PAM and winbind on AIX 5.2

[Bjorn Roden]

I have managed to get pam_winbind.so (2.2.7a) to work on IBM AIX 5.2 but the 
sys_getpwnam() subroutine still need a user to be defined in the /etc/passwd 
file.

Is it nessessary to port winbind_nss to AIX as a loadable authentication 
module (sort of similar to nss)?

I have done the following to make pam_winbind.so authenticate a user with 
the Windows PDC password:

1 - Configure smb.conf

        workgroup = <domainname>
        security = DOMAIN
        password server = <nt pdc name>
        encrypt passwords = Yes
        winbind uid = 10000-20000
        winbind gid = 10000-20000
        winbind cache time = 15
        template homedir = /home/%U
        template shell = /usr/bin/ksh

2 - Start winbindd

    winbindd (I used -i while debugging)

3 - Add users to /etc/passwd

    mkuser <username>

4 - Change the SYSTEM attribute for the default: stanza in 
/etc/security/user to:

    SYSTEM = "WINBIND OR WINBIND[UNAVAIL] AND compat"

5 - Add the following stanzas to /usr/lib/security/methods.cfg:

PAM:
        program = /usr/lib/security/PAM

WINBIND:
        options = auth=PAM,db=BUILTIN

6 - Create /etc/pam.conf with the following lines (the last entry is the NT 
Domain name):

OTHER   auth     required       /usr/lib/security/pam_winbind.so debug 
use_first_pass unknown_ok TESTDOM
OTHER   account  required       /usr/lib/security/pam_winbind.so debug 
use_first_pass unknown_ok TESTDOM
OTHER   session  required       /usr/lib/security/pam_winbind.so debug 
use_first_pass unknown_ok TESTDOM
OTHER   password required       /usr/lib/security/pam_winbind.so debug 
use_first_pass unknown_ok TESTDOM

7 - Patch samba-2.2.7a/source/nsswitch/pam_winbind.c

--- pam_winbind.c   Tue Jan 14 13:20:18 2003
+++ pam_winbind.c~patched   Tue Jan 14 13:20:10 2003
@@ -10,6 +10,7 @@
*/

#include "pam_winbind.h"
+static char ctrl_domain[64]; /*BR*/

/* prototypes from common.c */
void init_request(struct winbindd_request *req,int rq_type);
@@ -52,6 +53,8 @@
            ctrl |= WINBIND_UNKNOWN_OK_ARG;
        else {
            _pam_log(LOG_ERR, "pam_parse: unknown option; %s", *argv);
+           bzero(ctrl_domain);
+           strcpy(ctrl_domain,*argv); /*BR*/
        }
    }

@@ -421,7 +424,20 @@
     _pam_log(LOG_INFO, "Verify user `%s'", username);
#endif
      }
-     return winbind_auth_request(username, password, ctrl);
+/* BR */
+   if (strlen(ctrl_domain)>0) {
+       static char uuu[64];
+       bzero(uuu, sizeof(uuu));
+       strcpy(uuu, ctrl_domain);
+       uuu[strlen(uuu)] = '\\';
+       strcpy(&uuu[strlen(uuu)], username);
+       _pam_log(LOG_INFO, "Verify patched domain user `%s'", uuu);
+       return winbind_auth_request(uuu, password, ctrl);
+   } else {
+       /* Now use the username to look up password */
+       _pam_log(LOG_INFO, "Verify plain user `%s'", username);
+       return winbind_auth_request(username, password, ctrl);
+   }
}

PAM_EXTERN

8 - Compile pam_winbind.c to pam_winbind.so

    cd source && make nsswitch
    (cd nsswitch&&gcc  -lpam -Wl,-bexpall,-bM:SRE,-bnoentry -o 
pam_winbind.so pam_winbind.po wb_common.po ../lib/snprintf.po)

9 - Copy pam_winbind.so to /usr/lib/security

    cp source/nsswitch/pam_winbind.so /usr/lib/security
    chmod 644 /usr/lib/security/pam_winbind.so

10 - Test by using telnetting to the local host and login as a NT Domain 
user

    tn 0



_________________________________________________________________
STOP MORE SPAM with the new MSN 8 and get 2 months FREE* 
http://join.msn.com/?page=features/junkmail