Here's a little how-to I wrote up for the latest Samba (2.2.2) about setting up
pam and winbind. After it's all set up, you can call 'getent group' and
'getent passwd' to get unified group and user lists or just 'wbinfo -u' or
'wbinfo -g' for PDC user and group info
On 16-Oct-2001 Mike Papper wrote:
> Can I use PAM to get a list of groups, a list of users and a list of groups
> that a particular user is a member of? Looking at the API, it seems all I
> can do really is login a user. Also, I dont want to have to start a session
> with a user or autrhenticate them, I just want alist of their groups.
>
> What I want to do is use a PAM interface to manage "all" known users and
> groups. Then I will plug-in various authentication servers to become useful
> for various systems. In particular I would like to plug-in the winbind
> module into PAM and automagically get a list of users and gropups from the
> NT PDC. Then I'd like ot plug-in an LDAP module to get a list of users and
> groups from LDAP and from Microsoft ADSI (which suppoerts an LDAP
> interface).
>
> Am I dreaming here?
>
> Has anyone whos tried to do the same thing had any luck talking straight to
> a NT PDC using any samba API or talking to a winbind daemon?
>
> I am still signing up to this group, could you forward emails to myself too?
>
> Mike Papper
> mike@digitalpipe.net
>
>
>
>
> _______________________________________________
>
> Pam-list@redhat.com
> https://listman.redhat.com/mailman/listinfo/pam-list
--
John M. Trostel
Senior Software Engineer
Quantum / SnapAppliances
jtrostel@snapserver.com
--------------End of forwarded message-------------------------
--
John M. Trostel
Senior Software Engineer
Quantum / SnapAppliances
jtrostel@snapserver.com
Samba 2.2.2 and Winbind HOWTO
by John Trostel (jtrostel@snapserver.com)
version 0.1 1 October 2001
This HOWTO describes how to get winbind services up and running to control acces
s and
authenticate users on your Linux box using the winbind services which come with
SAMBA
2.2.2.
--------------------------------------------------------------------------------
-----
Table of Contents
1. Introduction
1.1 What is this HOWTO?
1.2 Why should I to this?
1.3 Who should be reading this document?
2. Requirements
2.1 Minimum System Requirements
2.1.1 SAMBA 2.2.2
2.1.2 Winbind
2.1.3 PAM
3. Testing it out
3.1 Configuring SAMBA
3.2 Configuring Winbind
3.3 Configuring PAM
3.4 Other system file changes
4. Ending
4.1 Copyright
4.2 Feedback
4.3 Disclaimer
------------------------------------------------------------------------
1. Introduction
1.1 What is this HOWTO?
This HOWTO describes the procedures I used to get winbind up and running on my R
edHat 7.1
system. Winbind is capable of providing access and authentication control for W
indows
Domain users through an NT or Win2K PDC for 'regular' services, such as telnet a
nd ftp, as
well for SAMBA services.
This HOWTO has been written from a 'RedHat-centric' perspective, so if you are u
sing
another distribution, you may have to modify the instructions somewhat to fit th
e way your
distribution works.
1.2 Why should I to this?
This allows the SAMBA administrator to rely on the authentication mechanisms on
the
NT/Win2K PDC for the authentication of domain members. NT/Win2K users no longer
need to
have separate accounts on the SAMBA server.
1.3 Who should be reading this document?
This HOWTO is designed for system administrators. If you are implementing SAMBA
on a file
server and wish to (fairly easily) integrate existing NT/Win2K users from your P
DC onto the
SAMBA server, this HOWTO is for you. That said, I am no NT or PAM expert, so yo
u may find
a better or easier way to accomplish these tasks.
2. Requirements
2.1 Before you get started
If you have a samba configuration file that you are currently using... BACK IT U
P!
If your system already uses PAM, BACK UP THE /etc/pam.d directory contents!
If you haven't already made a boot disk, MAKE ON NOW!
Messing with the pam configuration files can make it nearly impossible to log in
to your
machine. That's why you want to be able to boot back into your machine in single
user mode
and restore your /etc/pam.d back to the original state they were in if you get f
rustrated
with the way things are going ;->
2.1.1 SAMBA 2.2.2 and Winbind
The newest version of SAMBA (version 2.2.2), available from cvs.samba.org, now i
nclude a
functioning winbindd daemon. Please refer to the main SAMBA web page or, better
yet, your
closest SAMBA mirror site for instructions on downloading the source code.
2.1.3 PAM
To allow Domain users the ability to access SAMBA shares and files, as well as p
otentially
other services provided by your SAMBA machine, PAM (pluggable authentication mod
ules) must
be setup properly on your machine. In order to compile the winbind modules, you
should
have at least the pam libraries resident on your system. For recent RedHat syst
ems (7.1,
for instance), that means 'pam-0.74-22'. For best results, it is helpful to als
o
install the development packages in 'pam-devel-0.74-22'.
3. Testing it out
3.1 Preparations
Before starting, it is probably best to kill off all the SAMBA related daemons r
unning on your
server. Kill off all smbd, nmbd, and winbindd processes that may be running. T
o use PAM, you
will want to make sure that you have the standard PAM package (for RedHat) which
supplies the
/etc/pam.d directory structure, including the pam modules are used by pam-aware
services, several
pam libraries, and the /usr/doc and /usr/man entries for pam. Winbind built bet
ter in SAMBA if the
pam-devel package was also installed. This package includes the header files ne
eded to compile
pam-aware applications. For instance, my RedHat system has both 'pam-0.74-22' an
d
'pam-devel-0.74-22' RPMs installed.
3.2 Configure and compile SAMBA
The configuration and compilation of SAMBA is pretty straightforward.
1. (if needed) autoconf
2. (if needed) make clean
3. (if needed) rm config.cache (make a clean configure)
4. ./configure --with-winbind --with-pam
5. make
6. (as root) make install
This will, by default, install SAMBA in /usr/local/samba. See the main SAMBA do
cumentation if you
want to install SAMBA somewhere else. It will also build the winbindd executabl
e and libraries.
3.3 Configure nsswitch.conf and the winbind libraries
The libraries needed to run the winbind daemon through nsswitch need to be copie
d to their
proper locations, so, as root
# cp ../samba/source/nsswitch/libnss_winbind.so /lib
I also found it necessary to make the following symbolic link:
# ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2
Now, as root you need to edit /etc/nsswitch.conf to allow user and group entries
to be visible
from the winbind daemon, as well as from your /etc/hosts files and NIS servers.
My
/etc/nsswitch.conf file look like this after editing:
passwd: files nisplus winbind
shadow: files nisplus winbind
group: files nisplus winbind
The libraries needed by the winbind daemon will be automatically entered into th
e ldconfig cache
the next time your system reboots, but it is faster (and you don't need to reboo
t) if you do it
manually:
# /sbin/ldconfig -v | grep winbind
This makes libnss_winbind available to winbindd and echos back a check to you.
3.4 Configure smb.conf
Several parameters are needed in the smb.conf file to control the behavior of th
e winbind daemon.
These are described in more detail in the winbindd(8) man page. My smb.conf fil
e was modified to
include the following entries in the [global] section:
# separate domain and username with '+', like DOMAIN+username
winbind separator = +
# use uids from 10000 to 20000 for domain users
winbind uid = 10000-20000
# use gids from 10000 to 20000 for domain groups
winbind gid = 10000-20000
# allow enumeration of winbind users and groups
winbind enum users = yes
winbind enum groups = yes
# give winbind users a real shell (only needed if they have telnet access)
template shell = /bin/bash
3.5 Join the SAMBA server to the PDC domain
Enter the following command to make the SAMBA server join the PDC domain, where
'DOMAIN' is the
name of your PDC domain and 'Administrator' is a domain user who has administrat
ive privileges in
the domain.
# /usr/local/samba/bin/smbpasswd -j DOMAIN -r PDC -U Administrator
The proper response to the command should be:
"Joined the domain DOMAIN"
where 'DOMAIN' is your DOMAIN name.
3.6 Start up the winbindd daemon and test it!
Eventually, you will want to modify your smb startup script to automatically inv
oke the winbindd
daemon when the other parts of SAMBA start, but it is possible to test out just
the winbind
portion first. To start up winbind services, enter the following command as roo
t:
# /usr/local/samba/bin/winbindd
I'm always paranoid and like to make sure the daemon is really running...
# ps -ae | grep winbindd
3025 ? 00:00:00 winbindd
Now... for the real test, try to get some information about the users on your PD
C
# /usr/local/samba/bin/wbinfo -u
This should echo back a list of users on your Windows users on your PDC. For ex
ample, I get the
following response:
CEO+Administrator
CEO+burdell
CEO+Guest
CEO+jt-ad
CEO+krbtgt
CEO+TsInternetUser
Obviously, I have named my domain 'CEO' and my winbindd separator is '+'.
You can do the same sort of thing to get group information from the PDC:
# /usr/local/samba/bin/wbinfo -g
CEO+Domain Admins
CEO+Domain Users
CEO+Domain Guests
CEO+Domain Computers
CEO+Domain Controllers
CEO+Cert Publishers
CEO+Schema Admins
CEO+Enterprise Admins
CEO+Group Policy Creator Owners
The function 'getent' can now be used to get unified lists of both local and PDC
users and groups.
Try the following command:
# getent passwd
You should get a list that looks like your /etc/passwd list followed by the doma
in users with
their new uids, gids, home directories and default shells.
The same thing can be done for groups with the command
# getent group
3.3 Fix the /etc/rc.d/init.d/smb startup files
The winbindd daemon needs to start up after the smbd and nmbd daemons are runnin
g. To accomplish
this task, you need to modify the /etc/rc.d/init.d/smb script to add commands to
invoke this
daemon in the proper sequence. My /etc/rc.d/init.d/smb file starts up smbd, nmb
d, and winbindd
from the /usr/local/samba/bin directory directly. The 'start' function in the s
cript looks like
this:
start() {
KIND="SMB"
echo -n $"Starting $KIND services: "
daemon /usr/local/samba/bin/smbd $SMBDOPTIONS
RETVAL=$?
echo
KIND="NMB"
echo -n $"Starting $KIND services: "
daemon /usr/local/samba/bin/nmbd $NMBDOPTIONS
RETVAL2=$?
echo
KIND="Winbind"
echo -n $"Starting $KIND services: "
daemon /usr/local/samba/bin/winbindd
RETVAL3=$?
echo
[ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] && touch /var/lock
/subsys/smb || \
RETVAL=1
return $RETVAL
}
The 'stop' function has a corresponding entry to shut down the services and look
s like this:
stop() {
KIND="SMB"
echo -n $"Shutting down $KIND services: "
killproc smbd
RETVAL=$?
echo
KIND="NMB"
echo -n $"Shutting down $KIND services: "
killproc nmbd
RETVAL2=$?
echo
KIND="Winbind"
echo -n $"Shutting down $KIND services: "
killproc winbindd
RETVAL3=$?
[ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] && rm -f /var/lock
/subsys/smb
echo ""
return $RETVAL
}
3.4 Configure Winbind and PAM
If you have made it this far, you know that winbindd is working. Now it is time
to integrate it
into the operation of samba and other services. The pam configuration files nee
d to be altered in
this step. (Did you remember to make backups of your original /etc/pam.d files?
If not, do it
now.)
To get samba to allow domain users and groups, I modified the /etc/pam.d/samba f
ile from
auth required /lib/security/pam_stack.so service=system-auth
account required /lib/security/pam_stack.so service=system-auth
to
auth required /lib/security/pam_winbind.so
auth required /lib/security/pam_stack.so service=system-auth
account required /lib/security/pam_winbind.so
account required /lib/security/pam_stack.so service=system-auth
The other services that I modified to allow the use of winbind as an authenticat
ion service were
the normal login on the console (or a terminal session), telnet logins, and ftp
service. In order
to enable these services, you may first need to change the entries in /etc/xinet
d.d (or
/etc/inetd). RedHat 7.1 uses the new xinetd.d structure, in this case you need
to change the
lines in /etc/xinetd.d/telnet and /etc/xinetd.d/wu-ftp from
enable = no
to
enable = yes
For ftp services to work properly, you will also need to either have individual
directories for
the domain users already present on the server, or change the home directory tem
plate to a general
directory for all domain users. These can be easily set using the smb.conf glob
al entry 'template
homedir ='.
The /etc/pam.d/ftp file can be changed to allow winbind ftp access in a manner s
imilar to the
samba file. My /etc/pam.d/ftp file was changed to look like this:
auth sufficient /lib/security/pam_winbind.so
auth required /lib/security/pam_listfile.so item=user sense=deny file
=/etc/ftpusers onerr=succeed
auth required /lib/security/pam_stack.so service=system-auth
auth required /lib/security/pam_shells.so
account required /lib/security/pam_stack.so service=system-auth
session required /lib/security/pam_stack.so service=system-auth
The /etc/pam.d/login file can be changed nearly the same way. It now looks like
this:
auth required /lib/security/pam_securetty.so
auth sufficient /lib/security/pam_winbind.so
auth sufficient /lib/security/pam_unix.so use_first_pass
auth required /lib/security/pam_stack.so service=system-auth
auth required /lib/security/pam_nologin.so
account sufficient /lib/security/pam_winbind.so
account required /lib/security/pam_stack.so service=system-auth
password required /lib/security/pam_stack.so service=system-auth
session required /lib/security/pam_stack.so service=system-auth
session optional /lib/security/pam_console.so
In this case, I added the 'auth sufficient /lib/security/pam_winbind.so' lines a
s before, but also
added the required 'pam_securetty.so' above it, to disallow root logins over the
network. I also
added a 'sufficient /lib/security/pam_unix.so use_first_pass' line after the win
bind.so line to
get rid of annoying double prompts for passwords.
Finally, don't forget to copy the winbind pam modules from the source directory
in which you
originally compiled the new SAMBA up to the /lib/security directory so that pam
can use it:
# cp ../samba/source/nsswitch/pam_winbind.so /lib/security
4. Ending
4.1 Copyright
Copyright 2001 John M. Trostel
4.2 Feedback
If you have comments or need further information, please contact the author:
jtrostel@snapserver.com
4.3 Disclaimer
This information is provided "as is". The author believes this document to be
correct, but assumes no responsibility for any damage resulting from it's use.
