docs/Samba-Guide/Chap10b-DomainAppsSupport.xml

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
   3
   4 <chapter id="DomApps">
   5   <title>Integrating Additional Services</title>
   6
   7     <para><indexterm>
   8         <primary>authentication</primary>
   9       </indexterm><indexterm>
  10         <primary>backends</primary>
  11       </indexterm><indexterm>
  12         <primary>smbpasswd</primary>
  13       </indexterm><indexterm>
  14         <primary>ldapsam</primary>
  15       </indexterm><indexterm>
  16         <primary>Active Directory</primary>
  17       </indexterm>
  18         You've come a long way now. You have pretty much mastered Samba-3 for
  19         most uses it can be put to. Up until now, you have cast Samba-3 in the leading
  20         role and where authentication was required, you have used one or another of
  21         Samba's many authentication backends (from flat text files with smbpasswd
  22         to LDAP directory integration with ldapsam). Now you can design a
  23         solution for a new Abmas business. This business is running Windows Server
  24         2003 and Active Directory, and these are to stay. It's time to master
  25         implementing Samba and Samba-supported services in a domain controlled by
  26         the latest Windows authentication technologies. Let's get started &smbmdash; this is
  27         leading edge.
  28         </para>
  29
  30 <sect1>
  31         <title>Introduction</title>
  32
  33         <para>
  34         Abmas has continued its miraculous growth; indeed, nothing seems to be able
  35         to stop its diversification into multiple (and seemingly unrelated) fields.
  36         Its latest acquisition is Abmas Snack Foods, a big player in the snack-food
  37         business.
  38         </para>
  39
  40         <para>
  41         With this acquisition comes new challenges for you and your team. Abmas Snack
  42         Foods is a well-developed business with a huge and heterogeneous network. They
  43         already have Windows, Netware, and Proprietary UNIX, but as yet no Samba or Linux.
  44         The network is mature and well established, and there is no question of their chosen
  45         user authentication scheme being changed for now. You need to take a wise new
  46         approach.
  47         </para>
  48
  49         <para>
  50         You have decided to set the ball rolling by introducing Samba-3 into the network
  51         gradually, taking over key services and easing the way to a full migration and,
  52         therefore, integration into Abmas's existing business later.
  53         </para>
  54
  55         <sect2>
  56                 <title>Assignment Tasks</title>
  57
  58         <para><indexterm>
  59             <primary>web</primary>
  60             <secondary>proxying</secondary>
  61           </indexterm><indexterm>
  62             <primary>web</primary>
  63             <secondary>caching</secondary>
  64           </indexterm>
  65                 You've promised the skeptical Abmas Snack Foods management team
  66                 that you can show them how Samba can ease itself and other Open Source
  67                 technologies into their existing infrastructure and deliver sound business
  68                 advantages. Cost cutting is high on their agenda (a major promise of the
  69                 acquisition). You have chosen Web proxying and caching as your proving ground.
  70                 </para>
  71
  72         <para><indexterm>
  73             <primary>bandwidth</primary>
  74           </indexterm><indexterm>
  75             <primary>Microsoft ISA</primary>
  76           </indexterm>
  77                 Abmas Snack Foods has several thousand users housed at their Head Office
  78                 and multiple regional offices, plants, and warehouses. A high proportion of
  79                 the business's work is done online, so Internet access for most of these
  80                 users is essential. All Internet access, including all of their regional offices,
  81                 is funneled through the head office and is the job of the (now your) networking
  82                 team. The bandwidth requirements were horrific (comparable to a small ISP), and
  83                 the team soon discovered proxying and caching. In fact, they became one of
  84                 the earliest commercial users of Microsoft ISA.
  85                 </para>
  86
  87         <para><indexterm>
  88             <primary>Active Directory</primary>
  89           </indexterm><indexterm>
  90             <primary>authenticated</primary>
  91           </indexterm><indexterm>
  92             <primary>proxy</primary>
  93           </indexterm>
  94                 The team is not happy with ISA. Because it never lived up to its marketing promises,
  95                 it under-performed and had reliability problems. You have pounced on the opportunity
  96                 to show what Open Source can do. The one thing they do like, however, is ISA's
  97                 integration with Active Directory. They like that their users, once logged on,
  98                 are automatically authenticated against the proxy. If your alternative to ISA
  99                 can operate completely seamlessly in their Active Directory Domain, it will be
 100                 approved.
 101                 </para>
 102
 103                 <para>
 104                 This is a hands-on exercise. You build software applications so
 105                 that you obtain the functionality Abmas needs.
 106                 </para>
 107
 108         </sect2>
 109 </sect1>
 110
 111 <sect1>
 112         <title>Dissection and Discussion</title>
 113
 114         <para>
 115         The key requirements in this business example are straightforward. You are not required
 116         to do anything new, just to replicate an existing system, not lose any existing features,
 117         and improve performance. The key points are:
 118         </para>
 119
 120         <itemizedlist>
 121                 <listitem><para>
 122                 Internet access for most employees
 123                 </para></listitem>
 124                 <listitem><para>
 125                 Distributed system to accommodate load and geographical distribution of users
 126                 </para></listitem>
 127                 <listitem><para>
 128                 Seamless and transparent interoperability with the existing Active Directory domain
 129                 </para></listitem>
 130         </itemizedlist>
 131
 132
 133         <sect2>
 134                 <title>Technical Issues</title>
 135
 136         <para><indexterm>
 137             <primary>browsing</primary>
 138           </indexterm><indexterm>
 139             <primary>Squid proxy</primary>
 140           </indexterm><indexterm>
 141             <primary>proxy</primary>
 142           </indexterm><indexterm>
 143             <primary>authentication</primary>
 144           </indexterm><indexterm>
 145             <primary>Internet Explorer</primary>
 146           </indexterm><indexterm>
 147             <primary>winbind</primary>
 148           </indexterm><indexterm>
 149             <primary>NTLM</primary>
 150           </indexterm><indexterm>
 151             <primary>NTLM authentication daemon</primary>
 152           </indexterm><indexterm>
 153             <primary>authentication</primary>
 154           </indexterm><indexterm>
 155             <primary>daemon</primary>
 156           </indexterm><indexterm>
 157             <primary>Active Directory</primary>
 158           </indexterm><indexterm>
 159             <primary>domain</primary>
 160             <secondary>Active Directory</secondary>
 161           </indexterm><indexterm>
 162             <primary>Kerberos</primary>
 163           </indexterm><indexterm>
 164             <primary>token</primary>
 165           </indexterm>
 166                 Functionally, the user's Internet Explorer requests a browsing session with the
 167                 Squid proxy, for which it offers its AD authentication token. Squid hands off
 168                 the authentication request to the Samba-3 authentication helper application
 169                 called <command>ntlm_auth</command>. This helper is a hook into winbind, the
 170                 Samba-3 NTLM authentication daemon. Winbind enables UNIX services to authenticate
 171                 against Microsoft Windows Domains, including Active Directory domains. As Active
 172                 Directory authentication is a modified Kerberos authentication, winbind is assisted
 173                 in this by local Kerberos 5 libraries configured to check passwords with the Active
 174                 Directory server. Once the token has been checked, a browsing session is established.
 175                 This process is entirely transparent and seamless to the user.
 176                 </para>
 177
 178                 <para>
 179                 Enabling this consists of:
 180                 </para>
 181
 182                 <itemizedlist>
 183                         <listitem><para>
 184                         Preparing the necessary environment using preconfigured packages
 185                         </para></listitem>
 186
 187                         <listitem><para>
 188                         Setting up raw Kerberos authentication against the Active Directory domain
 189                         </para></listitem>
 190
 191                         <listitem><para>
 192                         Configuring, compiling, and then installing the supporting Samba-3 components
 193                         </para></listitem>
 194
 195                         <listitem><para>
 196                         Tying it all together
 197                         </para></listitem>
 198                 </itemizedlist>
 199
 200         </sect2>
 201
 202
 203         <sect2>
 204                 <title>Political Issues</title>
 205
 206                 <para>
 207                 You are a stranger in a strange land and all eyes are upon you. Some would even like to see
 208                 you fail. For you to gain the trust of your newly acquired IT people, it is essential that your
 209                 solution does everything the old one did, but does it better in every way. Only then
 210                 will the entrenched positions consider taking up your new way of doing things on a
 211                 wider scale.
 212                 </para>
 213
 214         </sect2>
 215
 216 </sect1>
 217
 218 <sect1>
 219         <title>Implementation</title>
 220
 221       <para><indexterm>
 222           <primary>Squid</primary>
 223         </indexterm>
 224         First, your system needs to be prepared and in a known good state to proceed. This consists
 225         of making sure that everything the system depends on is present and that everything that could
 226         interfere or conflict with the system is removed. You will be configuring the Squid and Samba-3
 227         packages and updating them if necessary. If conflicting packages of these programs are installed,
 228         they must be removed.
 229         </para>
 230
 231       <para><indexterm>
 232           <primary>Red Hat Linux</primary>
 233         </indexterm>
 234         The following packages should be available on your Red Hat Linux system:
 235         </para>
 236
 237         <itemizedlist>
 238         <listitem><para><indexterm>
 239               <primary>krb5</primary>
 240             </indexterm><indexterm>
 241               <primary>Kerberos</primary>
 242             </indexterm>
 243                 krb5-libs
 244                 </para></listitem>
 245
 246                 <listitem><para>
 247                 krb5-devel
 248                 </para></listitem>
 249
 250                 <listitem><para>
 251                 krb5-workstation
 252                 </para></listitem>
 253
 254                 <listitem><para>
 255                 krb5-server
 256                 </para></listitem>
 257
 258                 <listitem><para>
 259                 pam_krb5
 260                 </para></listitem>
 261         </itemizedlist>
 262
 263       <para><indexterm>
 264           <primary>SUSE Linux</primary>
 265         </indexterm>
 266         In the case of SUSE Linux, these packages are called:
 267         </para>
 268
 269         <itemizedlist>
 270                 <listitem><para>
 271                 heimdal-lib
 272                 </para></listitem>
 273
 274                 <listitem><para>
 275                 heimdal-devel
 276                 </para></listitem>
 277
 278         <listitem><para><indexterm>
 279               <primary>Heimdal</primary>
 280             </indexterm>
 281                 heimdal
 282                 </para></listitem>
 283
 284                 <listitem><para>
 285                 pam_krb5
 286                 </para></listitem>
 287         </itemizedlist>
 288
 289         <para>
 290         If the required packages are not present on your system, you must install
 291         them from the vendor's installation media. Follow the administrative guide
 292         for your Linux system to ensure that the packages are correctly updated.
 293         </para>
 294
 295       <note><para><indexterm>
 296             <primary>MS Windows Server 2003</primary>
 297           </indexterm><indexterm>
 298             <primary>Kerberos</primary>
 299           </indexterm><indexterm>
 300             <primary>MIT</primary>
 301           </indexterm>
 302         If the requirement is for interoperation with MS Windows Server 2003, it
 303         will be necessary to ensure that you are using MIT Kerberos version 1.3.1
 304         or later. Red Hat Linux 9 ships with MIT Kerberos 1.2.7 and thus requires
 305         updating.
 306         </para>
 307
 308         <para><indexterm>
 309             <primary>Heimdal</primary>
 310           </indexterm><indexterm>
 311             <primary>SUSE Enterprise Linux Server</primary>
 312           </indexterm>
 313         Heimdal 0.6 or later is required in the case of SUSE Linux. SUSE Enterprise
 314         Linux Server 8 ships with Heimdal 0.4. SUSE 9 ships with the necessary version.
 315         </para></note>
 316
 317         <sect2 id="ch10-one">
 318         <title>Removal of Pre-existing Conflicting RPMs</title>
 319
 320         <para><indexterm>
 321             <primary>Squid</primary>
 322           </indexterm>
 323         If Samba and/or Squid rpms are installed, they should be updated. You can
 324         build both from source.
 325         </para>
 326
 327         <para><indexterm>
 328             <primary>rpm</primary>
 329           </indexterm><indexterm>
 330             <primary>samba</primary>
 331           </indexterm><indexterm>
 332             <primary>squid</primary>
 333           </indexterm>
 334         Locating the packages to be uninstalled can be achieved by running:
 335 <screen>
 336 &rootprompt; rpm -qa | grep -i samba
 337 &rootprompt; rpm -qa | grep -i squid
 338 </screen>
 339         The identified packages may be removed using:
 340 <screen>
 341 &rootprompt; rpm -e samba-common
 342 </screen>
 343         </para>
 344
 345         <sect2>
 346         <title>Kerberos Configuration</title>
 347
 348         <para><indexterm>
 349             <primary>Kerberos</primary>
 350           </indexterm><indexterm>
 351             <primary>Active Directory</primary>
 352             <secondary>server</secondary>
 353           </indexterm><indexterm>
 354             <primary>ADS</primary>
 355           </indexterm><indexterm>
 356             <primary>KDC</primary>
 357           </indexterm>
 358         The systems Kerberos installation must be configured to communicate with
 359         your primary Active Directory server (ADS KDC).
 360         </para>
 361
 362         <para>
 363         Strictly speaking, MIT Kerberos version 1.3.1 currently gives the best results,
 364         although the current default Red Hat MIT version 1.2.7 gives acceptable results
 365         unless you are using Windows 2003 servers.
 366         </para>
 367
 368         <para><indexterm>
 369             <primary>MIT</primary>
 370           </indexterm><indexterm>
 371             <primary>Heimdal</primary>
 372           </indexterm><indexterm>
 373             <primary>Kerberos</primary>
 374           </indexterm><indexterm>
 375             <primary>/etc/krb5.conf</primary>
 376           </indexterm><indexterm>
 377             <primary>DNS</primary>
 378             <secondary>SRV records</secondary>
 379           </indexterm><indexterm>
 380             <primary>KDC</primary>
 381           </indexterm><indexterm>
 382             <primary>DNS</primary>
 383             <secondary>lookup</secondary>
 384           </indexterm>
 385         Officially, neither MIT (1.3.1) nor Heimdal (0.6) Kerberos needs an <filename>/etc/krb5.conf</filename>
 386         file in order to work correctly. All ADS domains automatically create SRV records in the
 387         DNS zone <constant>Kerberos.REALM.NAME</constant> for each KDC in the realm. Since both
 388         MIT and Heimdal, KRB5 libraries default to checking for these records, so they
 389         automatically find the KDCs. In addition, <filename>krb5.conf</filename> only allows
 390         specifying a single KDC, even there if there is more than one. Using the DNS lookup
 391         allows the KRB5 libraries to use whichever KDCs are available.
 392         </para>
 393
 394         <procedure>
 395           <step><para><indexterm>
 396                 <primary>krb5.conf</primary>
 397               </indexterm>
 398                 If you find the need to manually configure the <filename>krb5.conf</filename>, you should edit it
 399                 to have the contents shown in <link linkend="ch10-krb5conf"/>. The final fully qualified path for this file
 400                 should be <filename>/etc/krb5.conf</filename>.
 401                 </para></step>
 402
 403           <step><para><indexterm>
 404                 <primary>Kerberos</primary>
 405               </indexterm><indexterm>
 406                 <primary>realm</primary>
 407               </indexterm><indexterm>
 408                 <primary>case-sensitive</primary>
 409               </indexterm><indexterm>
 410                 <primary>KDC</primary>
 411               </indexterm><indexterm>
 412                 <primary>synchronization</primary>
 413               </indexterm><indexterm>
 414                 <primary>initial credentials</primary>
 415               </indexterm><indexterm>
 416                 <primary>Clock skew</primary>
 417               </indexterm><indexterm>
 418                 <primary>NTP</primary>
 419               </indexterm><indexterm>
 420                 <primary>DNS</primary>
 421                 <secondary>lookup</secondary>
 422               </indexterm><indexterm>
 423                 <primary>reverse DNS</primary>
 424               </indexterm><indexterm>
 425                 <primary>NetBIOS name </primary>
 426               </indexterm><indexterm>
 427                 <primary>/etc/hosts</primary>
 428               </indexterm><indexterm>
 429                 <primary>mapping</primary>
 430               </indexterm>
 431                 The following gotchas often catch people out. Kerberos is case sensitive. Your realm must
 432                 be in UPPERCASE, or you will get an error: <quote>Cannot find KDC for requested realm while getting
 433                 initial credentials</quote>.  Kerberos is picky about time synchronization. The time
 434                 according to your participating servers must be within 5 minutes or you get an error
 435                 <quote>kinit(v5): Clock skew too great while getting initial credentials</quote>.
 436                 Clock skew limits are, in fact, configurable in the Kerberos protocols (the default is
 437                 5 minutes). A better solution is to implement NTP throughout your server network.
 438                 Kerberos needs to be able to do a reverse DNS lookup on the IP address of your KDC.
 439                 Also, the name that this reverse lookup maps to must either be the NetBIOS name of
 440                 the KDC (i.e., the hostname with no domain attached), or it can alternately be the
 441                 NetBIOS name followed by the realm. If all else fails, you can add a
 442                 <filename>/etc/hosts</filename> entry mapping the IP address of your KDC to its
 443                 NetBIOS name. If Kerberos cannot do this reverse lookup, you will get a local error
 444                 when you try to join the realm.
 445                 </para></step>
 446
 447           <step><para><indexterm>
 448                 <primary>kinit</primary>
 449               </indexterm>
 450                 You are now ready to test your installation by issuing the command:
 451 <screen>
 452 &rootprompt; kinit [USERNAME@REALM]
 453 </screen>
 454                 You are asked for your password, which you should enter. The following
 455                 is a typical console sequence:
 456 <screen>
 457 &rootprompt; kinit ADMINISTRATOR@LONDON.ABMAS.BIZ
 458 Password for ADMINISTRATOR@LONDON.ABMAS.BIZ:
 459 </screen>
 460                 Make sure that your password is accepted by the Active Directory KDC.
 461                 </para></step>
 462         </procedure>
 463
 464 <example id="ch10-krb5conf">
 465 <title>Kerberos Configuration &smbmdash; File: <filename>/etc/krb5.conf</filename></title>
 466 <screen>
 467 [libdefaults]
 468         default_realm = LONDON.ABMAS.BIZ
 469
 470 [realms]
 471         LONDON.ABMAS.BIZ = {
 472         kdc = w2k3s.london.abmas.biz
 473         }
 474 </screen>
 475 </example>
 476
 477         <para><indexterm>
 478             <primary>klist</primary>
 479           </indexterm>
 480         The command:
 481 <screen>
 482 &rootprompt; klist -e
 483 </screen>
 484         shows the Kerberos tickets cached by the system:
 485         </para>
 486
 487         <sect3>
 488         <title>Samba Configuration</title>
 489
 490           <para><indexterm>
 491               <primary>Active Directory</primary>
 492             </indexterm>
 493         Samba must be configured to correctly use Active Directory. Samba-3 must be used, as
 494         this has the necessary components to interface with Active Directory.
 495         </para>
 496
 497         <procedure>
 498             <step><para><indexterm>
 499                   <primary>Red Hat Linux</primary>
 500                 </indexterm><indexterm>
 501                   <primary>Samba Tea</primary>
 502                 </indexterm><indexterm>
 503                   <primary>Red Hat Fedora Linux</primary>
 504                 </indexterm><indexterm>
 505                   <primary>MIT KRB5</primary>
 506                 </indexterm><indexterm>
 507                   <primary>ntlm_auth</primary>
 508                 </indexterm>
 509                 Download the latest stable Samba-3 for Red Hat Linux from the official Samba Team
 510                 <ulink url="http://ftp.samba.org">FTP site.</ulink> The official Samba Team
 511                 RPMs for Red Hat Fedora Linux contain the <command>ntlm_auth</command> tool
 512                 needed, and are linked against MIT KRB5 version 1.3.1 and, therefore, are ready for use.
 513                 </para>
 514
 515               <para><indexterm>
 516                   <primary>SerNet</primary>
 517                 </indexterm><indexterm>
 518                   <primary>RPMs</primary>
 519                 </indexterm>
 520                 The necessary, validated RPM packages for SUSE Linux may be obtained from
 521                 the <ulink url="ftp://ftp.sernet.de/pub/samba">SerNet</ulink> FTP site that
 522                 is located in Germany. All SerNet RPMs are validated, have the necessary
 523                 <command>ntlm_auth</command> tool, and are statically linked
 524                 against suitably patched Heimdal 0.6 libraries.
 525                 </para></step>
 526
 527                 <step><para>
 528                 Using your favorite editor, change the <filename>/etc/samba/smb.conf</filename>
 529                 file so it has contents similar to the example shown in <link linkend="ch10-smbconf"/>.
 530                 </para></step>
 531
 532             <step><para><indexterm>
 533                   <primary>computer account</primary>
 534                 </indexterm><indexterm>
 535                   <primary>Active Directory</primary>
 536                 </indexterm><indexterm>
 537                   <primary>net</primary>
 538                   <secondary>ads</secondary>
 539                   <tertiary>join</tertiary>
 540                 </indexterm><indexterm>
 541                   <primary>Kerberos ticket</primary>
 542                 </indexterm><indexterm>
 543                   <primary>ticket</primary>
 544                 </indexterm>
 545                 Next you need to create a computer account in the Active Directory.
 546                 This sets up the trust relationship needed for other clients to
 547                 authenticate to the Samba server with an Active Directory Kerberos ticket.
 548                 This is done with the <quote>net ads join -U [Administrator%Password]</quote>
 549                 command, as follows:
 550 <screen>
 551 &rootprompt; net ads join -U administrator%vulcon
 552 </screen>
 553                 </para></step>
 554
 555             <step><para><indexterm>
 556                   <primary>smbd</primary>
 557                 </indexterm><indexterm>
 558                   <primary>nmbd</primary>
 559                 </indexterm><indexterm>
 560                   <primary>winbindd</primary>
 561                 </indexterm><indexterm>
 562                   <primary>Active Directory</primary>
 563                 </indexterm><indexterm>
 564                   <primary>Samba</primary>
 565                 </indexterm>
 566                 Your new Samba binaries must be started in the standard manner as is applicable
 567                 to the platform you are running on. Alternately, start your Active Directory
 568                 enabled Samba with the following commands:
 569 <screen>
 570 &rootprompt; smbd -D
 571 &rootprompt; nmbd -D
 572 &rootprompt; winbindd -B
 573 </screen>
 574                 </para></step>
 575
 576             <step><para><indexterm>
 577                   <primary>winbind</primary>
 578                 </indexterm><indexterm>
 579                   <primary>Active Directory</primary>
 580                   <secondary>domain</secondary>
 581                 </indexterm><indexterm>
 582                   <primary>wbinfo</primary>
 583                 </indexterm><indexterm>
 584                   <primary>enumerating</primary>
 585                 </indexterm><indexterm>
 586                   <primary>Active Directory</primary>
 587                   <secondary>tree</secondary>
 588                 </indexterm>
 589                 We now need to test that Samba is communicating with the Active
 590                 Directory domain; most specifically, we want to see whether winbind
 591                 is enumerating users and groups. Issue the following commands:
 592 <screen>
 593 &rootprompt; wbinfo -t
 594 checking the trust secret via RPC calls succeeded
 595 </screen>
 596                 This tests whether we are authenticating against Active Directory:
 597 <screen>
 598 &rootprompt; wbinfo -u
 599 LONDON+Administrator
 600 LONDON+Guest
 601 LONDON+SUPPORT_388945a0
 602 LONDON+krbtgt
 603 LONDON+jht
 604 LONDON+xjht
 605 </screen>
 606                 This enumerates all the users in your Active Directory tree:
 607 <screen>
 608 &rootprompt; wbinfo -g
 609 LONDON+Domain Computers
 610 LONDON+Domain Controllers
 611 LONDON+Schema Admins
 612 LONDON+Enterprise Admins
 613 LONDON+Domain Admins
 614 LONDON+Domain Users
 615 LONDON+Domain Guests
 616 LONDON+Group Policy Creator Owners
 617 LONDON+DnsUpdateProxy
 618 </screen>
 619                 This enumerates all the groups in your Active Directory tree.
 620                 </para></step>
 621
 622             <step><para><indexterm>
 623                   <primary>Squid</primary>
 624                 </indexterm><indexterm>
 625                   <primary>ntlm_auth</primary>
 626                 </indexterm>
 627                 Squid uses the <command>ntlm_auth</command> helper build with Samba-3.
 628                 You may test <command>ntlm_auth</command> with the command:
 629 <screen>
 630 &rootprompt; /usr/bin/ntlm_auth --username=jht
 631 password: XXXXXXXX
 632 </screen>
 633                 You are asked for your password, which you should enter. You are rewarded with:
 634 <screen>
 635 &rootprompt; NT_STATUS_OK: Success (0x0)
 636 </screen>
 637                 </para></step>
 638
 639                 <step><para><indexterm>
 640                   <primary>ntlm_auth</primary>
 641                 </indexterm><indexterm>
 642                   <primary>authenticate</primary>
 643                 </indexterm><indexterm>
 644                   <primary>winbind</primary>
 645                 </indexterm><indexterm>
 646                   <primary>privileged pipe</primary>
 647                 </indexterm><indexterm>
 648                   <primary>squid</primary>
 649                 </indexterm><indexterm>
 650                   <primary>chgrp</primary>
 651                 </indexterm><indexterm>
 652                   <primary>chmod</primary>
 653                 </indexterm><indexterm>
 654                   <primary>failure</primary>
 655                 </indexterm>
 656                 The <command>ntlm_auth</command> helper, when run from a command line as the user
 657                 <quote>root</quote>, authenticates against your Active Directory domain (with
 658                 the aid of winbind). It manages this by reading from the winbind privileged pipe.
 659                 Squid is running with the permissions of user <quote>squid</quote> and group
 660                 <quote>squid</quote> and is not able to do this unless we make a vital change.
 661                 Squid cannot read from the winbind privilege pipe unless you change the
 662                 permissions of its directory. This is the single biggest cause of failure in the
 663                 whole process. Remember to issue the following command (for Red Hat Linux):
 664 <screen>
 665 &rootprompt; chgrp squid /var/cache/samba/winbindd_privileged
 666 &rootprompt; chmod 750 /var/cache/samba/winbindd_privileged
 667 </screen>
 668                 For SUSE Linux 9, execute the following:
 669 <screen>
 670 &rootprompt; chgrp squid /var/lib/samba/winbindd_privileged
 671 &rootprompt; chmod 750 /var/lib/samba/winbindd_privileged
 672 </screen>
 673                 </para></step>
 674
 675         </procedure>
 676         </sect3>
 677
 678         <sect3>
 679         <title>NSS Configuration</title>
 680
 681           <para><indexterm>
 682               <primary>NSS</primary>
 683             </indexterm><indexterm>
 684               <primary>winbind</primary>
 685             </indexterm><indexterm>
 686               <primary>authentication</primary>
 687             </indexterm>
 688         For Squid to benefit from Samba-3, NSS must be updated to allow winbind as a valid route to user authentication.
 689         </para>
 690
 691         <procedure>
 692                 <step><para>
 693                 Edit your <filename>/etc/nsswitch.conf</filename> file so it has the parameters shown
 694                 in <link linkend="ch10-etcnsscfg"/>.
 695                 </para></step>
 696         </procedure>
 697
 698 <smbconfexample id="ch10-smbconf">
 699 <title>Samba Configuration &smbmdash; File: <filename>/etc/samba/smb.conf</filename></title>
 700 <smbconfsection name="[global]"/>
 701 <smbconfoption name="workgroup">LONDON</smbconfoption>
 702 <smbconfoption name="netbios name">W2K3S</smbconfoption>
 703 <smbconfoption name="realm">LONDON.ABMAS.BIZ</smbconfoption>
 704 <smbconfoption name="security">ads</smbconfoption>
 705 <smbconfoption name="encrypt passwords">yes</smbconfoption>
 706 <smbconfoption name="password server">w2k3s.london.abmas.biz</smbconfoption>
 707
 708 <smbconfcomment>separate domain and username with '/', like DOMAIN/username</smbconfcomment>
 709 <smbconfoption name="winbind separator">/</smbconfoption>
 710
 711 <smbconfcomment>use UIDs from 10000 to 20000 for domain users</smbconfcomment>
 712 <smbconfoption name="idmap uid">10000-20000</smbconfoption>
 713 # use GIDs from 10000 to 20000 for domain groups
 714 <smbconfoption name="idmap gid">10000-20000</smbconfoption>
 715
 716 <smbconfcomment>allow enumeration of winbind users and groups</smbconfcomment>
 717 <smbconfoption name="winbind enum users">yes</smbconfoption>
 718 <smbconfoption name="winbind enum groups">yes</smbconfoption>
 719 <smbconfoption name="winbind user default domain">yes</smbconfoption>
 720 </smbconfexample>
 721
 722 <example id="ch10-etcnsscfg">
 723 <title>NSS Configuration File Extract &smbmdash; File: <filename>/etc/nsswitch.conf</filename></title>
 724 <screen>
 725 passwd: files winbind
 726 shadow: files
 727 group: files winbind
 728 </screen>
 729 </example>
 730
 731         </sect3>
 732
 733         <sect3>
 734         <title>Squid Configuration</title>
 735
 736           <para><indexterm>
 737               <primary>Squid</primary>
 738             </indexterm><indexterm>
 739               <primary>Active Directory</primary>
 740               <secondary>authentication</secondary>
 741             </indexterm>
 742         Squid must be configured correctly to interact with the Samba-3
 743         components that handle Active Directory authentication.
 744         </para>
 745
 746         </sect3>
 747
 748         </sect2>
 749
 750         <sect2>
 751         <title>Configuration</title></sect2>
 752
 753         <procedure>
 754         <step><para><indexterm>
 755               <primary>SUSE Linux</primary>
 756             </indexterm><indexterm>
 757               <primary>Squid</primary>
 758             </indexterm><indexterm>
 759               <primary>helper agent</primary>
 760             </indexterm>
 761                 If your Linux distribution is SUSE Linux 9, the version of Squid
 762                 supplied is already enabled to use the winbind helper agent. You
 763                 can, therefore, omit the steps that would build the Squid binary
 764                 programs.
 765                 </para></step>
 766
 767         <step><para><indexterm>
 768               <primary>nobody</primary>
 769             </indexterm><indexterm>
 770               <primary>squid</primary>
 771             </indexterm><indexterm>
 772               <primary>rpms</primary>
 773             </indexterm><indexterm>
 774               <primary>/etc/passwd</primary>
 775             </indexterm><indexterm>
 776               <primary>/etc/group</primary>
 777             </indexterm>
 778                 Squid, by default, runs as the user <constant>nobody</constant>. You need to
 779                 add a system user <constant>squid</constant> and a system group
 780                 <constant>squid</constant> if they are not set up already (if the default
 781                 Red Hat squid rpms were installed, they will be).  Set up a
 782                 <constant>squid</constant> user in <filename>/etc/passwd</filename>
 783                 and a <constant>squid</constant> group in <filename>/etc/group</filename> if these aren't there already.
 784                 </para></step>
 785
 786         <step><para><indexterm>
 787               <primary>permissions</primary>
 788             </indexterm><indexterm>
 789               <primary>chown</primary>
 790             </indexterm>
 791                 You now need to change the permissions on Squid's <constant>var</constant>
 792                 directory.  Enter the following command:
 793 <screen>
 794 &rootprompt; chown -R squid /var/cache/squid
 795 </screen>
 796                 </para></step>
 797
 798         <step><para><indexterm>
 799               <primary>logging</primary>
 800             </indexterm><indexterm>
 801               <primary>Squid</primary>
 802             </indexterm>
 803                 Squid must also have control over its logging. Enter the following commands:
 804 <screen>
 805 &rootprompt; chown -R chown squid:squid /var/log/squid
 806 &rootprompt; chmod 770 /var/log/squid
 807 </screen>
 808                 </para></step>
 809
 810                 <step><para>
 811                 Finally, Squid must be able to write to its disk cache!
 812                 Enter the following commands:
 813 <screen>
 814 &rootprompt; chown -R chown squid:squid /var/cache/squid
 815 &rootprompt; chmod 770 /var/cache/squid
 816 </screen>
 817                 </para></step>
 818
 819         <step><para><indexterm>
 820               <primary>/etc/squid/squid.conf</primary>
 821             </indexterm>
 822                 The <filename>/etc/squid/squid.conf</filename> file must be edited to include the lines from
 823                 <link linkend="etcsquidcfg"/> and <link linkend="etcsquid2"/>.
 824                 </para></step>
 825
 826         <step><para><indexterm>
 827               <primary>cache directories</primary>
 828             </indexterm>
 829                 You must create Squid's cache directories before it may be run.  Enter the following command:
 830 <screen>
 831 &rootprompt; squid -z
 832 </screen>
 833                 </para></step>
 834
 835                 <step><para>
 836                 Finally, start Squid and enjoy transparent Active Directory authentication.
 837                 Enter the following command:
 838 <screen>
 839 &rootprompt; squid
 840 </screen>
 841                 </para></step>
 842         </procedure>
 843
 844 <example id="etcsquidcfg">
 845 <title>Squid Configuration File Extract &smbmdash; <filename>/etc/squid.conf</filename> [ADMINISTRATIVE PARAMETERS Section]</title>
 846 <screen>
 847         cache_effective_user squid
 848         cache_effective_group squid
 849 </screen>
 850 </example>
 851
 852 <example id="etcsquid2">
 853 <title>Squid Configuration File extract &smbmdash; File: <filename>/etc/squid.conf</filename> [AUTHENTICATION PARAMETERS Section]</title>
 854 <screen>
 855         auth_param ntlm program /usr/bin/ntlm_auth \
 856                                 --helper-protocol=squid-2.5-ntlmssp
 857         auth_param ntlm children 5
 858         auth_param ntlm max_challenge_reuses 0
 859         auth_param ntlm max_challenge_lifetime 2 minutes
 860         auth_param basic program /usr/bin/ntlm_auth \
 861                                 --helper-protocol=squid-2.5-basic
 862         auth_param basic children 5
 863         auth_param basic realm Squid proxy-caching web server
 864         auth_param basic credentialsttl 2 hours
 865         acl AuthorizedUsers proxy_auth REQUIRED
 866         http_access allow all AuthorizedUsers
 867 </screen>
 868 </example>
 869
 870         </sect2>
 871
 872         <sect2>
 873                 <title>Key Points Learned</title>
 874
 875         <para><indexterm>
 876             <primary>Web browsers</primary>
 877           </indexterm><indexterm>
 878             <primary>services</primary>
 879           </indexterm><indexterm>
 880             <primary>authentication protocols</primary>
 881           </indexterm><indexterm>
 882             <primary>Web</primary>
 883             <secondary>proxy</secondary>
 884             <tertiary>access</tertiary>
 885           </indexterm><indexterm>
 886             <primary>NTLMSSP</primary>
 887           </indexterm>
 888                 Microsoft Windows networking protocols permeate the spectrum of technologies that Microsoft
 889                 Windows clients use, even when accessing traditional services such as Web browsers. Depending
 890                 on whom you discuss this with, this is either good or bad. No matter how you might evaluate this,
 891                 the use of NTLMSSP as the authentication protocol for Web proxy access has some advantages over
 892                 the cookie-based authentication regime used by all competing browsers. It is Samba's implementation
 893                 of NTLMSSP that makes it attractive to implement the solution that has been demonstrated in this chapter.
 894                 </para>
 895
 896         </sect2>
 897
 898 </sect1>
 899
 900 <sect1>
 901         <title>Questions and Answers</title>
 902
 903       <para><indexterm>
 904           <primary>ntlm_auth</primary>
 905         </indexterm><indexterm>
 906           <primary>SambaXP conference</primary>
 907         </indexterm><indexterm>
 908           <primary>Goettingen</primary>
 909         </indexterm><indexterm>
 910           <primary>Italian</primary>
 911         </indexterm>
 912         The development of the <command>ntlm_auth</command> module was first discussed in many Open Source circles
 913         in 2002. At the SambaXP conference in Goettingen, Germany, Mr. Francesco Chemolli demonstrated the use of
 914         <command>ntlm_auth</command> during one of the late developer meetings that took place. Since that time, the
 915         adoption of <command>ntlm_auth</command> has spread considerably.
 916         </para>
 917
 918         <para>
 919         The largest report from a site that uses Squid with <command>ntlm_auth</command>-based authentication
 920         support uses a dual processor server that has 2 GBytes of memory. It provides Web and FTP proxy services for 10,000
 921         users. Approximately 2,000 of these users make heavy use of the proxy services. According to the source, who
 922         wishes to remain anonymous, the sustained transaction load on this server hovers around 140 hits/sec. The following
 923         comments were made with respect to questions regarding the performance of this installation:
 924         </para>
 925
 926         <blockquote><para>
 927         [In our] EXTREMELY optimized environment ... [the] performance impact is almost [nothing]. The <quote>almost</quote>
 928         part is due to the brain damage of the ntlm-over-http protocol definition. Suffice to say that its worst-case
 929         scenario triples the number of hits needed to perform the same transactions versus basic or digest auth[entication].
 930         </para></blockquote>
 931
 932         <para>
 933         You would be well advised to recognize the fact that all cache-intensive proxying solutions demand a lot of memory.
 934         Make certain that your Squid proxy server is equipped with sufficient memory to permit all proxy operations to run
 935         out of memory without invoking the overheads involved in the use of memory that has to be swapped to disk.
 936         </para>
 937
 938         <qandaset defaultlabel="chap10bqa" type="number">
 939         <qandaentry>
 940         <question>
 941
 942                 <para>
 943                 What does Samba have to do with Web proxy serving?
 944                 </para>
 945
 946         </question>
 947         <answer>
 948
 949             <para><indexterm>
 950                 <secondary>transparent inter-operability</secondary>
 951               </indexterm><indexterm>
 952                 <primary>Windows clients</primary>
 953               </indexterm><indexterm>
 954                 <primary>network</primary>
 955                 <secondary>services</secondary>
 956               </indexterm><indexterm>
 957                 <primary>authentication</primary>
 958               </indexterm><indexterm>
 959                 <primary>wrapper</primary>
 960               </indexterm>
 961                 To provide transparent interoperability between Windows clients and the network services
 962                 that are used from them, Samba has had to develop tools and facilities that deliver that. The benefit
 963                 of Open Source software is that it can readily be reused. The current <command>ntlm_auth</command>
 964                 module is basically a wrapper around authentication code from the core of the Samba project.
 965                 </para>
 966
 967             <para><indexterm>
 968                 <primary>plain-text</primary>
 969               </indexterm><indexterm>
 970                 <primary>authentication</primary>
 971                 <secondary>plain-text</secondary>
 972               </indexterm><indexterm>
 973                 <primary>Web</primary>
 974                 <secondary>proxy</secondary>
 975               </indexterm><indexterm>
 976                 <primary>FTP</primary>
 977                 <secondary>proxy</secondary>
 978               </indexterm><indexterm>
 979                 <primary>NTLMSSP</primary>
 980               </indexterm><indexterm>
 981                 <primary>logon credentials</primary>
 982               </indexterm><indexterm>
 983                 <primary>Windows explorer</primary>
 984               </indexterm><indexterm>
 985                 <primary>Internet Information Server</primary>
 986               </indexterm><indexterm>
 987                 <primary>Apache Web server</primary>
 988               </indexterm>
 989                 The <command>ntlm_auth</command> module supports basic plain-text authentication and NTLMSSP
 990                 protocols. This module makes it possible for Web and FTP proxy requests to be authenticated without
 991                 the user being interrupted via his/her Windows logon credentials. This facility is available with
 992                 MS Windows explorer and is one of the key benefits claimed for Microsoft Internet Information Server.
 993                 There are a few open source initiatives to provide support for these protocols in the Apache Web server
 994                 also.
 995                 </para>
 996
 997             <para><indexterm>
 998                 <primary>wrapper</primary>
 999               </indexterm>
1000                 The short answer is that by adding a wrapper around key authentication components of Samba, other
1001                 projects (like Squid) can benefit from the labors expended in meeting user interoperability needs.
1002                 </para>
1003
1004         </answer>
1005         </qandaentry>
1006
1007         <qandaentry>
1008         <question>
1009
1010                 <para>
1011                 What other services does Samba provide?
1012                 </para>
1013
1014         </question>
1015         <answer>
1016
1017             <para><indexterm>
1018                 <primary>winbindd</primary>
1019               </indexterm><indexterm>
1020                 <primary>Identity resolver</primary>
1021               </indexterm><indexterm>
1022                 <primary>daemon</primary>
1023               </indexterm><indexterm>
1024                 <primary>smbd</primary>
1025               </indexterm><indexterm>
1026                 <primary>file and print server</primary>
1027               </indexterm>
1028                 Samba-3 is a file and print server. The core components that provide this functionality are <command>smbd</command>,
1029                 <command>nmbd</command>, and the Identity resolver daemon, <command>winbindd</command>.
1030                 </para>
1031
1032             <para><indexterm>
1033                 <primary>SMB/CIFS</primary>
1034               </indexterm><indexterm>
1035                 <primary>smbclient</primary>
1036               </indexterm>
1037                 Samba-3 is an SMB/CIFS client. The core component that provides this is called <command>smbclient</command>.
1038                 </para>
1039
1040             <para><indexterm>
1041                 <primary>modules</primary>
1042               </indexterm><indexterm>
1043                 <primary>utilities</primary>
1044               </indexterm><indexterm>
1045                 <primary>validation</primary>
1046               </indexterm><indexterm>
1047                 <primary>inter-operability</primary>
1048               </indexterm><indexterm>
1049                 <primary>authentication</primary>
1050               </indexterm>
1051                 Samba-3 includes a number of helper tools, plug-in modules, utilities, and test/validation facilities.
1052                 Samba-3 includes glue modules that help provide interoperability between MS Windows clients and UNIX/Linux
1053                 servers and client. It includes Winbind agents that make it possible to authenticate UNIX/Linux access attempts
1054                 as well as logins to an SMB/CIFS authentication server backend. Samba-3 includes name service switcher modules
1055                 to permit Identity resolution via SMB/CIFS servers (Windows NT4/200x, Samba, and a host of other commercial
1056                 server products).
1057                 </para>
1058
1059         </answer>
1060         </qandaentry>
1061
1062         <qandaentry>
1063         <question>
1064
1065                 <para>
1066                 Does use of Samba (<command>ntlm_auth</command>) improve the performance of Squid?
1067                 </para>
1068
1069         </question>
1070         <answer>
1071
1072                 <para>
1073                 Not really. Samba's <command>ntlm_auth</command> module handles only authentication. It requires that
1074                 Squid make an external call to <command>ntlm_auth</command> and, therefore, actually incurs a
1075                 little more overhead. Compared with the benefit obtained, that overhead is well worth enduring. Since
1076                 Squid is a proxy server, and proxy servers tend to require lots of memory, it is good advice to provide
1077                 sufficient memory when using Squid. Just add a little more to accommodate <command>ntlm_auth</command>.
1078                 </para>
1079
1080         </answer>
1081         </qandaentry>
1082         </qandaset>
1083
1084 </sect1>
1085
1086 </chapter>
1087