Changeset 599 for trunk/server/docs/htmldocs/Samba3-ByExample/kerberos.html
- Timestamp:
- Jul 6, 2011, 8:21:13 PM (14 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/server/docs/htmldocs/Samba3-ByExample/kerberos.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 11. Active Directory, Kerberos, and Security</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="RefSection.html" title="Part III. Reference Section"><link rel="next" href="DomApps.html" title="Chapter 12. Integrating Additional Services"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 11. Active Directory, Kerberos, and Security</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="RefSection.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="DomApps.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="kerberos"></a>Chapter 11. Active Directory, Kerberos, and Security</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="kerberos.html#id2610496">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2611138">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2611154">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2611545">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2613169">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2613518">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2614131">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2614530">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2615257">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2615391">Questions and Answers</a></span></dt></dl></div><p><a class="indexterm" name="id2610431"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 11. Active Directory, Kerberos, and Security</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="RefSection.html" title="Part III. Reference Section"><link rel="next" href="DomApps.html" title="Chapter 12. Integrating Additional Services"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 11. Active Directory, Kerberos, and Security</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="RefSection.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="DomApps.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 11. Active Directory, Kerberos, and Security"><div class="titlepage"><div><div><h2 class="title"><a name="kerberos"></a>Chapter 11. Active Directory, Kerberos, and Security</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="kerberos.html#id377126">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id377710">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id377723">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id378089">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id379573">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id379908">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id380465">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id380830">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id381514">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id381636">Questions and Answers</a></span></dt></dl></div><p><a class="indexterm" name="id377075"></a> 2 2 By this point in the book, you have been exposed to many Samba-3 features and capabilities. 3 3 More importantly, if you have implemented the examples given, you are well on your way to becoming … … 5 5 practice, you likely have thought of improvements and scenarios with which you can experiment. You 6 6 are rather well plugged in to the many flexible ways Samba can be used. 7 </p><p><a class="indexterm" name="id 2610450"></a>7 </p><p><a class="indexterm" name="id377090"></a> 8 8 This is a book about Samba-3. Understandably, its intent is to present it in a positive light. 9 9 The casual observer might conclude that this book is one-eyed about Samba. It is what … … 14 14 decision. Criticism can be expected from the outside. Let's see how the interesting dynamic of 15 15 criticism develops with respect to Abmas. 16 </p><p><a class="indexterm" name="id 2610478"></a>16 </p><p><a class="indexterm" name="id377113"></a> 17 17 This chapter provides a shameless self-promotion of Samba-3. The objections raised were not pulled 18 18 out of thin air. They were drawn from comments made by Samba users and from criticism during … … 20 20 as possible that of the original. The case presented is a straw-man example that is designed to 21 21 permit each objection to be answered as it might occur in real life. 22 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2610496"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id2610502"></a><a class="indexterm" name="id2610510"></a><a class="indexterm" name="id2610518"></a><a class="indexterm" name="id2610526"></a><a class="indexterm" name="id2610534"></a>22 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id377126"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id377133"></a><a class="indexterm" name="id377141"></a><a class="indexterm" name="id377148"></a><a class="indexterm" name="id377156"></a><a class="indexterm" name="id377164"></a> 23 23 Abmas is continuing its meteoric growth with yet further acquisitions. The investment community took 24 24 note of the spectacular projection of Abmas onto the global business stage. Abmas is building an … … 29 29 During the time that the acquisition was closing, the Video Rentals business upgraded its Windows 30 30 NT4-based network to Windows 2003 Server and Active Directory. 31 </p><p><a class="indexterm" name="id 2610558"></a>31 </p><p><a class="indexterm" name="id377182"></a> 32 32 You have accepted the fact that Abmas Video Rentals will use Microsoft Active Directory. 33 33 The IT team, led by Stan Soroka, is committed to Samba-3 and to maintaining a uniform technology platform. 34 34 Stan Soroka's team voiced its disapproval over the decision to permit this business to continue to 35 operate with a solution that is viewed by Christine and her group as “<span class="quote">an island of broken36 technologies.</span>” This comment was made by one of Christine's staff as they were installing a new35 operate with a solution that is viewed by Christine and her group as <span class="quote">“<span class="quote">an island of broken 36 technologies.</span>”</span> This comment was made by one of Christine's staff as they were installing a new 37 37 Samba-3 server at the new business. 38 </p><p><a class="indexterm" name="id 2610581"></a><a class="indexterm" name="id2610589"></a>38 </p><p><a class="indexterm" name="id377201"></a><a class="indexterm" name="id377209"></a> 39 39 Abmas Video Rentals' head of IT heard of this criticism. He was offended that a junior engineer 40 40 should make such a comment. He felt that he had to prepare in case he might be criticized for his 41 41 decision to use Active Directory. He decided he would defend his decision by hiring the services 42 of an outside security systems consultant to report<sup>[<a name="id 2610604" href="#ftn.id2610604" class="footnote">12</a>]</sup> on his unit's operations42 of an outside security systems consultant to report<sup>[<a name="id377221" href="#ftn.id377221" class="footnote">12</a>]</sup> on his unit's operations 43 43 and to investigate the role of Samba at his site. Here are key extracts from this hypothetical 44 44 report: 45 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id 2610616"></a><a class="indexterm" name="id2610624"></a><a class="indexterm" name="id2610632"></a><a class="indexterm" name="id2610640"></a>45 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id377230"></a><a class="indexterm" name="id377238"></a><a class="indexterm" name="id377246"></a><a class="indexterm" name="id377254"></a> 46 46 ... the implementation of Microsoft Active Directory at the Abmas Video Rentals, Bamingsham site, 47 47 has been examined. We find no evidence to support a notion that vulnerabilities exist at your site. … … 50 50 </p><p> 51 51 ... 52 </p><p><a class="indexterm" name="id 2610661"></a><a class="indexterm" name="id2610672"></a><a class="indexterm" name="id2610683"></a><a class="indexterm" name="id2610691"></a><a class="indexterm" name="id2610699"></a><a class="indexterm" name="id2610707"></a>52 </p><p><a class="indexterm" name="id377272"></a><a class="indexterm" name="id377283"></a><a class="indexterm" name="id377294"></a><a class="indexterm" name="id377302"></a><a class="indexterm" name="id377310"></a><a class="indexterm" name="id377318"></a> 53 53 User and group accounts, and respective privileges, have been well thought out. File system shares are 54 54 appropriately secured. Backup and disaster recovery plans are well managed and validated regularly, and 55 55 effective off-site storage practices are considered to exceed industry norms. 56 </p><p><a class="indexterm" name="id 2610723"></a><a class="indexterm" name="id2610731"></a><a class="indexterm" name="id2610739"></a>56 </p><p><a class="indexterm" name="id377332"></a><a class="indexterm" name="id377340"></a><a class="indexterm" name="id377347"></a> 57 57 Your staff are justifiably concerned that the use of Samba may compromise their good efforts to maintain 58 58 a secure network. 59 </p><p><a class="indexterm" name="id 2610756"></a><a class="indexterm" name="id2610764"></a><a class="indexterm" name="id2610772"></a><a class="indexterm" name="id2610779"></a>59 </p><p><a class="indexterm" name="id377363"></a><a class="indexterm" name="id377371"></a><a class="indexterm" name="id377379"></a><a class="indexterm" name="id377387"></a> 60 60 The recently installed Linux file and application server uses a tool called <code class="literal">winbind</code> 61 61 that is indiscriminate about security. All user accounts in Active Directory can be used to access data … … 64 64 to great lengths to set fine-grained controls that limit information access to those who need access. 65 65 It seems incongruous to us that Samba winbind should be permitted to be used considering that it voids this fine work. 66 </p><p><a class="indexterm" name="id 2610810"></a><a class="indexterm" name="id2610818"></a><a class="indexterm" name="id2610826"></a>66 </p><p><a class="indexterm" name="id377412"></a><a class="indexterm" name="id377420"></a><a class="indexterm" name="id377428"></a> 67 67 Graham Judd [head of network administration] has locked down the security of all systems and is following 68 68 the latest Microsoft guidelines. ... null session connections have been disabled ... the internal network … … 73 73 </p><p> 74 74 ... 75 </p><p><a class="indexterm" name="id 2610851"></a><a class="indexterm" name="id2610859"></a><a class="indexterm" name="id2610866"></a><a class="indexterm" name="id2610874"></a>75 </p><p><a class="indexterm" name="id377448"></a><a class="indexterm" name="id377456"></a><a class="indexterm" name="id377464"></a><a class="indexterm" name="id377471"></a> 76 76 Regarding the use of Samba, we offer the following comments: Samba is in use in nearly half of 77 77 all sites we have surveyed. ... It is our opinion that Samba offers no better security than Microsoft … … 81 81 Samba is not at the full capabilities of Microsoft Windows NT4 server. Microsoft has moved well beyond that 82 82 with trusted computing initiatives that the Samba developers do not participate in. 83 </p><p><a class="indexterm" name="id 2610898"></a><a class="indexterm" name="id2610906"></a><a class="indexterm" name="id2610913"></a><a class="indexterm" name="id2610921"></a><a class="indexterm" name="id2610929"></a><a class="indexterm" name="id2610937"></a><a class="indexterm" name="id2610945"></a>83 </p><p><a class="indexterm" name="id377489"></a><a class="indexterm" name="id377496"></a><a class="indexterm" name="id377504"></a><a class="indexterm" name="id377512"></a><a class="indexterm" name="id377520"></a><a class="indexterm" name="id377528"></a><a class="indexterm" name="id377536"></a> 84 84 One wonders about the integrity of an open source program that is developed by a team of hackers 85 85 who cannot be held accountable for the flaws in their code. The sheer number of updates and bug 86 86 fixes they have released should ring alarm bells in any business. 87 </p><p><a class="indexterm" name="id 2610960"></a><a class="indexterm" name="id2610968"></a><a class="indexterm" name="id2610976"></a>87 </p><p><a class="indexterm" name="id377549"></a><a class="indexterm" name="id377557"></a><a class="indexterm" name="id377565"></a> 88 88 Another factor that should be considered is that buying Microsoft products and services helps to 89 89 provide employment in the IT industry. Samba and Open Source software place those jobs at risk. 90 </p></blockquote></div><p><a class="indexterm" name="id 2610991"></a><a class="indexterm" name="id2610999"></a>90 </p></blockquote></div><p><a class="indexterm" name="id377578"></a><a class="indexterm" name="id377586"></a> 91 91 This is also a challenge to rise above the trouble spot. You call Stan's team together for a simple 92 92 discussion, but it gets further out of hand. When you return to your office, you find the following … … 101 101 across all systems. I concur with the desire to improve security. One of the new guys who is championing 102 102 the move to Kerberos was responsible for the comment that caused the embarrassment. 103 </p><p><a class="indexterm" name="id 2611036"></a><a class="indexterm" name="id2611043"></a><a class="indexterm" name="id2611051"></a><a class="indexterm" name="id2611059"></a>103 </p><p><a class="indexterm" name="id377616"></a><a class="indexterm" name="id377624"></a><a class="indexterm" name="id377632"></a><a class="indexterm" name="id377640"></a> 104 104 I am experiencing difficulty in handling the sharp push for Kerberos. He claims that Kerberos, OpenLDAP, 105 105 plus Samba-3 will seamlessly replace Microsoft Active Directory. I am a little out of my depth with respect 106 106 to the feasibility of such a move, but have taken steps to pull both of them into line. With your consent, 107 107 I would like to hire the services of a well-known Samba consultant to set the record straight. 108 </p><p><a class="indexterm" name="id 2611078"></a><a class="indexterm" name="id2611085"></a><a class="indexterm" name="id2611093"></a><a class="indexterm" name="id2611101"></a><a class="indexterm" name="id2611109"></a><a class="indexterm" name="id2611117"></a>108 </p><p><a class="indexterm" name="id377655"></a><a class="indexterm" name="id377662"></a><a class="indexterm" name="id377670"></a><a class="indexterm" name="id377678"></a><a class="indexterm" name="id377686"></a><a class="indexterm" name="id377694"></a> 109 109 I intend to use this report to answer the criticism raised and would like to establish a policy that we 110 110 will approve the use of Microsoft Windows Servers (and Active Directory) subject to all costs being covered … … 113 113 use of any centrally proposed standards, but make all noncompliance the financial responsibility of the 114 114 out-of-step division. Hopefully, this will encourage all divisions to walk with us and not alone. 115 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Stan</span></td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2611138"></a>Assignment Tasks</h3></div></div></div><p>115 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Stan</span></td></tr></table></div><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id377710"></a>Assignment Tasks</h3></div></div></div><p> 116 116 You agreed with Stan's recommendations and hired a consultant to help defuse the powder 117 117 keg. The consultant's task is to provide a tractable answer to each of the issues raised. The consultant must be able 118 118 to support his or her claims, keep emotions to the side, and answer technically. 119 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2611154"></a>Dissection and Discussion</h2></div></div></div><p><a class="indexterm" name="id2611161"></a><a class="indexterm" name="id2611169"></a><a class="indexterm" name="id2611177"></a><a class="indexterm" name="id2611185"></a><a class="indexterm" name="id2611193"></a><a class="indexterm" name="id2611201"></a><a class="indexterm" name="id2611209"></a>119 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id377723"></a>Dissection and Discussion</h2></div></div></div><p><a class="indexterm" name="id377730"></a><a class="indexterm" name="id377738"></a><a class="indexterm" name="id377746"></a><a class="indexterm" name="id377754"></a><a class="indexterm" name="id377761"></a><a class="indexterm" name="id377769"></a><a class="indexterm" name="id377777"></a> 120 120 Samba-3 is a tool. No one is pounding your door to make you use Samba. That is a choice that you are free to 121 121 make or reject. It is likely that your decision to use Samba can greatly benefit your company. … … 125 125 money saved by not spending in the IT area can be spent elsewhere in the business. All money saved 126 126 or spent creates employment. 127 </p><p><a class="indexterm" name="id 2611230"></a><a class="indexterm" name="id2611238"></a><a class="indexterm" name="id2611246"></a><a class="indexterm" name="id2611254"></a><a class="indexterm" name="id2611262"></a>127 </p><p><a class="indexterm" name="id377794"></a><a class="indexterm" name="id377802"></a><a class="indexterm" name="id377809"></a><a class="indexterm" name="id377817"></a><a class="indexterm" name="id377825"></a> 128 128 In the long term, the use of Samba must be economically sustainable. In some situations, Samba is adopted 129 129 purely to provide file and print service interoperability on platforms that otherwise cannot provide … … 131 131 effect a reduction in the cost of providing IT services. Obviously, it is also used by some as an 132 132 alternative to the use of a Microsoft file and print serving platforms with no consideration of costs. 133 </p><p><a class="indexterm" name="id 2611282"></a><a class="indexterm" name="id2611290"></a><a class="indexterm" name="id2611298"></a><a class="indexterm" name="id2611306"></a>133 </p><p><a class="indexterm" name="id377841"></a><a class="indexterm" name="id377848"></a><a class="indexterm" name="id377856"></a><a class="indexterm" name="id377864"></a> 134 134 It would be foolish to adopt a technology that might put any data or users at risk. Security affects 135 135 everyone. The Samba-Team is fully cognizant of the responsibility they have to their users. 136 136 The Samba documentation clearly reveals that full responsibility is accepted to fix anything 137 137 that is broken. 138 </p><p><a class="indexterm" name="id 2611322"></a><a class="indexterm" name="id2611330"></a><a class="indexterm" name="id2611338"></a><a class="indexterm" name="id2611346"></a><a class="indexterm" name="id2611358"></a><a class="indexterm" name="id2611366"></a><a class="indexterm" name="id2611374"></a><a class="indexterm" name="id2611382"></a><a class="indexterm" name="id2611389"></a><a class="indexterm" name="id2611397"></a><a class="indexterm" name="id2611405"></a>138 </p><p><a class="indexterm" name="id377878"></a><a class="indexterm" name="id377886"></a><a class="indexterm" name="id377894"></a><a class="indexterm" name="id377902"></a><a class="indexterm" name="id377913"></a><a class="indexterm" name="id377921"></a><a class="indexterm" name="id377929"></a><a class="indexterm" name="id377937"></a><a class="indexterm" name="id377945"></a><a class="indexterm" name="id377952"></a><a class="indexterm" name="id377960"></a> 139 139 There is a mistaken perception in the IT industry that commercial software providers are fully 140 140 accountable for the defects in products. Open Source software comes with no warranty, so it is … … 144 144 commercial software vendors are willingly accountable for product defects. In many cases, the 145 145 commercial vendor accepts liability only to reimburse the price paid for the software. 146 </p><p><a class="indexterm" name="id 2611428"></a><a class="indexterm" name="id2611435"></a><a class="indexterm" name="id2611443"></a><a class="indexterm" name="id2611451"></a><a class="indexterm" name="id2611459"></a><a class="indexterm" name="id2611467"></a>146 </p><p><a class="indexterm" name="id377977"></a><a class="indexterm" name="id377985"></a><a class="indexterm" name="id377993"></a><a class="indexterm" name="id378001"></a><a class="indexterm" name="id378009"></a><a class="indexterm" name="id378016"></a> 147 147 The real issues that a consumer (like you) needs answered are What is the way of escape from technical 148 148 problems, and how long will it take? The average problem turnaround time in the Open Source community is 149 149 approximately 48 hours. What does the EULA offer? What is the track record in the commercial software 150 150 industry? What happens when your commercial vendor decides to cease providing support? 151 </p><p><a class="indexterm" name="id 2611485"></a><a class="indexterm" name="id2611493"></a><a class="indexterm" name="id2611501"></a><a class="indexterm" name="id2611509"></a><a class="indexterm" name="id2611517"></a><a class="indexterm" name="id2611524"></a><a class="indexterm" name="id2611532"></a>151 </p><p><a class="indexterm" name="id378031"></a><a class="indexterm" name="id378039"></a><a class="indexterm" name="id378047"></a><a class="indexterm" name="id378055"></a><a class="indexterm" name="id378062"></a><a class="indexterm" name="id378070"></a><a class="indexterm" name="id378078"></a> 152 152 Open Source software at least puts you in possession of the source code. This means that when 153 153 all else fails, you can hire a programmer to solve the problem. 154 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2611545"></a>Technical Issues</h3></div></div></div><p>154 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id378089"></a>Technical Issues</h3></div></div></div><p> 155 155 Each issue is now discussed and, where appropriate, example implementation steps are 156 156 provided. 157 </p><div class="variablelist"><dl><dt><span class="term">Winbind and Security</span></dt><dd><p><a class="indexterm" name="id 2611566"></a><a class="indexterm" name="id2611574"></a><a class="indexterm" name="id2611582"></a><a class="indexterm" name="id2611593"></a><a class="indexterm" name="id2611601"></a><a class="indexterm" name="id2611609"></a><a class="indexterm" name="id2611617"></a><a class="indexterm" name="id2611625"></a><a class="indexterm" name="id2611633"></a><a class="indexterm" name="id2611641"></a>157 </p><div class="variablelist"><dl><dt><span class="term">Winbind and Security</span></dt><dd><p><a class="indexterm" name="id378109"></a><a class="indexterm" name="id378117"></a><a class="indexterm" name="id378125"></a><a class="indexterm" name="id378136"></a><a class="indexterm" name="id378144"></a><a class="indexterm" name="id378152"></a><a class="indexterm" name="id378160"></a><a class="indexterm" name="id378168"></a><a class="indexterm" name="id378175"></a><a class="indexterm" name="id378183"></a> 158 158 Windows network administrators may be dismayed to find that <code class="literal">winbind</code> 159 159 exposes all domain users so that they may use their domain account credentials to … … 161 161 UNIX/Linux server in their Network Neighborhood and can browse the shares on the 162 162 server seems to excite them further. 163 </p><p><a class="indexterm" name="id 2611664"></a><a class="indexterm" name="id2611673"></a><a class="indexterm" name="id2611680"></a><a class="indexterm" name="id2611688"></a>163 </p><p><a class="indexterm" name="id378204"></a><a class="indexterm" name="id378212"></a><a class="indexterm" name="id378220"></a><a class="indexterm" name="id378227"></a> 164 164 <code class="literal">winbind</code> provides for the UNIX/Linux domain member server or 165 165 client, the same as one would obtain by adding a Microsoft Windows server or … … 167 167 and therefore requires handling a little differently from the familiar Windows systems. 168 168 One must recognize fear of the unknown. 169 </p><p><a class="indexterm" name="id 2611711"></a><a class="indexterm" name="id2611719"></a><a class="indexterm" name="id2611727"></a><a class="indexterm" name="id2611735"></a><a class="indexterm" name="id2611743"></a><a class="indexterm" name="id2611755"></a>169 </p><p><a class="indexterm" name="id378247"></a><a class="indexterm" name="id378255"></a><a class="indexterm" name="id378263"></a><a class="indexterm" name="id378271"></a><a class="indexterm" name="id378279"></a><a class="indexterm" name="id378290"></a> 170 170 Windows network administrators need to recognize that <code class="literal">winbind</code> does 171 171 not, and cannot, override account controls set using the Active Directory management 172 172 tools. The control is the same. Have no fear. 173 </p><p><a class="indexterm" name="id 2611775"></a><a class="indexterm" name="id2611783"></a><a class="indexterm" name="id2611794"></a><a class="indexterm" name="id2611802"></a><a class="indexterm" name="id2611810"></a><a class="indexterm" name="id2611818"></a><a class="indexterm" name="id2611826"></a><a class="indexterm" name="id2611834"></a><a class="indexterm" name="id2611842"></a><a class="indexterm" name="id2611850"></a>173 </p><p><a class="indexterm" name="id378309"></a><a class="indexterm" name="id378317"></a><a class="indexterm" name="id378328"></a><a class="indexterm" name="id378336"></a><a class="indexterm" name="id378344"></a><a class="indexterm" name="id378352"></a><a class="indexterm" name="id378360"></a><a class="indexterm" name="id378368"></a><a class="indexterm" name="id378375"></a><a class="indexterm" name="id378383"></a> 174 174 Where Samba and the ADS domain account information obtained through the use of 175 175 <code class="literal">winbind</code> permits access, by browsing or by the drive mapping to … … 177 177 controls have not been properly implemented. Samba permits access controls to be set 178 178 on: 179 </p><div class="itemizedlist"><ul type="disc"><li><p>Shares themselves (i.e., the logical share itself)</p></li><li><p>The share definition in <code class="filename">smb.conf</code></p></li><li><p>The shared directories and files using UNIX permissions</p></li><li><p>Using Windows 2000 ACLs if the file system is POSIX enabled</p></li></ul></div><p>179 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Shares themselves (i.e., the logical share itself)</p></li><li class="listitem"><p>The share definition in <code class="filename">smb.conf</code></p></li><li class="listitem"><p>The shared directories and files using UNIX permissions</p></li><li class="listitem"><p>Using Windows 2000 ACLs if the file system is POSIX enabled</p></li></ul></div><p> 180 180 Examples of each are given in <a class="link" href="kerberos.html#ch10expl" title="Implementation">“Implementation”</a>. 181 </p></dd><dt><span class="term">User and Group Controls</span></dt><dd><p><a class="indexterm" name="id 2611924"></a><a class="indexterm" name="id2611932"></a><a class="indexterm" name="id2611943"></a><a class="indexterm" name="id2611954"></a><a class="indexterm" name="id2611962"></a><a class="indexterm" name="id2611970"></a><a class="indexterm" name="id2611978"></a><a class="indexterm" name="id2611986"></a><a class="indexterm" name="id2611994"></a>181 </p></dd><dt><span class="term">User and Group Controls</span></dt><dd><p><a class="indexterm" name="id378452"></a><a class="indexterm" name="id378460"></a><a class="indexterm" name="id378471"></a><a class="indexterm" name="id378483"></a><a class="indexterm" name="id378490"></a><a class="indexterm" name="id378498"></a><a class="indexterm" name="id378506"></a><a class="indexterm" name="id378514"></a><a class="indexterm" name="id378522"></a> 182 182 User and group management facilities as known in the Windows ADS environment may be 183 183 used to provide equivalent access control constraints or to provide equivalent … … 186 186 Windows 200x/XP. For example, access controls on a Samba server may be set within 187 187 the share definition in a manner for which Windows has no equivalent. 188 </p><p><a class="indexterm" name="id 2612014"></a><a class="indexterm" name="id2612022"></a><a class="indexterm" name="id2612030"></a><a class="indexterm" name="id2612037"></a><a class="indexterm" name="id2612049"></a><a class="indexterm" name="id2612057"></a><a class="indexterm" name="id2612065"></a>188 </p><p><a class="indexterm" name="id378537"></a><a class="indexterm" name="id378545"></a><a class="indexterm" name="id378553"></a><a class="indexterm" name="id378561"></a><a class="indexterm" name="id378572"></a><a class="indexterm" name="id378580"></a><a class="indexterm" name="id378588"></a> 189 189 In any serious analysis of system security, it is important to examine the safeguards 190 190 that remain when all other protective measures fail. An administrator may inadvertently … … 194 194 possible to guard against that by enforcing controls on the share definition itself. You 195 195 see a practical example of this a little later in this chapter. 196 </p><p><a class="indexterm" name="id 2612097"></a><a class="indexterm" name="id2612105"></a>196 </p><p><a class="indexterm" name="id378610"></a><a class="indexterm" name="id378618"></a> 197 197 The report that is critical of Samba really ought to have exercised greater due 198 198 diligence: the real weakness is on the side of a Microsoft Windows environment. 199 </p></dd><dt><span class="term">Security Overall</span></dt><dd><p><a class="indexterm" name="id 2612127"></a>199 </p></dd><dt><span class="term">Security Overall</span></dt><dd><p><a class="indexterm" name="id378638"></a> 200 200 Samba is designed in such a manner that weaknesses inherent in the design of 201 201 Microsoft Windows networking ought not to expose the underlying UNIX/Linux file 202 202 system in any way. All software has potential defects, and Samba is no exception. 203 203 What matters more is how defects that are discovered get dealt with. 204 </p><p><a class="indexterm" name="id 2612144"></a><a class="indexterm" name="id2612151"></a><a class="indexterm" name="id2612159"></a><a class="indexterm" name="id2612167"></a>204 </p><p><a class="indexterm" name="id378652"></a><a class="indexterm" name="id378660"></a><a class="indexterm" name="id378668"></a><a class="indexterm" name="id378676"></a> 205 205 The Samba Team totally agrees with the necessity to observe and fully implement 206 206 every security facility to provide a level of protection and security that is necessary … … 209 209 security be publicly condoned; yet this is the practice by many Windows network 210 210 administrators just to make happy users who have no notion of consequential risk. 211 </p><p><a class="indexterm" name="id 2612187"></a><a class="indexterm" name="id2612195"></a><a class="indexterm" name="id2612203"></a><a class="indexterm" name="id2612211"></a><a class="indexterm" name="id2612219"></a><a class="indexterm" name="id2612227"></a><a class="indexterm" name="id2612235"></a>211 </p><p><a class="indexterm" name="id378691"></a><a class="indexterm" name="id378699"></a><a class="indexterm" name="id378707"></a><a class="indexterm" name="id378715"></a><a class="indexterm" name="id378723"></a><a class="indexterm" name="id378730"></a><a class="indexterm" name="id378738"></a> 212 212 The report condemns Samba for releasing updates and security fixes, yet Microsoft 213 213 online updates need to be applied almost weekly. The answer to the criticism … … 215 215 user needs are being increasingly met or exceeded, and security updates are issued 216 216 with a short turnaround time. 217 </p><p><a class="indexterm" name="id 2612252"></a><a class="indexterm" name="id2612260"></a><a class="indexterm" name="id2612268"></a><a class="indexterm" name="id2612276"></a><a class="indexterm" name="id2612284"></a>217 </p><p><a class="indexterm" name="id378753"></a><a class="indexterm" name="id378761"></a><a class="indexterm" name="id378768"></a><a class="indexterm" name="id378776"></a><a class="indexterm" name="id378784"></a> 218 218 The release of Samba-4 is expected around late 2004 to early 2005 and involves a near 219 219 complete rewrite to permit extensive modularization and to prepare Samba for new … … 222 222 degree of dependability and on charter development consistent with published 223 223 roadmap projections. 224 </p><p><a class="indexterm" name="id 2612307"></a><a class="indexterm" name="id2612315"></a><a class="indexterm" name="id2612326"></a><a class="indexterm" name="id2612338"></a><a class="indexterm" name="id2612346"></a><a class="indexterm" name="id2612354"></a><a class="indexterm" name="id2612362"></a>224 </p><p><a class="indexterm" name="id378803"></a><a class="indexterm" name="id378811"></a><a class="indexterm" name="id378822"></a><a class="indexterm" name="id378833"></a><a class="indexterm" name="id378841"></a><a class="indexterm" name="id378849"></a><a class="indexterm" name="id378857"></a> 225 225 Not well published is the fact that Microsoft was a foundation member of 226 226 the Common Internet File System (CIFS) initiative, together with the participation … … 231 231 CIFS conferences and at the interoperability laboratories run concurrently with 232 232 them. 233 </p></dd><dt><span class="term">Cryptographic Controls (schannel, sign'n'seal)</span></dt><dd><p><a class="indexterm" name="id 2612391"></a><a class="indexterm" name="id2612399"></a><a class="indexterm" name="id2612407"></a>233 </p></dd><dt><span class="term">Cryptographic Controls (schannel, sign'n'seal)</span></dt><dd><p><a class="indexterm" name="id378881"></a><a class="indexterm" name="id378889"></a><a class="indexterm" name="id378897"></a> 234 234 The report correctly mentions that Samba did not support the most recent 235 235 <code class="constant">schannel</code> and <code class="constant">digital sign'n'seal</code> features … … 239 239 pathology report they reflect accurately (at best) status at a snapshot in time. 240 240 Meanwhile, the world moves on. 241 </p><p><a class="indexterm" name="id 2612437"></a><a class="indexterm" name="id2612445"></a><a class="indexterm" name="id2612453"></a><a class="indexterm" name="id2612460"></a><a class="indexterm" name="id2612468"></a><a class="indexterm" name="id2612483"></a><a class="indexterm" name="id2612491"></a>241 </p><p><a class="indexterm" name="id378923"></a><a class="indexterm" name="id378930"></a><a class="indexterm" name="id378938"></a><a class="indexterm" name="id378946"></a><a class="indexterm" name="id378953"></a><a class="indexterm" name="id378968"></a><a class="indexterm" name="id378976"></a> 242 242 It should be pointed out that had clear public specifications for the protocols 243 243 been published, it would have been much easier to implement these features and would have … … 247 247 and defensible standards is obvious to all and would have enabled more secure networking 248 248 for everyone. 249 </p><p><a class="indexterm" name="id 2612512"></a><a class="indexterm" name="id2612520"></a>249 </p><p><a class="indexterm" name="id378992"></a><a class="indexterm" name="id379000"></a> 250 250 Critics of Samba often ignore fundamental problems that may plague (or may have plagued) 251 251 the users of Microsoft's products also. Those who are first to criticize Samba … … 259 259 Windows networking sites. From notes such as this it is clear that there are benefits 260 260 from not rushing new technology out of the door too soon. 261 </p><p><a class="indexterm" name="id 2612560"></a><a class="indexterm" name="id2612568"></a><a class="indexterm" name="id2612576"></a><a class="indexterm" name="id2612584"></a><a class="indexterm" name="id2612592"></a><a class="indexterm" name="id2612600"></a><a class="indexterm" name="id2612608"></a><a class="indexterm" name="id2612616"></a><a class="indexterm" name="id2612624"></a>261 </p><p><a class="indexterm" name="id379032"></a><a class="indexterm" name="id379040"></a><a class="indexterm" name="id379048"></a><a class="indexterm" name="id379056"></a><a class="indexterm" name="id379064"></a><a class="indexterm" name="id379072"></a><a class="indexterm" name="id379080"></a><a class="indexterm" name="id379088"></a><a class="indexterm" name="id379096"></a> 262 262 One final comment is warranted. If companies want more secure networking protocols, 263 263 the most effective method by which this can be achieved is by users seeking … … 268 268 help the consumer to make a better choice. 269 269 </p></dd><dt><span class="term">Active Directory Replacement with Kerberos, LDAP, and Samba 270 <a class="indexterm" name="id 2612649"></a><a class="indexterm" name="id2612661"></a><a class="indexterm" name="id2612669"></a><a class="indexterm" name="id2612677"></a>270 <a class="indexterm" name="id379116"></a><a class="indexterm" name="id379128"></a><a class="indexterm" name="id379136"></a><a class="indexterm" name="id379143"></a> 271 271 272 272 </span></dt><dd><p> … … 278 278 and yet by which they are made to interoperate in ways that the components do not 279 279 support. 280 </p><p><a class="indexterm" name="id 2612711"></a><a class="indexterm" name="id2612723"></a><a class="indexterm" name="id2612731"></a><a class="indexterm" name="id2612739"></a><a class="indexterm" name="id2612747"></a>280 </p><p><a class="indexterm" name="id379174"></a><a class="indexterm" name="id379185"></a><a class="indexterm" name="id379193"></a><a class="indexterm" name="id379201"></a><a class="indexterm" name="id379209"></a> 281 281 In order to make the popular request for Samba to be an Active Directory Server a 282 282 reality, it is necessary to add to OpenLDAP, Kerberos, as well as Samba, RPC calls … … 286 286 the Samba Team does not make it a priority to absorb Kerberos and LDAP functionality 287 287 into the Samba project, this dream request cannot become a reality. 288 </p><p><a class="indexterm" name="id 2612768"></a><a class="indexterm" name="id2612776"></a><a class="indexterm" name="id2612784"></a><a class="indexterm" name="id2612795"></a><a class="indexterm" name="id2612802"></a>288 </p><p><a class="indexterm" name="id379225"></a><a class="indexterm" name="id379233"></a><a class="indexterm" name="id379241"></a><a class="indexterm" name="id379252"></a><a class="indexterm" name="id379260"></a> 289 289 At this time, the integration of LDAP, Kerberos, and the missing RPCs is not on the 290 290 Samba development roadmap. If it is not on the published roadmap, it cannot be delivered … … 292 292 The Samba Team is most committed to permitting Samba to be a full ADS domain member 293 293 that is increasingly capable of being managed using Microsoft Windows MMC tools. 294 </p></dd></dl></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2612822"></a>Kerberos Exposed</h4></div></div></div><p><a class="indexterm" name="id2612829"></a><a class="indexterm" name="id2612837"></a><a class="indexterm" name="id2612845"></a>294 </p></dd></dl></div><div class="sect3" title="Kerberos Exposed"><div class="titlepage"><div><div><h4 class="title"><a name="id379276"></a>Kerberos Exposed</h4></div></div></div><p><a class="indexterm" name="id379282"></a><a class="indexterm" name="id379290"></a><a class="indexterm" name="id379298"></a> 295 295 Kerberos is a network authentication protocol that provides secure authentication for 296 296 client-server applications by using secret-key cryptography. Firewalls are an insufficient … … 298 298 traffic but cannot prevent network traffic that comes from authorized locations from 299 299 performing unauthorized activities. 300 </p><p><a class="indexterm" name="id 2612863"></a><a class="indexterm" name="id2612871"></a><a class="indexterm" name="id2612879"></a>300 </p><p><a class="indexterm" name="id379312"></a><a class="indexterm" name="id379320"></a><a class="indexterm" name="id379328"></a> 301 301 Kerberos was created by MIT as a solution to network security problems. The Kerberos protocol uses 302 302 strong cryptography so that a client can prove its identity to a server (and vice versa) across an … … 304 304 they can also encrypt all of their communications to assure privacy and data integrity as they go 305 305 about their business. 306 </p><p><a class="indexterm" name="id 2612897"></a><a class="indexterm" name="id2612905"></a><a class="indexterm" name="id2612913"></a><a class="indexterm" name="id2612921"></a><a class="indexterm" name="id2612932"></a>306 </p><p><a class="indexterm" name="id379343"></a><a class="indexterm" name="id379351"></a><a class="indexterm" name="id379359"></a><a class="indexterm" name="id379367"></a><a class="indexterm" name="id379378"></a> 307 307 Kerberos is a trusted third-party service. That means that there is a third party (the kerberos 308 308 server) that is trusted by all the entities on the network (users and services, usually called … … 311 311 trusting the kerberos server, users and services can authenticate each other. 312 312 </p><p> 313 <a class="indexterm" name="id 2612952"></a>314 <a class="indexterm" name="id 2612959"></a>315 <a class="indexterm" name="id 2612966"></a>313 <a class="indexterm" name="id379394"></a> 314 <a class="indexterm" name="id379401"></a> 315 <a class="indexterm" name="id379408"></a> 316 316 Kerberos was, until recently, a technology that was restricted from being exported from the United States. 317 317 For many years that hindered global adoption of more secure networking technologies both within the United States … … 323 323 and use of Kerberos across the spectrum of the information technology industry. 324 324 </p><p> 325 <a class="indexterm" name="id 2612995"></a>325 <a class="indexterm" name="id379430"></a> 326 326 A storm has broken out concerning interoperability between MIT Kerberos and Microsofts' implementation 327 327 of it. For example, a 2002 328 328 <a class="ulink" href="http://www.idg.com.sg/idgwww.nsf/0/5DDA8D153A7505A748256BAB000D992A?OpenDocument" target="_top">IDG</a> 329 report<sup>[<a name="id 2613014" href="#ftn.id2613014" class="footnote">13</a>]</sup> by329 report<sup>[<a name="id379447" href="#ftn.id379447" class="footnote">13</a>]</sup> by 330 330 states: 331 331 </p><div class="blockquote"><blockquote class="blockquote"><p> … … 335 335 use of the Kerberos authentication specification, not everyone agrees. 336 336 </p><p> 337 <a class="indexterm" name="id 2613041"></a>337 <a class="indexterm" name="id379470"></a> 338 338 Robert Short, vice president of Windows core technology at Microsoft, wrote in his direct testimony prepared 339 339 before his appearance that non-Microsoft operating systems can disregard the portion of the Kerberos version … … 343 343 that software developers could add their own authorization information, he said. 344 344 </p></blockquote></div><p> 345 <a class="indexterm" name="id 2613065"></a>346 <a class="indexterm" name="id 2613071"></a>345 <a class="indexterm" name="id379488"></a> 346 <a class="indexterm" name="id379494"></a> 347 347 It so happens that Microsoft Windows clients depend on and expect the contents of the <span class="emphasis"><em>unspecified 348 348 fields</em></span> in the Kerberos 5 communications data stream for their Windows interoperability, … … 356 356 <a class="ulink" href="http://www.microsoft.com/technet/itsolutions/interop/mgmt/kerberos.asp" target="_top"> 357 357 technet</a> article: 358 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id 2613106"></a><a class="indexterm" name="id2613118"></a>358 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id379523"></a><a class="indexterm" name="id379535"></a> 359 359 The DCE Security Services are also layered on the Kerberos protocol. DCE authentication services use RPC 360 360 representation of Kerberos protocol messages. In addition, DCE uses the authorization data field in Kerberos … … 364 364 is not an issue with Kerberos interoperability, but rather an issue of interoperability between DCE and 365 365 Windows NT access control information. 366 </p></blockquote></div></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch10expl"></a>Implementation</h2></div></div></div><p>366 </p></blockquote></div></div></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch10expl"></a>Implementation</h2></div></div></div><p> 367 367 The following procedures outline the implementation of the security measures discussed so far. 368 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2613169"></a>Share Access Controls</h3></div></div></div><p><a class="indexterm" name="id2613176"></a><a class="indexterm" name="id2613184"></a><a class="indexterm" name="id2613192"></a>368 </p><div class="sect2" title="Share Access Controls"><div class="titlepage"><div><div><h3 class="title"><a name="id379573"></a>Share Access Controls</h3></div></div></div><p><a class="indexterm" name="id379580"></a><a class="indexterm" name="id379588"></a><a class="indexterm" name="id379596"></a> 369 369 Access control entries placed on the share itself act as a filter at the time a when CIFS/SMB client (such as 370 370 Windows XP Pro) attempts to make a connection to the Samba server. 371 </p><div class="procedure" ><a name="id2613205"></a><p class="title"><b>Procedure 11.1. Create/Edit/Delete Share ACLs</b></p><ol type="1"><li><p><a class="indexterm" name="id2613216"></a><a class="indexterm" name="id2613224"></a>371 </p><div class="procedure" title="Procedure 11.1. Create/Edit/Delete Share ACLs"><a name="id379607"></a><p class="title"><b>Procedure 11.1. Create/Edit/Delete Share ACLs</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p><a class="indexterm" name="id379617"></a><a class="indexterm" name="id379625"></a> 372 372 From a Windows 200x/XP Professional workstation, log on to the domain using the Domain Administrator 373 373 account (on Samba domains, this is usually the account called <code class="constant">root</code>). 374 </p></li><li ><p>374 </p></li><li class="step" title="Step 2"><p> 375 375 Click 376 376 <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Control Panel</span> → <span class="guimenuitem">Administrative Tools</span> → <span class="guimenuitem">Computer Management</span>. 377 </p></li><li ><p>377 </p></li><li class="step" title="Step 3"><p> 378 378 In the left panel, 379 379 <span class="guimenu">[Right mouse menu item] Computer Management (Local)</span> → <span class="guimenuitem">Connect to another computer ...</span> → <span class="guimenuitem">Browse...</span> → <span class="guimenuitem">Advanced</span> → <span class="guimenuitem">Find Now</span>. In the lower panel, click on the name of the server you wish to 380 administer. Click <span class="guimenu">OK</span> → <span class="guimenuitem">OK</span> → <span class="guimenuitem">OK</span>.<a class="indexterm" name="id 2613347"></a>380 administer. Click <span class="guimenu">OK</span> → <span class="guimenuitem">OK</span> → <span class="guimenuitem">OK</span>.<a class="indexterm" name="id379745"></a> 381 381 In the left panel, the entry <span class="guimenu">Computer Management (Local)</span> should now reflect 382 382 the change made. For example, if the server you are administering is called <code class="constant">FRODO</code>, 383 383 the Computer Management entry should now say <span class="guimenu">Computer Management (FRODO)</span>. 384 </p></li><li ><p>384 </p></li><li class="step" title="Step 4"><p> 385 385 In the left panel, click <span class="guimenu">Computer Management (FRODO)</span> → <span class="guimenuitem">[+] Shared Folders</span> → <span class="guimenuitem">Shares</span>. 386 </p></li><li ><p><a class="indexterm" name="id2613411"></a><a class="indexterm" name="id2613419"></a>386 </p></li><li class="step" title="Step 5"><p><a class="indexterm" name="id379806"></a><a class="indexterm" name="id379814"></a> 387 387 In the right panel, double-click on the share on which you wish to set/edit ACLs. This 388 388 will bring up the Properties panel. Click the <span class="guimenu">Share Permissions</span> tab. 389 </p></li><li ><p><a class="indexterm" name="id2613442"></a><a class="indexterm" name="id2613450"></a><a class="indexterm" name="id2613458"></a><a class="indexterm" name="id2613466"></a><a class="indexterm" name="id2613474"></a><a class="indexterm" name="id2613482"></a>389 </p></li><li class="step" title="Step 6"><p><a class="indexterm" name="id379836"></a><a class="indexterm" name="id379844"></a><a class="indexterm" name="id379852"></a><a class="indexterm" name="id379860"></a><a class="indexterm" name="id379868"></a><a class="indexterm" name="id379875"></a> 390 390 You may now edit/add/remove access control settings. Be very careful. Many problems have been 391 391 created by people who decided that everyone should be rejected but one particular group should … … 393 393 belong to the group <code class="constant">Everyone</code>, which therefore overrules any permissions 394 394 set for the permitted group. 395 </p></li><li ><p>395 </p></li><li class="step" title="Step 7"><p> 396 396 When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span> 397 397 buttons. 398 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2613518"></a>Share Definition Controls</h3></div></div></div><p><a class="indexterm" name="id2613525"></a><a class="indexterm" name="id2613536"></a><a class="indexterm" name="id2613544"></a><a class="indexterm" name="id2613552"></a><a class="indexterm" name="id2613560"></a><a class="indexterm" name="id2613568"></a>398 </p></li></ol></div></div><div class="sect2" title="Share Definition Controls"><div class="titlepage"><div><div><h3 class="title"><a name="id379908"></a>Share Definition Controls</h3></div></div></div><p><a class="indexterm" name="id379914"></a><a class="indexterm" name="id379926"></a><a class="indexterm" name="id379934"></a><a class="indexterm" name="id379942"></a><a class="indexterm" name="id379949"></a><a class="indexterm" name="id379957"></a> 399 399 Share-definition-based access controls can be used like a checkpoint or like a pile-driver. Just as a 400 400 checkpoint can be used to require someone who wants to get through to meet certain requirements, so … … 403 403 credential-related objectives, the user can be granted powers and privileges that would not normally be 404 404 available under default settings. 405 </p><p><a class="indexterm" name="id 2613588"></a><a class="indexterm" name="id2613596"></a><a class="indexterm" name="id2613604"></a><a class="indexterm" name="id2613612"></a>405 </p><p><a class="indexterm" name="id379973"></a><a class="indexterm" name="id379981"></a><a class="indexterm" name="id379989"></a><a class="indexterm" name="id379997"></a> 406 406 It must be emphasized that the controls discussed here can act as a filter or give rights of passage 407 407 that act as a superstructure over normal directory and file access controls. However, share-level … … 409 409 share-level controls to get to the share-definition controls. The proper hierarchy of controls implemented 410 410 by Samba and Windows networking consists of: 411 </p><div class="orderedlist"><ol type="1"><li><p>Share-level ACLs</p></li><li><p>Share-definition controls</p></li><li><p>Directory and file permissions</p></li><li><p>Directory and file POSIX ACLs</p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2613658"></a>Checkpoint Controls</h4></div></div></div><p><a class="indexterm" name="id2613664"></a>411 </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>Share-level ACLs</p></li><li class="listitem"><p>Share-definition controls</p></li><li class="listitem"><p>Directory and file permissions</p></li><li class="listitem"><p>Directory and file POSIX ACLs</p></li></ol></div><div class="sect3" title="Checkpoint Controls"><div class="titlepage"><div><div><h4 class="title"><a name="id380037"></a>Checkpoint Controls</h4></div></div></div><p><a class="indexterm" name="id380044"></a> 412 412 Consider the following extract from a <code class="filename">smb.conf</code> file defining the share called <code class="constant">Apps</code>: 413 413 </p><pre class="screen"> … … 420 420 This definition permits only those who are members of the group called <code class="constant">Employees</code> to 421 421 access the share. 422 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p><a class="indexterm" name="id2613700"></a><a class="indexterm" name="id2613711"></a><a class="indexterm" name="id2613720"></a><a class="indexterm" name="id2613728"></a><a class="indexterm" name="id2613735"></a>422 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p><a class="indexterm" name="id380077"></a><a class="indexterm" name="id380088"></a><a class="indexterm" name="id380096"></a><a class="indexterm" name="id380104"></a><a class="indexterm" name="id380112"></a> 423 423 On domain member servers and clients, even when the <em class="parameter"><code>winbind use default domain</code></em> has 424 424 been specified, the use of domain accounts in security controls requires fully qualified domain specification, … … 426 426 Note the necessity to use the double quotes to avoid having the space in the Windows group name interpreted as a 427 427 delimiter. 428 </p></div><p><a class="indexterm" name="id 2613771"></a><a class="indexterm" name="id2613778"></a><a class="indexterm" name="id2613786"></a>428 </p></div><p><a class="indexterm" name="id380145"></a><a class="indexterm" name="id380152"></a><a class="indexterm" name="id380160"></a> 429 429 If there is an ACL on the share itself to permit read/write access for all <code class="constant">Employees</code> 430 430 as well as read/write for the group <code class="constant">Doctors</code>, both groups are permitted through … … 432 432 the group <code class="constant">Doctors</code>, who is not also a member of the group <code class="constant">Employees</code>, 433 433 would immediately fail to validate. 434 </p><p><a class="indexterm" name="id 2613817"></a>434 </p><p><a class="indexterm" name="id380188"></a> 435 435 Consider another example. In this case, you want to permit all members of the group <code class="constant">Employees</code> 436 436 except the user <code class="constant">patrickj</code> to access the <code class="constant">Apps</code> share. This can be … … 445 445 invalid users = patrickj 446 446 </pre><p> 447 <a class="indexterm" name="id 2613858"></a>447 <a class="indexterm" name="id380224"></a> 448 448 Let us assume that you want to permit the user <code class="constant">gbshaw</code> to manage any file in the 449 449 UNIX/Linux file system directory <code class="filename">/data/apps</code>, but you do not want to grant any write … … 457 457 admin users = gbshaw 458 458 </pre><p> 459 <a class="indexterm" name="id 2613888"></a>459 <a class="indexterm" name="id380251"></a> 460 460 Now we have a set of controls that permits only <code class="constant">Employees</code> who are also members of 461 461 the group <code class="constant">Doctors</code>, excluding the user <code class="constant">patrickj</code>, to have … … 479 479 write list = peters 480 480 </pre><p> 481 <a class="indexterm" name="id 2613948"></a>481 <a class="indexterm" name="id380303"></a> 482 482 This is a particularly complex example at this point, but it begins to demonstrate the possibilities. 483 483 You should refer to the online manual page for the <code class="filename">smb.conf</code> file for more information regarding 484 484 the checkpoint controls that Samba implements. 485 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2613970"></a>Override Controls</h4></div></div></div><p><a class="indexterm" name="id2613977"></a>485 </p></div><div class="sect3" title="Override Controls"><div class="titlepage"><div><div><h4 class="title"><a name="id380322"></a>Override Controls</h4></div></div></div><p><a class="indexterm" name="id380328"></a> 486 486 Override controls implemented by Samba permit actions like the adoption of a different identity 487 487 during file system operations, the forced overwriting of normal file and directory permissions, … … 501 501 force group = Mentors 502 502 </pre><p> 503 <a class="indexterm" name="id 2614020"></a><a class="indexterm" name="id2614028"></a>503 <a class="indexterm" name="id380366"></a><a class="indexterm" name="id380374"></a> 504 504 That is all there is to it. Well, it is almost that simple. The downside of this method is that 505 505 users are logged onto the Windows client as themselves, and then immediately before accessing the … … 508 508 This imposes significant overhead on Samba. The alternative way to effectively achieve the same result 509 509 (but with lower system CPU overheads) is described next. 510 </p><p><a class="indexterm" name="id 2614049"></a><a class="indexterm" name="id2614057"></a><a class="indexterm" name="id2614065"></a><a class="indexterm" name="id2614076"></a><a class="indexterm" name="id2614084"></a>510 </p><p><a class="indexterm" name="id380389"></a><a class="indexterm" name="id380397"></a><a class="indexterm" name="id380405"></a><a class="indexterm" name="id380416"></a><a class="indexterm" name="id380424"></a> 511 511 The use of the <em class="parameter"><code>force user</code></em> or the <em class="parameter"><code>force group</code></em> may 512 512 also have a severe impact on system (particularly on Windows client) performance. If opportunistic … … 518 518 apparent performance degradation as the client continually attempts to reconnect to overcome the 519 519 effect of the lost <code class="constant">oplock break</code>, or time-out. 520 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2614131"></a>Share Point Directory and File Permissions</h3></div></div></div><p><a class="indexterm" name="id2614138"></a><a class="indexterm" name="id2614146"></a><a class="indexterm" name="id2614154"></a><a class="indexterm" name="id2614162"></a>520 </p></div></div><div class="sect2" title="Share Point Directory and File Permissions"><div class="titlepage"><div><div><h3 class="title"><a name="id380465"></a>Share Point Directory and File Permissions</h3></div></div></div><p><a class="indexterm" name="id380472"></a><a class="indexterm" name="id380480"></a><a class="indexterm" name="id380488"></a><a class="indexterm" name="id380496"></a> 521 521 Samba has been designed and implemented so that it respects as far as is feasible the security and 522 522 user privilege controls that are built into the UNIX/Linux operating system. Samba does nothing … … 526 526 from a basic UNIX training guide. Instead, one common example of a typical problem is used 527 527 to demonstrate the most effective solution referred to in the immediately preceding paragraph. 528 </p><p><a class="indexterm" name="id 2614185"></a><a class="indexterm" name="id2614193"></a><a class="indexterm" name="id2614201"></a>528 </p><p><a class="indexterm" name="id380512"></a><a class="indexterm" name="id380520"></a><a class="indexterm" name="id380528"></a> 529 529 One of the common issues that repeatedly pops up on the Samba mailing lists involves the saving of 530 530 Microsoft Office files (Word and Excel) to a network drive. Here is the typical sequence: 531 </p><div class="orderedlist"><ol type="1"><li><p>531 </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p> 532 532 A user opens a Word document from a network drive. The file was owned by user <code class="constant">janetp</code> 533 533 and <code class="constant">users</code>, and was set read/write-enabled for everyone. 534 </p></li><li ><p>534 </p></li><li class="listitem"><p> 535 535 File changes and edits are made. 536 </p></li><li ><p>536 </p></li><li class="listitem"><p> 537 537 The file is saved, and MS Word is closed. 538 </p></li><li ><p>538 </p></li><li class="listitem"><p> 539 539 The file is now owned by the user <code class="constant">billc</code> and group <code class="constant">doctors</code>, 540 540 and is set read/write by <code class="constant">billc</code>, read-only by <code class="constant">doctors</code>, and 541 541 no access by everyone. 542 </p></li><li ><p>543 The original owner cannot now access her own file and is “<span class="quote">justifiably</span>”upset.542 </p></li><li class="listitem"><p> 543 The original owner cannot now access her own file and is <span class="quote">“<span class="quote">justifiably</span>”</span> upset. 544 544 </p></li></ol></div><p> 545 545 There have been many postings over the years that report the same basic problem. Frequently Samba users 546 want to know when this “<span class="quote">bug</span>”will be fixed. The fact is, this is not a bug in Samba at all.546 want to know when this <span class="quote">“<span class="quote">bug</span>”</span> will be fixed. The fact is, this is not a bug in Samba at all. 547 547 Here is the real sequence of what happens in this case. 548 </p><p><a class="indexterm" name="id 2614288"></a><a class="indexterm" name="id2614296"></a><a class="indexterm" name="id2614304"></a>548 </p><p><a class="indexterm" name="id380609"></a><a class="indexterm" name="id380617"></a><a class="indexterm" name="id380624"></a> 549 549 When the user saves a file, MS Word creates a new (temporary) file. This file is naturally owned 550 550 by the user who creates the file (<code class="constant">billc</code>) and has the permissions that follow … … 559 559 operations. 560 560 </p><p> 561 The question is, “<span class="quote">How can we solve the problem?</span>”561 The question is, <span class="quote">“<span class="quote">How can we solve the problem?</span>”</span> 562 562 </p><p> 563 563 The solution is simple. Use UNIX file system permissions and controls to your advantage. Follow these 564 564 simple steps to create a share in which all files will consistently be owned by the same user and the 565 565 same group: 566 </p><div class="procedure" ><a name="id2614351"></a><p class="title"><b>Procedure 11.2. Using Directory Permissions to Force File User and Group Ownership</b></p><ol type="1"><li><p>566 </p><div class="procedure" title="Procedure 11.2. Using Directory Permissions to Force File User and Group Ownership"><a name="id380661"></a><p class="title"><b>Procedure 11.2. Using Directory Permissions to Force File User and Group Ownership</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 567 567 Change your share definition so that it matches this pattern: 568 568 </p><pre class="screen"> … … 572 572 read only = No 573 573 </pre><p> 574 </p></li><li ><p><a class="indexterm" name="id2614377"></a><a class="indexterm" name="id2614388"></a>574 </p></li><li class="step" title="Step 2"><p><a class="indexterm" name="id380685"></a><a class="indexterm" name="id380696"></a> 575 575 Set consistent user and group permissions recursively down the directory tree as shown here: 576 576 </p><pre class="screen"> 577 577 <code class="prompt">root# </code> chown -R janetp.users /usr/data/finance 578 578 </pre><p> 579 </p></li><li ><p><a class="indexterm" name="id2614420"></a>579 </p></li><li class="step" title="Step 3"><p><a class="indexterm" name="id380727"></a> 580 580 Set the files and directory permissions to be read/write for owner and group, and not accessible 581 581 to others (everyone), using the following command: … … 583 583 <code class="prompt">root# </code> chmod ug+rwx,o-rwx /usr/data/finance 584 584 </pre><p> 585 </p></li><li ><p><a class="indexterm" name="id2614449"></a>585 </p></li><li class="step" title="Step 4"><p><a class="indexterm" name="id380754"></a> 586 586 Set the SGID (supergroup) bit on all directories from the top down. This means all files 587 587 can be created with the permissions of the group set on the directory. It means all users … … 593 593 </pre><p> 594 594 595 </p></li><li ><p><a class="indexterm" name="id2614489"></a><a class="indexterm" name="id2614497"></a><a class="indexterm" name="id2614505"></a>595 </p></li><li class="step" title="Step 5"><p><a class="indexterm" name="id380791"></a><a class="indexterm" name="id380799"></a><a class="indexterm" name="id380807"></a> 596 596 Make sure all users that must have read/write access to the directory have 597 597 <code class="constant">finance</code> group membership as their primary group, 598 598 for example, the group they belong to in <code class="filename">/etc/passwd</code>. 599 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2614530"></a>Managing Windows 200x ACLs</h3></div></div></div><p><a class="indexterm" name="id2614537"></a><a class="indexterm" name="id2614545"></a><a class="indexterm" name="id2614553"></a><a class="indexterm" name="id2614561"></a>599 </p></li></ol></div></div><div class="sect2" title="Managing Windows 200x ACLs"><div class="titlepage"><div><div><h3 class="title"><a name="id380830"></a>Managing Windows 200x ACLs</h3></div></div></div><p><a class="indexterm" name="id380837"></a><a class="indexterm" name="id380845"></a><a class="indexterm" name="id380853"></a><a class="indexterm" name="id380860"></a> 600 600 Samba must translate Windows 2000 ACLs to UNIX POSIX ACLs. This has some interesting side effects because 601 601 there is not a one-to-one equivalence between them. The as-close-as-possible ACLs match means … … 605 605 There are two possible ways to set ACLs on UNIX/Linux file systems from a Windows network workstation, 606 606 either via File Manager or via the Microsoft Management Console (MMC) Computer Management interface. 607 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2614585"></a>Using the MMC Computer Management Interface</h4></div></div></div><div class="procedure"><ol type="1"><li><p>607 </p><div class="sect3" title="Using the MMC Computer Management Interface"><div class="titlepage"><div><div><h4 class="title"><a name="id380879"></a>Using the MMC Computer Management Interface</h4></div></div></div><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 608 608 From a Windows 200x/XP Professional workstation, log on to the domain using the Domain Administrator 609 609 account (on Samba domains, this is usually the account called <code class="constant">root</code>). 610 </p></li><li ><p>610 </p></li><li class="step" title="Step 2"><p> 611 611 Click 612 612 <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Control Panel</span> → <span class="guimenuitem">Administrative Tools</span> → <span class="guimenuitem">Computer Management</span>. 613 </p></li><li ><p>613 </p></li><li class="step" title="Step 3"><p> 614 614 In the left panel, 615 615 <span class="guimenu">[Right mouse menu item] Computer Management (Local)</span> → <span class="guimenuitem">Connect to another computer ...</span> → <span class="guimenuitem">Browse...</span> → <span class="guimenuitem">Advanced</span> → <span class="guimenuitem">Find Now</span>. In the lower panel, click on the name of the server you wish to … … 618 618 the change made. For example, if the server you are administering is called <code class="constant">FRODO</code>, 619 619 the Computer Management entry should now say: <span class="guimenu">Computer Management (FRODO)</span>. 620 </p></li><li ><p>620 </p></li><li class="step" title="Step 4"><p> 621 621 In the left panel, click <span class="guimenu">Computer Management (FRODO)</span> → <span class="guimenuitem">[+] Shared Folders</span> → <span class="guimenuitem">Shares</span>. 622 </p></li><li ><p><a class="indexterm" name="id2614768"></a><a class="indexterm" name="id2614776"></a><a class="indexterm" name="id2614783"></a><a class="indexterm" name="id2614791"></a>622 </p></li><li class="step" title="Step 5"><p><a class="indexterm" name="id381056"></a><a class="indexterm" name="id381064"></a><a class="indexterm" name="id381072"></a><a class="indexterm" name="id381080"></a> 623 623 In the right panel, double-click on the share on which you wish to set/edit ACLs. This 624 624 brings up the Properties panel. Click the <span class="guimenu">Security</span> tab. It is best … … 627 627 functionality under the <code class="constant">Permissions</code> tab can be utilized with respect 628 628 to a Samba domain server. 629 </p></li><li ><p><a class="indexterm" name="id2614831"></a><a class="indexterm" name="id2614839"></a>629 </p></li><li class="step" title="Step 6"><p><a class="indexterm" name="id381116"></a><a class="indexterm" name="id381124"></a> 630 630 You may now edit/add/remove access control settings. Be very careful. Many problems have been 631 631 created by people who decided that everyone should be rejected but one particular group should … … 633 633 belong to the group <code class="constant">Everyone</code>, which therefore overrules any permissions 634 634 set for the permitted group. 635 </p></li><li ><p>635 </p></li><li class="step" title="Step 7"><p> 636 636 When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span> 637 637 buttons until the last panel closes. 638 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2614876"></a>Using MS Windows Explorer (File Manager)</h4></div></div></div><p>638 </p></li></ol></div></div><div class="sect3" title="Using MS Windows Explorer (File Manager)"><div class="titlepage"><div><div><h4 class="title"><a name="id381156"></a>Using MS Windows Explorer (File Manager)</h4></div></div></div><p> 639 639 The following alternative method may be used from a Windows workstation. In this example we work 640 640 with a domain called <code class="constant">MEGANET</code>, a server called <code class="constant">MASSIVE</code>, and a 641 641 share called <code class="constant">Apps</code>. The underlying UNIX/Linux share point for this share is 642 642 <code class="filename">/data/apps</code>. 643 </p><div class="procedure"><ol type="1"><li><p>643 </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 644 644 Click <span class="guimenu">Start</span> → <span class="guimenuitem">[right-click] My Computer</span> → <span class="guimenuitem">Explore</span> → <span class="guimenuitem">[left panel] [+] My Network Places</span> → <span class="guimenuitem">[+] Entire Network</span> → <span class="guimenuitem">[+] Microsoft Windows Network</span> → <span class="guimenuitem">[+] Meganet</span> → <span class="guimenuitem">[+] Massive</span> → <span class="guimenuitem">[right-click] Apps</span> → <span class="guimenuitem">Properties</span> → <span class="guimenuitem">Security</span> → <span class="guimenuitem">Advanced</span>. This opens a panel that has four tabs. Only the functionality under the 645 645 <code class="constant">Permissions</code> tab can be utilized for a Samba domain server. 646 </p></li><li ><p><a class="indexterm" name="id2615000"></a><a class="indexterm" name="id2615008"></a>646 </p></li><li class="step" title="Step 2"><p><a class="indexterm" name="id381277"></a><a class="indexterm" name="id381285"></a> 647 647 You may now edit/add/remove access control settings. Be very careful. Many problems have been 648 648 created by people who decided that everyone should be rejected but one particular group should … … 650 650 belong to the group <code class="constant">Everyone</code>, which therefore overrules any permissions 651 651 set for the permitted group. 652 </p></li><li ><p>652 </p></li><li class="step" title="Step 3"><p> 653 653 When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span> 654 654 buttons until the last panel closes. 655 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2615047"></a>Setting Posix ACLs in UNIX/Linux</h4></div></div></div><p><a class="indexterm" name="id2615054"></a><a class="indexterm" name="id2615062"></a>655 </p></li></ol></div></div><div class="sect3" title="Setting Posix ACLs in UNIX/Linux"><div class="titlepage"><div><div><h4 class="title"><a name="id381318"></a>Setting Posix ACLs in UNIX/Linux</h4></div></div></div><p><a class="indexterm" name="id381325"></a><a class="indexterm" name="id381333"></a> 656 656 Yet another alternative method for setting desired security settings on the shared resource files and 657 657 directories can be achieved by logging into UNIX/Linux and setting POSIX ACLs directly using command-line 658 658 tools. Here is an example session on the same resource as in the immediately preceding example on a SUSE 9 659 659 Linux system: 660 </p><div class="procedure"><ol type="1"><li><p>660 </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 661 661 Log into the Linux system as the user <code class="constant">root</code>. 662 </p></li><li ><p>662 </p></li><li class="step" title="Step 2"><p> 663 663 Change directory to the location of the exported (shared) Windows file share (Apps), which is in 664 664 the directory <code class="filename">/data</code>. Execute the following: … … 676 676 other::r-x 677 677 </pre><p> 678 </p></li><li ><p><a class="indexterm" name="id2615136"></a>678 </p></li><li class="step" title="Step 3"><p><a class="indexterm" name="id381401"></a> 679 679 You want to add permission for <code class="constant">AppsMgrs</code> to enable them to 680 680 manage the applications (apps) share. It is important to set the ACL recursively … … 699 699 </pre><p> 700 700 This confirms that the change of POSIX ACL permissions has been effective. 701 </p></li><li ><p><a class="indexterm" name="id2615192"></a><a class="indexterm" name="id2615199"></a><a class="indexterm" name="id2615207"></a><a class="indexterm" name="id2615215"></a><a class="indexterm" name="id2615223"></a>701 </p></li><li class="step" title="Step 4"><p><a class="indexterm" name="id381451"></a><a class="indexterm" name="id381459"></a><a class="indexterm" name="id381467"></a><a class="indexterm" name="id381475"></a><a class="indexterm" name="id381483"></a> 702 702 It is highly recommended that you read the online manual page for the <code class="literal">setfacl</code> 703 703 and <code class="literal">getfacl</code> commands. This provides information regarding how to set/read the default 704 704 ACLs and how that may be propagated through the directory tree. In Windows ACLs terms, this is the equivalent 705 705 of setting <code class="constant">inheritance</code> properties. 706 </p></li></ol></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2615257"></a>Key Points Learned</h3></div></div></div><p>706 </p></li></ol></div></div></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id381514"></a>Key Points Learned</h3></div></div></div><p> 707 707 The mish-mash of issues were thrown together into one chapter because it seemed like a good idea. 708 708 Looking back, this chapter could be broken into two, but it's too late now. It has been done. 709 709 The highlights covered are as follows: 710 </p><div class="itemizedlist"><ul type="disc"><li><p><a class="indexterm" name="id2615274"></a><a class="indexterm" name="id2615282"></a><a class="indexterm" name="id2615290"></a><a class="indexterm" name="id2615298"></a>710 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p><a class="indexterm" name="id381529"></a><a class="indexterm" name="id381537"></a><a class="indexterm" name="id381545"></a><a class="indexterm" name="id381553"></a> 711 711 Winbind honors and does not override account controls set in Active Directory. 712 712 This means that password change, logon hours, and so on, are (or soon will be) enforced … … 714 714 change is enforced. At this time, if logon hours expire, the user is not forcibly 715 715 logged off. That may be implemented at some later date. 716 </p></li><li ><p><a class="indexterm" name="id2615317"></a><a class="indexterm" name="id2615325"></a>716 </p></li><li class="listitem"><p><a class="indexterm" name="id381568"></a><a class="indexterm" name="id381576"></a> 717 717 Sign'n'seal (plus schannel support) has been implemented in Samba-3. Beware of potential 718 718 problems acknowledged by Microsoft as having been fixed but reported by some as still 719 719 possibly an open issue. 720 </p></li><li ><p><a class="indexterm" name="id2615341"></a><a class="indexterm" name="id2615349"></a><a class="indexterm" name="id2615356"></a><a class="indexterm" name="id2615364"></a>720 </p></li><li class="listitem"><p><a class="indexterm" name="id381590"></a><a class="indexterm" name="id381598"></a><a class="indexterm" name="id381606"></a><a class="indexterm" name="id381614"></a> 721 721 The combination of Kerberos 5, plus OpenLDAP, plus Samba, cannot replace Microsoft 722 722 Active Directory. The possibility to do this is not planned in the current Samba-3 723 723 roadmap. Samba-3 does aim to provide further improvements in interoperability so that 724 724 UNIX/Linux systems may be fully integrated into Active Directory domains. 725 </p></li><li ><p>725 </p></li><li class="listitem"><p> 726 726 This chapter reviewed mechanisms by which Samba servers may be kept secure. Each of 727 727 the four key methodologies was reviewed with specific reference to example deployment 728 728 techniques. 729 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2615391"></a>Questions and Answers</h2></div></div></div><p>730 </p><div class="qandaset" ><dl><dt> <a href="kerberos.html#id2615407">729 </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id381636"></a>Questions and Answers</h2></div></div></div><p> 730 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id381645"></a><dl><dt> <a href="kerberos.html#id381651"> 731 731 Does Samba-3 require the Sign'n'seal registry hacks needed by Samba-2? 732 </a></dt><dt> <a href="kerberos.html#id 2615477">732 </a></dt><dt> <a href="kerberos.html#id381720"> 733 733 Does Samba-3 support Active Directory? 734 </a></dt><dt> <a href="kerberos.html#id 2615508">734 </a></dt><dt> <a href="kerberos.html#id381747"> 735 735 When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was 736 736 necessary with Samba-2? 737 </a></dt><dt> <a href="kerberos.html#id 2615547">737 </a></dt><dt> <a href="kerberos.html#id381782"> 738 738 Is it safe to set share-level access controls in Samba? 739 </a></dt><dt> <a href="kerberos.html#id 2615576">739 </a></dt><dt> <a href="kerberos.html#id381809"> 740 740 Is it mandatory to set share ACLs to get a secure Samba-3 server? 741 </a></dt><dt> <a href="kerberos.html#id 2615653">741 </a></dt><dt> <a href="kerberos.html#id381882"> 742 742 The valid users did not work on the [homes]. 743 743 Has this functionality been restored yet? 744 </a></dt><dt> <a href="kerberos.html#id 2615719">744 </a></dt><dt> <a href="kerberos.html#id381944"> 745 745 Is the bias against use of the force user and force group 746 746 really warranted? 747 </a></dt><dt> <a href="kerberos.html#id 2615782">747 </a></dt><dt> <a href="kerberos.html#id382006"> 748 748 The example given for file and directory access control forces all files to be owned by one 749 749 particular user. I do not like that. Is there any way I can see who created the file? 750 </a></dt><dt> <a href="kerberos.html#id 2615830">750 </a></dt><dt> <a href="kerberos.html#id382050"> 751 751 In the book, “The Official Samba-3 HOWTO and Reference Guide”, you recommended use 752 752 of the Windows NT4 Server Manager (part of the SRVTOOLS.EXE) utility. Why 753 753 have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility? 754 </a></dt><dt> <a href="kerberos.html#id 2615896">754 </a></dt><dt> <a href="kerberos.html#id382110"> 755 755 I tried to set valid users = @Engineers, but it does not work. My Samba 756 756 server is an Active Directory domain member server. Has this been fixed now? 757 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2615407"></a><a name="id2615409"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615412"></a><a class="indexterm" name="id2615420"></a>757 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id381651"></a><a name="id381654"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id381657"></a><a class="indexterm" name="id381665"></a> 758 758 Does Samba-3 require the <code class="constant">Sign'n'seal</code> registry hacks needed by Samba-2? 759 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2615440"></a><a class="indexterm" name="id2615447"></a><a class="indexterm" name="id2615455"></a>759 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id381683"></a><a class="indexterm" name="id381691"></a><a class="indexterm" name="id381699"></a> 760 760 No. Samba-3 fully supports <code class="constant">Sign'n'seal</code> as well as <code class="constant">schannel</code> 761 761 operation. The registry change should not be applied when Samba-3 is used as a domain controller. 762 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2615477"></a><a name="id2615480"></a></td><td align="left" valign="top"><p>762 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id381720"></a><a name="id381722"></a></td><td align="left" valign="top"><p> 763 763 Does Samba-3 support Active Directory? 764 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2615490"></a>764 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id381732"></a> 765 765 Yes. Samba-3 can be a fully participating native mode Active Directory client. Samba-3 does not 766 766 provide Active Directory services. It cannot be used to replace a Microsoft Active Directory 767 767 server implementation. Samba-3 can function as an Active Directory client (workstation) toolkit, 768 768 and it can function as an Active Directory domain member server. 769 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2615508"></a><a name="id2615511"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615514"></a>769 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id381747"></a><a name="id381749"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id381752"></a> 770 770 When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was 771 771 necessary with Samba-2? 772 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2615530"></a>772 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id381768"></a> 773 773 No. Samba-3 can be used with NetBIOS over TCP/IP disabled, just as can be done with Windows 200x 774 774 Server and 200x/XPPro client products. It is no longer necessary to run mixed-mode operation, 775 775 because Samba-3 can join a native Windows 2003 Server ADS domain. 776 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2615547"></a><a name="id2615549"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615552"></a>776 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id381782"></a><a name="id381785"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id381788"></a> 777 777 Is it safe to set share-level access controls in Samba? 778 778 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 780 780 very mature technology. Not enough sites make use of this powerful capability, neither on 781 781 Windows server or with Samba servers. 782 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2615576"></a><a name="id2615578"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615582"></a>782 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id381809"></a><a name="id381811"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id381814"></a> 783 783 Is it mandatory to set share ACLs to get a secure Samba-3 server? 784 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2615597"></a><a class="indexterm" name="id2615605"></a><a class="indexterm" name="id2615613"></a><a class="indexterm" name="id2615622"></a><a class="indexterm" name="id2615630"></a>784 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id381829"></a><a class="indexterm" name="id381837"></a><a class="indexterm" name="id381845"></a><a class="indexterm" name="id381853"></a><a class="indexterm" name="id381861"></a> 785 785 No. Samba-3 honors UNIX/Linux file system security, supports Windows 200x ACLs, and provides 786 786 means of securing shares through share definition controls in the <code class="filename">smb.conf</code> file. The additional 787 787 support for share-level ACLs is like frosting on the cake. It adds to security but is not essential 788 788 to it. 789 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2615653"></a><a name="id2615655"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615658"></a>789 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id381882"></a><a name="id381884"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id381887"></a> 790 790 The <em class="parameter"><code>valid users</code></em> did not work on the <em class="parameter"><code>[homes]</code></em>. 791 791 Has this functionality been restored yet? 792 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2615686"></a>792 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id381914"></a> 793 793 Yes. This was fixed in Samba-3.0.2. The use of this parameter is strongly recommended as a safeguard 794 794 on the <em class="parameter"><code>[homes]</code></em> meta-service. The correct way to specify this is: 795 795 <a class="link" href="smb.conf.5.html#VALIDUSERS" target="_top">valid users = %S</a>. 796 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2615719"></a><a name="id2615721"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615724"></a><a class="indexterm" name="id2615732"></a><a class="indexterm" name="id2615740"></a>796 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id381944"></a><a name="id381947"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id381950"></a><a class="indexterm" name="id381958"></a><a class="indexterm" name="id381966"></a> 797 797 Is the bias against use of the <em class="parameter"><code>force user</code></em> and <em class="parameter"><code>force group</code></em> 798 798 really warranted? 799 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2615767"></a>799 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id381992"></a> 800 800 There is no bias. There is a determination to recommend the right tool for the task at hand. 801 801 After all, it is better than putting users through performance problems, isn't it? 802 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2615782"></a><a name="id2615784"></a></td><td align="left" valign="top"><p>802 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id382006"></a><a name="id382008"></a></td><td align="left" valign="top"><p> 803 803 The example given for file and directory access control forces all files to be owned by one 804 804 particular user. I do not like that. Is there any way I can see who created the file? 805 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2615797"></a>805 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id382019"></a> 806 806 Sure. You do not have to set the SUID bit on the directory. Simply execute the following command 807 807 to permit file ownership to be retained by the user who created it: … … 811 811 Note that this required no more than removing the <code class="constant">u</code> argument so that the 812 812 SUID bit is not set for the owner. 813 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2615830"></a><a name="id2615832"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615835"></a>814 In the book, “<span class="quote">The Official Samba-3 HOWTO and Reference Guide</span>”, you recommended use813 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id382050"></a><a name="id382052"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id382055"></a> 814 In the book, <span class="quote">“<span class="quote">The Official Samba-3 HOWTO and Reference Guide</span>”</span>, you recommended use 815 815 of the Windows NT4 Server Manager (part of the <code class="filename">SRVTOOLS.EXE</code>) utility. Why 816 816 have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility? 817 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2615863"></a><a class="indexterm" name="id2615870"></a>817 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id382081"></a><a class="indexterm" name="id382088"></a> 818 818 Either tool can be used with equal effect. There is no benefit of one over the other, except that 819 819 the MMC utility is present on all Windows 200x/XP systems and does not require additional software … … 821 821 Samba-controlled domain, the only tool that permits that is the NT4 Domain User Manager, which 822 822 is provided as part of the <code class="filename">SRVTOOLS.EXE</code> utility. 823 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2615896"></a><a name="id2615898"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615902"></a><a class="indexterm" name="id2615909"></a><a class="indexterm" name="id2615917"></a>823 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id382110"></a><a name="id382112"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id382116"></a><a class="indexterm" name="id382123"></a><a class="indexterm" name="id382130"></a> 824 824 I tried to set <em class="parameter"><code>valid users = @Engineers</code></em>, but it does not work. My Samba 825 825 server is an Active Directory domain member server. Has this been fixed now? … … 827 827 The use of this parameter has always required the full specification of the domain account, for 828 828 example, <em class="parameter"><code>valid users = @"MEGANET2\Domain Admins"</code></em>. 829 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id 2610604" href="#id2610604" class="para">12</a>] </sup>This report is entirely fictitious.830 Any resemblance to a factual report is purely coincidental.</p></div><div class="footnote"><p><sup>[<a name="ftn.id 2613014" href="#id2613014" class="para">13</a>] </sup>Note: This link is no longer active. The same article is still829 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id377221" href="#id377221" class="para">12</a>] </sup>This report is entirely fictitious. 830 Any resemblance to a factual report is purely coincidental.</p></div><div class="footnote"><p><sup>[<a name="ftn.id379447" href="#id379447" class="para">13</a>] </sup>Note: This link is no longer active. The same article is still 831 831 available from <a class="ulink" href="http://199.105.191.226/Man/2699/020430msdoj/" target="_top">ITWorld.com</a> (July 5, 2005)</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="RefSection.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="RefSection.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="DomApps.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Part III. Reference Section </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 12. Integrating Additional Services</td></tr></table></div></body></html>
Note:
See TracChangeset
for help on using the changeset viewer.
