samba - Apr 2019 - Enabling LDAPS in Samba in a dual-DC setup

Hi everyone, I have a basic SAMBA setup with a main AD DC ad1 and a 
backup AD DC ad2, running on Samba 4.5.16-Debian on Raspbian.

I would now like to enable LDAPS so my users can authenticate in other 
non Samba services using Active Directory. From reading the 
documentation here: 
https://wiki.samba.org/index.php/Configuring_LDAP_over_SSL_(LDAPS)_on_a_Samba_AD_DC
I understand that for the most basic LDAPS setup using the pre-existing 
self-signed certificate I need only add the following lines to my 
smb.conf to enable this:

tls enabled  = yes
tls keyfile  = tls/key.pem
tls certfile = tls/cert.pem
tls cafile   = tls/ca.pem

My questions related to this are:

1) Since I have a dual DC setup do I need to manually enable tls for 
LDAPS separately on the secondary DC, or will this be automatically 
detected from the primary and the settings copied over automatically?

2) How do I go about creating a dedicated user account that can be used 
with third-party services (in this case redmine) to access AD via LDAPS 
to retrieve user login credentials securely? For the avoidance of 
confusion here I understand the processes used to create a basic AD 
account. What I am specifically interested in is the particular 
combination of privileges or permissions i would need to set on a basic 
account to allow LDAPS access using this account. I believe I will need 
to create such an account to use with redmine since I have read that 
anonymous LDAPS access is not possible with AD.

3) What will happen in 700 days time when the self-certified certificate 
initially created by Samba on its first execution expires? Will 
everything just suddenly stop working suddenly and authentication in 
Redmine come grinding to a halt? How should I remedy this?

Thanks
Stephen Ellwood

On Fri, 5 Apr 2019 12:13:46 +0100
Stephen via samba <samba at lists.samba.org> wrote:
> Hi everyone, I have a basic SAMBA setup with a main AD DC ad1 and a 
> backup AD DC ad2, running on Samba 4.5.16-Debian on Raspbian.
> 
> I would now like to enable LDAPS so my users can authenticate in
> other non Samba services using Active Directory.
Have you considered kerberos, this is even more secure than ldaps.

Rowland

If you dont want to juse the selfsigned certs. 

I can recommend: 
https://hohnstaedt.de/xca/ 

Setup you own CA root. 
Setup the certificates for the servers and deploy the Root Cert. 

Now its in you hand then things expire. 

Or 
https://lists.samba.org/archive/samba/2019-January/220463.html 
I've not tested that yet but its high on my list to test.  


Greetz, 

Louis

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Stephen via samba
> Verzonden: vrijdag 5 april 2019 13:14
> Aan: samba at lists.samba.org
> Onderwerp: [Samba] Enabling LDAPS in Samba in a dual-DC setup
> 
> Hi everyone, I have a basic SAMBA setup with a main AD DC ad1 and a 
> backup AD DC ad2, running on Samba 4.5.16-Debian on Raspbian.
> 
> I would now like to enable LDAPS so my users can authenticate 
> in other 
> non Samba services using Active Directory. From reading the 
> documentation here: 
> https://wiki.samba.org/index.php/Configuring_LDAP_over_SSL_(LD
> APS)_on_a_Samba_AD_DC
> I understand that for the most basic LDAPS setup using the 
> pre-existing 
> self-signed certificate I need only add the following lines to my 
> smb.conf to enable this:
> 
> tls enabled  = yes
> tls keyfile  = tls/key.pem
> tls certfile = tls/cert.pem
> tls cafile   = tls/ca.pem
> 
> My questions related to this are:
> 
> 1) Since I have a dual DC setup do I need to manually enable tls for 
> LDAPS separately on the secondary DC, or will this be automatically 
> detected from the primary and the settings copied over automatically?
> 
> 2) How do I go about creating a dedicated user account that 
> can be used 
> with third-party services (in this case redmine) to access AD 
> via LDAPS 
> to retrieve user login credentials securely? For the avoidance of 
> confusion here I understand the processes used to create a basic AD 
> account. What I am specifically interested in is the particular 
> combination of privileges or permissions i would need to set 
> on a basic 
> account to allow LDAPS access using this account. I believe I 
> will need 
> to create such an account to use with redmine since I have read that 
> anonymous LDAPS access is not possible with AD.
> 
> 3) What will happen in 700 days time when the self-certified 
> certificate 
> initially created by Samba on its first execution expires? Will 
> everything just suddenly stop working suddenly and authentication in 
> Redmine come grinding to a halt? How should I remedy this?
> 
> Thanks
> Stephen Ellwood
> 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>

And i just noticed that dehydrated is available in stretch.

apt-cache policy dehydrated
dehydrated:
  Installed: (none)
  Candidate: 0.3.1-3+deb9u2
  Version table:
     0.3.1-3+deb9u2 500
        500 http://ftp.nl.debian.org/debian stretch/main amd64 Packages

 
> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> L.P.H. van Belle via samba
> Verzonden: vrijdag 5 april 2019 13:53
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] Enabling LDAPS in Samba in a dual-DC setup
> 
> If you dont want to juse the selfsigned certs. 
> 
> I can recommend: 
> https://hohnstaedt.de/xca/ 
> 
> Setup you own CA root. 
> Setup the certificates for the servers and deploy the Root Cert. 
> 
> Now its in you hand then things expire. 
> 
> Or 
> https://lists.samba.org/archive/samba/2019-January/220463.html 
> I've not tested that yet but its high on my list to test.  
> 
> 
> Greetz, 
> 
> Louis
> 
> 
> > -----Oorspronkelijk bericht-----
> > Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> > Stephen via samba
> > Verzonden: vrijdag 5 april 2019 13:14
> > Aan: samba at lists.samba.org
> > Onderwerp: [Samba] Enabling LDAPS in Samba in a dual-DC setup
> > 
> > Hi everyone, I have a basic SAMBA setup with a main AD DC ad1 and a 
> > backup AD DC ad2, running on Samba 4.5.16-Debian on Raspbian.
> > 
> > I would now like to enable LDAPS so my users can authenticate 
> > in other 
> > non Samba services using Active Directory. From reading the 
> > documentation here: 
> > https://wiki.samba.org/index.php/Configuring_LDAP_over_SSL_(LD
> > APS)_on_a_Samba_AD_DC
> > I understand that for the most basic LDAPS setup using the 
> > pre-existing 
> > self-signed certificate I need only add the following lines to my 
> > smb.conf to enable this:
> > 
> > tls enabled  = yes
> > tls keyfile  = tls/key.pem
> > tls certfile = tls/cert.pem
> > tls cafile   = tls/ca.pem
> > 
> > My questions related to this are:
> > 
> > 1) Since I have a dual DC setup do I need to manually 
> enable tls for 
> > LDAPS separately on the secondary DC, or will this be automatically 
> > detected from the primary and the settings copied over 
> automatically?
> > 
> > 2) How do I go about creating a dedicated user account that 
> > can be used 
> > with third-party services (in this case redmine) to access AD 
> > via LDAPS 
> > to retrieve user login credentials securely? For the avoidance of 
> > confusion here I understand the processes used to create a basic AD 
> > account. What I am specifically interested in is the particular 
> > combination of privileges or permissions i would need to set 
> > on a basic 
> > account to allow LDAPS access using this account. I believe I 
> > will need 
> > to create such an account to use with redmine since I have 
> read that 
> > anonymous LDAPS access is not possible with AD.
> > 
> > 3) What will happen in 700 days time when the self-certified 
> > certificate 
> > initially created by Samba on its first execution expires? Will 
> > everything just suddenly stop working suddenly and 
> authentication in 
> > Redmine come grinding to a halt? How should I remedy this?
> > 
> > Thanks
> > Stephen Ellwood
> > 
> > 
> > -- 
> > To unsubscribe from this list go to the following URL and read the
> > instructions:  https://lists.samba.org/mailman/options/samba
> > 
> > 
> 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>

Hi Rowland. I hear you about the security issues around LDAP.

Unfortunately Redmine is stuck with only LDAP and LDAPS support for now 
- see here. It is an evantual goal for the project to add Kerberos (for 
ten years now...). Only dubious looking third-party plugins with limited 
adoption are available at present to enable Kerberos within Redmine and 
I am loathe to rely upon such implementations.

Thanks

Stephen

Mandi! Stephen via samba
  In chel di` si favelave...

AFAIK.
> 1) Since I have a dual DC setup do I need to manually enable tls for LDAPS
> separately on the secondary DC, or will this be automatically detected from
> the primary and the settings copied over automatically?
Settings are in smb.conf, and i doubt certs config can reside on LDAP
because... a cert config would be necessary to access LDAP. Classical
bootstrap problem.
So, i suppose, for every DC.

> 3) What will happen in 700 days time when the self-certified certificate
> initially created by Samba on its first execution expires? Will everything
> just suddenly stop working suddenly and authentication in Redmine come
> grinding to a halt? How should I remedy this?
I think all is governed by 'libldap', so probably you can simply put:

	TLS_REQCERT	never

in /etc/ldap/ldap.conf (in debian based distro) and simply skip cert
verification.

> 2) How do I go about creating a dedicated user account that can be used
with
> third-party services (in this case redmine) to access AD via LDAPS to
> retrieve user login credentials securely? For the avoidance of confusion
> here I understand the processes used to create a basic AD account. What I
am
> specifically interested in is the particular combination of privileges or
> permissions i would need to set on a basic account to allow LDAPS access
> using this account. I believe I will need to create such an account to use
> with redmine since I have read that anonymous LDAPS access is not possible
> with AD.
Good point. I've looked also i for some hint, but lead to nothing.

For now, i've created a specific OU for that users, create a group and
remove 'Domain Users' group for that users; also, i've no rfc2307
data
for that user.

-- 
dott. Marco Gaiarin				        GNUPG Key ID: 240A3D66
  Associazione ``La Nostra Famiglia''         
http://www.lanostrafamiglia.it/
  Polo FVG   -   Via della Bontà, 7 - 33078   -   San Vito al Tagliamento (PN)
  marco.gaiarin(at)lanostrafamiglia.it   t +39-0434-842711   f +39-0434-842797

		Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA!
      http://www.lanostrafamiglia.it/index.php/it/sostienici/5x1000
	(cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)

> Good point. I've looked also i for some hint, but lead to nothing.
>
> For now, i've created a specific OU for that users, create a group and
> remove 'Domain Users' group for that users; also, i've no
rfc2307 data
> for that user.
Marco, I found the following post that describes how to delegate access 
to LDAP via ADUC for a new user. Not tried it yet - but it sounds promising.

https://social.technet.microsoft.com/Forums/windowsserver/en-US/9c231b65-7b66-4331-baa1-7aa7a9a26050/accessing-ldap-on-active-directory