[Samba] winbind offline logon

Rowland penny
Thu, 21 Jan 2021 15:05:30 -0000

On 21/01/2021 13:28, Jon Gerdes via samba wrote:
> Dale
>
> I have just been down this rabbit hole.  Winbind sets KRB5CCNAME when you
use pam_winbind.  If you set eg
>
> krb5_ccache_type = FILE:/var/lib/krb5cc/krb5cc_%u
>
> in pam_winbind.conf then it should work.  For me it doesn't 8( . The
code is in source3/winbindd/winbindd_pam.c and it
> looks correct.  I can see the %u thing mentioned in the code that looks for
FILE:/ at the start of krb5_ccache_type.  My
> systemd journal reports:
>
> login[5550]: pam_winbind(login:auth): CONFIG file: krb5_ccache_type
'FILE:/var/lib/krb5cc/krb5cc_%u'
>
> If I set this in /etc/krb5.conf:
>
> [libdefaults]
>      default_ccache_name = FILE:/var/lib/krb5cc/krb5cc_%{uid}
>
> then kinit creates the cache correctly.  Winbind ignores that I think and
does its own thing instead and sets KRB5CCNAME
> to override krb5.conf.
>
OK, can you try this (tested on Debian Buster with Samba 4.12.9):

As root, create a directory

mkdir /temp

Alter /etc/krb5.conf to match this:

[libdefaults]
 ??????? default_realm = SAMDOM.EXAMPLE.COM
 ??????? dns_lookup_realm = false
 ??????? dns_lookup_kdc = true

[appdefaults]
 ??????? ccache = krb5cc_%u
 ??????? ccache_dir = FILE:/temp

Replace 'SAMDOM.EXAMPLE.COM' with your realm.

Alter /etc/pam.d/common-auth

Change:

auth??? [success=3 default=ignore]????? pam_krb5.so minimum_uid=10000
auth??? [success=2 default=ignore]????? pam_unix.so nullok_secure
try_first_pass
auth??? [success=1 default=ignore]????? pam_winbind.so krb5_auth
krb5_ccache_type=FILE cached_login try_first_pass

To:

auth??? [success=3 default=ignore]????? pam_winbind.so krb5_auth
krb5_ccache_type=FILE:/temp/krb5cc_%u cached_login try_first_pass
auth??? [success=2 default=ignore]????? pam_krb5.so minimum_uid=1000
auth??? [success=1 default=ignore]????? pam_unix.so nullok_secure
try_first_pass

Now log out and log in as a domain user, you should now find a kerberos
ticket in temp.

Log out again and disconnect from network, then log in again as the user.

Rowland