Possibilities for using winbind libs with Samba < 4.2.1
This question is mainly for Matthew, since he is the author of auth_wbclient.c. I just tried to use that on our Debian systems, but then I saw that Samba version 4.2.1 was required. It seems that this version introduced the used method wbcCtxAuthenticateUserEx. Older versions (4.1.something on the current Debian stable) do however have a wbcAuthenticateUserEx, that looks like it does about the same thing, but without the context-object that the first method uses. Is there a specific reason that you used the functionality from Samba 4.2.1, or do you think it could be possible to make it work with older versions of Samba as well? I'm more than willing to actually write the code myself, but maybe you had already concluded that it won't be possible to make it work with older versions, than it would be a waste of time to try to make it work. -- Herwin Weststrate
On 8 Dec 2015, at 08:39, Herwin Weststrate <herwin@quarantainenet.nl> wrote:
This question is mainly for Matthew, since he is the author of auth_wbclient.c. I just tried to use that on our Debian systems, but then I saw that Samba version 4.2.1 was required. It seems that this version introduced the used method wbcCtxAuthenticateUserEx. Older versions (4.1.something on the current Debian stable) do however have a wbcAuthenticateUserEx, that looks like it does about the same thing, but without the context-object that the first method uses.
Is there a specific reason that you used the functionality from Samba 4.2.1, or do you think it could be possible to make it work with older versions of Samba as well? I'm more than willing to actually write the code myself, but maybe you had already concluded that it won't be possible to make it work with older versions, than it would be a waste of time to try to make it work.
Threading issues I believe? -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Hi, On Tue, Dec 08, 2015 at 02:39:54PM +0100, Herwin Weststrate wrote:
This question is mainly for Matthew, since he is the author of auth_wbclient.c. I just tried to use that on our Debian systems, but then I saw that Samba version 4.2.1 was required. It seems that this version introduced the used method wbcCtxAuthenticateUserEx. Older versions (4.1.something on the current Debian stable) do however have a wbcAuthenticateUserEx, that looks like it does about the same thing, but without the context-object that the first method uses.
Yes... I also wrote wbcCtxAuthenticateUserEx and friends for Samba. See https://bugzilla.samba.org/show_bug.cgi?id=11149
Is there a specific reason that you used the functionality from Samba 4.2.1, or do you think it could be possible to make it work with older versions of Samba as well?
Yes, by adding the patches in that bug report. Should apply easily to all 4.x versions.
I'm more than willing to actually write the code myself, but maybe you had already concluded that it won't be possible to make it work with older versions, than it would be a waste of time to try to make it work.
It won't work without those patches (i.e. you can't change FR to call wbcAuthenticateUserEx) unless you a) make mschap non-threaded (which rather defeats the point of this code) b) expect lots of auths to fail or FR to crash because the threads stomp on each other. Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
On 08-12-15 15:02, Matthew Newton wrote:
Yes, by adding the patches in that bug report. Should apply easily to all 4.x versions.
Well, that would defy my (unwritten) purpose of keeping the system as much debian-stock as possible. Instead of recompiling a 4.1.something with those changes, I could as well use a more recent version of Samba directly (which would probably be less work).
It won't work without those patches (i.e. you can't change FR to call wbcAuthenticateUserEx) ...
Then I won't try to waste my time on trying that. Thanks for the info -- Herwin Weststrate
On Tue, Dec 08, 2015 at 03:24:00PM +0100, Herwin Weststrate wrote:
On 08-12-15 15:02, Matthew Newton wrote:
Yes, by adding the patches in that bug report. Should apply easily to all 4.x versions.
Well, that would defy my (unwritten) purpose of keeping the system as much debian-stock as possible. Instead of recompiling a 4.1.something with those changes, I could as well use a more recent version of Samba directly (which would probably be less work).
We run Debian here and I'm in exactly the same position. My choices have been to compile Samba locally and put in /opt or to try and use 4.3.x from Debian experimental. Former works fine but is just a bit messy (local init scripts really). Latter is horrible in terms of package dependencies as it wants to upgrade the whole system. Samba 4.3.x from experimental won't compile cleanly on stable (build dependencies - official Samba releases compile fine). I hadn't thought of patching Debian's Samba version and building packages of that - would actually be the cleanest way. It's not as if Samba itself is being used really anyway. All we want are winbind and libwbclient. If there's a critical Samba vulnerability then the immediate fix is to update to latest Debian Samba and drop back to ntlm_auth, then to patch and rebuild locally at leisure. FWIW, so far since upgrading our RADIUS server hardware in October we haven't seen any issues with ntlm_auth... whether this is good or bad, I'm not sure! Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi,
Well, that would defy my (unwritten) purpose of keeping the system as much debian-stock as possible. Instead of recompiling a 4.1.something with those changes, I could as well use a more recent version of Samba directly (which would probably be less work).
exactly. just build latest samba - and in fact, go with 4.3.0 anyway as the latest stable release - be up to date for once instead of 2 years behind. there should be Debian PPAs for latest samba lurking around somewhere anyway alan
On Dec 8, 2015, at 2:14 PM, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
Well, that would defy my (unwritten) purpose of keeping the system as much debian-stock as possible. Instead of recompiling a 4.1.something with those changes, I could as well use a more recent version of Samba directly (which would probably be less work).
exactly. just build latest samba - and in fact, go with 4.3.0 anyway as the latest stable release - be up to date for once instead of 2 years behind.
there should be Debian PPAs for latest samba lurking around somewhere anyway
I looked a couple of weeks ago and there wasn't. I wanted to try and build some test cases, and see if we could get group info via this interface. -Arran
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Arran Cudbard-Bell -
Herwin Weststrate -
Matthew Newton