></li><li class="listitem"><p>
|
|---|
| 303 | <em class="parameter"><code>done:</code></em> Equivalent to <em class="parameter"><code>ok</code></em> with the side effect of terminating the module stack and
|
|---|
| 304 | PAM immediately returning to the application.
|
|---|
| 305 | </p></li><li class="listitem"><p>
|
|---|
| 306 | <em class="parameter"><code>reset:</code></em> Clears all memory of the state of the module stack and starts again with
|
|---|
| 307 | the next stacked module.
|
|---|
| 308 | </p></li></ul></div><p>
|
|---|
| 309 | Each of the four keywords, <em class="parameter"><code>required</code></em>; <em class="parameter"><code>requisite</code></em>;
|
|---|
| 310 | <em class="parameter"><code>sufficient</code></em>; and <em class="parameter"><code>optional</code></em>, have an equivalent expression in terms
|
|---|
| 311 | of the [...] syntax. They are as follows:
|
|---|
| 312 | </p><p>
|
|---|
| 313 | </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
|
|---|
| 314 | <em class="parameter"><code>required</code></em> is equivalent to <em class="parameter"><code>[success=ok new_authtok_reqd=ok ignore=ignore default=bad]</code></em>.
|
|---|
| 315 | </p></li><li class="listitem"><p>
|
|---|
| 316 | <em class="parameter"><code>requisite</code></em> is equivalent to <em class="parameter"><code>[success=ok new_authtok_reqd=ok ignore=ignore default=die]</code></em>.
|
|---|
| 317 | </p></li><li class="listitem"><p>
|
|---|
| 318 | <em class="parameter"><code>sufficient</code></em> is equivalent to <em class="parameter"><code>[success=done new_authtok_reqd=done default=ignore]</code></em>.
|
|---|
| 319 | </p></li><li class="listitem"><p>
|
|---|
| 320 | <em class="parameter"><code>optional</code></em> is equivalent to <em class="parameter"><code>[success=ok new_authtok_reqd=ok default=ignore]</code></em>.
|
|---|
| 321 | </p></li></ul></div><p>
|
|---|
| 322 | </p><p>
|
|---|
| 323 | Just to get a feel for the power of this new syntax, here is a taste of what you can do with it. With Linux-PAM-0.63,
|
|---|
| 324 | the notion of client plug-in agents was introduced. This makes it possible for PAM to support
|
|---|
| 325 | machine-machine authentication using the transport protocol inherent to the client/server application. With the
|
|---|
| 326 | <em class="parameter"><code>[ ... value=action ... ]</code></em> control syntax, it is possible for an application to be configured
|
|---|
| 327 | to support binary prompts with compliant clients, but to gracefully fail over into an alternative authentication
|
|---|
| 328 | mode for legacy applications.
|
|---|
| 329 | </p></dd><dt><span class="term">module-path</span></dt><dd><p>
|
|---|
| 330 | The pathname of the dynamically loadable object file; the pluggable module itself. If the first character of the
|
|---|
| 331 | module path is <span class="quote">“<span class="quote">/</span>”</span>, it is assumed to be a complete path. If this is not the case, the given module path is appended
|
|---|
| 332 | to the default module path: <code class="filename">/lib/security</code> (but see the previous notes).
|
|---|
| 333 | </p><p>
|
|---|
| 334 | The arguments are a list of tokens that are passed to the module when it is invoked, much like arguments to a typical
|
|---|
| 335 | Linux shell command. Generally, valid arguments are optional and are specific to any given module. Invalid arguments
|
|---|
| 336 | are ignored by a module; however, when encountering an invalid argument, the module is required to write an error
|
|---|
| 337 | to syslog(3). For a list of generic options, see the next section.
|
|---|
| 338 | </p><p>
|
|---|
| 339 | If you wish to include spaces in an argument, you should surround that argument with square brackets. For example:
|
|---|
| 340 | </p><pre class="programlisting">
|
|---|
| 341 | squid auth required pam_mysql.so user=passwd_query passwd=mada \
|
|---|
| 342 | db=eminence [query=select user_name from internet_service where \
|
|---|
| 343 | user_name=<span class="quote">“<span class="quote">%u</span>”</span> and password=PASSWORD(<span class="quote">“<span class="quote">%p</span>”</span>) and service=<span class="quote">“<span class="quote">web_proxy</span>”</span>]
|
|---|
| 344 | </pre><p>
|
|---|
| 345 | When using this convention, you can include <span class="quote">“<span class="quote">[</span>”</span> characters inside the string, and if you wish to have a <span class="quote">“<span class="quote">]</span>”</span>
|
|---|
| 346 | character inside the string that will survive the argument parsing, you should use <span class="quote">“<span class="quote">\[</span>”</span>. In other words,
|
|---|
| 347 | </p><pre class="programlisting">
|
|---|
| 348 | [..[..\]..] --> ..[..]..
|
|---|
| 349 | </pre><p>
|
|---|
| 350 | Any line in one of the configuration files that is not formatted correctly will generally tend (erring on the
|
|---|
| 351 | side of caution) to make the authentication process fail. A corresponding error is written to the system log files
|
|---|
| 352 | with a call to syslog(3).
|
|---|
| 353 | </p></dd></dl></div></div></div><div class="sect2" title="Example System Configurations"><div class="titlepage"><div><div><h3 class="title"><a name="id429866"></a>Example System Configurations</h3></div></div></div><p>
|
|---|
| 354 | The following is an example <code class="filename">/etc/pam.d/login</code> configuration file.
|
|---|
| 355 | This example had all options uncommented and is probably not usable
|
|---|
| 356 | because it stacks many conditions before allowing successful completion
|
|---|
| 357 | of the login process. Essentially, all conditions can be disabled
|
|---|
| 358 | by commenting them out, except the calls to <code class="filename">pam_pwdb.so</code>.
|
|---|
| 359 | </p><div class="sect3" title="PAM: Original Login Config"><div class="titlepage"><div><div><h4 class="title"><a name="id429889"></a>PAM: Original Login Config</h4></div></div></div><p>
|
|---|
| 360 | </p><pre class="programlisting">
|
|---|
| 361 | #%PAM-1.0
|
|---|
| 362 | # The PAM configuration file for the <span class="quote">“<span class="quote">login</span>”</span> service
|
|---|
| 363 | #
|
|---|
| 364 | auth required pam_securetty.so
|
|---|
| 365 | auth required pam_nologin.so
|
|---|
| 366 | # auth required pam_dialup.so
|
|---|
| 367 | # auth optional pam_mail.so
|
|---|
| 368 | auth required pam_pwdb.so shadow md5
|
|---|
| 369 | # account requisite pam_time.so
|
|---|
| 370 | account required pam_pwdb.so
|
|---|
| 371 | session required pam_pwdb.so
|
|---|
| 372 | # session optional pam_lastlog.so
|
|---|
| 373 | # password required pam_cracklib.so retry=3
|
|---|
| 374 | password required pam_pwdb.so shadow md5
|
|---|
| 375 | </pre><p>
|
|---|
| 376 | </p></div><div class="sect3" title="PAM: Login Using pam_smbpass"><div class="titlepage"><div><div><h4 class="title"><a name="id429912"></a>PAM: Login Using <code class="filename">pam_smbpass</code></h4></div></div></div><p>
|
|---|
| 377 | PAM allows use of replaceable modules. Those available on a sample system include:
|
|---|
| 378 | </p><p><code class="prompt">$</code><strong class="userinput"><code>/bin/ls /lib/security</code></strong>
|
|---|
| 379 | </p><pre class="programlisting">
|
|---|
| 380 | pam_access.so pam_ftp.so pam_limits.so
|
|---|
| 381 | pam_ncp_auth.so pam_rhosts_auth.so pam_stress.so
|
|---|
| 382 | pam_cracklib.so pam_group.so pam_listfile.so
|
|---|
| 383 | pam_nologin.so pam_rootok.so pam_tally.so
|
|---|
| 384 | pam_deny.so pam_issue.so pam_mail.so
|
|---|
| 385 | pam_permit.so pam_securetty.so pam_time.so
|
|---|
| 386 | pam_dialup.so pam_lastlog.so pam_mkhomedir.so
|
|---|
| 387 | pam_pwdb.so pam_shells.so pam_unix.so
|
|---|
| 388 | pam_env.so pam_ldap.so pam_motd.so
|
|---|
| 389 | pam_radius.so pam_smbpass.so pam_unix_acct.so
|
|---|
| 390 | pam_wheel.so pam_unix_auth.so pam_unix_passwd.so
|
|---|
| 391 | pam_userdb.so pam_warn.so pam_unix_session.so
|
|---|
| 392 | </pre><p>
|
|---|
| 393 | The following example for the login program replaces the use of
|
|---|
| 394 | the <code class="filename">pam_pwdb.so</code> module that uses the system
|
|---|
| 395 | password database (<code class="filename">/etc/passwd</code>,
|
|---|
| 396 | <code class="filename">/etc/shadow</code>, <code class="filename">/etc/group</code>) with
|
|---|
| 397 | the module <code class="filename">pam_smbpass.so</code>, which uses the Samba
|
|---|
| 398 | database containing the Microsoft MD4 encrypted password
|
|---|
| 399 | hashes. This database is stored either in
|
|---|
| 400 | <code class="filename">/usr/local/samba/private/smbpasswd</code>,
|
|---|
| 401 | <code class="filename">/etc/samba/smbpasswd</code> or in
|
|---|
| 402 | <code class="filename">/etc/samba.d/smbpasswd</code>, depending on the
|
|---|
| 403 | Samba implementation for your UNIX/Linux system. The
|
|---|
| 404 | <code class="filename">pam_smbpass.so</code> module is provided by
|
|---|
| 405 | Samba version 2.2.1 or later. It can be compiled by specifying the
|
|---|
| 406 | <code class="option">--with-pam_smbpass</code> options when running Samba's
|
|---|
| 407 | <code class="literal">configure</code> script. For more information
|
|---|
| 408 | on the <code class="filename">pam_smbpass</code> module, see the documentation
|
|---|
| 409 | in the <code class="filename">source/pam_smbpass</code> directory of the Samba
|
|---|
| 410 | source distribution.
|
|---|
| 411 | </p><p>
|
|---|
| 412 | </p><pre class="programlisting">
|
|---|
| 413 | #%PAM-1.0
|
|---|
| 414 | # The PAM configuration file for the <span class="quote">“<span class="quote">login</span>”</span> service
|
|---|
| 415 | #
|
|---|
| 416 | auth required pam_smbpass.so nodelay
|
|---|
| 417 | account required pam_smbpass.so nodelay
|
|---|
| 418 | session required pam_smbpass.so nodelay
|
|---|
| 419 | password required pam_smbpass.so nodelay
|
|---|
| 420 | </pre><p>
|
|---|
| 421 | The following is the PAM configuration file for a particular
|
|---|
| 422 | Linux system. The default condition uses <code class="filename">pam_pwdb.so</code>.
|
|---|
| 423 | </p><p>
|
|---|
| 424 | </p><pre class="programlisting">
|
|---|
| 425 | #%PAM-1.0
|
|---|
| 426 | # The PAM configuration file for the <span class="quote">“<span class="quote">samba</span>”</span> service
|
|---|
| 427 | #
|
|---|
| 428 | auth required pam_pwdb.so nullok nodelay shadow audit
|
|---|
| 429 | account required pam_pwdb.so audit nodelay
|
|---|
| 430 | session required pam_pwdb.so nodelay
|
|---|
| 431 | password required pam_pwdb.so shadow md5
|
|---|
| 432 | </pre><p>
|
|---|
| 433 | In the following example, the decision has been made to use the
|
|---|
| 434 | <code class="literal">smbpasswd</code> database even for basic Samba authentication. Such a
|
|---|
| 435 | decision could also be made for the <code class="literal">passwd</code> program and would
|
|---|
| 436 | thus allow the <code class="literal">smbpasswd</code> passwords to be changed using the
|
|---|
| 437 | <code class="literal">passwd</code> program:
|
|---|
| 438 | </p><p>
|
|---|
| 439 | </p><pre class="programlisting">
|
|---|
| 440 | #%PAM-1.0
|
|---|
| 441 | # The PAM configuration file for the <span class="quote">“<span class="quote">samba</span>”</span> service
|
|---|
| 442 | #
|
|---|
| 443 | auth required pam_smbpass.so nodelay
|
|---|
| 444 | account required pam_pwdb.so audit nodelay
|
|---|
| 445 | session required pam_pwdb.so nodelay
|
|---|
| 446 | password required pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf
|
|---|
| 447 | </pre><p>
|
|---|
| 448 | </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>PAM allows stacking of authentication mechanisms. It is
|
|---|
| 449 | also possible to pass information obtained within one PAM module through
|
|---|
| 450 | to the next module in the PAM stack. Please refer to the documentation for
|
|---|
| 451 | your particular system implementation for details regarding the specific
|
|---|
| 452 | capabilities of PAM in this environment. Some Linux implementations also
|
|---|
| 453 | provide the <code class="filename">pam_stack.so</code> module that allows all
|
|---|
| 454 | authentication to be configured in a single central file. The
|
|---|
| 455 | <code class="filename">pam_stack.so</code> method has some devoted followers
|
|---|
| 456 | on the basis that it allows for easier administration. As with all issues in
|
|---|
| 457 | life, though, every decision has trade-offs, so you may want to examine the
|
|---|
| 458 | PAM documentation for further helpful information.
|
|---|
| 459 | </p></div></div></div><div class="sect2" title="smb.conf PAM Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id430135"></a><code class="filename">smb.conf</code> PAM Configuration</h3></div></div></div><p>
|
|---|
| 460 | There is an option in <code class="filename">smb.conf</code> called <a class="link" href="smb.conf.5.html#OBEYPAMRESTRICTIONS" target="_top">obey pam restrictions</a>.
|
|---|
| 461 | The following is from the online help for this option in SWAT:
|
|---|
| 462 | </p><div class="blockquote"><blockquote class="blockquote"><p>
|
|---|
| 463 | When Samba is configured to enable PAM support (i.e., <code class="option">--with-pam</code>), this parameter will
|
|---|
| 464 | control whether or not Samba should obey PAM's account and session management directives. The default behavior
|
|---|
| 465 | is to use PAM for clear-text authentication only and to ignore any account or session management. Samba always
|
|---|
| 466 | ignores PAM for authentication in the case of <a class="link" href="smb.conf.5.html#ENCRYPTPASSWORDS" target="_top">encrypt passwords = yes</a>.
|
|---|
| 467 | The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB
|
|---|
| 468 | password encryption.
|
|---|
| 469 | </p><p>Default: <a class="link" href="smb.conf.5.html#OBEYPAMRESTRICTIONS" target="_top">obey pam restrictions = no</a></p></blockquote></div></div><div class="sect2" title="Remote CIFS Authentication Using winbindd.so"><div class="titlepage"><div><div><h3 class="title"><a name="id430207"></a>Remote CIFS Authentication Using <code class="filename">winbindd.so</code></h3></div></div></div><p>
|
|---|
| 470 | All operating systems depend on the provision of user credentials acceptable to the platform.
|
|---|
| 471 | UNIX requires the provision of a user identifier (UID) as well as a group identifier (GID).
|
|---|
| 472 | These are both simple integer numbers that are obtained from a password backend such
|
|---|
| 473 | as <code class="filename">/etc/passwd</code>.
|
|---|
| 474 | </p><p>
|
|---|
| 475 | Users and groups on a Windows NT server are assigned a relative ID (RID) which is unique for
|
|---|
| 476 | the domain when the user or group is created. To convert the Windows NT user or group into
|
|---|
| 477 | a UNIX user or group, a mapping between RIDs and UNIX user and group IDs is required. This
|
|---|
| 478 | is one of the jobs that winbind performs.
|
|---|
| 479 | </p><p>
|
|---|
| 480 | As winbind users and groups are resolved from a server, user and group IDs are allocated
|
|---|
| 481 | from a specified range. This is done on a first come, first served basis, although all
|
|---|
| 482 | existing users and groups will be mapped as soon as a client performs a user or group
|
|---|
| 483 | enumeration command. The allocated UNIX IDs are stored in a database file under the Samba
|
|---|
| 484 | lock directory and will be remembered.
|
|---|
| 485 | </p><p>
|
|---|
| 486 | The astute administrator will realize from this that the combination of <code class="filename">pam_smbpass.so</code>,
|
|---|
| 487 | <code class="literal">winbindd</code>, and a distributed <a class="link" href="smb.conf.5.html#PASSDBBACKEND" target="_top">passdb backend</a>
|
|---|
| 488 | such as <em class="parameter"><code>ldap</code></em> will allow the establishment of a centrally managed, distributed user/password
|
|---|
| 489 | database that can also be used by all PAM-aware (e.g., Linux) programs and applications. This arrangement can have
|
|---|
| 490 | particularly potent advantages compared with the use of Microsoft Active Directory Service (ADS) insofar as
|
|---|
| 491 | the reduction of wide-area network authentication traffic.
|
|---|
| 492 | </p><div class="warning" title="Warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
|
|---|
| 493 | The RID to UNIX ID database is the only location where the user and group mappings are
|
|---|
| 494 | stored by <code class="literal">winbindd</code>. If this file is deleted or corrupted, there is no way for <code class="literal">winbindd</code>
|
|---|
| 495 | to determine which user and group IDs correspond to Windows NT user and group RIDs.
|
|---|
| 496 | </p></div></div><div class="sect2" title="Password Synchronization Using pam_smbpass.so"><div class="titlepage"><div><div><h3 class="title"><a name="id430295"></a>Password Synchronization Using <code class="filename">pam_smbpass.so</code></h3></div></div></div><p>
|
|---|
| 497 | <code class="filename">pam_smbpass</code> is a PAM module that can be used on conforming systems to
|
|---|
| 498 | keep the <code class="filename">smbpasswd</code> (Samba password) database in sync with the UNIX
|
|---|
| 499 | password file. PAM is an API supported
|
|---|
| 500 | under some UNIX operating systems, such as Solaris, HPUX, and Linux, that provides a
|
|---|
| 501 | generic interface to authentication mechanisms.
|
|---|
| 502 | </p><p>
|
|---|
| 503 | This module authenticates a local <code class="filename">smbpasswd</code> user database. If you require
|
|---|
| 504 | support for authenticating against a remote SMB server, or if you are
|
|---|
| 505 | concerned about the presence of SUID root binaries on your system, it is
|
|---|
| 506 | recommended that you use <code class="filename">pam_winbind</code> instead.
|
|---|
| 507 | </p><p>
|
|---|
| 508 | Options recognized by this module are shown in <a class="link" href="pam.html#smbpassoptions" title="Table 28.1. Options recognized by pam_smbpass">next table</a>.
|
|---|
| 509 | </p><div class="table"><a name="smbpassoptions"></a><p class="title"><b>Table 28.1. Options recognized by <em class="parameter"><code>pam_smbpass</code></em></b></p><div class="table-contents"><table summary="Options recognized by pam_smbpass" border="1"><colgroup><col align="left"><col align="justify"></colgroup><tbody><tr><td align="left">debug</td><td align="justify">Log more debugging info.</td></tr><tr><td align="left">audit</td><td align="justify">Like debug, but also logs unknown usernames.</td></tr><tr><td align="left">use_first_pass</td><td align="justify">Do not prompt the user for passwords; take them from PAM_ items instead.</td></tr><tr><td align="left">try_first_pass</td><td align="justify">Try to get the password from a previous PAM module; fall back to prompting the user.</td></tr><tr><td align="left">use_authtok</td><td align="justify">Like try_first_pass, but *fail* if the new PAM_AUTHTOK has not been previously set (intended for stacking password modules only).</td></tr><tr><td align="left">not_set_pass</td><td align="justify">Do not make passwords used by this module available to other modules.</td></tr><tr><td align="left">nodelay</td><td align="justify">dDo not insert ~1-second delays on authentication failure.</td></tr><tr><td align="left">nullok</td><td align="justify">Null passwords are allowed.</td></tr><tr><td align="left">nonull</td><td align="justify">Null passwords are not allowed. Used to override the Samba configuration.</td></tr><tr><td align="left">migrate</td><td align="justify">Only meaningful in an <span class="quote">“<span class="quote">auth</span>”</span> context; used to update smbpasswd file with a password used for successful authentication.</td></tr><tr><td align="left">smbconf=<em class="replaceable"><code>file</code></em></td><td align="justify">Specify an alternate path to the <code class="filename">smb.conf</code> file.</td></tr></tbody></table></div></div><p><br class="table-break">
|
|---|
| 510 | </p><p>
|
|---|
| 511 | The following are examples of the use of <code class="filename">pam_smbpass.so</code> in the format of the Linux
|
|---|
| 512 | <code class="filename">/etc/pam.d/</code> files structure. Those wishing to implement this
|
|---|
| 513 | tool on other platforms will need to adapt this appropriately.
|
|---|
| 514 | </p><div class="sect3" title="Password Synchronization Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id430500"></a>Password Synchronization Configuration</h4></div></div></div><p>
|
|---|
| 515 | The following is a sample PAM configuration that shows the use of pam_smbpass to make
|
|---|
| 516 | sure <code class="filename">private/smbpasswd</code> is kept in sync when <code class="filename">/etc/passwd (/etc/shadow)</code>
|
|---|
| 517 | is changed. It is useful when an expired password might be changed by an
|
|---|
| 518 | application (such as <code class="literal">ssh</code>).
|
|---|
| 519 | </p><p>
|
|---|
| 520 | </p><pre class="programlisting">
|
|---|
| 521 | #%PAM-1.0
|
|---|
| 522 | # password-sync
|
|---|
| 523 | #
|
|---|
| 524 | auth requisite pam_nologin.so
|
|---|
| 525 | auth required pam_unix.so
|
|---|
| 526 | account required pam_unix.so
|
|---|
| 527 | password requisite pam_cracklib.so retry=3
|
|---|
| 528 | password requisite pam_unix.so shadow md5 use_authtok try_first_pass
|
|---|
| 529 | password required pam_smbpass.so nullok use_authtok try_first_pass
|
|---|
| 530 | session required pam_unix.so
|
|---|
| 531 | </pre></div><div class="sect3" title="Password Migration Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id430540"></a>Password Migration Configuration</h4></div></div></div><p>
|
|---|
| 532 | The following PAM configuration shows the use of <code class="filename">pam_smbpass</code> to migrate
|
|---|
| 533 | from plaintext to encrypted passwords for Samba. Unlike other methods,
|
|---|
| 534 | this can be used for users who have never connected to Samba shares:
|
|---|
| 535 | password migration takes place when users <code class="literal">ftp</code> in, login using <code class="literal">ssh</code>, pop
|
|---|
| 536 | their mail, and so on.
|
|---|
| 537 | </p><p>
|
|---|
| 538 | </p><pre class="programlisting">
|
|---|
| 539 | #%PAM-1.0
|
|---|
| 540 | # password-migration
|
|---|
| 541 | #
|
|---|
| 542 | auth requisite pam_nologin.so
|
|---|
| 543 | # pam_smbpass is called IF pam_unix succeeds.
|
|---|
| 544 | auth requisite pam_unix.so
|
|---|
| 545 | auth optional pam_smbpass.so migrate
|
|---|
| 546 | account required pam_unix.so
|
|---|
| 547 | password requisite pam_cracklib.so retry=3
|
|---|
| 548 | password requisite pam_unix.so shadow md5 use_authtok try_first_pass
|
|---|
| 549 | password optional pam_smbpass.so nullok use_authtok try_first_pass
|
|---|
| 550 | session required pam_unix.so
|
|---|
| 551 | </pre></div><div class="sect3" title="Mature Password Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id430581"></a>Mature Password Configuration</h4></div></div></div><p>
|
|---|
| 552 | The following is a sample PAM configuration for a mature <code class="filename">smbpasswd</code> installation.
|
|---|
| 553 | <code class="filename">private/smbpasswd</code> is fully populated, and we consider it an error if
|
|---|
| 554 | the SMB password does not exist or does not match the UNIX password.
|
|---|
| 555 | </p><p>
|
|---|
| 556 | </p><pre class="programlisting">
|
|---|
| 557 | #%PAM-1.0
|
|---|
| 558 | # password-mature
|
|---|
| 559 | #
|
|---|
| 560 | auth requisite pam_nologin.so
|
|---|
| 561 | auth required pam_unix.so
|
|---|
| 562 | account required pam_unix.so
|
|---|
| 563 | password requisite pam_cracklib.so retry=3
|
|---|
| 564 | password requisite pam_unix.so shadow md5 use_authtok try_first_pass
|
|---|
| 565 | password required pam_smbpass.so use_authtok use_first_pass
|
|---|
| 566 | session required pam_unix.so
|
|---|
| 567 | </pre></div><div class="sect3" title="Kerberos Password Integration Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id430616"></a>Kerberos Password Integration Configuration</h4></div></div></div><p>
|
|---|
| 568 | The following is a sample PAM configuration that shows <em class="parameter"><code>pam_smbpass</code></em> used together with
|
|---|
| 569 | <em class="parameter"><code>pam_krb5</code></em>. This could be useful on a Samba PDC that is also a member of
|
|---|
| 570 | a Kerberos realm.
|
|---|
| 571 | </p><p>
|
|---|
| 572 | </p><pre class="programlisting">
|
|---|
| 573 | #%PAM-1.0
|
|---|
| 574 | # kdc-pdc
|
|---|
| 575 | #
|
|---|
| 576 | auth requisite pam_nologin.so
|
|---|
| 577 | auth requisite pam_krb5.so
|
|---|
| 578 | auth optional pam_smbpass.so migrate
|
|---|
| 579 | account required pam_krb5.so
|
|---|
| 580 | password requisite pam_cracklib.so retry=3
|
|---|
| 581 | password optional pam_smbpass.so nullok use_authtok try_first_pass
|
|---|
| 582 | password required pam_krb5.so use_authtok try_first_pass
|
|---|
| 583 | session required pam_krb5.so
|
|---|
| 584 | </pre></div></div></div><div class="sect1" title="Common Errors"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id430652"></a>Common Errors</h2></div></div></div><p>
|
|---|
| 585 | PAM can be fickle and sensitive to configuration glitches. Here we look at a few cases from
|
|---|
| 586 | the Samba mailing list.
|
|---|
| 587 | </p><div class="sect2" title="pam_winbind Problem"><div class="titlepage"><div><div><h3 class="title"><a name="id430662"></a>pam_winbind Problem</h3></div></div></div><p>
|
|---|
| 588 | A user reported, <span class="emphasis"><em>I have the following PAM configuration</em></span>:
|
|---|
| 589 | </p><p>
|
|---|
| 590 | </p><pre class="programlisting">
|
|---|
| 591 | auth required /lib/security/pam_securetty.so
|
|---|
| 592 | auth sufficient /lib/security/pam_winbind.so
|
|---|
| 593 | auth sufficient /lib/security/pam_unix.so use_first_pass nullok
|
|---|
| 594 | auth required /lib/security/pam_stack.so service=system-auth
|
|---|
| 595 | auth required /lib/security/pam_nologin.so
|
|---|
| 596 | account required /lib/security/pam_stack.so service=system-auth
|
|---|
| 597 | account required /lib/security/pam_winbind.so
|
|---|
| 598 | password required /lib/security/pam_stack.so service=system-auth
|
|---|
| 599 | </pre><p>
|
|---|
| 600 | </p><p>
|
|---|
| 601 | <span class="emphasis"><em>When I open a new console with [ctrl][alt][F1], I can't log in with my user <span class="quote">“<span class="quote">pitie.</span>”</span>
|
|---|
| 602 | I have tried with user <span class="quote">“<span class="quote">scienceu\pitie</span>”</span> also.</em></span>
|
|---|
| 603 | </p><p>
|
|---|
| 604 | The problem may lie with the inclusion of <em class="parameter"><code>pam_stack.so
|
|---|
| 605 | service=system-auth</code></em>. That file often contains a lot of stuff that may
|
|---|
| 606 | duplicate what you are already doing. Try commenting out the <em class="parameter"><code>pam_stack</code></em> lines
|
|---|
| 607 | for <em class="parameter"><code>auth</code></em> and <em class="parameter"><code>account</code></em> and see if things work. If they do, look at
|
|---|
| 608 | <code class="filename">/etc/pam.d/system-auth</code> and copy only what you need from it into your
|
|---|
| 609 | <code class="filename">/etc/pam.d/login</code> file. Alternatively, if you want all services to use
|
|---|
| 610 | Winbind, you can put the Winbind-specific stuff in <code class="filename">/etc/pam.d/system-auth</code>.
|
|---|
| 611 | </p></div><div class="sect2" title="Winbind Is Not Resolving Users and Groups"><div class="titlepage"><div><div><h3 class="title"><a name="id430751"></a>Winbind Is Not Resolving Users and Groups</h3></div></div></div><p>
|
|---|
| 612 | <span class="quote">“<span class="quote">
|
|---|
| 613 | My <code class="filename">smb.conf</code> file is correctly configured. I have specified
|
|---|
| 614 | <a class="link" href="smb.conf.5.html#IDMAPUID" target="_top">idmap uid = 12000</a>
|
|---|
| 615 | and <a class="link" href="smb.conf.5.html#IDMAPGID" target="_top">idmap gid = 3000-3500,</a>
|
|---|
| 616 | and <code class="literal">winbind</code> is running. When I do the following it all works fine.
|
|---|
| 617 | </span>”</span>
|
|---|
| 618 | </p><pre class="screen">
|
|---|
| 619 | <code class="prompt">root# </code><strong class="userinput"><code>wbinfo -u</code></strong>
|
|---|
| 620 | MIDEARTH\maryo
|
|---|
| 621 | MIDEARTH\jackb
|
|---|
| 622 | MIDEARTH\ameds
|
|---|
| 623 | ...
|
|---|
| 624 | MIDEARTH\root
|
|---|
| 625 |
|
|---|
| 626 | <code class="prompt">root# </code><strong class="userinput"><code>wbinfo -g</code></strong>
|
|---|
| 627 | MIDEARTH\Domain Users
|
|---|
| 628 | MIDEARTH\Domain Admins
|
|---|
| 629 | MIDEARTH\Domain Guests
|
|---|
| 630 | ...
|
|---|
| 631 | MIDEARTH\Accounts
|
|---|
| 632 |
|
|---|
| 633 | <code class="prompt">root# </code><strong class="userinput"><code>getent passwd</code></strong>
|
|---|
| 634 | root:x:0:0:root:/root:/bin/bash
|
|---|
| 635 | bin:x:1:1:bin:/bin:/bin/bash
|
|---|
| 636 | ...
|
|---|
| 637 | maryo:x:15000:15003:Mary Orville:/home/MIDEARTH/maryo:/bin/false
|
|---|
| 638 | </pre><p>
|
|---|
| 639 | <span class="quote">“<span class="quote">
|
|---|
| 640 | But this command fails:
|
|---|
| 641 | </span>”</span>
|
|---|
| 642 | </p><pre class="screen">
|
|---|
| 643 | <code class="prompt">root# </code><strong class="userinput"><code>chown maryo a_file</code></strong>
|
|---|
| 644 | chown: 'maryo': invalid user
|
|---|
| 645 | </pre><p>
|
|---|
| 646 | <span class="quote">“<span class="quote">This is driving me nuts! What can be wrong?</span>”</span>
|
|---|
| 647 | </p><p>
|
|---|
| 648 | Your system is likely running <code class="literal">nscd</code>, the name service
|
|---|
| 649 | caching daemon. Shut it down, do not restart it! You will find your problem resolved.
|
|---|
| 650 | </p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="ProfileMgmt.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="optional.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="integrate-ms-networks.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 27. Desktop Profile Management </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 29. Integrating MS Windows Networks with Samba</td></tr></table></div></body></html>
|
|---|
