X-Git-Url: https://git.deb.at/?a=blobdiff_plain;f=KerberosAuthenticationInfrastructure%2Findex.mdwn;h=266675d78b3ad7ee35a5cfc979878ece1e139eef;hb=60de4a374a06325db01f237cea2716286eed24a3;hp=4e262acddac37c34609b96d0f97f7c25b49a40f2;hpb=096ccad2de573f503e177bb76164614337f92da3;p=debienna.git diff --git a/KerberosAuthenticationInfrastructure/index.mdwn b/KerberosAuthenticationInfrastructure/index.mdwn index 4e262ac..266675d 100644 --- a/KerberosAuthenticationInfrastructure/index.mdwn +++ b/KerberosAuthenticationInfrastructure/index.mdwn @@ -1,71 +1,65 @@ -= central usermanagement = -...using ldap and kerberos +# central usermanagement + +...using ldap and kerberos -= motivation = +# motivation warum: - * skaliert - * sicherheit - * komfort (single sign on) +* skaliert +* sicherheit +* komfort (single sign on) warum nicht: - * fehlerquelle komplexitaet - * gefahr single point of failure / break in +* fehlerquelle komplexitaet +* gefahr single point of failure / break in -> infrastruktur! - -= theorie = +# theorie recommended reading: - * http://www.openinput.com/auth-howto/index.html - * http://www.pdc.kth.se/heimdal/ - * http://www.openldap.org/doc/admin23/ +* [[http://www.openinput.com/auth-howto/index.html|http://www.openinput.com/auth-howto/index.html]] +* [[http://www.pdc.kth.se/heimdal/|http://www.pdc.kth.se/heimdal/]] +* [[http://www.openldap.org/doc/admin23/|http://www.openldap.org/doc/admin23/]] architektur: - * trusted third party, der KDC. hat gemeinsames secret mit allen - hosts/services/usern. "principals". generiert auf anfrage ticket mit - zeit, ip, und welcher user zu welchem service. +* trusted third party, der KDC. hat gemeinsames secret mit allen hosts/services/usern. "principals". generiert auf anfrage ticket mit zeit, ip, und welcher user zu welchem service. design decisions: - * keine passwoerter im ldap, alles via kerberos, rueckwaertskompatibilitaet via pam_krb, nicht sasl oder pam_ldap. - * kerberos datenbank im ldap, keine seperate replikation noetig (nur mit heimdal). - * eigene ldap range fuer uid/groupid, root und systemuser bleiben - lokal falls das netzwerk spinnt. - +* keine passwoerter im ldap, alles via kerberos, rueckwaertskompatibilitaet via pam_krb, nicht sasl oder pam_ldap. +* kerberos datenbank im ldap, keine seperate replikation noetig (nur mit heimdal). +* eigene ldap range fuer uid/groupid, root und systemuser bleiben lokal falls das netzwerk spinnt. -= required software = +# required software zutaten am server: - * heimdal kerberos (ldap), alternativen: mit, shishi - * openldap, alternativ: mysql, postgresql - * wohlgepflegtes dns und reverse-dns - * schwer empfohlen: replikation und redundanz - -{{{ -sudo aptitude install slapd heimdal-kdc -}}} +* heimdal kerberos (ldap), alternativen: mit, shishi +* openldap, alternativ: mysql, postgresql +* wohlgepflegtes dns und reverse-dns +* schwer empfohlen: replikation und redundanz +[[!format txt """ +sudo aptitude install slapd heimdal-kdc +"""]] zutaten am host: - * libnss-ldap - * pam-krb5 - * sasl mit gssapi provider - * richtige zeit, zb. openntpd (kann aber nicht stratum faken fuer windows) - * kerberized client/serversoftware (zb. openssh, apache2) - -{{{ -sudo aptitude install libnss-ldap libpam-krb5 libsasl2-gssapi-mit heimdal-clients -}}} +* libnss-ldap +* pam-krb5 +* sasl mit gssapi provider +* richtige zeit, zb. openntpd (kann aber nicht stratum faken fuer windows) +* kerberized client/serversoftware (zb. openssh, apache2) +[[!format txt """ +sudo aptitude install libnss-ldap libpam-krb5 libsasl2-gssapi-mit heimdal-clients +"""]] -= vorbereitung: domain name service = +# vorbereitung: domain name service config im dns (da gibts uebrigens auch welche mit ldap/sql backend ;): @@ -76,7 +70,7 @@ config file /etc/krb5.conf auf allen hosts ident! was ist ein "canonical hostname"? zonefile mm-karton.com (snippet): -{{{ +[[!format txt """ $ORIGIN mm-karton.com. kerberos A 10.128.0.24 kerberos-1 A 10.128.0.25 @@ -95,20 +89,18 @@ _kerberos._udp SRV 20 1 88 kerberos-1 _ldap._tcp SRV 10 1 88 ldap _ldap._tcp SRV 20 1 88 ldap-1 -}}} - +"""]] zonefile mm-karton.net (snippet), afaik heimdal specific: -{{{ +[[!format txt """ _kerberos TXT "MM-KARTON.COM" -}}} +"""]] - - -= config am server = +# config am server /etc/ldap/slapd.conf -{{{ + +[[!format txt """ # This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options. @@ -134,8 +126,8 @@ argsfile /var/run/slapd/slapd.args loglevel 0 -modulepath /usr/lib/ldap -moduleload back_bdb +modulepath /usr/lib/ldap +moduleload back_bdb moduleload syncprov # The maximum number of entries that is returned for a search operation @@ -147,7 +139,7 @@ sizelimit 500 ####################################################################### # Specific Backend Directives for bdb: -backend bdb +backend bdb checkpoint 512 30 @@ -164,8 +156,8 @@ lastmod on index objectClass eq -index cn,uid,displayName eq,sub,pres -index krb5PrincipalName eq +index cn,uid,displayName eq,sub,pres +index krb5PrincipalName eq index associatedDomain pres,eq,sub index entryUUID,default,entryCSN eq @@ -250,10 +242,9 @@ access to dn.subtree="dc=mm-karton,dc=com" by dn="cn=unki@mm-karton.com,dc=mm-karton,dc=com" write by dn="cn=lefant@mm-karton.com,dc=mm-karton,dc=com" write by dn="cn=ldap/srv-vie-27.vie.mm-karton.com@mm-karton.com,ou=kdc,dc=mm-karton,dc=com" read -}}} - +"""]] /etc/default/slapd -{{{ +[[!format txt """ # Default location of the slapd.conf file SLAPD_CONF= @@ -269,7 +260,7 @@ SLAPD_GROUP="openldap" # will try to figure it out from $SLAPD_CONF (/etc/ldap/slapd.conf) SLAPD_PIDFILE= -# Configure if the slurpd daemon should be started. Possible values: +# Configure if the slurpd daemon should be started. Possible values: # - yes: Always start slurpd # - no: Never start slurpd # - auto: Start slurpd if a replica option is found in slapd.conf (default) @@ -288,17 +279,13 @@ SLURPD_OPTIONS="" export KRB5_KTNAME="FILE:/etc/ldap/ldap.keytab" [ -L /var/run/ldapi ] || ln -s /var/run/slapd/ldapi /var/run/ldapi -}}} - - - +"""]] /etc/heimdal-kdc/kadmin.acl -{{{ +[[!format txt """ lefant/admin@MM-KARTON.COM all -}}} - +"""]] /etc/heimdal-kdc/kdc.conf -{{{ +[[!format txt """ [kdc] database = { realm = MM-KARTON.COM @@ -307,20 +294,18 @@ lefant/admin@MM-KARTON.COM all acl_file = /etc/heimdal-kdc/kadmind.acl } addresses = 10.128.0.24 -}}} +"""]] -{{{ +[[!format txt """ $ sudo kadmin -l init MY.REALM add lefant/admin -}}} - +"""]] - -= config am host = +# config am host /etc/libnss-ldap.conf -{{{ +[[!format txt """ BASE dc=mm-karton, dc=com URI ldap://ldap.mm-karton.com/,ldap://ldap-1.mm-karton.com/ @@ -350,10 +335,9 @@ nss_reconnect_sleeptime 1 nss_reconnect_maxsleeptime 2 nss_reconnect_maxconntries 3 nss_initgroups_ignoreusers arpwatch,asterisk,backup,bin,bind,clamav,cricket,daemon,Debian-exim,debianmirror,dovecot,fetchmail,ftp,games,gnats,identd,irc,list,lp,mail,man,messagebus,mysql,nagios,news,nobody,ntp,ntpd,nut,openvpn,pdns,proftpd,proxy,puppet,root,smmsp,smmta,smsd,snmp,snort,sshd,statd,sync,sys,uucp,www-data,zope -}}} - +"""]] /etc/nsswitch.conf -{{{ +[[!format txt """ passwd: files ldap group: files ldap shadow: files @@ -367,29 +351,28 @@ ethers: db files rpc: db files netgroup: nis -}}} - +"""]] /etc/krb5.conf -{{{ +[[!format txt """ [libdefaults] default_realm = MM-KARTON.COM dns_lookup_realm = yes [logging] - default = SYSLOG:NOTICE:DAEMON - kdc = FILE:/var/log/kdc.log - kadmind = FILE:/var/log/kadmind.log + default = SYSLOG:NOTICE:DAEMON + kdc = FILE:/var/log/kdc.log + kadmind = FILE:/var/log/kadmind.log [appdefaults] - pam = { - ticket_lifetime = 10h - renew_lifetime = 10h - forwardable = true - proxiable = false - retain_after_close = false - minimum_uid = 0 - debug = false - } + pam = { + ticket_lifetime = 10h + renew_lifetime = 10h + forwardable = true + proxiable = false + retain_after_close = false + minimum_uid = 0 + debug = false + } [domain_realm] srv-pof-30.pof.mmk.mmdom.net = MM-KARTON.COM @@ -408,39 +391,32 @@ netgroup: nis auth_to_local = RULE:[1:$1@$0](^.*@MMK.MMDOM.NET$)s/@MMK.MMDOM.NET// auth_to_local = DEFAULT } -}}} - - +"""]] /etc/pam.d/common-account -{{{ +[[!format txt """ account required pam_access.so account sufficient pam_krb5.so forwardable realm=MMK.MMDOM.NET minimum_uid=20000 account sufficient pam_krb5.so forwardable realm=MM-KARTON.COM minimum_uid=20000 account required pam_unix.so -}}} - +"""]] /etc/pam.d/common-auth -{{{ +[[!format txt """ auth optional pam_group.so auth sufficient pam_krb5.so forwardable realm=MMK.MMDOM.NET minimum_uid=20000 try_first_pass auth sufficient pam_krb5.so forwardable realm=MM-KARTON.COM minimum_uid=20000 try_first_pass auth required pam_unix.so try_first_pass -}}} - +"""]] /etc/pam.d/common-session -{{{ +[[!format txt """ session required pam_mkhomedir.so umask=0022 skel=/etc/mmskel session sufficient pam_krb5.so forwardable realm=MMK.MMDOM.NET minimum_uid=20000 session sufficient pam_krb5.so forwardable realm=MM-KARTON.COM minimum_uid=20000 session required pam_unix.so -}}} - - - +"""]] restrict logins to certain users: /etc/security/access.conf -{{{ +[[!format txt """ # first, to avoid delays when network is still unavailable +:ALL:LOCAL +:root:ALL @@ -450,67 +426,50 @@ restrict logins to certain users: # deny everything else -:ALL:ALL -}}} - - - +"""]] /etc/adduser.conf (snippet) -{{{ +[[!format txt """ # FIRST_[GU]ID to LAST_[GU]ID inclusive is the range of UIDs of dynamically # allocated user accounts/groups. FIRST_UID=1000 LAST_UID=19999 -}}} - - - - +"""]] ldap client config (administration): /etc/ldap/ldap.conf -{{{ +[[!format txt """ BASE dc=mm-karton, dc=com URI ldap://ldap.mm-karton.com/ ssl start_tls tls_cacert /etc/ssl/certs/ca_crt.pem -}}} - +"""]] ldapwhoami, ldapsearch - - sudo, nopasswd, weil solches haben wir ja nicht... /etc/sudoers -{{{ +[[!format txt """ lefant ALL=(ALL) NOPASSWD:ALL -}}} - +"""]] - -= single sign on fuer applikationen (gssapi support, das grosse fragezeichen) = +# single sign on fuer applikationen (gssapi support, das grosse fragezeichen) /etc/ssh/sshd_config (snippet) -{{{ +[[!format txt """ GSSAPIAuthentication yes GSSAPIKeyExchange yes -}}} - +"""]] /etc/ssh/ssh_config (snippet) -{{{ +[[!format txt """ host * GSSAPIAuthentication yes GSSAPIDelegateCredentials yes GSSAPITrustDns yes -}}} - - - +"""]] firefox: out-of-the-box! -apache: (apt-get install libapache2-mod-auth-kerb) -config snippet -{{{ +apache: (apt-get install libapache2-mod-auth-kerb) config snippet +[[!format txt """ AuthType Kerberos AuthName "MM Login (use windows login *without* mm\ prefix)" @@ -524,11 +483,10 @@ config snippet Allow from noc.mm-karton.com Satisfy any -}}} - +"""]] +# misc stuff -= misc stuff = - * tcpdump - * strace - * $HOME/.k5login \ No newline at end of file +* tcpdump +* strace +* $HOME/.k5login \ No newline at end of file