[Samba] SSH SSO without keytab file

[L.P.H. van Belle]

Hai, 

> -----Oorspronkelijk bericht-----
> Van: Harpoon [mailto:harp00n at protonmail.com] 
> Verzonden: vrijdag 18 januari 2019 9:24
> Aan: L.P.H. van Belle
> CC: samba at lists.samba.org
> Onderwerp: Re: [Samba] SSH SSO without keytab file
> 
> Thanks for the prompt reply!
Your welkom. 

> 
> > I did see that you are using Administrator, and thats the problem.
> 
> > Administrator is mapped to root ( most of the time ),
> > if you assigned Administrator UID = 0 then you have a 
> problem, because only root = uid 0.
> >
> > Never ever give Administrator a UID/GID

> I am using tdb backend. It mapped administrator account to 12000:10000.
No no no.. as said, never ever assign administrator a UID/GID. 
Now your administrator != root anymore and you cannt manage the server correctly anymore as user Administrator.
You cant use the TDB backend for a domain member only, you MUST choose to set AD or RID backend.
https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member#Configuring_Samba 
See: Choose backend for id mapping in winbindd

> 
> > So try again with a normal user, that does have a UID/GID.
> 
> I tried testing with normal users too whose UID/GID was 
> mapped by tdb in ~10000 range. It produced the same problem.
> 
> > If that does not work, please share these, because this 
> should work fine.
> > /etc/samba/smb.conf
> > /etc/krb5.conf
> > /etc/ssh/sshd_config
> 
> Please find these conf files here:
> 
> -----------------------------
> DC's /etc/samba/smb.conf
> -----------------------------
> [global]
>         netbios name = DC1
>         realm = SAMDOM.EXAMPLE.COM
>         workgroup = SAMDOM
>         dns forwarder = 10.0.5.200
>         server role = active directory domain controller
>         idmap_ldb:use rfc2307 = yes
>         winbind enum users = yes
>         winbind enum groups = yes
>         template shell = /bin/bash
> 
> [netlogon]
>         path = /var/lib/samba/sysvol/samdom.example.com/scripts
>         read only = No
> 
> [sysvol]
>         path = /var/lib/samba/sysvol
>         read only = No
> 
Looks good, except, you dont need : 
winbind enum users = yes
winbind enum groups = yes

For testing fine, but when done testing set these 2 to no. 
These only slowdown you server. 


> --------------------------------
> Client's /etc/samba/smb.conf
> --------------------------------
> [global]
>         netbios name = client1
>         realm = SAMDOM.EXAMPLE.COM
>         workgroup = SAMDOM
>         security = ADS
>         kerberos method = secrets and keytab
>         winbind trusted domains only = no
>         winbind enum users = yes
>         winbind enum groups = yes
>         winbind use default domain = yes
>         winbind nss info = rfc2307
> 
>         idmap config * : backend = tdb
>         idmap config * : range = 10000-200000

This config is incomplete. 
( and same for the winbind enum set these to no. ) 

My suggested change 


	dedicated keytab file = /etc/krb5.keytab
	kerberos method = secrets and keytab

	# Renew the kerberos tickets
	winbind refresh tickets = yes

	# Enable offline logins
	winbind offline logon = yes


	# With default domain set to yes, wbinfo -u shows username only, not SAMBADOM\username.
	winbind use default domain = yes

      idmap config * : backend = tdb
      idmap config * : range =  3000-7999

	# https://wiki.samba.org/index.php/Idmap_config_ad 
	# ( based on >         winbind nss info = rfc2307 in you config. ) 
	idmap config SAMDOM : backend = ad
	idmap config SAMDOM : range = 10000-200000

	# Optional, use these, but since you set AD backend you can set this from cli. 
	# Template settings for login shell and home directory
	#	template shell = /bin/bash
	#	template homedir = /home/%U
	# mk_homedir might be needed, this depends on you needs/setup. 

> 
> -------------------------------
> /etc/ssh/sshd_config (Running on DC)
> -------------------------------
> PubkeyAuthentication no
> PasswordAuthentication yes
> ChallengeResponseAuthentication no
> X11Forwarding yes
> PrintMotd no
> AcceptEnv LANG LC_*
> Subsystem       sftp    /usr/lib/openssh/sftp-server
> KerberosAuthentication yes
> GSSAPIAuthentication yes
> GSSAPICleanupCredentials yes
> UseDNS yes
> PermitRootLogin yes
> UsePAM no
> 
Looks fine. 

> -------------------------------
> /etc/ssh/ssh_config (Client SSH config)
> -------------------------------
> 
> Host *
>     SendEnv LANG LC_*
>     HashKnownHosts yes
>     GSSAPIAuthentication yes
>     GSSAPIDelegateCredentials yes

Looks fine. 

> 
> --------------------------------------
> /etc/krb5.conf (Same of DC and clients)
> --------------------------------------
> 
> [libdefaults]
>         default_realm = SAMDOM.EXAMPLE.COM
>         dns_lookup_realm = false
>         dns_lookup_kdc = true
> 
Looks fine.  



> Thanks for your help!

Greetz, 

Louis