[Samba] Re: kerberos/Samba integration questions

[Jon Allingham]

For all interested:

Adding the following to the global config section and rejoining the domain 
caused samba to fill my krb5.keytab file for me! I'm still working on some 
minor issues with winbind and the ad sfu integration, but this was my big 
missing item.

use kerberos keytab = Yes

Thanks to the folks that responded and got me pointed the right way!

"Jon Allingham" <jallingham at leapstone.com> wrote in message 
news:eq8dsj$tcd$1 at sea.gmane.org...
> I'm trying to integrate Samba with my kerberos configuration on Solaris 10 
> (with Samba 3.0.23d) and I have one basic issue - probably I don't 
> understand something. Hopefully one of you experts can help.
>
> We have an AD based organization but we do a lot of Unix work on Solaris 
> 10 and AIX 5.3 - I have about 75 *nix servers of various flavors. There's 
> a lot of value in SSO solutions/credential consolidation to us, but we're 
> a small organization.
>
> I have a functional Solaris configuration talking LDAP to AD, using 
> kerberos for password authentication, successfully pulling UID/GID from 
> SFU on Server 2003 R2. LDAP mapping using the built in LDAP client in 
> Solaris 10 works smoothly; getent returns everything it should. kerberos 
> versions of telnet etc all work fine and forward credentials. This config 
> uses the pam_krb5 module, not winbind and uses ldap in the nssswitch.conf
>
> Alternatively, I can not run the kinit -k for the host, leave out the 
> krb5.keytab (and of course fix all the SPN information in AD from the 
> above configuration) and configure Samba in AD mode and it properly joins 
> the domain. User names get mapped properly. File access through samba 
> works.
>
> What I can't seem to figure out how to do is have a functional kerberos 
> configuration with a keytab entry at the same time I have samba working - 
> Samba wants to join the domain using a machine account and assigns the 
> principal host/hostname.myorg.com and I don't see any way of getting that 
> same information exported into the krb5.keytab so I can run kinit -k to 
> get the proper host credentials. And I need the same 
> host/hostname.myorg.com principal to be set on the account that is mapped 
> to the system.
>
> AD isn't terribly happy about using a machine account anyway to configure 
> kerberos, at least not on Solaris - it works much better to use a user 
> account and then set the principal with the ktpass utility on the windows 
> DC.
>
> It seems that conceptually what I need is to be able to set the samba 
> created information as the keytab entry, but I haven't the faintest idea 
> how to do that.
>
> I tried setting the verify_ap_req_nofail = false value in the krb5.conf 
> file to keep it from requiring a host entry, but that didn't seem to make 
> any difference.
>
> I suppose what I'd really like to do is be able to manually export the 
> keytab from AD using ktpass and use the SAME information for both the OS 
> controlled kerberos based services as well as for Samba. Or alternatively 
> be able to point my krb5.conf file to a samba controlled keytab entry for 
> host/hostname.myorg.com
>
> Any ideas are appreciated.
>
>
>
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/listinfo/samba
>