12:26 a.m.
Hello,
I realize it's a bit late for posting more FC5 wish-list
entries, but I'll try any way in case Santa is still
listening.
I've been researching Linux user-management and
authentication in enterprise environments for a few
months.
I'm quite disappointed by the lack of integration between
the various components, which effectively makes it very
hard to provide a single authentication for intranet users.
This isn't specific to Fedora: no Linux distro I know of
provides a decent solution to this very common problem
(at least, common to any site with 10 or more users).
My current environment looks roughly like this:
- OpenLDAP to store user's information and authentication
data;
- nss_ldap to let all clients share user information;
- Samba with LDAP backend;
- Heimdal's KDC, configured with the LDAP backend.
Heimdal can use NT password hashes as kerberos
authentication info.
(MIT's kerberos does not yet come with it, but I've
read Novell contributed code some time ago);
- pam_krb5 to obtain Kerberos tickets at login time;
- mod_auth_kerb to perform SPNEGO with Apache;
- hacked Firefox configuration on all clients to
enable negotiate-auth for https;
What works:
- Use intranet pages with Konqueror and Firefox from
Fedora and Gentoo clients.
- I can manually request a ticket on MacOS X and use
it with Firefox. Safari is supposed to work, but
it doesn't, for reasons I can't explain.
What's missing:
- I can't get anything to work for Windows 2000 and XP
clients. That would require more integration between
Samba and Heimdal, and perhaps full ADS support.
Hopefully Samba 4 will solve this.
- Some web applications want their own user database
(notably Bugzilla, Mailman and MoinMoin);
- Most web applications use their own cookie-based
authentication method (SquirrelMail, Bugzilla,
Mailman...);
- I couldn't get password-less IMAP to work with
courier-imap because of limited SASL support.
Maybe I'd be more lucky with cyrus-imap, but it
doesn't support Maildirs, so I can't switch;
- NFSv4 with GSSAPI authentication. Many patches from
CITI are still missing in the kernel and in userland.
I found it extremely difficult to get reliable NFS
operation with NFSv4 (but it was two months ago, the
situation may have improved in the meantime);
- Integrated management tools. I've currently settled
with a combination of phpLdapAdmin, ldapvi and
smb-ldaptools, all of which arn't exactly as simple
and quick as traditional UNIX tools (useradd, passwd,
vipw...);
Oh, Santa, please bring me an FC5 with single-signon out
of the box! I promise I'll be a good boy and help fixing
bugs.
--
// Bernardo Innocenti - Develer S.r.l., R&D dept.
\X/ http://www.develer.com/
1:56 a.m.
Bernardo Innocenti wrote:
- Heimdal's KDC, configured with the LDAP backend.
Heimdal can use NT password hashes as kerberos
authentication info.
As of right now, krb5_workstation can authenticate Linux against AD in
exactly the same manner as Windows 2000, XP and 2003 clients - using
Kerberos over TCP for long requests, and weird MS specific encryption
types. All the stuff that MS did to Kerberos is now doable on Unix.
- hacked Firefox configuration on all clients to
enable negotiate-auth for https;
Surprised firefox doesn't support kerberos through GSSAPI or similar as
is. I thought the version in RHEL 4 did - there was a big Kerberos push
for RHEL 4 - are you sure?
- I can't get anything to work for Windows 2000 and XP
clients. That would require more integration between
Samba and Heimdal, and perhaps full ADS support.
Hopefully Samba 4 will solve this.
Yep.
- Some web applications want their own user database
(notably Bugzilla, Mailman and MoinMoin);
A krb5 authing, LDAP using Bugzilla would be great.
- Most web applications use their own cookie-based
authentication method (SquirrelMail, Bugzilla,
Mailman...);
- I couldn't get password-less IMAP to work with
courier-imap because of limited SASL support.
Dovecot supports krb5 IIRC.
- NFSv4 with GSSAPI authentication. Many patches from
CITI are still missing in the kernel and in userland.
I found it extremely difficult to get reliable NFS
operation with NFSv4 (but it was two months ago, the
situation may have improved in the meantime);
Haven't played with this. Have you tried AFS? It's a neater protocol and
has a few large implementations (eg, CSFB) using it on Red Hat like systems.
- Integrated management tools. I've currently settled
with a combination of phpLdapAdmin, ldapvi and
smb-ldaptools, all of which arn't exactly as simple
and quick as traditional UNIX tools (useradd, passwd,
vipw...);
jXplorer from CA is Open Source, good, and may well build on a free java
stack. It's already on the FC5future area of the wiki.
Mike
2:44 a.m.
Mike MacCana wrote:
Bernardo Innocenti wrote:
> - Heimdal's KDC, configured with the LDAP backend.
> Heimdal can use NT password hashes as kerberos
> authentication info.
>
>
As of right now, krb5_workstation can authenticate Linux against AD in
exactly the same manner as Windows 2000, XP and 2003 clients - using
Kerberos over TCP for long requests, and weird MS specific encryption
types. All the stuff that MS did to Kerberos is now doable on Unix.
The thing is, Samba does not yet support acting as an ADS DC,
and I don't have (or want) a W2K domain controller in my
network :-)
Being able to use sambaSamAccount information in Heimdal
is very useful: otherwise I'd have to create separate
krb5 principals for all users and using hacky scripts to
keep passwords in sync between POSIX, Samba and Kerberos.
> - hacked Firefox configuration on all clients to
> enable negotiate-auth for https;
>
Surprised firefox doesn't support kerberos through GSSAPI or similar as
is. I thought the version in RHEL 4 did - there was a big Kerberos push
for RHEL 4 - are you sure?
I didn't rebuild Firefox, I just hacked prefs.js to set:
user_pref("network.negotiate-auth.delegation-uris", "http://,
https://");
user_pref("network.negotiate-auth.trusted-uris", "http://,
https://");
IIRC, Mozilla shipped with FC3 doesn't support it.
Only Firefox does. But who's still using Mozilla anyway?
> - I can't get anything to work for Windows 2000 and XP
> clients. That would require more integration between
> Samba and Heimdal, and perhaps full ADS support.
> Hopefully Samba 4 will solve this.
>
Yep.
Well, I fear Samba 4 will try to act as an LDAP + KDC
to fulfill AD requirements, but without actually using
the real LDAP and Kerberos servers as backends.
> - Some web applications want their own user database
> (notably Bugzilla, Mailman and MoinMoin);
>
>
A krb5 authing, LDAP using Bugzilla would be great.
New versions of Bugzilla can use LDAP for authentication,
but users must still be created in the MySQL database.
(BTW, it doesn't even work automatically once LDAP is
enabled).
> - I couldn't get password-less IMAP to work with
> courier-imap because of limited SASL support.
>
>
Dovecot supports krb5 IIRC.
Last time I checked it, Dovecot was very simple
and lacked many features I needed. I shall try
it again, thanks!
> - NFSv4 with GSSAPI authentication. Many patches from
> CITI are still missing in the kernel and in userland.
> I found it extremely difficult to get reliable NFS
> operation with NFSv4 (but it was two months ago, the
> situation may have improved in the meantime);
>
>
Haven't played with this. Have you tried AFS? It's a neater protocol and
has a few large implementations (eg, CSFB) using it on Red Hat like
systems.
I've played with Arla, but got scared by the apparent
complexity of the server-side installation.
A kernel-based server is also missing, which could make
it too slow as an NFS replacement.
These are, of course, just my assumpions. Reality may
differ :-)
> - Integrated management tools. I've currently settled
> with a combination of phpLdapAdmin, ldapvi and
> smb-ldaptools, all of which arn't exactly as simple
> and quick as traditional UNIX tools (useradd, passwd,
> vipw...);
>
jXplorer from CA is Open Source, good, and may well build on a free java
stack. It's already on the FC5future area of the wiki.
Thank you! Right now I can't get the installer to work
with neither GCJ's VM and Sun's Java 1.5.1 for x86_64.
I'll try harder because I badly needed a GUI replacement
for phpLdapAdmin. Using web interfaces is always very
slow and uncomfortable, even when they did every effort
to make them more usable.
--
// Bernardo Innocenti - Develer S.r.l., R&D dept.
\X/ http://www.develer.com/
4:42 a.m.
On 06/18/2005 03:44 AM, Bernardo Innocenti wrote:
>>- hacked Firefox configuration on all clients to
>> enable negotiate-auth for https;
>>
>
>Surprised firefox doesn't support kerberos through GSSAPI or similar as
>is. I thought the version in RHEL 4 did - there was a big Kerberos push
>for RHEL 4 - are you sure?
I didn't rebuild Firefox, I just hacked prefs.js to set:
user_pref("network.negotiate-auth.delegation-uris", "http://,
https://");
user_pref("network.negotiate-auth.trusted-uris", "http://,
https://");
IIRC, Mozilla shipped with FC3 doesn't support it.
Only Firefox does. But who's still using Mozilla anyway?
Mozilla had this support far longer than Firefox did. They share the
exact same code here really.
Who's still using Mozilla? Anyone using Epiphany ;-)
6:25 a.m.
>> - I couldn't get password-less IMAP to work with
>> courier-imap because of limited SASL support.
>>
>>
> Dovecot supports krb5 IIRC.
Last time I checked it, Dovecot was very simple
and lacked many features I needed. I shall try
it again, thanks!
There's also Cyrus-IMAP which support GSSAPI auth and is pretty powerful.
2:10 a.m.
On Sat, 2005-06-18 at 07:26 +0200, Bernardo Innocenti wrote:
- I couldn't get password-less IMAP to work with
courier-imap because of limited SASL support.
Maybe I'd be more lucky with cyrus-imap, but it
doesn't support Maildirs, so I can't switch;
Passwordless IMAP works for me. Try invoking courier or dovecot over an
SSH login. Evolution and mutt at least can run 'ssh $server exec imapd'
instead of trying to make a TCP connection to the imap server and then
authenticating to it.
--
dwmw2
2:48 a.m.
David Woodhouse wrote:
On Sat, 2005-06-18 at 07:26 +0200, Bernardo Innocenti wrote:
> - I couldn't get password-less IMAP to work with
> courier-imap because of limited SASL support.
> Maybe I'd be more lucky with cyrus-imap, but it
> doesn't support Maildirs, so I can't switch;
Passwordless IMAP works for me. Try invoking courier or dovecot over an
SSH login. Evolution and mutt at least can run 'ssh $server exec imapd'
instead of trying to make a TCP connection to the imap server and then
authenticating to it.
Nice hack! I'm afraid neither Thunderbird and KMail
can't do that.
By the way, does Thunderbird even support anything besides
password logins? I'd prefer not to force users to switch
to another MUA, expecially on Windows clients.
--
// Bernardo Innocenti - Develer S.r.l., R&D dept.
\X/ http://www.develer.com/
4:29 a.m.
On 06/18/2005 01:26 AM, Bernardo Innocenti wrote:
- hacked Firefox configuration on all clients to
enable negotiate-auth for https;
Firefox already ships with this support. However, you must whitelist
the sites you wish to authenticate with. See
https://bugzilla.mozilla.org/show_bug.cgi?id=237586#c24 for the details
and reasoning.
4:58 a.m.
lör 2005-06-18 klockan 07:26 +0200 skrev Bernardo Innocenti:
- Heimdal's KDC,
I have Heimdal and Arla RPM:s that I've been meaning to try to get into
Extras. See http:/ayo.sys.kth.se/kth/linux/4/i386/krbafs/ . (Binaries
for RHEL4, but the SRPMS works with FC3 at least.)
configured with the LDAP backend.
I don't know how that works but I must say I'm very sceptical, mostly
from a security standpoint. What's the advantage of doing it that way?
- I couldn't get password-less IMAP to work with
courier-imap because of limited SASL support.
Maybe I'd be more lucky with cyrus-imap
Cyrus-IMAPd + Heimdal and Evolution + MIT-KRB play along nicely.
/abo
5:01 a.m.
tis 2005-06-21 klockan 11:58 +0200 skrev Alexander Boström:
lör 2005-06-18 klockan 07:26 +0200 skrev Bernardo Innocenti:
> - Heimdal's KDC,
I have Heimdal and Arla RPM:s that I've been meaning to try to get into
Extras. See http:/ayo.sys.kth.se/kth/linux/4/i386/krbafs/ . (Binaries
for RHEL4, but the SRPMS works with FC3 at least.)
Or http://www.stacken.kth.se/projekt/arla/redhat.html
/abo
7:35 p.m.
Alexander Boström wrote:
tis 2005-06-21 klockan 11:58 +0200 skrev Alexander Boström:
>lör 2005-06-18 klockan 07:26 +0200 skrev Bernardo Innocenti:
>
>
>> - Heimdal's KDC,
>
>I have Heimdal and Arla RPM:s that I've been meaning to try to get into
>Extras. See http:/ayo.sys.kth.se/kth/linux/4/i386/krbafs/ . (Binaries
>for RHEL4, but the SRPMS works with FC3 at least.)
Or http://www.stacken.kth.se/projekt/arla/redhat.html
I hope these packages can at least get in extras.
I was lucky enough to find them by googling around.
SuSE 9.x shipped with Heimdal 0.6.x instead of
MIT's Kerberos.
Now it seems in SuSE 9.3 they've reverted to MIT.
I don't know why they did that, but I'd like to check
their RPM source package to see if they added those
Novell patches for NT compatibility.
I've seen some slides where these enhancements were
mentioned as important missing bits towards full
ActiveDirectory controller support in Samba.
--
// Bernardo Innocenti - Develer S.r.l., R&D dept.
\X/ http://www.develer.com/
10:11 a.m.
>>>> "AB" == Alexander Boström
<abo(a)kth.se> writes:
AB> I don't know how that works but I must say I'm very sceptical,
AB> mostly from a security standpoint. What's the advantage of doing
AB> it that way?
A single replication infrastructure. I use the MIT KDC because it's
what Red Hat happens to ship, but I'd much rather have everything in
LDAP instead of having two separate systems to configure and maintain.
- J<
3:49 a.m.
On Tue, 2005-06-21 at 10:11 -0500, Jason L Tibbitts III wrote:
>>>>> "AB" == Alexander Boström
<abo(a)kth.se> writes:
AB> I don't know how that works but I must say I'm very sceptical,
AB> mostly from a security standpoint. What's the advantage of doing
AB> it that way?
A single replication infrastructure. I use the MIT KDC because it's
what Red Hat happens to ship, but I'd much rather have everything in
LDAP instead of having two separate systems to configure and maintain.
So Heimdal can use an LDAP data store? Sweet. Thanks so much for your
post.
I've wanted MIT krb5 to do this (in a non hacky way) for ages.
Can Heimdal do Kerberos over TCP, and does it support MS specific
encryption types, like MIT Kerberos does?
Mike
5:13 a.m.
Mike MacCana wrote:
On Tue, 2005-06-21 at 10:11 -0500, Jason L Tibbitts III wrote:
>>>>>>"AB" == Alexander Boström <abo(a)kth.se> writes:
>>>>>>
>>>>>>
>AB> I don't know how that works but I must say I'm very sceptical,
>AB> mostly from a security standpoint. What's the advantage of doing
>AB> it that way?
>
>A single replication infrastructure. I use the MIT KDC because it's
>what Red Hat happens to ship, but I'd much rather have everything in
>LDAP instead of having two separate systems to configure and maintain.
>
>
So Heimdal can use an LDAP data store? Sweet. Thanks so much for your
post.
I've wanted MIT krb5 to do this (in a non hacky way) for ages.
A data abstraction layer (DAL) patch that does just that has been just
been committed to the cvs of MIT KDC.
Can Heimdal do Kerberos over TCP, and does it support MS specific
encryption types, like MIT Kerberos does?
Quoted from heimdal.info:
Encryption types
================
Windows 2000 supports both the standard DES encryptions (des-cbc-crc and
des-cbc-md5) and its own proprietary encryption that is based on MD4 and
rc4 that is documented in and is supposed to be described in
`draft-brezak-win2k-krb-rc4-hmac-03.txt'. New users will get both MD4
and DES keys. Users that are converted from a NT4 database, will only
have MD4 passwords and will need a password change to get a DES key.
Heimdal implements both of these encryption types, but since DES is the
standard and the hmac-code is somewhat newer, it is likely to work
better.
Also I believe heimdal can (or will be able to) use the LDAP attribute
"sambaNTPassword" as a arcfour-hmac-md5 kerberos key. I haven't tried
MIT KDC+DAL (or heimdal for that matter) but I guess that the raison
d'être of DAL being its possible use alongside future versions of samba,
it's likely to support the same feature.
In a related note, my hardest headache is renewing keys for users that
have home directories access via NFS4+krb5. We could not get
"gnome-kerberos" or "xscreensaver" to do it, so we keep a terminal
window open so that kinit can be run there. Am I missing something?
Also is the new kernel keyring facility planned for FC5 inclusion?
8:10 p.m.
Charles Lopes wrote:
> So Heimdal can use an LDAP data store? Sweet. Thanks so much for
your
> post. I've wanted MIT krb5 to do this (in a non hacky way) for ages.
>
>
A data abstraction layer (DAL) patch that does just that has been just
been committed to the cvs of MIT KDC.
I just did a "cvs update" from MIT's repository and... yes!
Now it's there.
But where is the LDAP backend? Does one exist yet? Does it work
already? Is it compatible is it with Heimdal's hdb.schema?
(ok, too many questions :-)
Also I believe heimdal can (or will be able to) use the LDAP
attribute
"sambaNTPassword" as a arcfour-hmac-md5 kerberos key. I haven't tried
MIT KDC+DAL (or heimdal for that matter) but I guess that the raison
d'être of DAL being its possible use alongside future versions of samba,
it's likely to support the same feature.
Looking at Samba 4 sources, and reading around posts by
Andrew Tridgell, it seems the focus for Samba isn't to
interoperate with OpenLDAP and Heimdal (or MIT).
Instead, they're integrating some parts of Heimdal and rewriting
a lightweight LDAP server with as much functionality as it's
needed for ADS support.
Andrew says that 99% of sites just want to get the ActiveDirectory
domain controller to work and don't know or care anything about
full blown Kerberos and LDAP servers.
I think he's basically right, altough I'm one of those 1% users
who would be hit by this route of action.
In a related note, my hardest headache is renewing keys for users
that
have home directories access via NFS4+krb5. We could not get
"gnome-kerberos" or "xscreensaver" to do it, so we keep a terminal
window open so that kinit can be run there. Am I missing something?
So someone actually got NFS4 + GSSAPI to work!!! Could you please
elaborate? I went through applying CITI's kernel and userland
patches, with very little luck.
Also is the new kernel keyring facility planned for FC5 inclusion?
Shouldn't that patch first be submitted to a kernel maintainer?
Last time I checked, outstanding NFSv4 patches were (slowly)
being included in official kernels through -mm.
--
// Bernardo Innocenti - Develer S.r.l., R&D dept.
\X/ http://www.develer.com/
8:35 p.m.
>>>> "BI" == Bernardo Innocenti
<bernie(a)develer.com> writes:
[kernel keyring]
BI> Shouldn't that patch first be submitted to a kernel maintainer?
As far as I know it already has. But Red Hat has many times in the
past been known to incorporate locally-developed bits previous to
their inclusion in the mainline kernel.
- J<
5:52 a.m.
Bernardo Innocenti wrote:
Charles Lopes wrote:
>>So Heimdal can use an LDAP data store? Sweet. Thanks so much for your
>>post. I've wanted MIT krb5 to do this (in a non hacky way) for ages.
>>
>>
>>
>>
>A data abstraction layer (DAL) patch that does just that has been just
>been committed to the cvs of MIT KDC.
>
>
I just did a "cvs update" from MIT's repository and... yes!
Now it's there.
But where is the LDAP backend? Does one exist yet? Does it work
already? Is it compatible is it with Heimdal's hdb.schema?
(ok, too many questions :-)
I checked the cvs and the code imported after the tag
trunk-before-novell-dal-merge seems to be about thread support. I guess
it's only the first part of the code.
>Also I believe heimdal can (or will be able to) use the LDAP attribute
>"sambaNTPassword" as a arcfour-hmac-md5 kerberos key. I haven't tried
>MIT KDC+DAL (or heimdal for that matter) but I guess that the raison
>d'être of DAL being its possible use alongside future versions of samba,
>it's likely to support the same feature.
>
>
Looking at Samba 4 sources, and reading around posts by
Andrew Tridgell, it seems the focus for Samba isn't to
interoperate with OpenLDAP and Heimdal (or MIT).
Instead, they're integrating some parts of Heimdal and rewriting
a lightweight LDAP server with as much functionality as it's
needed for ADS support.
Andrew says that 99% of sites just want to get the ActiveDirectory
domain controller to work and don't know or care anything about
full blown Kerberos and LDAP servers.
I think he's basically right, altough I'm one of those 1% users
who would be hit by this route of action.
I seem to remember some discussion about the fear of forking heimdal and
how the import of its code in samba4 was going to be temporary. That
position must have changed then.
>In a related note, my hardest headache is renewing keys for users
that
>have home directories access via NFS4+krb5. We could not get
>"gnome-kerberos" or "xscreensaver" to do it, so we keep a
terminal
>window open so that kinit can be run there. Am I missing something?
>
>
So someone actually got NFS4 + GSSAPI to work!!! Could you please
elaborate? I went through applying CITI's kernel and userland
patches, with very little luck.
I didn't have to apply any patches to get it working, although I had to
edit /etc/gssapi_mech.conf and change /usr/lib/libgssapi_krb5.so into
/usr/lib/libgssapi_krb5.so.2 (bug #151251). The rest seems to work out
of the box if you have the proper keys in /etc/krb5.keytab and
SECURE_NFS=y in /etc/sysinit/nfs.
It's only recently that I picked up the CITI kernel patches to see if
they would fix the frequent rpciod freezes I have been experiencing with
kernel 2.6.11-1.1369_FC4. And indeed, they seem to have fixed that problem.
Just out of curiousity, are there any further patches for nfs-utils that
are not included in FC3/4? If so what do they do?
>Also is the new kernel keyring facility planned for FC5
inclusion?
>
>
Shouldn't that patch first be submitted to a kernel maintainer?
Last time I checked, outstanding NFSv4 patches were (slowly)
being included in official kernels through -mm.
Indeed, that's why I was asking. I guess I really meant to ask if anyone
knew if it was going to be mature enough to be included upstream before
FC5 was out.
7:43 p.m.
Mike MacCana wrote:
On Tue, 2005-06-21 at 10:11 -0500, Jason L Tibbitts III wrote:
>A single replication infrastructure. I use the MIT KDC because it's
>what Red Hat happens to ship, but I'd much rather have everything in
>LDAP instead of having two separate systems to configure and maintain.
So Heimdal can use an LDAP data store? Sweet. Thanks so much for your
post.
Works fine here, except Heimdal keeps creating its krb5Principal
under the root node instead of folding them into ou=KerberosPrincipals
as I told in the config file.
I've wanted MIT krb5 to do this (in a non hacky way) for ages.
Novell says they've contributed this to MIT, but I can't
see it in their CVS repository yet.
Can Heimdal do Kerberos over TCP, and does it support MS specific
encryption types, like MIT Kerberos does?
A quick check with netstat appears to confirm it also
listens to TCP ports.
MS encryptation support is the main reason I switched to
Heimdal. I thought MIT still refused to add Microsoft's
"extensions" for ethical reasons... I'm surprised to hear
they're now implemented.
But what I like the most about Heimdal is that kadmin
uses readline for proper history and line editing support.
and also uses nicer names for commands :-)
--
// Bernardo Innocenti - Develer S.r.l., R&D dept.
\X/ http://www.develer.com/
4:48 a.m.
tis 2005-06-21 klockan 10:11 -0500 skrev Jason L Tibbitts III:
A single replication infrastructure. I use the MIT KDC because
it's
what Red Hat happens to ship, but I'd much rather have everything in
LDAP instead of having two separate systems to configure and maintain.
You'd still need as many servers and services, but add more dependencies
between them, right?
Anyway, I'm not sure that I'm the right person and this is the right
place to discuss this, but lets just say that in the unlikely(?) event
that Fedora would actually include Heimdal, enabling the LDAP backend by
default should not be done without careful consideration.
/abo
7:28 p.m.
Alexander Boström wrote:
> - Heimdal's KDC,
I have Heimdal and Arla RPM:s that I've been meaning to try to get into
Extras. See http:/ayo.sys.kth.se/kth/linux/4/i386/krbafs/ . (Binaries
for RHEL4, but the SRPMS works with FC3 at least.)
I tried ARLA's Heimdal binaries before building it
from sources, but they were built without the LDAP
backend or something like that.
By the way, integrating Heimdal in Fedora isn't
as trivial as I had guessed. Heimdal's libkrb5
doesn't appear to be binary compatible with the
MIT version, and many libraries such as libkrb5support
and libgssapi_krb5 don't even exist.
Heimdal uses a few encryptations that clients linked
against the MIT libraries don't seem to support.
Actually, I'm not sure how to fix this as I couldn't
find clear documentation about supported encryptation
methods and how to configure the server and client
side to negotiate a commonly supported method.
Maybe I just need to study Kerberos a bit harder.
> configured with the LDAP backend.
I don't know how that works but I must say I'm very sceptical, mostly
from a security standpoint. What's the advantage of doing it that way?
The main advantage is that you can add/remove/edit
an user account and its associated security information
from a single place.
I was also pleased to discover that Heimdal can (ab)use
NT hashes stored in sambaSamAccount objects, so I can
just use "smbpasswd" or even Windows tools to edit
POSIX, Samba and Kerberos passphrases at the same time.
Security is just as bad as letting Samba access the
LDAP database. I' musing the ldapi:// method with
a socket accessible to root only. I prefer this
over storing the LDAP manager password in a secret
file, although ldapi doesn't allow me to split Samba,
LDAP and KDC on different servers.
Using SASL GSSAPI wouldn't be an option, as Kerberos
can't use itself to authenticate to the LDAP service :-)
> - I couldn't get password-less IMAP to work with
> courier-imap because of limited SASL support.
> Maybe I'd be more lucky with cyrus-imap
Cyrus-IMAPd + Heimdal and Evolution + MIT-KRB play along nicely.
I use qmail as an MTA, and last time I checked cyrus-imapd
didn't support Maildir.
--
// Bernardo Innocenti - Develer S.r.l., R&D dept.
\X/ http://www.develer.com/
6882
days inactive
6887
days old
21 comments
8 participants
participants (8)
-
Alexander Boström -
Bernardo Innocenti -
Charles Lopes -
Christopher Aillon -
David Woodhouse -
Felipe Alfaro Solana -
Jason L Tibbitts III -
Mike MacCana