thr3ads.net - samba - [Samba] Opensolaris-ish joins but does not seem to be valid [Oct 2017]

If this information is useful, please help other people find it:
Share via:

Andrew Martin

2017-Oct-10 14:39 UTC

[Samba] Opensolaris-ish joins but does not seem to be valid

----- Original Message -----> From: "samba" <samba at lists.samba.org>
> To: "samba" <samba at lists.samba.org>
> Sent: Tuesday, October 10, 2017 2:23:02 AM
> Subject: Re: [Samba] Opensolaris-ish joins but does not seem to be valid
> On Mon, 9 Oct 2017 18:04:45 -0500 (CDT)
> Mike Ray via samba <samba at lists.samba.org> wrote:
> 
>> We have a product that is similar to Opensolaris. It joins to the
>> domain (Samba version 4.7.0) without error and I can verify that a
>> computer object is created in the domain for it.
>> 
>> However, the command "getent passwd" which I would expect to
return a
>> list of all domain users, only returns a list of local users.
>> 
>> I am confident I do not have a misconfigured file because if I get a
>> kerberos ticket as the Administrator (i.e. kinit -UAdministrator) and
>> then issue "getent passwd", the list returns as I would
expect.
>> 
>> The host is populated with a keytab after joining to the domain and
>> it appears to have good entries:
>> "host/hostname.example.com at EXAMPLE.COM", etc. And when I
do a "klist"
>> with no prior kinit, it says it says the default principal is
>> "host/hostname at EXAMPLE.COM" which is listed in the keytab.
>> 
>> Since I am on 4.7.0, I've also turned on the authentication
auditing
>> and I can see the authentication attempt when I issue "getent
>> passwd". But instead of being host specific, it registers the user
as
>> [NT AUTHORITY]\[ANONYMOUS LOGON].
>> 
>> There is an additional setup we have to run for this host, setting up
>> directory based mappings for idmap to resolve UIDs
>>
(http://web.archive.org/web/20090416045554/http://docs.sun.com:80/app/docs/doc/820-2429/createidmappingstrategy?a=view).
>> That command registers as the host authority in the DC logs, i.e.
>> "[EXAMPLE]\[HOSTNAME$][SID]"; however, on the client side,
the
>> process returns as "sasl/GSSAPI bind" error. As above, if I
do a
>> kinit as Administrator beforehand, the command succeeds successfully.
>> 
>> It seems like something is wrong with the computer account, but
it's
>> not like I can set the computer accounts password and manually trying
>> kiniting as it. Any suggestions about what might be wrong or how to
>> further troubleshoot?
>> 
>> Mike Ray
>> 
> 
> Can you post your smb.conf
> 
> Rowland
> 
Rowland,

Here's the smb.conf for one of the DCs (I'm working with Mike on this):
[global]
        netbios name = DC3
        realm = EXAMPLE.COM
        workgroup = EXAMPLE
        server role = active directory domain controller
        allow dns updates = nonsecure
        dns forwarder = 192.168.0.2
        idmap_ldb:use rfc2307 = Yes
        printcap name = /dev/null
        load printers = no
        printing = bsd
        ntp signd socket directory = /var/run/samba/ntp_signd
        #acl:search = no
        ldap server require strong auth = no
        winbind sealed pipes = false
        client signing = off
        require strong key = false
        client ldap sasl wrapping = plain
        log level = 1 auth_audit:10

[netlogon]
        path = /var/lib/samba/sysvol/example.com/scripts
        read only = No

[sysvol]
        path = /var/lib/samba/sysvol
        read only = No

Thanks,

Andrew

Rowland Penny

2017-Oct-10 15:19 UTC

head link

[Samba] Opensolaris-ish joins but does not seem to be valid

On Tue, 10 Oct 2017 09:39:43 -0500 (CDT)
Andrew Martin <amartin at xes-inc.com> wrote:
> ----- Original Message -----
> > From: "samba" <samba at lists.samba.org>
> > To: "samba" <samba at lists.samba.org>
> > Sent: Tuesday, October 10, 2017 2:23:02 AM
> > Subject: Re: [Samba] Opensolaris-ish joins but does not seem to be
> > valid
> 
> > On Mon, 9 Oct 2017 18:04:45 -0500 (CDT)
> > Mike Ray via samba <samba at lists.samba.org> wrote:
> > 
> >> We have a product that is similar to Opensolaris. It joins to the
> >> domain (Samba version 4.7.0) without error and I can verify that a
> >> computer object is created in the domain for it.
> >> 
> >> However, the command "getent passwd" which I would
expect to
> >> return a list of all domain users, only returns a list of local
> >> users.
> >> 
> >> I am confident I do not have a misconfigured file because if I get
> >> a kerberos ticket as the Administrator (i.e. kinit
> >> -UAdministrator) and then issue "getent passwd", the
list returns
> >> as I would expect.
> >> 
> >> The host is populated with a keytab after joining to the domain
and
> >> it appears to have good entries:
> >> "host/hostname.example.com at EXAMPLE.COM", etc. And
when I do a
> >> "klist" with no prior kinit, it says it says the default
principal
> >> is "host/hostname at EXAMPLE.COM" which is listed in the
keytab.
> >> 
> >> Since I am on 4.7.0, I've also turned on the authentication
> >> auditing and I can see the authentication attempt when I issue
> >> "getent passwd". But instead of being host specific, it
registers
> >> the user as [NT AUTHORITY]\[ANONYMOUS LOGON].
> >> 
> >> There is an additional setup we have to run for this host, setting
> >> up directory based mappings for idmap to resolve UIDs
> >>
(http://web.archive.org/web/20090416045554/http://docs.sun.com:80/app/docs/doc/820-2429/createidmappingstrategy?a=view).
> >> That command registers as the host authority in the DC logs, i.e.
> >> "[EXAMPLE]\[HOSTNAME$][SID]"; however, on the client
side, the
> >> process returns as "sasl/GSSAPI bind" error. As above,
if I do a
> >> kinit as Administrator beforehand, the command succeeds
> >> successfully.
> >> 
> >> It seems like something is wrong with the computer account, but
> >> it's not like I can set the computer accounts password and
> >> manually trying kiniting as it. Any suggestions about what might
> >> be wrong or how to further troubleshoot?
> >> 
> >> Mike Ray
> >> 
> > 
> > Can you post your smb.conf
> > 
> > Rowland
> > 
> 
> Rowland,
> 
> Here's the smb.conf for one of the DCs (I'm working with Mike on
> this): [global]
>         netbios name = DC3
>         realm = EXAMPLE.COM
>         workgroup = EXAMPLE
>         server role = active directory domain controller
>         allow dns updates = nonsecure
>         dns forwarder = 192.168.0.2
>         idmap_ldb:use rfc2307 = Yes
>         printcap name = /dev/null
>         load printers = no
>         printing = bsd
>         ntp signd socket directory = /var/run/samba/ntp_signd
>         #acl:search = no
>         ldap server require strong auth = no
>         winbind sealed pipes = false
>         client signing = off
>         require strong key = false
>         client ldap sasl wrapping = plain
>         log level = 1 auth_audit:10
> 
> [netlogon]
>         path = /var/lib/samba/sysvol/example.com/scripts
>         read only = No
> 
> [sysvol]
>         path = /var/lib/samba/sysvol
>         read only = No
> 
> Thanks,
> 
> Andrew
Is this from the Opensolaris-ish machine ?

I expected to see a smb.conf file from a Unix domain member.

If it is from the machine where you are getting '[NT
AUTHORITY]\[ANONYMOUS LOGON]', then can you try 'getent passwd
username'. By default winbind doesn't enumerate users and groups.

Rowland

Andrew Martin

2017-Oct-10 16:28 UTC

head link

[Samba] Opensolaris-ish joins but does not seem to be valid

----- Original Message -----> From: "samba" <samba at lists.samba.org>
> To: "samba" <samba at lists.samba.org>
> Sent: Tuesday, October 10, 2017 10:19:29 AM
> Subject: Re: [Samba] Opensolaris-ish joins but does not seem to be valid
> On Tue, 10 Oct 2017 09:39:43 -0500 (CDT)
> Andrew Martin <amartin at xes-inc.com> wrote:
> 
>> ----- Original Message -----
>> > From: "samba" <samba at lists.samba.org>
>> > To: "samba" <samba at lists.samba.org>
>> > Sent: Tuesday, October 10, 2017 2:23:02 AM
>> > Subject: Re: [Samba] Opensolaris-ish joins but does not seem to be
>> > valid
>> 
>> > On Mon, 9 Oct 2017 18:04:45 -0500 (CDT)
>> > Mike Ray via samba <samba at lists.samba.org> wrote:
>> > 
>> >> We have a product that is similar to Opensolaris. It joins to
the
>> >> domain (Samba version 4.7.0) without error and I can verify
that a
>> >> computer object is created in the domain for it.
>> >> 
>> >> However, the command "getent passwd" which I would
expect to
>> >> return a list of all domain users, only returns a list of
local
>> >> users.
>> >> 
>> >> I am confident I do not have a misconfigured file because if I
get
>> >> a kerberos ticket as the Administrator (i.e. kinit
>> >> -UAdministrator) and then issue "getent passwd", the
list returns
>> >> as I would expect.
>> >> 
>> >> The host is populated with a keytab after joining to the
domain and
>> >> it appears to have good entries:
>> >> "host/hostname.example.com at EXAMPLE.COM", etc. And
when I do a
>> >> "klist" with no prior kinit, it says it says the
default principal
>> >> is "host/hostname at EXAMPLE.COM" which is listed in
the keytab.
>> >> 
>> >> Since I am on 4.7.0, I've also turned on the
authentication
>> >> auditing and I can see the authentication attempt when I issue
>> >> "getent passwd". But instead of being host specific,
it registers
>> >> the user as [NT AUTHORITY]\[ANONYMOUS LOGON].
>> >> 
>> >> There is an additional setup we have to run for this host,
setting
>> >> up directory based mappings for idmap to resolve UIDs
>> >>
(http://web.archive.org/web/20090416045554/http://docs.sun.com:80/app/docs/doc/820-2429/createidmappingstrategy?a=view).
>> >> That command registers as the host authority in the DC logs,
i.e.
>> >> "[EXAMPLE]\[HOSTNAME$][SID]"; however, on the client
side, the
>> >> process returns as "sasl/GSSAPI bind" error. As
above, if I do a
>> >> kinit as Administrator beforehand, the command succeeds
>> >> successfully.
>> >> 
>> >> It seems like something is wrong with the computer account,
but
>> >> it's not like I can set the computer accounts password and
>> >> manually trying kiniting as it. Any suggestions about what
might
>> >> be wrong or how to further troubleshoot?
>> >> 
>> >> Mike Ray
>> >> 
>> > 
>> > Can you post your smb.conf
>> > 
>> > Rowland
>> > 
>> 
>> Rowland,
>> 
>> Here's the smb.conf for one of the DCs (I'm working with Mike
on
>> this): [global]
>>         netbios name = DC3
>>         realm = EXAMPLE.COM
>>         workgroup = EXAMPLE
>>         server role = active directory domain controller
>>         allow dns updates = nonsecure
>>         dns forwarder = 192.168.0.2
>>         idmap_ldb:use rfc2307 = Yes
>>         printcap name = /dev/null
>>         load printers = no
>>         printing = bsd
>>         ntp signd socket directory = /var/run/samba/ntp_signd
>>         #acl:search = no
>>         ldap server require strong auth = no
>>         winbind sealed pipes = false
>>         client signing = off
>>         require strong key = false
>>         client ldap sasl wrapping = plain
>>         log level = 1 auth_audit:10
>> 
>> [netlogon]
>>         path = /var/lib/samba/sysvol/example.com/scripts
>>         read only = No
>> 
>> [sysvol]
>>         path = /var/lib/samba/sysvol
>>         read only = No
>> 
>> Thanks,
>> 
>> Andrew
> 
> Is this from the Opensolaris-ish machine ?
> 
> I expected to see a smb.conf file from a Unix domain member.
> 
> If it is from the machine where you are getting '[NT
> AUTHORITY]\[ANONYMOUS LOGON]', then can you try 'getent passwd
> username'. By default winbind doesn't enumerate users and groups.
Running "getent passwd username" does not return anything on the
client machine.


The smb.conf I sent is from the DC; the OpenSolaris-based machine 
is not using Samba but is using the Solaris CIFS Service instead:
http://docs.oracle.com/cd/E19120-01/open.solaris/820-2429/configuredomainmodetask/index.html


The Solaris CIFS service, aka smb/server, is joined to the domain
with "smbadm join -u Administrator example.com" and once joined you
can query AD users using "idmap show -cV user at example.com". By
default, idmapd uses "Ephemeral mapping", so AD users are represented
locally by a randomly-chosen, high-numbered uid rather than their
actual uid as stored in uidNumber or elsewhere in AD. This is
undesirable, so we have reconfigured idmap to use
"directory-based mapping" instead:
http://docs.oracle.com/cd/E22471_01/html/820-4167/configuration__services__identity_mapping.html
https://docs.oracle.com/cd/E19120-01/open.solaris/820-2429/configuredirbasedmapping/index.html


This allows us to set some properties in idmap to tell it which AD
attribute (CN) to query to find out how to map AD users to local users:
svccfg -s svc:/system/idmap setprop config/ad_unixgroup_attr=astring: cn
svccfg -s svc:/system/idmap setprop config/ad_unixuser_attr=astring: cn
svccfg -s svc:/system/idmap setprop config/directory_based_mapping=astring: name
svcadm refresh idmap


At this point smb/server and idmap should be able to look up AD users and
map them to a local user whose username is the same as the user's CN field
in AD. We then populate all of the AD users in the local nsswitch database
by running "ldapclient" and telling it which AD attributes to map to
each
property in the nsswitch database:
https://docs.oracle.com/cd/E23824_01/html/821-1455/clientsetup-49.html


We have two problems, both of which I think may be related to the same
underlying issue of not being able to communicate with the Samba DC:
* idmap cannot query user's CN values for "directory-based
mapping"
* ldapclient cannot query users to populate the nsswitch database


I think both of these are related to the "sasl/GSSAPI bind" error that
Mike mentioned; previously on Samba 4.0.6, this client was able to
make these queries successfully, but now on Samba 4.7.0 these queries
require that we manually kinit on the client before the GSSAPI 
authentication is allowed. Has something changed with how GSSAPI
authentication or host Kerberos tickets are issued? Can we still allow
the old behavior with a smb.conf config option?


Thanks,


Andrew

Possibly Parallel Threads

Search for more apparently analagous threads

samba - Oct 2017 - Opensolaris-ish joins but does not seem to be valid

[Samba] Opensolaris-ish joins but does not seem to be valid

[Samba] Opensolaris-ish joins but does not seem to be valid

[Samba] Opensolaris-ish joins but does not seem to be valid

Possibly Parallel Threads