Ldap-sasl-kerberos

daten des servers

domain = linuggs.de
passwd = sysadm
server = maria.xinux.org
ip = 192.168.244.154

apparmor entfernen oder die doku lesen :-)

apt-get remove apparmor
reboot

slapd

• apt-get install slapd libldap2-dev db-util sasl2-bin

ldaputils

• apt-get install ldap-utils libpam-ldap libnss-ldap ldapscripts

/etc/ldap/ldap.conf

• ldap.conf

grundkonfiguration

• dpkg-reconfigure -p low slapd

alles löschen 

kontrolle der konfig

• ldapsearch -Y EXTERNAL -LLL -H ldapi:/// -b cn=config "(|(cn=config)(olcDatabase={1}hdb))"
• cn=config

sasl changes

• sasl.ldif
• ldapmodify -Y EXTERNAL -H ldapi:/// -f sasl.ldif

struktur anlegen

• struktur.ldif
• ldapadd -xD cn=admin,dc=linuggs,dc=de -w sysadm -f struktur.ldif

gruppen anlegen

• gruppen.ldif
• ldapadd -xD cn=admin,dc=linuggs,dc=de -w sysadm -f gruppen.ldif

struktur listen

• ldapsearch -xLLL

dn: dc=linuggs,dc=de
objectClass: top
objectClass: dcObject
objectClass: organization
o: linuggs.de
dc: linuggs

dn: cn=admin,dc=linuggs,dc=de
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin
description: LDAP administrator

dn: ou=users,dc=linuggs,dc=de
objectClass: organizationalUnit
ou: users

dn: ou=groups,dc=linuggs,dc=de
objectClass: organizationalUnit
ou: groups

dn: ou=hosts,dc=linuggs,dc=de
objectClass: organizationalUnit
ou: hosts

kerberos

• sudo apt-get install krb5-kdc krb5-admin-server

konfig /etc/krb4kdc/krb.conf

• krb.conf

konfig /etc/krb4kdc/kadm5.acl

*/admin *
admin *

konfig /etc/krb5.conf

• krb5.conf

make a newrealm

• rm /var/lib/krb5kdc/*
• krb5_newrealm
• generiert zufallszahlen wenn es zu lange dauert
• (cat /dev/sda > /dev/urandom)

admin user im kerberos anlegen und passwors "sysadm" setzen

• kadmin.local -q "addprinc -pw sysadm admin"
• kadmin.local -q "addprinc -pw sysadm root/admin"

hostkeytab anlegen und verteilen

• kadmin.local -q "addprinc -randkey host/maria.xinux.org"
• kadmin.local -q "ktadd -k /etc/krb5.keytab host/maria.xinux.org"

ldapkeytab anlegen und verteilen

• kadmin.local -q "addprinc -randkey ldap/maria.xinux.org"
• kadmin.local -q "ktadd -k /etc/ldap/ldap.keytab ldap/maria.xinux.org"

tests

• kinit admin

Password for admin@LINUGGS.DE:

• klist

Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admin@LINUGGS.DE

Valid starting       Expires              Service principal
09.12.2014 19:04:36  10.12.2014 05:04:36  krbtgt/LINUGGS.DE@LINUGGS.DE
renew until 10.12.2014 19:04:29

slapd mit ticket starten

• echo export KRB5_KTNAME=/etc/ldap/ldap.keytab >> /etc/default/slapd
• service slapd restart

openldap user zur slasl gruppe

• usermod -G sasl openldap

sasl

• sudo apt-get install sasl2-bin libsasl2-modules-gssapi-mit

/etc/default/saslauthd

• START=yes
• MECHANISMS="kerberos5"

restart sasl

• service saslauthd restart

sasl test

• testsaslauthd -u admin -p sysadm -r LINUGGS.DE

0: OK "Success."

sasl ldap aktivieren

• mkdir /etc/ldap/sasl2
• echo "pwcheck_method: saslauthd" > /etc/ldap/sasl2/slapd.conf
• service slapd restart

user anlegen

/usr/local/sbin/uadd

• uadd

anlegen

• uadd jethru 10001

adding new entry "uid=jethru,ou=users,dc=linuggs,dc=de"

Authenticating as principal admin/admin@LINUGGS.DE with password.
WARNING: no policy specified for jethru@LINUGGS.DE; defaulting to no policy
Principal "jethru@LINUGGS.DE" created.

sasl test

• testsaslauthd -u jethru -p suxer -r LINUGGS.DE

0: OK "Success."

ldap sasl test

• ldapsearch -LLL -D uid=jethru,ou=users,dc=linuggs,dc=de -w suxer cn=it

dn: cn=it,ou=groups,dc=linuggs,dc=de
objectClass: posixGroup
cn: it
gidNumber: 10001
description: Group account

daten des client

domain = linuggs.de
passwd = sysadm
server = huey.xinux.org
ip = 192.168.244.151

kerberos client konf kopieren

• cd /etc
• scp root@maria:$PWD/krb5.conf .

konfig /etc/krb5.conf

• krb5.conf

hostkeytab anlegen und verteilen

• kadmin

Authenticating as principal root/admin@LINUGGS.DE with password.
Password for root/admin@LINUGGS.DE: 

• kadmin: addprinc -randkey host/huey.xinux.org

WARNING: no policy specified for host/huey.xinux.org@LINUGGS.DE; defaulting to no policy
Principal "host/huey.xinux.org@LINUGGS.DE" created.

• kadmin: ktadd -k /etc/krb5.keytab host/huey.xinux.org

Entry for principal host/huey.xinux.org with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab WRFILE:/etc/krb5.keytab.
Entry for principal host/huey.xinux.org with kvno 2, encryption type arcfour-hmac added to keytab WRFILE:/etc/krb5.keytab.
Entry for principal host/huey.xinux.org with kvno 2, encryption type des3-cbc-sha1 added to keytab WRFILE:/etc/krb5.keytab.
Entry for principal host/huey.xinux.org with kvno 2, encryption type des-cbc-crc added to keytab WRFILE:/etc/krb5.keytab.

installation ldap pam krb5 tools

• apt-get install ldap-utils libpam-ldap libnss-ldap libpam-krb5

/etc/ldap/ldap.conf

• ldap.conf

ich nutze nur eine ldap.conf

• ln -s /etc/ldap/ldap.conf /etc/

/etc/nsswitch.conf

• nsswitch.conf

pam.d

das System nimmt normalerweise Änderungen selbst vor.

• common-account
• common-auth
• common-password

man kann hier das automatische homeverzeichniss erstellen aktivieren

session required pam_mkhomedir.so  skel=/etc/skel umask=0022

• common-session

tests

einglogen von neutralem rechner

• thomas@cardassia ~ $ ssh mario@huey
• mario@huey:~$ id

uid=10003(mario) gid=10001(it) Gruppen=10001(it)

• mario@huey:~$ klist

Ticket cache: FILE:/tmp/krb5cc_10003_2yjLSp
Default principal: mario@LINUGGS.DE

Valid starting       Expires              Service principal
10.12.2014 14:02:33  11.12.2014 00:02:33  krbtgt/LINUGGS.DE@LINUGGS.DE
	renew until 11.12.2014 14:02:33

password ändern

• mario@huey:~$ kpasswd

Password for mario@LINUGGS.DE: 
Enter new password: 
Enter it again: 
Password changed.

single sign on ssh über keberos

alle teilnehmenden Rechner anpassen

sshd anpassen

• /etc/sshd/sshd_config

GSSAPIAuthentication yes
GSSAPICleanupCredentials yes

ssh neustart

service ssh restart

ssh client

• ssh -k maria

oder per default

GSSAPIAuthentication yes

in der Datei

• /etc/ssh/ssh_config

oder

• ~/.ssh/config