pam_ldap/pam_krb5 Authentication Against Active Directory?

Very Jerry asks: "Here's my problem. I'm currently in the middle of unifying all of our logins here at my place of work because of all the usual reasons (users forget passwords all too often, leaving them more resistant to setting up more complex passwords). Now we have an Active Directory domain setup here, and I was hoping to have all the users authenticate to that. SFU 2.0 is out of the question because it still leaves you to define extra attributes on the user in Active Directory Users and Domains. After a bit of searching, I've found out that pam_krb5 and pam_ldap have been used with success for authentication, but wherever I turn, there are no specific details. I'm currently 2 weeks deep in to this with no progress and a looming deadline. If anyone could point me to some good, specific instructions (specific to Active Directory, not just OpenLDAP) or help me out with a couple tips, it would be much appreciated."

Comments

Solutions

[Anonymous Coward]

Hi,

We have had similar issues regarding Microsoft's Active Directory product at Amaa Fui. We were switching from a Unix based kerberos system to one that used Microsoft's.

Here are some solutions to the same problems you had. Firstly, you need to patch your w2k boxes to the latest pack. Then install the beta k5 updates from Microsoft beta w2k site. These updates remove the slight changes Microsoft made to kerberos, and thus makes it compatible with your other systems.

Once those are patched in, you need to install Heesi optimizer (This can be found on any download site), I recommend this, cause this would go through your AD configuration and kerberos setup and tell you exectly where your security is weak and so on.

Once everthing is in place, you can move to more secure passwords and corportation wide access to single passwords. But let me warn you, you still need different passwords on resources that are of a criticial nature.

Also ensure everthing is behind firewalls and if your using VPN install the latest patches from Microsoft site, We run OpenBSD and Ipsec, they work very well with the current configuration.

Our systems include, Windows 2k/nt, Linux i386/alpha/ppc, Mac OS 9/X, HP/UX, IBM AIX, Solaris and an old VAX system. All of them are maintained by the w2k based kereberos authentication systme and LDAP for directory stuff.

Everthing works well and I'm very satisfied, only concern we have is that Microsoft's version of kerberos is very slow to authenticate our user. This creates some problems, specially since some of our internal services have authentication decay in it, to solve this problem we just moved to better hardware, but this is something Microsoft has to solve on their own.

Good luck with your setup and hope this helps, if not you can send me an e-mail to, fadaboi@NOSPAM.riyaasath.com

Fadaboi Kesbe

Been there...

[Russ Steffen]

Done at least half of that...

Authenticating users against AD with pam_krb5 works fine. Just list the DNS names of your Win2k domain controllers in the config file just as if they were normal Kerberos servers, and use the AD domain as the Kerberos realm.

When I did this, I still had local passwd and group files. But it should be possible to move that stuff into AD. You would have to modify the AD schema to include that info in the directory (that's not a task for the faint of heart). Once you do that, though, it's pretty easy to query AD from Linux.

Ganymede

[jonabbey]

Where I work, we master all of our accounts for UNIX and NT, along with all of our email routing, our NFS volume definitions, our automounter configuration, and our DNS, in Ganymede.

We synchronize passwords from Ganymede into NIS, Samba, and our Windows NT PDC. We also configure tacacs and radius, and LDAP from the same master database. Ganymede provides a high quality GUI interface, and allows you to designate privileges over the directory database to as many classes of administrators as you like. Several people can be simultaneously browsing and making changes to the database, and when transactions are committed, a background thread updates all of the network services. Ganymede is the closest thing that the open source community has to NDS or Active Directory, in terms of being a complete management solution, even though it is not based on LDAP and it does not scale anywhere near as well as an Active Directory or NDS. If you are looking to manage a single location, however, Ganymede will do the job right.

Take a look at the web site in my .signature, below. Ganymede 1.0 is due out within the next week, along with a userKit that supports password synchronization for UNIX, Samba, and Windows NT, with password quality checking handled by Clyde Hoover's excellent nPasswd passwd validation suite.

- jon

Very possible

[Eimi Metamorphoumai]

We did that where I work, under Solaris, last summer. What we did is use a perl script I wrote to create a passwd file out of Active Directory (with all the passwords set to NP), then did the authentication using pam_krb5. Set Kerberos up like normal, it it pretty much all falls into place. The only hard parts are programs that don't play nice with pam. I think I can find the Perl script if you'd like it. Email me at lopresto@writeme.com. Good luck!

Re:And I'd like to know exactly the opposite

[stab]

Well, you could replace the 2k kerberos auth with MIT Kerberos ...

http://microsoft.com/technet/win2000/rsvpker.asp

And 2k clients could still authenticate with no problems, but you have a *NIX based KDC, with the obvious advantages that brings.

Microsoft even publishes a step-by-step guide to doing this!

http://www.microsoft.com/windows2000/techinfo/plan ning/security/kerbsteps.asp

Re:Resist your users!

[gumbo]

If an attacker manages to get onto your network, they'll probably be able to sniff someone's password within about 5 minutes since Windows will use plain text unless you're in an all-NT/2000 environment.

I'm certainly not a Microsoft fan, but I have to stop FUD when I see it. The above is false. The SMB side of my network is 95/98/NT/2000, and there are no clear-text SMB passwords floating around. The Win 95/98 machines authenticate against the NT domain, and do it without plain-text passwords. Same thing when the Linux machines need to connect to an SMB share. So, sorry, but that's just not true.

They do pass around password information that L0phtcrack can work with, though, so if the passwords are weak, they'll be easily broken. It's essentially the equivalent of sending out /etc/shadow entries unencrypted on the network.

Gumbo

Password authentication should be simple, but...

[Trepalium]

The major problem you'll face isn't authentication (which pam_krb can handle), it's the fact that the stock Microsoft Active Directory LDAP directory doesn't have the needed schema to support UNIX clients without the Services for Unix 2.0 package (in which case, you could just use NIS). To complete the package, you need to have both nss_ldap and pam_ldap, however the format of Active Directory doesn't match the format that nss_ldap expects.

Somewhere on MS's site is some code for adding/deleteing/modifying users from Active Directory along with a script that could cull the users from active directory and allow you to import that into a passwd file (minus the passwords, which would be authenticated via kerberos). This is certainly not for the faint-at-heart, and I looked into it for a while and eventually gave up on that idea because it was simply too complex and too likely to break for no apparent reason.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:How about the "third solution..."

[Xross_Ied]

I have not looked into Novell stuff for about 6months, but I think you are mistaken..

e-directory (your name NDS) is NDS that can run on NetwareOS, WinNT/2K and Linux..
a) On WinNT/2K it actually replaces domain/AD as the authenticator.
b) on Linux it replaces the password file by using PAM modules to redirect authentications to NDS

What you are thinking of is DirXML a directory synchronizing daemon that maps parts of AD to NDS and vice-versa. IMO it is the slickest software from Novell since Netware 3.11 came out.

You create the mapping of NDS schema to/from AD and you can tell it what part of (container / organizational unit) your NDS maps to what part of AD. You are still running two directories which are being synchronized at an interval you decide. What makes it kick ass is the schema and attributes synch is all visual, point and click.

Re:How about the "third solution..."

[apachetoolbox]

Novell has already made a pam modules for NDS. Just install NDS for linux/solaris on the server and copy the PAM module over. Problem solved. You can also use DirXML to sync an AD "tree" with and NDS tree, so in turn you can login to the tree and have the user object on the AD tree.

I use the term tree with AD loosely; understand it that AD isn't truly a hierarchical system. It's a flat database just like their old Domain system. Don't believe me? Test it, create an OU, and make a user called "bsmith". Now create another OU anywhere else and try and create a user named "bsmith". You can't. Seriously look into Novell's NDS as a directory solution, you can't even partition an AD tree. That means the entire database is transmitted to every server, even if their OU has nothing to do with that system. Partitioning a tree keeps the traffic to a minimum while still replicating to other specific servers for redundancy. Also know that in AD, when you edit an attribute in an object, the entire object is resent out to all the servers. Not just that attribute for the object. AD is still not even remotely close to NDS.

NDS runs on Netware, NT, Win2000, Linux, Solaris.
AD runs on Windows2000, and to really use it all your workstations have to be Windows 2000!