10.4 Password Backends
10.4 Password BackendsSamba offers the greatest flexibility in backend account database design of any SMB/CIFS server technology available today. The flexibility is immediately obvious as one begins to explore this capability. It is possible to specify not only multiple different password backends, but even multiple backends of the same type. For example, to use two different tdbsam databases: passdb backend = tdbsam:/etc/samba/passdb.tdb \ tdbsam:/etc/samba/old-passdb.tdb 10.4.1 PlaintextOlder versions of Samba retrieved user information from the UNIX user database and eventually some other fields from the file /etc/samba/smbpasswd or /etc/smbpasswd . When password encryption is disabled, no SMB specific data is stored at all. Instead all operations are conducted via the way that the Samba host OS will access its /etc/passwd database. Linux systems For example, all operations are done via PAM. 10.4.2 smbpasswd ” Encrypted Password DatabaseTraditionally, when configuring encrypt passwords = yes in Samba's smb.conf file, user account information such as username, LM/NT password hashes, password change times, and account flags have been stored in the smbpasswd(5) file. There are several disadvantages to this approach for sites with large numbers of users (counted in the thousands).
As a result of these deficiencies, a more robust means of storing user attributes used by smbd was developed. The API which defines access to user accounts is commonly referred to as the samdb interface (previously this was called the passdb API, and is still so named in the Samba CVS trees). Samba provides an enhanced set of passdb backends that overcome the deficiencies of the smbpasswd plain text database. These are tdbsam, ldapsam and xmlsam. Of these, ldapsam will be of most interest to large corporate or enterprise sites. 10.4.3 tdbsamSamba can store user and machine account data in a " TDB " (Trivial Database). Using this backend does not require any additional configuration. This backend is recommended for new installations that do not require LDAP. As a general guide, the Samba Team does not recommend using the tdbsam backend for sites that have 250 or more users. Additionally, tdbsam is not capable of scaling for use in sites that require PDB/BDC implementations that require replication of the account database. Clearly, for reason of scalability, the use of ldapsam should be encouraged. The recommendation of a 250 user limit is purely based on the notion that this would generally involve a site that has routed networks, possibly spread across more than one physical location. The Samba Team has not at this time established the performance based scalability limits of the tdbsam architecture. 10.4.4 ldapsamThere are a few points to stress that the ldapsam does not provide. The LDAP support referred to in this documentation does not include:
The second item can be accomplished by using LDAP NSS and PAM modules. LGPL versions of these libraries can be obtained from PADL Software [3] . More information about the configuration of these packages may be found at LDAP, System Administration ; Gerald Carter by O'Reilly; Chapter 6: Replacing NIS." [4]
This document describes how to use an LDAP directory for storing Samba user account information traditionally stored in the smbpasswd(5) file. It is assumed that the reader already has a basic understanding of LDAP concepts and has a working directory server already installed. For more information on LDAP architectures and directories, please refer to the following sites:
Two additional Samba resources which may prove to be helpful are:
10.4.4.1 Supported LDAP ServersThe LDAP ldapsam code has been developed and tested using the OpenLDAP 2.0 and 2.1 server and client libraries. The same code should work with Netscape's Directory Server and client SDK. However, there are bound to be compile errors and bugs . These should not be hard to fix. Please submit fixes via the process outlined in Chapter 34, Reporting Bugs . 10.4.4.2 Schema and Relationship to the RFC 2307 posixAccountSamba-3.0 includes the necessary schema file for OpenLDAP 2.0 in examples/LDAP/samba. schema . The sambaSamAccount objectclass is given here: objectclass (1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' SUP top AUXILIARY DESC 'Samba-3.0 Auxiliary SAM Account' MUST ( uid $ sambaSID ) MAY ( cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $ sambaLogonTime $ sambaLogoffTime $ sambaKickoffTime $ sambaPwdCanChange $ sambaPwdMustChange $ sambaAcctFlags $ displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogonScript $ sambaProfilePath $ description $ sambaUserWorkstations $ sambaPrimaryGroupSID $ sambaDomainName )) The samba.schema file has been formatted for OpenLDAP 2.0/2.1. The Samba Team owns the OID space used by the above schema and recommends its use. If you translate the schema to be used with Netscape DS, please submit the modified schema file as a patch to jerry@samba.org [9] .
Just as the smbpasswd file is meant to store information that provides information additional to a user's /etc/passwd entry, so is the sambaSamAccount object meant to supplement the UNIX user account information. A sambaSamAccount is a AUXILIARY objectclass so it can be used to augment existing user account information in the LDAP directory, thus providing information needed for Samba account handling. However, there are several fields (e.g., uid) that overlap with the posixAccount objectclass outlined in RFC2307. This is by design. In order to store all user account information (UNIX and Samba) in the directory, it is necessary to use the sambaSamAccount and posixAccount objectclasses in combination. However, smbd will still obtain the user's UNIX account information via the standard C library calls (e.g., getpwnam(), et al). This means that the Samba server must also have the LDAP NSS library installed and functioning correctly. This division of information makes it possible to store all Samba account information in LDAP, but still maintain UNIX account information in NIS while the network is transitioning to a full LDAP infrastructure. 10.4.4.3 OpenLDAP ConfigurationTo include support for the sambaSamAccount object in an OpenLDAP directory server, first copy the samba.schema file to slapd's configuration directory. The samba.schema file can be found in the directory examples/LDAP in the Samba source distribution. root# cp samba.schema /etc/openldap/schema/ Next, include the samba.schema file in slapd.conf . The sambaSamAccount object contains two attributes that depend on other schema files. The uid attribute is defined in cosine.schema and the displayName attribute is defined in the inetorgperson.schema file. Both of these must be included before the samba.schema file. ## /etc/openldap/slapd.conf ## schema files (core.schema is required by default) include /etc/openldap/schema/ core .schema ## needed for sambaSamAccount include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/samba.schema include /etc/openldap/schema/nis.schema .... It is recommended that you maintain some indices on some of the most useful attributes, as in the following example, to speed up searches made on sambaSamAccount objectclasses (and possibly posixAccount and posixGroup as well): # Indices to maintain ## required by OpenLDAP index objectclass eq index cn pres,sub,eq index sn pres,sub,eq ## required to support pdb_getsampwnam index uid pres,sub,eq ## required to support pdb_getsambapwrid() index displayName pres,sub,eq ## uncomment these if you are storing posixAccount and ## posixGroup entries in the directory as well ##index uidNumber eq ##index gidNumber eq ##index memberUid eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub Create the new index by executing: root# ./sbin/slapindex -f slapd.conf Remember to restart slapd after making these changes: root# /etc/init.d/slapd restart 10.4.4.4 Initialize the LDAP DatabaseBefore you can add accounts to the LDAP database you must create the account containers that they will be stored in. The following LDIF file should be modified to match your needs (DNS entries, and so on): # Organization for Samba Base dn: dc=quenya,dc=org objectclass: dcObject objectclass: organization dc: quenya o: Quenya Org Network description: The Samba-3 Network LDAP Example # Organizational Role for Directory Management dn: cn=Manager,dc=quenya,dc=org objectclass: organizationalRole cn: Manager description: Directory Manager # Setting up container for users dn: ou=People,dc=quenya,dc=org objectclass: top objectclass: organizationalUnit ou: People # Setting up admin handle for People OU dn: cn=admin,ou=People,dc=quenya,dc=org cn: admin objectclass: top objectclass: organizationalRole objectclass: simpleSecurityObject userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz # Setting up container for groups dn: ou=Groups,dc=quenya,dc=org objectclass: top objectclass: organizationalUnit ou: Groups # Setting up admin handle for Groups OU dn: cn=admin,ou=Groups,dc=quenya,dc=org cn: admin objectclass: top objectclass: organizationalRole objectclass: simpleSecurityObject userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz # Setting up container for computers dn: ou=Computers,dc=quenya,dc=org objectclass: top objectclass: organizationalUnit ou: Computers # Setting up admin handle for Computers OU dn: cn=admin,ou=Computers,dc=quenya,dc=org cn: admin objectclass: top objectclass: organizationalRole objectclass: simpleSecurityObject userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz The userPassword shown above should be generated using slappasswd . The following command will then load the contents of the LDIF file into the LDAP database. $ slapadd -v -l initldap.dif Do not forget to secure your LDAP server with an adequate access control list as well as an admin password.
10.4.4.5 Configuring SambaThe following parameters are available in smb.conf only if your version of Samba was built with LDAP support. Samba automatically builds with LDAP support if the LDAP libraries are found. LDAP related smb.conf options: passdb backend = ldapsam:url, ldap admin dn , ldap delete dn , ldap filter , ldap group suffix , ldap idmap suffix , ldap machine suffix , ldap passwd sync , ldap ssl , ldap suffix , ldap user suffix , These are described in the smb.conf man page and so will not be repeated here. However, a sample smb.conf file for use with an LDAP directory could appear as shown in Example 10.2. 10.4.4.6 Accounts and Groups ManagementAs user accounts are managed through the sambaSamAccount objectclass, you should modify your existing administration tools to deal with sambaSamAccount attributes. Example 10.2 Configuration with LDAP[global] security = user encrypt passwords = yes netbios name = MORIA workgroup = NOLDOR # ldap related parameters # define the DN to use when binding to the directory servers # The password for this DN is not stored in smb.conf. Rather it # must be set by using 'smbpasswd -w secretpw ' to store the # passphrase in the secrets.tdb file. If the "ldap admin dn" values # change, this password will need to be reset. ldap admin dn = "cn=Manager,ou=People,dc=quenya,dc=org" # Define the SSL option when connecting to the directory # ('off', 'start tls', or 'on' (default)) ldap ssl = start tls # syntax: passdb backend = ldapsam:ldap://server-name[:port] passdb backend = ldapsam:ldap://frodo.quenya.org # smbpasswd -x delete the entire dn-entry ldap delete dn = no # the machine and user suffix added to the base suffix # wrote WITHOUT quotes. NULL suffixes by default ldap user suffix = ou=People ldap group suffix = ou=Groups ldap machine suffix = ou=Computers # Trust UNIX account information in LDAP # (see the smb.conf manpage for details) # specify the base DN to use when searching the directory ldap suffix = dc=quenya,dc=org # generally the default ldap search filter is ok ldap filter = (&(uid=%u)(objectclass=sambaSamAccount)) Machine accounts are managed with the sambaSamAccount objectclass, just like users accounts. However, it is up to you to store those accounts in a different tree of your LDAP namespace. You should use " ou=Groups,dc=quenya,dc=org " to store groups and " ou=People,dc=quenya,dc=org " to store users. Just configure your NSS and PAM accordingly (usually, in the /etc/openldap/sldap.conf configuration file). In Samba-3, the group management system is based on POSIX groups. This means that Samba makes use of the posixGroup objectclass. For now, there is no NT-like group system management (global and local groups). Samba-3 knows only about Domain Groups and, unlike MS Windows 2000 and Active Directory, Samba-3 does not support nested groups. 10.4.4.7 Security and sambaSamAccountThere are two important points to remember when discussing the security of sambaSamAccount entries in the directory.
These password hashes are cleartext equivalents and can be used to impersonate the user without deriving the original cleartext strings. For more information on the details of LM/NT password hashes, refer to the Account Information Database section of this chapter. To remedy the first security issue, the ldap ssl smb.conf parameter defaults to require an encrypted session ( ldap ssl = on) using the default port of 636 when contacting the directory server. When using an OpenLDAP server, it is possible to use the use the StartTLS LDAP extended operation in the place of LDAPS. In either case, you are strongly discouraged to disable this security ( ldap ssl = off). Note that the LDAPS protocol is deprecated in favor of the LDAPv3 StartTLS extended operation. However, the OpenLDAP library still provides support for the older method of securing communication between clients and servers. The second security precaution is to prevent non-administrative users from harvesting password hashes from the directory. This can be done using the following ACL in slapd.conf: ## allow the "ldap admin dn" access, but deny everyone else access to attrs=lmPassword,ntPassword by dn="cn=Samba Admin,ou=People,dc=quenya,dc=org" write by * none 10.4.4.8 LDAP Special Attributes for sambaSamAccountsThe sambaSamAccount objectclass is composed of the attributes shown in Table 10.1, and Table 10.2. The majority of these parameters are only used when Samba is acting as a PDC of a domain (refer to Chapter 4, Domain Control , for details on how to configure Samba as a Primary Domain Controller). The following four attributes are only stored with the sambaSamAccount entry if the values are non-default values:
These attributes are only stored with the sambaSamAccount entry if the values are non-default values. For example, assume MORIA has now been configured as a PDC and that logon home = \\%L\%u was defined in its smb.conf file . When a user named " becky " logons to the domain, the logon home string is expanded to \\MORIA\becky. If the smbHome attribute exists in the entry " uid=becky,ou=People,dc=samba,dc=org ", this value is used. However, if this attribute does not exist, then the value of the logon home parameter is used in its place. Samba will only write the attribute value to the directory entry if the value is something other than the default (e.g., \\MOBY\becky ). 10.4.4.9 Example LDIF Entries for a sambaSamAccountThe following is a working LDIF that demonstrates the use of the SambaSamAccount objectclass: dn: uid=guest2, ou=People,dc=quenya,dc=org sambaLMPassword: 878D8014606CDA29677A44EFA1353FC7 sambaPwdMustChange: 2147483647 sambaPrimaryGroupSID: S-1-5-21-2447931902-1787058256-3961074038-513 sambaNTPassword: 552902031BEDE9EFAAD3B435B51404EE sambaPwdLastSet: 1010179124 sambaLogonTime: 0 objectClass: sambaSamAccount uid: guest2 sambaKickoffTime: 2147483647 sambaAcctFlags: [UX ] sambaLogoffTime: 2147483647 sambaSID: S-1-5-21-2447931902-1787058256-3961074038-5006 sambaPwdCanChange: 0 The following is an LDIF entry for using both the sambaSamAccount and posixAccount objectclasses: dn: uid=gcarter, ou=People,dc=quenya,dc=org sambaLogonTime: 0 displayName: Gerald Carter sambaLMPassword: 552902031BEDE9EFAAD3B435B51404EE sambaPrimaryGroupSID: S-1-5-21-2447931902-1787058256-3961074038-1201 objectClass: posixAccount objectClass: sambaSamAccount sambaAcctFlags: [UX ] userPassword: {crypt}BpM2ej8Rkzogo uid: gcarter uidNumber: 9000 cn: Gerald Carter loginShell: /bin/bash logoffTime: 2147483647 gidNumber: 100 sambaKickoffTime: 2147483647 sambaPwdLastSet: 1010179230 sambaSID: S-1-5-21-2447931902-1787058256-3961074038-5004 homeDirectory: /home/moria/gcarter sambaPwdCanChange: 0 sambaPwdMustChange: 2147483647 sambaNTPassword: 878D8014606CDA29677A44EFA1353FC7 10.4.4.10 Password SynchronizationSamba-3 and later can update the non-samba (LDAP) password stored with an account. When using pam_ldap, this allows changing both UNIX and Windows passwords at once. The ldap passwd sync options can have the values shown in Table 10.3. More information can be found in the smb.conf manpage. 10.4.5 MySQLEvery so often someone will come along with a great new idea. Storing user accounts in a SQL backend is one of them. Those who want to do this are in the best position to know what the specific benefits are to them. This may sound like a cop-out, but in truth we cannot attempt to document every little detail why certain things of marginal utility to the bulk of Samba users might make sense to the rest. In any case, the following instructions should help the determined SQL user to implement a working system. 10.4.5.1 Creating the DatabaseYou can set up your own table and specify the field names to pdb_mysql (see below for the column names ) or use the default table. The file examples/pdb/mysql/mysql.dump contains the correct queries to create the required tables. Use the command: $ mysql -uusername -hhostname -ppassword \ databasename < / path /to/samba/examples/pdb/mysql/mysql.dump 10.4.5.2 ConfiguringThis plugin lacks some good documentation, but here is some brief infoormation. Add the following to the passdb backend variable in your smb.conf: passdb backend = [other-plugins] mysql:identifier [other-plugins] The identifier can be any string you like, as long as it does not collide with the identifiers of other plugins or other instances of pdb_mysql. If you specify multiple pdb_mysql.so entries in passdb backend , you also need to use different identifiers. Additional options can be given through the smb.conf file in the [global] section. Refer to Table 10.4.
Names of the columns are given in Table 10.5. The default column names can be found in the example table dump. You can put a colon (:) after the name of each column, which should specify the column to update when updating the table. You can also specify nothing behind the colon . Then the field data will not be updated. Setting a column name to NULL means the field should not be used. An example configuration can be found in Example 10.3. Example 10.3 Example configuration for the MySQL passdb backend[global] passdb backend = mysql:foo foo:mysql user = samba foo:mysql password = abmas foo:mysql database = samba # domain name is static and can't be changed foo:domain column = 'MYWORKGROUP': # The fullname column comes from several other columns foo:fullname column = CONCAT( firstname ,' ', surname ): # Samba should never write to the password columns foo:lanman pass column = lm_pass: foo:nt pass column = nt_pass: # The unknown 3 column is not stored foo:unknown 3 column = NULL 10.4.5.3 Using Plaintext Passwords or Encrypted PasswordI strongly discourage the use of plaintext passwords, however, you can use them. If you would like to use plaintext passwords, set 'identifier:lanman pass column' and 'identifier:nt pass column' to 'NULL' (without the quotes) and 'identifier:plain pass column' to the name of the column containing the plaintext passwords. If you use encrypted passwords, set the 'identifier:plain pass column' to 'NULL' (without the quotes). This is the default. 10.4.5.4 Getting Non-Column Data from the TableIt is possible to have not all data in the database by making some 'constant'. For example, you can set 'identifier:fullname column' to something like CONCAT(Firstname,' ',Surname) Or, set 'identifier:workstations column' to: NULL See the MySQL documentation for more language constructs. 10.4.6 XMLThis module requires libxml2 to be installed. The usage of pdb_xml is fairly straightforward. To export data, use: $ pdbedit -e xml:filename (where filename is the name of the file to put the data in) To import data, use: $ pdbedit -i xml:filename |
EAN: 2147483647
Pages: 297