Integrating Solaris 10
and Active DirectoryAssumtions:
You have a working version of:
The Solaris pam_krb5 seems to have issues that seem to overcomplicate the Kerberos authentication system (namely: needing stuff in keytab files which other distribs like Linux do not seem to need). I have taken the simple pam_krb5 1.0 module developed by () and modified it slightly to include extra security enhancements and EUID checking, and repackaged it so it compiles under Solaris 10 with GCC.
Download, and build # tar -zxvf pam_krb5-1.2.tar.gz # make # mv /usr/lib/security/pam_krb5.so.1 /usr/lib/security/pam_krb5.so.SOLARIS # make install Configuring PAM is detailed later....
Linux distributions come with a neat module called pam_mkhomedir. This module will create the users home directory if it does not exist and they authenticated. The module is distributes with the Linux-PAM project source. I have written a script which will fetch Linux-PAM-0.79 (Latest at time of writing), patch it, compile it, and leave pam_mkhomedir.so in your working directory.
set proxy if necessary # export http_proxy="http://proxy.host.yourdomain.com:3128/" Download and run script IMPORTANT Make sure that gcc is using the Solaris linker ld - ie, it takes a -B option, and ln can take a -f flag. # ./make_mkhomedir.sh =================================================== pam_mkhomedir.so Creator By Matt Bradford (m.bradford@isi.qut.edu.au) Configured for PAM-0.79 ==================================================== --- Attempting to create pam_mkhomedir.so. --------- --- If all goes well, it will exist here, ---------- --- in /usr/local/src. ----------------------------- --- Wish me luck... -------------------------------- ==================================================== Getting Linux-PAM-0.79.tar.gz... Extracting... Configuring... Prepping... -> Patching pammodutil files... Generating Patch... Patching Makefile... Looks like a normal diff. done Generating Patch... Patching modutil_getspnam.c... Looks like a normal diff. done Building modutils... modutil_getlogin.c: In function `_pammodutil_getlogin': modutil_getlogin.c:26: warning: dereferencing type-punned pointer will break strict-aliasing rules modutil_getlogin.c:31: warning: dereferencing type-punned pointer will break strict-aliasing rules -> Copying required modutil files... -> Patching pam_mkhomedir.c... Looks like a normal diff. done -> Compiling pam_mkhomedir... -> Linking pam_mkhomedir... DONE. Copying module out of path of destruction... Removing old source, etc... Done: -rwxr-xr-x 1 root root 82124 May 13 12:32 pam_mkhomedir.so =================================================== Copy the new module to the PAM module directory. # cp pam_mkhomedir.so /usr/lib/security/pam_mkhomedir.so.1 # ln -s ./pam_mkhomedir.so.1 /usr/lib/security/pam_mkhomedir.so
PAM (Pluggable Authentication Module) Will allow us to hook into the login process, recycling the user's entered credentials. The three modules we installed have the following characteristics:
pam_winbind
# PAM configuration # # Authentication management # login auth optional /usr/lib/security/$ISA/pam_krb5.so.1 debug login auth sufficient /usr/lib/security/$ISA/pam_winbind.so try_first_pass login auth required /usr/lib/security/$ISA/pam_unix_cred.so.1 debug login auth required /usr/lib/security/$ISA/pam_unix_auth.so.1 try_first_pass login auth required /usr/lib/security/$ISA/pam_dial_auth.so.1 try_first_pass # dtlogin auth optional /usr/lib/security/$ISA/pam_krb5.so.1 debug dtlogin auth sufficient /usr/lib/security/$ISA/pam_winbind.so try_first_pass dtlogin auth required /usr/lib/security/$ISA/pam_unix_cred.so.1 debug dtlogin auth required /usr/lib/security/$ISA/pam_unix_auth.so.1 try_first_pass # dtsession auth required /usr/lib/security/$ISA/pam_unix_password.so.1 # rlogin auth required /usr/lib/security/$ISA/pam_deny.so rsh auth required /usr/lib/security/$ISA/pam_deny.so # other auth optional /usr/lib/security/$ISA/pam_krb5.so.1 debug other auth sufficient /usr/lib/security/$ISA/pam_winbind.so try_first_pass other auth required /usr/lib/security/$ISA/pam_unix_cred.so.1 debug other auth required /usr/lib/security/$ISA/pam_unix_auth.so.1 try_first_pass # # Account management # login account sufficient /usr/lib/security/$ISA/pam_winbind.so login account requisite /usr/lib/security/$ISA/pam_roles.so.1 login account required /usr/lib/security/$ISA/pam_unix_account.so.1 # dtlogin account sufficient /usr/lib/security/$ISA/pam_winbind.so dtlogin account requisite /usr/lib/security/$ISA/pam_roles.so.1 dtlogin account required /usr/lib/security/$ISA/pam_unix_account.so.1 # other account sufficient /usr/lib/security/$ISA/pam_winbind.so.1 other account requisite /usr/lib/security/$ISA/pam_roles.so.1 other account required /usr/lib/security/$ISA/pam_unix_account.so.1 # # Session management # other session optional /usr/lib/security/$ISA/pam_mkhomedir.so.1 skel=/etc/skel/ umask=0077 other session required /usr/lib/security/$ISA/pam_unix_session.so.1 # # Password management # other password sufficient /usr/lib/security/$ISA/pam_winbind.so other password required /usr/lib/security/$ISA/pam_unix_password.so.1 #
This configuration firstly allows us to grab a kerberos ticket from the domain controller. It's optional because it doesn't really really matter if it fails - if it does, the next one will most likely fail as well. We just want this entry to get our ticket.
The next entry in the auth statements allows us to recycle the provided credentials to winbind. This one is listed as sufficient, so that when a user authenticates against the domain successfully, the PAM modules below winbind do not need to be processed.
However, if root were to log in, the first two would fail, but would drop down to unix authentication, which is where root's account details are stored.
Account management only has winbind listed, because winbind is what provides us with account information.
The user's home directory is made when the session starts - therefore the module is included at the session level.
-~- Conclusion
Now, When the user logs in, their home directory should be created, and "klist" should reveal a ticket. To test that it is all working correctly, kerberized samba requests can be used to test it: smbclient -k --list //windows-host/share and a list of the shares on the windows (or SAMBA ADS) host should appear without the prompt for a password: # smbclient -k --list //windows-host OS=[Windows 5.0] Server=[Windows 2000 LAN Manager] Sharename Type Comment --------- ---- ------- IPC$ IPC Remote IPC print$ Disk Printer Drivers NETLOGON Disk Logon server share F$ Disk Default share ADMIN$ Disk Remote Admin SYSVOL Disk Logon server share VPLOGON Disk Virus Protect C$ Disk Default share VPHOME Disk Virus Protect VPALERT$ Disk Virus Protect admin_share Disk OS=[Windows 5.0] Server=[Windows 2000 LAN Manager] Server Comment --------- ------- Workgroup Master --------- -------