On 10/05/2023 17:01, Kees van Vloten via samba wrote:>
> Op 10-05-2023 om 11:33 schreef matti.kaupenjohann:
>>> It will work, as long as you can authenticate either with
>>> user/password or with kerberos you can run ldap queries.
>> So far I understand, Kerberos can work on systems which are not a
>> domain member, but I cannot find any instruction on how to achieve a
>> correct setup. Most instruction beginning with setup of a KDC which
>> makes no sense, since I already have the samba dc. The approach worked
>> fine for my server which is already domain member. But my non domain
>> member has kerberos not installed so the command kinit is obvious not
>> available. What boggers me as well: Is running "sudo kinit
>> administrator" on a non domain member really possible? How does
kinit
>> know what the DC is?
>>
>> Matti
>>
> Indeed Samba-AD-DC includes a KDC, the only thing you have to do is to
> setup the kerberos client on the clients machines and point it to your DC.
>
> Now you can use kinit to get a ticket.
>
> You can also create a machine account or a service account (do set a
> random password), export the keytab and use that on your client so that
> services (like apache) can interact with kerberos without the machine
> being a domain-member.
>
>
> - Kees.
>
>
As far as I remember, it was never mentioned that it was required for
ldap searches to work on a non domain machine with kerberos, what I
posted will work on a domain member.
If you are going down the kerberos path on a non domain joined machine,
then you are going to need a search user in AD (with a password) and its
keytab.
The problem with ldaps is that it doesn't really work on Samba AD and
Kerberos is more secure.
Rowland