Changes

Jump to navigation Jump to search

Client Authentication:Fedora (view source)

Revision as of 09:22, 29 October 2017

7,335 bytes added ,  09:22, 29 October 2017
→‎Automount Ibays at Login
Line 1: Line 1: −
{{Warning Box| If your reading this then this page isn't finished. Don't follow the instructions as they are untested and being converted from the Ubuntu Howto}}
+
 
−
{{Warning box| This is based upon limited testing and a small number of users via a VirtualBox virtual machine installation of Fedora. YMMV}}
+
{{Warning box|This is based upon limited testing and a small number of users.}}
−
==Fedora 11 Authentication==
+
==Client Configuration==
 
===Introduction===
 
===Introduction===
−
The following details the setup of Fedora 11 as a desktop to authenticate users against SME. The method has been tested using Fedora installed in a VirtualBox virtual machine on a Windows XP host. It assumes login is via the gui interface.
+
The following is Fedora 21 (F21) - standard gnome edition desktop configuration for SME Server 9 authentication using Samba and Winbind. It allows login via the standard Fedora login screen. Also suitable for Fedora 19 and 20 (F19 and F20) for SME Server 8 - note that the Firewall and SELinux Administration GUI's may be slightly different.
−
 
   
===Install Fedora===
 
===Install Fedora===
−
Download the Fedora .iso and install.  
+
*Download the Fedora .iso and install. During the install process change the hostname to something of your choice and your domain name.
−
{{Tip box| When prompted for a user name to log in with, give a non-SME user such as 'administrator', as this first user effectively becomes a local user with sudo root access.  
+
<HOSTNAME>.<yourdomain>.<yourtld>
 +
{{Tip box| Make sure you set the <HOSTNAME> to something less than 15 characters.
 +
The hostname can be set during the Installation Summary section of the install procedure by selecting Network & Hostname.
   −
Make sure you set the 'Name of this Computer' to something less than 15 characters.}}
+
When creating a user account, give a non SME Server user such as 'administrator' as this first user effectively becomes a local user for Gnome login. Root is not allowed to login at the Gnome GDM prompt. You can login as this user, open the Terminal (cli) and 'su' to root to carry out most of the authentication setup later.}}
−
Complete install, login and apply all updates.  
+
*When the install has finished, remove the media and reboot.
−
{{Note box| For VirtualBox VM installation only, install the 'Guest Additions'.}}
+
*Complete the install, login and apply all updates. Logout and Restart.
 +
{{Note box| There may be a lot of updates, it is recommended to apply them all but ensure the security fixes are applied as a minimum.}}
 
===Additional Packages===
 
===Additional Packages===
−
Use the 'System - Administration - Synaptic Package Manager' to install additional packages
+
*Open the Terminal and use "su" to log in as root user.
 +
*Use "yum" at the Terminal to install the additional packages.
 +
*If you prefer to use a graphical package manager then install the "Yum Extender" from the Software" package.
 +
*The following shows how to install using yum at the Terminal, the package names are the same if you use the gui. Note: Firewall-config is already installed on F19 & F20.
 +
yum install \
 +
pam_mount policycoreutils-gui authconfig-gtk \
 +
samba samba-winbind samba-winbind-clients \
 +
system-config-samba firewall-config
   −
auth_client_config
+
===Package Removal===
−
winbind
+
*Remove the following package (F21 only)
−
libpam_mount
+
  yum remove sssd-libwbclient
−
  smbfs
      +
===Firewall Modifications===
 +
*Search for and open “Firewall” and tick
 +
samba
 +
samba-client
 +
as trusted services. Do not forget to select “Permanent” in the configuration drop down box first otherwise the changes will apply to the current session only.
 +
===SELinux Administration===
 +
*Search for and open “SELinux Management” - note that the screen which opens is titled “SELinux Administration” (not Management)
 +
*On the "Status" menu select the "System Default Enforcing Mode" to "Disabled".
 
===Samba Modifications===
 
===Samba Modifications===
−
Open an 'Applications - Accessories - Terminal' cli and change to root privileges
+
At the Terminal and still as root user, run the following two commands.
−
sudo su
+
systemctl enable smb.service
−
 
+
systemctl start smb.service
−
Open and edit /etc/samba/smb.conf. Find the relevant lines and alter them or uncomment them as below. Some lines may not exist and may need to be added.
+
*Search for and open “Authentication”. This will open the Authentication Configuration dialogue.
−
workgroup = <WORKGROUP>
+
{{Tip box| Do not press the “Join Domain” button until you have completed the changes to all of the Authentication Configuration dialogue boxes as detailed below.}}
−
wins server = <ip of sme server>
+
*On the Identity & Authentication tab select Winbind as the User Account Database.
−
  name resolve order = wins host lmhosts bcast
+
*Complete the dialogue box as follows:
−
  security = domain
+
Winbind Domain - this is the Windows Workgroup name for your SME Server
−
  password server = <ip of sme server>
+
Security Model - set this to domain
−
  socket options = TCP_NODELAY
+
Winbind Domain Controllers - this is the IP Address of your SME Server
−
  idmap uid = 5000-20000
+
Template shell - set this to /bin/bash
−
  idmap gid = 5000-20000
+
Allow offline login - tick
 +
*On the Advanced Options tab
 +
Enable local access control - tick
 +
Password hashing Algorithm - MD5
 +
Create home directories on first login         - tick
 +
*Password options tab.
 +
No configuration changes changes on this tab are necessary
 +
*Change back to the Identity & Authentication tab.
 +
*Click on “Join Domain” button and save changes when prompted. Enter 'admin' as the Domain Administrator and then enter your SME Server 'admin' password. Click “OK”, then click “Apply” on the Identity & Authentication tab.
 +
*Open the Terminal and 'su' to root if not already done.
 +
*Open and edit /etc/samba/smb.conf. Under [global] there will be a section commented as having been generated by authconfig. Check this section is as below, some lines may not exist and may need to be added.
 +
:Replace <WORKGROUP> below with the 'Windows Workgroup' name of your SME Server.
 +
:Replace <ip of sme server> below with the ip address of your SME Server.
 +
[global]
 +
#--authconfig--start-line--
 +
 +
# Generated by authconfig on 2013/08/10 15:16:23
 +
# DO NOT EDIT THIS SECTION (delimited by --start-line--/--end-line--)
 +
# Any modification may be deleted or altered by authconfig in future
 +
   
 +
  workgroup = <WORKGROUP>
 +
# password server = <ip of sme server> (not required – leave as is but comment out)
 +
security = domain
 +
  idmap config * : backend = tdb (add this line)
 +
  idmap config * : range = 16777216-33554431            (leave whatever range is set by default)
 +
idmap config DOMAIN : backend = rid       (add his line)
 +
  idmap config DOMAIN : range = 10000-49999       (add this line)
 +
idmap config DOMAIN : base_rid = 1000                (add this line)
 
  template shell = /bin/bash
 
  template shell = /bin/bash
−
  template homedir = /home/%D/%U
+
# kerberos method = secrets only                      (comment out if this line exists)
−
  winbind enum users = yes
+
winbind use default domain = yes (change this from false)
−
  winbind enum groups = yes
+
winbind offline logon = true
−
  winbind cache time = 10
+
wins server = <ip of sme server> (add all of the following lines)
−
  winbind use default domain = yes
+
name resolve order = wins host lmhosts bcast
 +
socket options = TCP_NODELAY
 +
  template homedir = /home/%D/%U  
 +
  winbind enum users = yes  
 +
  winbind enum groups = yes  
 +
  winbind cache time = 10  
 +
  obey pam restrictions = yes
 +
pam password change = yes
 +
hostname lookups = yes  
 +
 +
  #--authconfig--end-line--
   −
Replace <WORKGROUP> above (and below) with the 'Windows workgroup' name of your SME server. Replace <ip of sme server> above with the internal network ip address of your SME server.
+
{{Note box| If you run the 'Authentication' tool again your amendments will be lost}}
−
 
+
*To check validation of smb.conf, run
−
To check validation of smb.conf, run
   
  testparm
 
  testparm
−
 
+
*The 'Join Domain' above should also have worked so to list users, groups and available shares respectively from the SME server, test with
−
If all OK, then run
  −
net rpc join -D <WORKGROUP> -U admin
  −
 
  −
Enter the admin password for the SME server when prompted and you should get a message,
  −
Joined domain <WORKGROUP>
  −
 
  −
{{Note box| Now restart the machine, login, open a Terminal cli and 'sudo su' again. You could miss out this restart step and carry on with the modifications below, but the following commands didn't work and the full join to SME didn't seem to work until the machine has been restarted and reconnected to the server.
  −
 
  −
This may be a timing/delay issue similar to the volume mount (see below) due to NAT traversal. The restart may be unnecessary - can anyone confirm??}}
  −
 
  −
The following commands should now list users, groups and available shares respectively from the SME server
   
  wbinfo -u
 
  wbinfo -u
 
  wbinfo -g
 
  wbinfo -g
 
  smbtree
 
  smbtree
−
 
+
:If it doesn't appear to have worked then run
 +
net rpc join -D <WORKGROUP> -U admin
 +
:Enter the admin password for the SME server when prompted and you should get a message,
 +
Joined domain <WORKGROUP>
 
===Authentication Modifications===
 
===Authentication Modifications===
−
{{Warning box| Altering the pam system authentication files can seriously effect your ability to login in to the system. Take a backup of the /etc/pam.d directory and /etc/nsswitch.conf. Have a live CD available to give access and re-apply the backup files if you make a mistake and/or get locked out}}
+
{{Warning box| Altering the pam system authentication files can seriously effect your ability to login in to the system. Take a backup of the /etc/pam.d directory and /etc/nsswitch.conf. Have a live DVD available to give access and re-apply the backup files if you make a mistake and/or get locked out}}
−
Open and edit /etc/nsswitch.conf and find the hosts: line. Change it to
+
*Open, check and edit as necessary /etc/nsswitch.conf. On F21 the following 4 lines will require amendment, on F19 and F20 only line 4 should require amendment. Close and Save.
−
  hosts: files wins dns
+
passwd:  files winbind
 +
shadow: files winbind
 +
group: files winbind
 +
  hosts: files dns wins (ensure the order is correct – put wins at the end)
 +
*Open and edit the /etc/pam.d/system-auth file, and amend as below:
 +
#%PAM-1.0
 +
# This file is auto-generated.
 +
# User changes will be destroyed the next time authconfig is run.
 +
auth        required      pam_env.so
 +
auth        sufficient    pam_fprintd.so
 +
auth        sufficient    pam_unix.so nullok try_first_pass
 +
auth        requisite    pam_succeed_if.so uid >= 1000 quiet_success
 +
auth        sufficient    pam_winbind.so cached_login use_first_pass
 +
auth   optional      pam_mount.so enable_pam_password
 +
auth        required      pam_deny.so
 +
 +
account    required      pam_access.so
 +
account    required      pam_unix.so broken_shadow
 +
account    sufficient    pam_localuser.so
 +
account    sufficient    pam_succeed_if.so uid < 1000 quiet
 +
account    [default=bad success=ok user_unknown=ignore] pam_winbind.so cached_login
 +
account    required      pam_permit.so
 +
 +
password    requisite    pam_pwquality.so try_first_pass retry=3 type=
 +
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
 +
password    sufficient    pam_winbind.so use_authtok
 +
password    required      pam_deny.so
 +
 +
session    optional      pam_keyinit.so revoke
 +
session    required      pam_limits.so
 +
-session    optional      pam_systemd.so
 +
session    optional      pam_mkhomedir.so
 +
session    [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
 +
session    required      pam_unix.so
 +
session    optional      pam_winbind.so cached_login
 +
session     optional   pam_mount.so enable_pam_password
 +
{{Note box| The following two lines were added to the system-auth file:
 +
auth     optional   pam_mount.so enable_pam_password
   −
Change to the auth-client-config tool profile directory
+
session     optional   pam_mount.so enable_pam_password}}
−
  cd /etc/auth-client-config/profile.d
+
*Open and edit the /etc/pam.d/password-auth file, and amend as below:
 +
#%PAM-1.0
 +
# This file is auto-generated.
 +
# User changes will be destroyed the next time authconfig is run.
 +
auth        required      pam_env.so
 +
auth        sufficient    pam_unix.so nullok try_first_pass
 +
  auth        requisite    pam_succeed_if.so uid >= 1000 quiet_success
 +
auth        sufficient    pam_winbind.so cached_login use_first_pass
 +
auth        optional      pam_mount.so enable_pam_password
 +
auth        required      pam_deny.so
 +
 +
account    required      pam_access.so
 +
account    required      pam_unix.so broken_shadow
 +
account    sufficient    pam_localuser.so
 +
account    sufficient    pam_succeed_if.so uid < 1000 quiet
 +
account    [default=bad success=ok user_unknown=ignore] pam_winbind.so cached_login
 +
account    required      pam_permit.so
 +
 +
password    requisite    pam_pwquality.so try_first_pass retry=3 type=
 +
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
 +
password    sufficient    pam_winbind.so use_authtok
 +
password    required      pam_deny.so
 +
 +
session    optional      pam_keyinit.so revoke
 +
session    required      pam_limits.so
 +
-session    optional      pam_systemd.so
 +
session    optional      pam_mkhomedir.so
 +
session    [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
 +
session    required      pam_unix.so
 +
session    optional      pam_winbind.so cached_login
 +
session     optional   pam_mount.so enable_pam_password
 +
{{Note box| The following two lines were added to the password-auth file:
 +
auth     optional   pam_mount.so enable_pam_password
 +
 +
session     optional   pam_mount.so enable_pam_password}}
 +
*Open and edit the /etc/pam.d/gdm-password file, and amend as below:
 +
auth    [success=done ignore=ignore default=bad] pam_selinux_permit.so
 +
auth        substack      password-auth
 +
auth        optional      pam_gnome_keyring.so
 +
auth      optional      pam_mount.so
 +
auth        include      postlogin
 +
 +
account    required      pam_nologin.so
 +
account    include      password-auth  
 +
 +
password    include      password-auth
 +
 +
session    required      pam_selinux.so close
 +
session    required      pam_loginuid.so
 +
session    optional      pam_console.so
 +
-session    optional    pam_ck_connector.so
 +
session    required      pam_selinux.so open
 +
session    optional      pam_keyinit.so force revoke
 +
session    required      pam_namespace.so
 +
session    include      password-auth
 +
session    optional      pam_gnome_keyring.so auto_start
 +
session    include      postlogin
 +
session     optional   pam_mount.so
 +
{{Note box| The following two lines were added to the gdm-password file:
 +
auth     optional   pam_mount.so
   −
Create and edit a new file called acc-sme, and enter
+
session     optional   pam_mount.so}}
−
[sme]
  −
nss_group=group:        compat winbind
  −
nss_netgroup=netgroup:  nis
  −
nss_passwd=passwd:      compat winbind
  −
nss_shadow=shadow:      compat
  −
pam_account=account  [success=2 new_authtok_reqd=done default=ignore]  pam_winbind.so
  −
            account  [success=1 default=ignore]                        pam_unix.so use_first_pass use_authtok
  −
            account  requisite                                        pam_deny.so
  −
            account  required                                          pam_permit.so
  −
pam_auth=auth [success=2 default=ignore]  pam_winbind.so
  −
          auth [success=1 default=ignore]  pam_unix.so      nullok_secure  use_first_pass  use_authtok
  −
          auth requisite             pam_deny.so
  −
          auth required     pam_permit.so
  −
          auth required     pam_securetty.so
  −
          auth optional     pam_mount.so      enable_pam_password
  −
pam_password=password [success=2 default=ignore]  pam_unix.so    obscure sha512
  −
              password [success=1 default=ignore]  pam_winbind.so  use_first_pass  md5  use_authtok
  −
              password requisite     pam_deny.so
  −
              password required     pam_permit.so
  −
              password optional             pam_gnome_keyring.so
  −
pam_session=session  [default=1]  pam_permit.so
  −
            session  requisite    pam_deny.so
  −
            session required     pam_permit.so
  −
            session  optional     pam_winbind.so
  −
            session  required    pam_unix.so
  −
            session  required    pam_mkhomedir.so skel=/etc/skel umask=0022
  −
            session  optional    pam_mount.so         enable_pam_password
  −
            session  optional    pam_ck_connector.so  nox11
  −
{{Tip box| You can use
  −
auth-client-config -S > acc-sme
  −
to create the file first, containing the current pam files configuration, and then just modify}}  
  −
Save the file. Apply the pam authorisation changes
  −
auth-client-config -a -p sme
  −
=== Automount User Home Directories at Login===
  −
cd /etc/security
     −
Open and edit pam_mount.conf.xml file. Find the 'Volume Definitions' section. Add a volume line below the header
+
===Automount User Home Directories at Login===
 +
*Create a new group in SME Server with a Group Name of  “nethome” and a Description of “nethome-group”. Add all SME Server users to this group, or at least all SME Server users who will be using the SME Server to authenticate a Fedora client workstation.
 +
{{Note box| The names “nethome” and “nethome-group” can, of course be anything you like, these are just my example for the purpose of this HowTo. They are, however, a sensible choice as we are going to use a mount point called “nethome” but again this mount point name can be anything you want.}}
 +
*Open and edit /etc/security/pam_mount.conf.xml file. Find the 'Volume Definitions' section. Add a volume line below the header
 
  <nowiki><!-- Volume Definitions --> </nowiki>
 
  <nowiki><!-- Volume Definitions --> </nowiki>
−
  <volume fstype="cifs" server="<SMESERVER>" path="homes" mountpoint="~/nethome" options="nosuid,nodev" />
+
  <volume sgrp="nethome-group" fstype="cifs" server="<SMESERVER>" path="homes" mountpoint="~/nethome" options="nosuid,nodev,vers=1.0" />
−
 
+
*Replace <SMESERVER> above with the samba name of your SME Server. This will mount the users 'home' directory from SME Server into a directory called 'nethome' in their local home directory.
−
Replace <SMESERVER> above with the samba name of your SME server. This will mount the users 'home' directory from SME into a directory called 'nethome' in their local home directory.
     −
===Login and Test===
+
===Automount Using smserver-tw-loginscript===
−
Exit the Terminal cli
     −
Logout of Ubuntu.  
+
The [[Smeserver-tw-logonscript]] package provides a convenient and flexible alternative to managing mounts for user home directories and i-bay directories.  
   −
Login as a valid SME server user on your system, just giving username and password. No need for DOMAIN\user as samba configured above to use the default Windows Workgroup
+
Instead of the hardcoded lines as described above it auto generates a small user specific script when the user logs in and then links the pam_mount to this user script.
   −
Authentication against SME should proceed and the user log in. A home directory on the local machine should be created as /home/DOMAIN/user, and a sub directory to that called 'nethome' mounted to the users home directory on the SME server. The mount point should also appear on the users gui desktop.
+
=== Automount Ibays at Login===
 +
*Edit /etc/security/pam_mount.conf.xml and add a line below the header
 +
<nowiki><!-- Volume Definitions --> </nowiki>
 +
<volume sgrp="<GROUPNAME>" fstype="cifs" server="<SMESERVER>" path="<IBAYNAME>" mountpoint="~/<IBAYNAME>" options="user=%(DOMAIN_USER),setuids,acl,vers=1.0" />
 +
*Replace <SMESERVER> with the samba name of your SME server, <IBAYNAME> with the ibay name, <GROUPNAME> with the '''[[description]]''' of the ibay owner group. The description can be recovered with
 +
wbinfo -g
 +
{{Note box| The sgrp param is optional. If used, ibay will be mounted only if %(DOMAIN_USER) is a member of ibay's owner group}}
   −
===Issues / ToDo===
+
===Login and Test===
−
The above was tested on a VirtualBox virtual machine. The login appears to stall after username and password entered due to the mount of the home directory, but this does complete after a little while. Appears to be due to NAT traversal and WINS lookup as VM is using NAT and a different subnet. Couldn't get bridged mode to work, and haven't installed on a dedicated machine on the same subnet to confirm. Login is a little slow therefore using the VM. Perhaps someone could confirm its OK when on proper subnet.
+
*Exit the Terminal cli
−
 
+
*Logout, and Restart Fedora.
−
Haven't tested the pam password configuration to see if password changes are handled correctly.
+
*Login as a valid SME server user on your system, just giving username and password. No need for DOMAIN\user as samba configured above to use the default Windows Workgroup
 +
*Authentication against SME Server should proceed and the user log in. A home directory on the local machine should be created as /home/DOMAIN/user, and a sub directory to that called 'nethome' mounted to the users home directory on the SME server.
 +
===Password Changes===
 +
User password changes made through the web browser (www.yourdomain.xxx/user-password) are implemented correctly. The new password also being recognised when logging in away from the SME Server network i.e. off-line cached login, particularly useful for business laptops.
 +
----
 +
[[Category:Howto]]
 +
[[Category:Administration]]
Arnaud
41

edits

Retrieved from "https://wiki.koozali.org/Special:MobileDiff/13740...34042"

Navigation menu