[Samba] How to GSSAPI/Kerberos authenticate with Dovecot [formerly Where is krb5.keytab or equivalent?]

Mon Jul 4 21:01:22 UTC 2016


Am 04.07.2016 um 22:43 schrieb Rowland penny:
> On 04/07/16 21:21, Mark Foley wrote:
>>> To: samba at lists.samba.org
>>> From: Achim Gottinger <achim at ag-web.biz>
>>> Date: Mon, 4 Jul 2016 09:29:02 +0200
>>> Subject: Re: [Samba] How to GSSAPI/Kerberos authenticate with Dovecot
>>>
>>> Am 04.07.2016 um 01:34 schrieb Mark Foley:
>>>> After a nearly 2-year struggle to get Dovecot to do either NTLM or 
>>>> GSSAPI authentication with
>>>> Samba4 AD/DC, I believe I've finally got it! Infinite thanks to 
>>>> Achim Gottinger for his
>>>> patience in working this through with me.  Although my purpose was 
>>>> for Dovecot to authenticate
>>>> mail clients, the configuration settings needed were on the Samba 
>>>> side.  I hope these
>>>> instructions can eventually make it into:
>>>>
>>>> https://wiki.samba.org/index.php/Setup_a_Samba_Active_Directory_Domain_Controller#Configure_Kerberos 
>>>>
>>>>
>>>> as those instruction contain nothing about the required `samba-tool 
>>>> spn add` and samba-tool domain
>>>> exportkeytab` settings, without which it is impossible to get 
>>>> Dovecot (and presumably other
>>>> local authenticators needing GSSAPI/Kerberos) to authenticate.
>>>>
>>>> You need kerberos as the Samba built-in kerberos does not have 
>>>> needed commands like `klist`.
>>>>
>>>> My distro (Slackware 14.1) does not come with kerberos, but is 
>>>> easily found at:
>>>>
>>>> https://slackbuilds.org/repository/14.1/network/krb5/
>>>>
>>>> Per the samba docs, copy the krb5.conf template created when 
>>>> provisioned:
>>>>
>>>> $ cp /usr/local/samba/private/krb5.conf /etc/krb5.conf
>>>>
>>>> (Note: the actual docs advise symlinking:
>>>>
>>>>     ln -sf /usr/local/samba/private/krb5.conf /etc/krb5.conf
>>>>
>>>> but I prefer making a copy in case I need to modify things).
>>>>
>>>> I've set The /etc/krb5.conf file to world readable.  It's default 
>>>> contents are (and these do
>>>> not need to be changed):
>>>>
>>>> [libdefaults]
>>>>           default_realm = HPRS.LOCAL
>>>>           dns_lookup_realm = false
>>>>           dns_lookup_kdc = true
>>>>
>>>> where HPRS.LOCAL is my realm, of course use your own.
>>>>
>>>> Now, we need a samba user in order to create the necessary SPNs 
>>>> (Server Principal Names):
>>>>
>>>> $ samba-tool user create dovecot
>>>> New Password:
>>>> Retype Password:
>>>> User 'dovecot' created successfully
>>>>
>>>> Next, add the SPN(s), and create the keytab:
>>>>
>>>> $ samba-tool spn add imap/mail.hprs.local dovecot
>>>> $ samba-tool domain exportkeytab --principal imap/mail.hprs.local 
>>>> dovecot.keytab
>>>>
>>>> Dovecot does not do my (outgoing) SMTP serving, only (incoming) 
>>>> IMAP, but if it did I'd have to
>>>> create another SPN for smtp:
>>>>
>>>> $ samba-tool spn add smtp/mail.hprs.local dovecot
>>>> $ samba-tool domain exportkeytab --principal smtp/mail.hprs.local 
>>>> dovecot.keytab
>>>>
>>>> Dovecot needs to be able to read the keytab file:
>>>>
>>>> $ chgrp dovecot /etc/dovecot/dovecot.keytab
>>>> $ chmod g+r /etc/dovecot/dovecot.keytab
>>>>
>>>> my new keytab:
>>>>
>>>> $ klist -Kek /etc/dovecot/dovecot.keytab
>>>> Keytab name: FILE:/etc/dovecot/dovecot.keytab
>>>> KVNO Principal
>>>> ---- 
>>>> --------------------------------------------------------------------------
>>>>      1 imap/mail.hprs.local at HPRS.LOCAL (des-cbc-crc) 
>>>> (0x232616c2a4fd08f7)
>>>>      1 imap/mail.hprs.local at HPRS.LOCAL (des-cbc-md5) 
>>>> (0x232616c2a4fd08f7)
>>>>      1 imap/mail.hprs.local at HPRS.LOCAL (arcfour-hmac) 
>>>> (0x9dae89a221dc374a39f560833352f60f)
>>>> (and if I also created the spn for smtp I would also have these:)
>>>>      1 smtp/mail.hprs.local at HPRS.LOCAL (des-cbc-crc) 
>>>> (0x232616c2a4fd08f7)
>>>>      1 smtp/mail.hprs.local at HPRS.LOCAL (des-cbc-md5) 
>>>> (0x232616c2a4fd08f7)
>>>>      1 smtp/mail.hprs.local at HPRS.LOCAL (arcfour-hmac) 
>>>> (0x9dae89a221dc374a39f560833352f60f)
>>>>
>>>> DOVECOT SETTINGS:
>>>>
>>>> Of crucial importance is to buld dovecot with GSSAPI! That is NOT 
>>>> one of the default settings.
>>>> In the build directory:
>>>>
>>>> ./configure --with-gssapi=yes
>>>>
>>>> Otherwise, settings are pretty simple. Add the following 3 settings 
>>>> to 10-auth.conf:
>>>>
>>>> auth_gssapi_hostname = "$ALL"
>>>> auth_krb5_keytab = /etc/dovecot/dovecot.keytab
>>>> auth_mechanisms = plain login gssapi
>>>>
>>>> The auth_gssapi_hostname is supposedly not required according to 
>>>> dovecotList comments, but my
>>>> 10-auth.conf template implies differently, so it can't hurt.
>>>>
>>>> I couldn't get any of this working until I rebooted the Samba 
>>>> AD/DC-Dovecot server, but that
>>>> just may have been me not stopping/starting Samba and Dovecot in 
>>>> the right sequence (or, I
>>>> needed a Samba upgrade to 4.2!).
>>>>
>>>> In my WIN7 and Ubuntu Thunderbird clients I selected 
>>>> gssapi/kerberos for the IMAP authenticate
>>>> method and it works!
>>>>
>>>> Again, thanks to Achim for his critical help.
>>>>
>>>> Someone please put at least the required samba-tool commands into 
>>>> the wiki for other poor
>>>> schmucks like me.
>>>>
>>>> --Mark
>>>>
>>>>
>>> Glad you finaly got it working! Have you tried it without
>>> 'auth_gssapi_hostname = "$ALL"'? In my tests with those principals it
>>> worked without it.
>>> With Samba 4.4.3 there are also aes 128/256 versions of the keys in the
>>> exported keytab.
>>> On Windows 7 kinit shows what encryption was used. With arcfour-hmac it
>>> shows rc4-hmac.
>>>
>>> achim~
>>>
>>>
>> Thanks Achim, no haven't tried without the auth_gssapi_hostname 
>> settings, though it probably
>> will work. The dovecot people seemed to think so. I'm giving this a 
>> rest to let my brain cool
>> down. Perhaps I'll try it later.
>>
>> Please weight in on Rowland's comment about restricting documentation 
>> on kerberos
>> authentication to domain members.  I've posted a dissenting view, but 
>> maybe I'm alone in my
>> opinion that there should be no issue running a mail server on the 
>> same box as the AD/DC.
>> Perhaps few people do that, but my feeling is that most people do 
>> that.  Feedback by you and
>> others as to real-world use could be valuable.
>>
>> --Mark
>>
>
> Perhaps this info would be better on the Dovecot wiki ?
> I have no real problem with putting the info on the Samba wiki, but as 
> I said, stuff like this used to be on the wiki and it was removed 
> during Marc's clean up.
>
> If Marc gives the go ahead, I will add it, if he says no, then I 
> won't, there is no point in adding something that Marc is just going 
> to remove.
>
> Rowland
>
>
>
Few points:
The samba wiki contains an article for OpenSSH Single Sign on. 
https://wiki.samba.org/index.php/OpenSSH_Single_sign-on.
It is not required for dovecot run run on the samba server. It can be an 
different server, the service principals for imap/pop/smtp must be 
created on the samba domain. The keytab file must be copied to the 
dovecot server.
An howto about creating and exporting special service principals would 
be helpfull for kerberized nfs as well. In this case the nfs server can 
also be an seperate machine.

achim~