On 01/17/2012 09:40 PM, Gémes Géza wrote:
Hi,
See comments inline:
Hi everyone
I'm trying to use kerberos to authenticate to Samba 4 ldap. At the
moment, I authenticate by specifying the binddn and password in
/etc/nslcd.conf and all works fine
If I add the line:
sasl_mech GSSAPI
That should suffice, but please note, that nslcd should also have access
to some kind of keytab, to authenticate itself.
This is done on Debian/Ubuntu via the /etc/default/nsldcd.conf (mine is
looking like):
# Defaults for nslcd init script
# Whether to start k5start (for obtaining and keeping a Kerberos ticket)
# By default k5start is started if nslcd.conf has sasl_mech set to GSSAPI
# and krb5_ccname is set to a file-type ticket cache.
# Set to "yes" to force starting k5start, any other value will not start
# k5start.
K5START_START="yes"
# Options for k5start.
K5START_BIN=/usr/bin/k5start
K5START_KEYTAB=/etc/krb5.keytab
K5START_CCREFRESH=60
K5START_PRINCIPAL="host/$(hostname -f)"
And must have k5start installed (it is wrapper which keeps fresh tickets
for long runing services)
to /etc/nslcd.conf
and restart nslcd, no one can connect to the database. Nothing works.
ldapsearch and getent passwd draw a blank.
ldapsearch -x -b '' -sbase supportedSASLMechanisms
gives me:
dn:
supportedSASLMechanisms: GSS-SPNEGO
supportedSASLMechanisms: GSSAPI
supportedSASLMechanisms: NTLM
but ldapsearch -Y GSSAPI gives:
SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Local error (-2)
additional info: SASL(-1): generic failure: GSSAPI Error:
Unspecified GSS failure. Minor code may provide more information
(Server not found in Kerberos database)
before you can do an SASL/GSSAPI based ldap operation you must have
valid kerberos tickets (so do a kinit first)!
and Samba gives:
Kerberos: TGS-REQ administra...@hh3.site from ipv4:192.168.1.3:56859
for ldap/hh3.s...@hh3.site [canonicalize, renewable]
Kerberos: Searching referral for hh3.site
Kerberos: Returning a referral to realm SITE for server
ldap/hh3.s...@hh3.site that was not found
Failed find a single entry for
(&(objectClass=trustedDomain)(|(flatname=SITE)(trustPartner=SITE))):
got 0
Kerberos: samba_kdc_fetch: could not find principal in DB
Kerberos: Server not found in database: krbtgt/s...@hh3.site: no such
entry found in hdb
Kerberos: Failed building TGS-REP to ipv4:192.168.1.3:56859
I've tried making a ldap principal but samba-tool spn doesn't let me
add an ldap principal.
Any ideas anyone?
Thanks,
Steve
Regards
Geza
Hi Geza
OK. Now on Ubuntu. I have k5init installed and have made a host principal:
klist -k /etc/host.keytab
Keytab name: WRFILE:/etc/host.keytab
KVNO Principal
----
--------------------------------------------------------------------------
1 host/hh3.s...@hh3.site
1 host/hh3.s...@hh3.site
1 host/hh3.s...@hh3.site
Just to be sure I have:
ls -la /etc/host.keytab
-rw-rw-rw- 1 root root 193 2012-01-18 11:34 /etc/host.keytab
cat /etc/default/nslcd
# Defaults for nslcd init script
# Whether to start k5start (for obtaining and keeping a Kerberos ticket)
# By default k5start is started if nslcd.conf has sasl_mech set to GSSAPI
# and krb5_ccname is set to a file-type ticket cache.
# Set to "yes" to force starting k5start, any other value will not start
# k5start.
K5START_START="yes"
# Options for k5start.
K5START_BIN=/usr/bin/k5start
K5START_KEYTAB=/etc/host.keytab
K5START_CCREFRESH=60
#K5START_PRINCIPAL="host/$(hostname -f)"
K5START_PRINCIPAL="host/HH3.SITE -f"
I did kinit Administrator and have a cache in /tmp/krbcc_0
cat /etc/nslcd.conf
uid nslcd
gid nslcd
uri ldap://127.0.0.1
base dc=hh3,dc=site
binddn cn=Administrator,cn=Users,dc=hh3,dc=site
map passwd uid sAMAccountName
map passwd homeDirectory unixHomeDirectory
map shadow uid sAMAccountName
sasl_mech GSSAPI
sasl_realm HH3.SITE
krb5_ccname /tmp/krb5cc_0
But:
service nslcd restart
* Restarting LDAP connection daemon
nslcd [ OK ]
* Stopping Keep alive Kerberos ticket
k5start No process in pidfile
'/var/run/nslcd/k5start_nslcd.pid' found running; none killed.
[ OK ]
* Starting Keep alive Kerberos ticket
k5start k5start: error getting
credentials: Client not found in Kerberos database
[fail]
[ OK ]
and Samba gives:
Kerberos: AS-REQ host/hh3.s...@hh3.site from ipv4:192.168.1.3:38618 for
krbtgt/hh3.s...@hh3.site
Kerberos: UNKNOWN -- host/hh3.s...@hh3.site: no such entry found in hdb
Why isn't the host principal being found?
Ahhgg!!
Where to start?
Any ideas?
Cheers,
Steve
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
