Beyond Samba

Integrating Windows Authentication into the Unix world

Who am I?

'Student Network Administrator' at Hawker College

Samba Team

Authentication in the real world

800 students

170 client computers

Win NT, Win2k, WinXP

Single sign on, Samba domain

The Holy Grail

One password

Legacy NT passwords in particular

Secure login systems

Not acceptable:

Custom 'password change' web pages

Overnight 'password sync' delays

Fixed passwords

Protocols with windows authentication

CIFS

HTTP

LDAP

IMAP

POP

SMTP

TELNET

RPC

MAPI

Starting assumptions

Member server or PDC

Allows:

Plain text

NTLM

MSCHAP

Uses only a normal machine trust account in the domain

Does not required the original clear passwords

Plain text Authentication

If we have the plain text, the game is easy

pam_winbind

ntlm_auth 'basic' authentication modes.

Integrating PAM, SSH etc into windows domains

Still 'single sign on'

User still uses their windows password

Exposes passwords on the network

Using pam_winbind

Killing the 'password sync'

Rather than 'sync' your passwords, just always ask Samba.

This works, on a PDC just as much as a member server

PAM Module

This means POP/IMAP, HTTP (mod_auth_pam), SSH etc

NTLMSSP

Single Sign on

Uses the windows password

Challenge-response authentication

No passwords on the wire

Unprompted authentication

Users type their passwords once only

ntlm_auth

The external interface to Samba Authentication

A number of ways to authenticate

Plaintext

NTLMSSP

MSCHAPv2

NTLMSSP in Squid

'Transparent' proxy authentication

Users are not aware that they are being authenticated

Supported Browsers:

IE

Mozilla 1.5 (1.6 all platforms)

ntlm_auth is an NTLMSSP 'helper' in squid

Users are 'virtual', do not need to be unix users

Squid Configuration

squid.conf:

auth_param basic program \
/usr/bin/ntlm_auth \
–helper-protocol=squid-2.5-basic

auth_param basic realm Hawker \
College

auth_param ntlm program \
/usr/bin/ntlm_auth \
--helper-protocol=squid-2.5-ntlmssp

auth_param ntlm children 5

VPN integration

Integrated 'PoPToP' VPNs into Windows domains

Allows unmodified windows clients to contact a Linux VPN server.

pppd modified to call ntlm_auth

Previously pppd could not integrate against a windows domain

Next task:

Integrate FreeRadius with ntlm_auth

ntlm_auth in other projects

ntlm_auth provides a generic interface

NTLMSSP client and server

Cyrus-SASL patch

IMAP

SMTP

Midgard

Home-grown NTLMSSP

Many projects also have their own versions of NTLMSSP:

Cyrus-SASL

Fetchmail

Mozilla

Kerberos is better

Could be considered the 'original' single sign on

Microsoft extended it (as usual)

NT4 can be upgraded to kerberos, without changing passwords

Already widely supported on Unix

Starting Assumptions - PDC

Allows

Plaintext

NTLM

MSCHAP

Kerberos

Being a PDC implies

direct access to the hashed passwords

Intercept password changes

The Heimdal patch

Heimdal 0.6.1 includes most of my Samba interop patch

If configured at a Samba LDAP store

Uses Samba passwords

Honors Samba password expiry

Honors Samba account control entries

Single Sign On example

All these services using one password:

Kerberos (Heimdal)

Reading the 'samba' password entries

LDAP

Both Simple and Kerberos SASL binds

pam_ldap clients

Because LDAP supports the simple bind

Samba

Reading the Samba passwords

SSO Example – Cyrus SASL

Cyrus SASL is used by many server applications

Supports 4 authentication mechnaimis:

NTLMSSP

KERBEROS

SPENGO

PLAIN

Resources

My VPN intergration paper

http://hawkerc.net/staff/abartlet/comp3700

LDAPv3 HOWTO

http://www.bayour.com/LDAPv3-HOWTO.html

Lorikeet

pserver.samba.org – CVS module 'lorikeet'

2004-04-05T17:53:11