samba - May 2017 - Samba server with NFSV4/kerberos

On Tue, Mar 24, 2015 at 01:21:50PM +0100, Volker Lendecke
wrote:
> On Tue, Mar 24, 2015 at 11:18:13AM +0100, Rainer Krienke wrote:
> > Now here is the problem: When samba tries to access a directory of a
> > windows user say "john"  (john's home is NFS4 mounted on
the samba
> > server) the samba process does this as the user "john" not
root and gets
> > a permission denied, since for user "john" there is no
kerberos TGT
> > allowing him to access the kerberized service NFS. This happens
because
> > a windows user authenticates against the windows ADS server when he
logs
> > in at windows and my MIT kerberos server does not know anything about
this.
> > 
> > Does anyone have a similar setup and has a solution for the problem
> > described thats working?
> 
> We've done something very similar eons ago with AFS. Similar
> problem. With the fake-kaserver Samba could create its own
> tickets. Something that in modern days you definitely do NOT
> want. We need to hook Samba much better into the nfsv4
> client now. Somehow we need to acquire credentials for the
> NFS4 service, probably to do this MIT somehow needs to trust
> the AD with a cross-realm trust. If Samba has the nfsv4
> ticket, we need to tell the kernel to use it when we switch
> to "john". Interesting project, but none of this is done yet
> unfortunately.
I have some code that does this I gave to a (large) user
site to test. It took a forwarded ticket from the Windows
client and saved it in the /tmp/krb5cc_XXXXX file so that
the NFS client redirector on Linux could use it.

I got it to work in testing, but never got good feedback
from the users so didn't finish it up.

I can dig it out again and forward port to 4.x if you
like ?

Jeremy.

> I have some code that does this I gave to a (large) user
> site to test. It took a forwarded ticket from the Windows
> client and saved it in the /tmp/krb5cc_XXXXX file so that
> the NFS client redirector on Linux could use it.
>
> I got it to work in testing, but never got good feedback
> from the users so didn't finish it up.
>
> I can dig it out again and forward port to 4.x if you
> like ?
>
> Jeremy.
I would be very much interested in this if this is still around.

-- 
Orion Poplawski
Technical Manager                          720-772-5637
NWRA, Boulder/CoRA Office             FAX: 303-415-9702
3380 Mitchell Lane                       orion at nwra.com
Boulder, CO 80301                   http://www.nwra.com

On Wed, May 10, 2017 at 01:43:18PM -0600, Orion Poplawski via samba
wrote:
> > I have some code that does this I gave to a (large) user
> > site to test. It took a forwarded ticket from the Windows
> > client and saved it in the /tmp/krb5cc_XXXXX file so that
> > the NFS client redirector on Linux could use it.
> >
> > I got it to work in testing, but never got good feedback
> > from the users so didn't finish it up.
> >
> > I can dig it out again and forward port to 4.x if you
> > like ?
> >
> > Jeremy.
> 
> I would be very much interested in this if this is still around.
Here is the (horrible hack) I created. Appropriately
entitled "horrible hack". Won't apply to 4.x, and according
to Simo the correct way to do this is via gss_store_cred_into(),
so this code won't ever get upstream.

If you can make it work locally it might help you out though !

Jeremy.
-------------- next part --------------