Issue setting up FreeIPA and Samba

[Robert Byrne]

Hi,

I am trying to setup FreeIPA to authenticate users logging into Linux systems, but would
also like to use this to authenticate users accessing Samba shares from Windows clients.
The problem is that I cannot access the shares at all from Windows clients and when I try
to access a share from a Linux client, the following error message is printed:

  robert@workstation 14:13:09 > smbclient //192.168.0.xx/samba -U robert
  WARNING: The "syslog" option is deprecated
  krb5_init_context failed (Invalid argument)
  smb_krb5_context_init_basic failed (Invalid argument)
  Enter WORKGROUP\robert's password: 
  krb5_init_context failed (Invalid argument)
  smb_krb5_context_init_basic failed (Invalid argument)
  session setup failed: NT_STATUS_LOGON_FAILURE

Information regarding the setup:

- The FreeIPA + Samba server (samba.linux.company.local) is a VM running CentOS 7. The
FreeIPA version is "VERSION: 4.5.4, API_VERSION: 2.228". The Samba version is
4.7.1.
- The firewalls on the server, VM host and clients are turned off for debugging purposes.
- SELINUX is also turned off.
- This was a fresh install and FreeIPA was setup with the following commands:

  sudo yum install ipa-server
  sudo ipa-server-install

  Do you want to configure integrated DNS (BIND)? [no]: no
  Server host name [ipa.company.local]: samba.linux.company.local
  Please confirm the domain name [company.local]: samba.linux.company.local
  Please provide a realm name [SAMBA.COMPANY.LOCAL]: SAMBA.LINUX.COMPANY.LOCAL

- The users can log into the Linux workstations that have been enrolled, suggesting that
the setup is at least partly correct.

The Windows clients are not enrolled into the FreeIPA domain and are instead in the domain
company.local. I followed the instructions here
(https://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_I...) with
the following options:

  yum install ipa-server-trust-ad
  sudo ipa-adtrust-install

  Enable trusted domains support in slapi-nis? [no]: no
  NetBIOS domain name [LINUX]: LINUX
  Do you want to run the ipa-sidgen task? [no]: yes

Followed by:

  sudo mkdir /samba
  sudo chmod 777 /samba
  sudo net conf addshare samba /samba writeable=y guest_ok=n
  sudo systemctl restart smb

Running sudo net conf list produces the following output:

[global]
	workgroup = LINUX
	netbios name = SAMBA
	realm = LINUX.COMPANY.LOCAL
	kerberos method = dedicated keytab
	dedicated keytab file = /etc/samba/samba.keytab
	create krb5 conf = no
	security = user
	domain master = yes
	domain logons = yes
	log level = 1
	max log size = 100000
	log file = /var/log/samba/log.%m
	passdb backend = ipasam:ldapi://%2fvar%2frun%2fslapd-LINUX-COMPANY-LOCAL.socket
	disable spoolss = yes
	ldapsam:trusted = yes
	ldap ssl = off
	ldap suffix = dc=linux,dc=company,dc=local
	ldap user suffix = cn=users,cn=accounts
	ldap group suffix = cn=groups,cn=accounts
	ldap machine suffix = cn=computers,cn=accounts
	rpc_server:epmapper = external
	rpc_server:lsarpc = external
	rpc_server:lsass = external
	rpc_server:lsasd = external
	rpc_server:samr = external
	rpc_server:netlogon = external
	rpc_server:tcpip = yes
	rpc_daemon:epmd = fork
	rpc_daemon:lsasd = fork

[samba]
	path = /samba
	guest ok = yes
	read only = no

When I try to mount the share on Windows clients (either with \\192.168.0.xx\samba or
\\samba.linux.company.local in Explorer) it states that 'The user name or password is
incorrect.' I am not convinced that this is the case, however, since the same message
is displayed even if the share is created with the option 'guest_ok=y'.

If I try to mount the 'guest_ok=y' share from a Linux client in the FreeIPA realm,
I at least get an error message:

  robert@workstation 14:13:09 > smbclient //192.168.0.xx/samba -U username
  WARNING: The "syslog" option is deprecated
  krb5_init_context failed (Invalid argument)
  smb_krb5_context_init_basic failed (Invalid argument)
  Enter LINUX\robert's password: 
  krb5_init_context failed (Invalid argument)
  smb_krb5_context_init_basic failed (Invalid argument)
  session setup failed: NT_STATUS_LOGON_FAILURE

Under both Windows and Linux I have tried all combinations of domain (LINUX, SAMBA,
WORKGROUP) and various user that I can think of, but with no success.

Does anyone have an idea what the issue might be? I previously created the above setup on
a pair of VMs and everything worked as expected, but am having difficulty reproducing it
here....

Many thanks in advance for any help and suggestions! Please let me know if you need any
more information.

Rob

[Alexander Bokovoy]

On to, 29 marras 2018, Robert Byrne via FreeIPA-users wrote:
> Hi,
>
> I am trying to setup FreeIPA to authenticate users logging into Linux
> systems, but would also like to use this to authenticate users
> accessing Samba shares from Windows clients. The problem is that I
> cannot access the shares at all from Windows clients and when I try to
> access a share from a Linux client, the following error message is
> printed: 
We do not support this yet. Mounting shares from Windows requires
Windows applications to look up user and groups via Global Catalog
service on the side of the domain where share belongs to (IPA). As we do
not provide GC service, Windows clients fail.

As to the other direction, there are known bugs too. I recently outlined
some of them on samba-technical@ --
https://lists.samba.org/archive/samba-technical/2018-November/131274.html

-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[Robert Byrne]

Hi,

A belated thanks for the reply and I seem to have solved the problem. The cause might have
been obvious to others, but I will describe it here briefly in case it helps others:

- We have a FreeIPA server and this exports a number of directories by Samba. FreeIPA was
setup as described above and Samba as described here
(https://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_I...).
- There is no trust with the Windows domain / AD. Some of the users are also using OSX.
- FreeIPA users were unable to mount the Samba shares if they entered
\\samba.linux.company.local\samba_share_name in e.g. Windows Explorer.
- The issue was that I had changed the users' UIDs and GIDs from those automatically
assigned by the Web UI to their current values to aid migration. The values were then
outside of the local domain range defined in the IPA server > ID ranges tab of the Web
UI. As soon as this range was changed (in my case through reinstalling FreeIPA server with
the option "--idstart=2000") the users could mount the shares from Windows.

A bit frustrating, but still a lot easier than setting up LDAP even without Samba! :-)

Somewhat off-topic. Does anyone know if the connection between the clients (Windows or
OSX) and the FreeIPA/Samba server is encrypted or how I could find this out? This is the
output of 'net conf list':

[global]
	workgroup = LINUX
	netbios name = IPA
	realm = LINUX.CRELUX.LOCAL
	kerberos method = dedicated keytab
	dedicated keytab file = /etc/samba/samba.keytab
	create krb5 conf = no
	security = user
	domain master = yes
	domain logons = yes
	log level = 1
	max log size = 100000
	log file = /var/log/samba/log.%m
	passdb backend = ipasam:ldapi://%2fvar%2frun%2fslapd-LINUX-CRELUX-LOCAL.socket
	disable spoolss = yes
	ldapsam:trusted = yes
	ldap ssl = off
	ldap suffix = dc=linux,dc=crelux,dc=local
	ldap user suffix = cn=users,cn=accounts
	ldap group suffix = cn=groups,cn=accounts
	ldap machine suffix = cn=computers,cn=accounts
	rpc_server:epmapper = external
	rpc_server:lsarpc = external
	rpc_server:lsass = external
	rpc_server:lsasd = external
	rpc_server:samr = external
	rpc_server:netlogon = external
	rpc_server:tcpip = yes
	rpc_daemon:epmd = fork
	rpc_daemon:lsasd = fork

I guess from the line 'ldap ssl = off' that the user credentials are being sent in
plain-text. Is this correct?

Best regards,
Rob

[Alexander Bokovoy]

On ke, 05 joulu 2018, Robert Byrne via FreeIPA-users wrote:
> Hi,
>
> A belated thanks for the reply and I seem to have solved the problem. The cause might have
> been obvious to others, but I will describe it here briefly in case it helps others:
>
> - We have a FreeIPA server and this exports a number of directories by Samba. FreeIPA was
> setup as described above and Samba as described here
> (https://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_I...).
> - There is no trust with the Windows domain / AD. Some of the users are also using OSX.
> - FreeIPA users were unable to mount the Samba shares if they entered
> \\samba.linux.company.local\samba_share_name in e.g. Windows Explorer.
> - The issue was that I had changed the users' UIDs and GIDs from those automatically
> assigned by the Web UI to their current values to aid migration. The values were then
> outside of the local domain range defined in the IPA server > ID ranges tab of the Web
> UI. As soon as this range was changed (in my case through reinstalling FreeIPA server with
> the option "--idstart=2000") the users could mount the shares from Windows.
>
> A bit frustrating, but still a lot easier than setting up LDAP even without Samba! :-)
>
> Somewhat off-topic. Does anyone know if the connection between the clients (Windows or
> OSX) and the FreeIPA/Samba server is encrypted or how I could find this out? This is the
> output of 'net conf list':
>
> [global]
> 	workgroup = LINUX
> 	netbios name = IPA
> 	realm = LINUX.CRELUX.LOCAL
> 	kerberos method = dedicated keytab
> 	dedicated keytab file = /etc/samba/samba.keytab
> 	create krb5 conf = no
> 	security = user
> 	domain master = yes
> 	domain logons = yes
> 	log level = 1
> 	max log size = 100000
> 	log file = /var/log/samba/log.%m
> 	passdb backend = ipasam:ldapi://%2fvar%2frun%2fslapd-LINUX-CRELUX-LOCAL.socket
> 	disable spoolss = yes
> 	ldapsam:trusted = yes
> 	ldap ssl = off
> 	ldap suffix = dc=linux,dc=crelux,dc=local
> 	ldap user suffix = cn=users,cn=accounts
> 	ldap group suffix = cn=groups,cn=accounts
> 	ldap machine suffix = cn=computers,cn=accounts
> 	rpc_server:epmapper = external
> 	rpc_server:lsarpc = external
> 	rpc_server:lsass = external
> 	rpc_server:lsasd = external
> 	rpc_server:samr = external
> 	rpc_server:netlogon = external
> 	rpc_server:tcpip = yes
> 	rpc_daemon:epmd = fork
> 	rpc_daemon:lsasd = fork
>
> I guess from the line 'ldap ssl = off' that the user credentials are being sent in
> plain-text. Is this correct? 
passdb backend is set to use 'ipasam' module
with LDAPI protocol which
is LDAP over Unix domain socket. It doesn't use SSL but instead uses
GSSAPI for authentication and signing. So first, the data is not sent
over network, only between two daemons on the same machine over a UNIX
domain socket. And second, the channel set up with GSSAPI and it is
encrypted even for that UNIX domain socket.

Use of 'ldap ssl = off' is to avoid hitting the code paths in Samba that
require to handle certificate for the case where they are not needed at
all.

Hope this helps.
-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

Vault feature for AD users

[Ronald Wimmer]

Is there any possibility to use the vault feature for external (AD) users?