Client Authentication:Fedora
Fedora 11 Authentication
Introduction
The following details the setup of Fedora 11 as a desktop to authenticate users against SME 7.4 using Samba and Winbind. The method has been tested using Fedora installed in a VirtualBox virtual machine on a Windows XP host. It assumes login is via the gui interface.
Install Fedora
- Download the Fedora .iso and install. The initial install process asks for a root password and the hostname (which defaults to localhost.localdomain). Change this to a hostname of your choice and your domain name.
<HOSTNAME>.<yourdomain>.<yourtld>
- When the install has finished you need to remove the media and reboot. A gui Welcome startup process then completes the setup and installation. During this process you will be asked for a username and password to set up the first user, and also the date/time configuration.
- Complete install, login and apply all update. Logout and Restart.
Additional Packages
Use the 'System - Administration - Add/Remove Software' or yum to install additional packages
Windows file server (Note this is a group of packages under Package Collections or yum groupinstall) pam_mount libtalloc (this needs to be updated if you haven't run all the updates, else samba and the domain join don't work)
Firewall Modifications
Open the 'System - Administration - Firewall' and tick
samba samba-client
as Trusted Services. Don't forget to 'Apply'
SELinux Administration
Open 'Systems - Administration - SELinux Administration' and set 'System Default Enforcing Mode' to 'Disbled
Samba Modifications
- Open 'System - Administration - Services' and enable 'smb'
- Open 'System - Administration - Authentication'. This will open an 'Authentication Configuration' dialogue.
- On the 'User Information' tab tick 'Enable Winbind Support' and press the 'Configure Winbind ' button.
- A 'Winbind Configuration' dialogue opens. Complete the boxes with the relevant information and press OK
Winbind Domain - this is the Windows Workgroup name for your SME Server Security - set this to domain Winbind Domain Controllers - this is the ip address of your SME server Template Shell - set this to /bin/bash Allow Offline Login - tick
- Change to the 'Authentication' tab. Check 'Enable Winbind Support' is ticked and press the 'Configure Winbind' button.
- A 'Winbind Settings' dialogue opens. Check the values are the same as above and press OK.
- Change to the Options tab and check the following are ticked or set
Use Shadow Passwords Password Hashing Algorithym - MD5 Local Authorization is sufficient for local users Create Home directories on first login
- Now change back to the 'User Information' tab, press 'Configure Winbind' and then 'Join Domain'. Save the configuration when prompted and close this application down when complete.
- Open an 'Applications - Accessories - Terminal' cli and 'su' to root
- Open and edit /etc/samba/smb.conf. Under [global] there will be a section commented as having been generated by authconfig. Check this section is as below. Some lines may not exist and may need to be added.
- Replace <WORKGROUP> and below with the 'Windows workgroup' name of your SME server. Replace <ip of sme server> below with the internal network ip address of your SME server.
workgroup = <WORKGROUP> password server = <ip of sme server> security = domain idmap uid = <whatever range is set> idmap gid = <whatever range is set> template shell = /bin/bash winbind use default domain = yes (you will probably need to change this from false) winbind offline logo n = true wins server = <ip of sme server> name resolve order = wins host lmhosts bcast socket options = TCP_NODELAY template homedir = /home/%D/%U winbind enum users = yes winbind enum groups = yes winbind cache time = 10 obey pam restrictions = yes pam password change = yes hostname lookup = yes
- To check validation of smb.conf, run
testparm
- The 'Join Domain' above should also have worked so to list users, groups and available shares respectively from the SME server, test with
wbinfo -u wbinfo -g smbtree
- If it doesn't appear to have worked then run
net rpc join -D <WORKGROUP> -U admin
- Enter the admin password for the SME server when prompted and you should get a message,
Joined domain <WORKGROUP>
Authentication Modifications
- Open, check and edit as necessary /etc/nsswitch.conf . Close and Save
hosts: files wins dns group: files winbind passwd: files winbind shadow: files winbind
- Open and edit the /etc/pam.d/system-auth file, and amend as below
#%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_fprintd.so auth sufficient pam_unix.so nullok try_first_pass #auth requisite pam_succeed_if.so uid >= 500 quiet auth optional pam_winbind.so use_first_pass auth optional pam_mount.so enable_pam_password #auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_winbind.so use_first_pass account required pam_permit.so #password requisite pam_cracklib.so try_first_pass retry=3 password sufficient pam_unix.so md5 shadow nullok password sufficient pam_winbind.so use_first_pass use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_mkhomedir.so skel=/etc/skel umask=0022 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_winbind.so session optional pam_mount.so enable_pam_password
- Open and edit the /etc/pam.d/password-auth file, and amend as below
#%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass #auth requisite pam_succeed_if.so uid >= 500 quiet auth optional pam_winbind.so use_first_pass auth optional pam_mount.so enable_pam_password #auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_winbind.so use_first_pass account required pam_permit.so #password requisite pam_cracklib.so try_first_pass retry=3 password sufficient pam_unix.so md5 shadow nullok password sufficient pam_winbind.so use_first_pass use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_mkhomedir.so skel=/etc/skel umask=0022 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_winbind.so session optional pam_mount.so enable_pam_password
Automount User Home Directories at Login
- Open and edit /etc/security/pam_mount.conf.xml file. Find the 'Volume Definitions' section. Add a volume line below the header
<!-- Volume Definitions --> <volume fstype="cifs" server="<SMESERVER>" path="homes" mountpoint="~/nethome" options="nosuid,nodev" />
- Replace <SMESERVER> above with the samba name of your SME server. This will mount the users 'home' directory from SME into a directory called 'nethome' in their local home directory.
Login and Test
- Exit the Terminal cli
- Logout of Fedora.
- Login as a valid SME server user on your system, just giving username and password. No need for DOMAIN\user as samba configured above to use the default Windows Workgroup
- Authentication against SME should proceed and the user log in. A home directory on the local machine should be created as /home/DOMAIN/user, and a sub directory to that called 'nethome' mounted to the users home directory on the SME server. The mount point should also appear on the users gui desktop.
VirtualBox Guest Additions Installation
- The autorun.sh script on the VirtualBox Guest Additions media does not run on Fedora as it requires gksu which doesn't appear to be available as a standard RedHat package. You will need to add the following packages therefore either through the 'System - Adminsitration - Add/Remove Software' or with yum at a Terminal cli command prompt
gcc kernel-headers kernel-devel
- Change to the mounted Virtual Box Guest Additions CDROM, eg
cd /media/VBOXADDITIONS_3.0.10_54097
- Run the relevant script for your processor type, eg for i386 processors
sh ./VBoxLinuxAdditions-x86.run
- The script should run, build and install the guest additions. Logout and restart to complete the installation.
Issues / ToDo
The above was tested on a VirtualBox virtual machine. The login appears to stall after username and password entered due to the mount of the home directory, but this does complete after a little while. Appears to be due to NAT traversal and WINS lookup as VM is using NAT and a different subnet. Couldn't get bridged mode to work, and haven't installed on a dedicated machine on the same subnet to confirm. Login is a little slow therefore using the VM. Perhaps someone could confirm its OK when on proper subnet.
Haven't tested the pam password configuration to see if password changes are handled correctly.