Freeradius Multiple Disjoint Ad Domains
Hi , Before I begin I would like to apologise that this is not really a FR issue but the Samba community has been less than helpful in responding hence hoping in the collective knowledge of this list I can get some pointers. We have a situation where we have 2 AD domains which are running across two complete separate AD domains i.e. no trust. Because of political reasons they cannot establish a trust. I have been able to get multiple instances of winbindd running with separate smb.conf's and joined to the respective AD domains. The problem seems to be ntlm_auth doesnt see that the winbindd privileged pipe and winbindd socket is running in a custom directory. I know what to do in the FR side .. Just wondering anyone has any experience with this kind of setup. Once I can get the ntlm_auth to work I can than finish off the rest of the FR config. My SMB config looks like follows: Winbindd_A server string = Samba Server Domain A hosts allow = 127. log file = /var/log/samba/log-DOMAINA.%m log level = 3 max log size = 50 security = ads encrypt passwords = yes passdb backend = tdbsam load printers = no cups options = raw printcap name = /dev/null allow trusted domains = yes interfaces=172.21.8.250 bind interfaces only = yes WORKGROUP=DOMAINA-NETWORKS REALM=DOMAINA-networks.com pid directory = /var/run/samba/DOMAINA-networks lock directory = /var/cache/samba/DOMAINA-networks private dir = /var/cache/samba/DOMAINA-networks winbindd socket directory = /var/cache/samba/DOMAINA-networks winbindd privileged socket directory = /var/cache/samba/DOMAINA-networks/winbindd_privileged smb passwd file = /var/cache/samba/DOMAINA-networks state directory = /var/cache/samba/DOMAINA-networks cache directory = /var/cache/samba/DOMAINA-networks usershare path = /var/cache/samba/DOMAINA-networks ntp signd socket directory = /var/cache/samba/DOMAINA-networks winbindd_B server string = Samba Server Domain B hosts allow = 127. log file = /var/log/samba/log-DOMAINB.%m log level = 3 max log size = 50 security = ads encrypt passwords = yes passdb backend = tdbsam load printers = no cups options = raw printcap name = /dev/null allow trusted domains = yes interfaces=172.21.8.250 bind interfaces only = yes WORKGROUP=DOMAINB-NETWORKS REALM=DOMAINB-networks.com pid directory = /var/run/samba/DOMAINB-networks lock directory = /var/cache/samba/DOMAINB-networks private dir = /var/cache/samba/DOMAINB-networks winbindd socket directory = /var/cache/samba/DOMAINB-networks winbindd privileged socket directory = /var/cache/samba/DOMAINB-networks/winbindd_privileged smb passwd file = /var/cache/samba/DOMAINB-networks state directory = /var/cache/samba/DOMAINB-networks cache directory = /var/cache/samba/DOMAINB-networks usershare path = /var/cache/samba/DOMAINB-networks ntp signd socket directory = /var/cache/samba/DOMAINB-networks Any pointers would be extremely appreciated..
On Mon, May 22, 2017 at 01:27:53PM +0200, Arnab Roy wrote:
The problem seems to be ntlm_auth doesnt see that the winbindd privileged pipe and winbindd socket is running in a custom directory.
IIRC ntlm_auth connects to winbindd using the /tmp/.winbindd/pipe pipe, and then queries winbindd over that pipe what the location of the priv pipe is. So if you've got two winbindds both with /tmp/.winbindd/pipe, only one of those is going to work. Assuming the two copies of Samba were compiled with different locations then it might work. I'd be inclined to strace all the things and see what's really happening. I'd expect that if you built Samba and installed in /opt/samba1/ and /opt/samba2/ and then ran /opt/samba1/ntlm_auth and /opt/samba2/ntlm_auth that the locations would probably be separate and all would be OK. But running two copies of Samba on the same box is hardly a standard setup, so you're likely to be on your own. Or you could just proxy the RADIUS request to a separate VM with another instance of Samba on it and save the unusual setup. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
The problem seems to be ntlm_auth doesnt see that the winbindd privileged pipe and winbindd socket is running in a custom directory. IIRC ntlm_auth connects to winbindd using the /tmp/.winbindd/pipe pipe, and then queries winbindd over that pipe what the location of the priv pipe is. So if you've got two winbindds both with /tmp/.winbindd/pipe, only one of those is going to work. Assuming the two copies of Samba were compiled with different locations then it might work. I'd be inclined to strace all the things and see what's really happening. I'd expect that if you built Samba and installed in /opt/samba1/ and /opt/samba2/ and then ran /opt/samba1/ntlm_auth and /opt/samba2/ntlm_auth that the locations would probably be separate and all would be OK. But running two copies of Samba on the same box is hardly a standard setup, so you're likely to be on your own. Or you could just proxy the RADIUS request to a separate VM with another instance of Samba on it and save the unusual setup. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi Matthew, Sorry I am back with this one. After digging through tons of samba source I have finally managed to reach a stage where Winbind is now running completely separately so just need to sort out ntlm_auth. Looking through the source code I stumbled upon the following file in nsswitch and saw your name as the author :) hope its the same Matthew :) nsswitch/wb_common.c Now previously it seems like it was possible to set the Winbind Socket directory via an environment variable ( http://samba.2283325.n4.nabble.com/NTLM-Authentication-against-multiple -domain-comtrollers-td3024825.html ) This seems to have gone now looking at the code static const char *winbindd_socket_dir(void) { if (nss_wrapper_enabled()) { const char *env_dir; env_dir = getenv("SELFTEST_WINBINDD_SOCKET_DIR"); if (env_dir != NULL) { return env_dir; } } return WINBINDD_SOCKET_DIR; } Can you see any issues if I changed this to return a custom environment variable instead ? Also from a FR perspective I am considering chrooting ntlm_auth ? Your help is much appreciated. Many Thanks Arnab Sent: Monday, May 22, 2017 at 12:37 PM From: "Matthew Newton" <mcn4@leicester.ac.uk> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Subject: Re: Freeradius Multiple Disjoint Ad Domains On Mon, May 22, 2017 at 01:27:53PM +0200, Arnab Roy wrote: - List info/subscribe/unsubscribe? See [1]http://www.freeradius.org/list/users.html References 1. http://www.freeradius.org/list/users.html
On Mon, May 22, 2017 at 09:09:58PM +0200, Arnab Roy wrote:
Looking through the source code I stumbled upon the following file in nsswitch and saw your name as the author :) hope its the same Matthew
Yes it is, but writing patches for Samba over two years ago doesn't make me an expert on it. As I said before, I would strace ntlm_auth and winbindd, then you can easily tell what pipes they are opening. I think if you build Samba with a different --prefix then it will start to look at different locations for these files. Otherwise there might be a configuration option to set the pipe location. Building and then stracing it will tell you what it's doing, if you can't figure it out from the source. I found the Samba guys are all friendly, I'm sure they can advise on this. But I imagine you might get the answer "don't do that". Otherwise do it the normal way and proxy to another machine. It will be a lot more standard and other people will find it easier to understand what you've done. And it will just work. -- Matthew
Hi Matthew, Thanks for all the help once I posted in the correct samba dev thread I got what I wanted just needed to recompile ntlm auth with some minor modifications which allows me to specify the winbind pipe directory and all works flawlessly. Thanks Arnab
On 22-05-17 13:27, Arnab Roy wrote:
I have been able to get multiple instances of winbindd running with separate smb.conf's and joined to the respective AD domains.
The problem seems to be ntlm_auth doesnt see that the winbindd privileged pipe and winbindd socket is running in a custom directory.
Have you tried this argument for ntlm_auth? --configfile=<configuration file> The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide. See smb.conf for more information. The default configuration file name is determined at compile time. And another solution: is it possible to create two VMs for the samba servers, both running a freeradius instance. The current freeradius instance could act as a proxy (assuming you could select the correct radius server based on a realm). -- Herwin Weststrate
I have been able to get multiple instances of winbindd running with separate smb.conf's and joined to the respective AD domains.
The problem seems to be ntlm_auth doesnt see that the winbindd privileged pipe and winbindd socket is running in a custom directory. Have you tried this argument for ntlm_auth? --configfile=<configuration file> The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide. See smb.conf for more information. The default configuration file name is determined at compile time. And another solution: is it possible to create two VMs for the samba servers, both running a freeradius instance. The current freeradius instance could act as a proxy (assuming you could select the correct radius server based on a realm). -- Herwin Weststrate
Hi Herwin, Thanks your response. Yes I have been using the --configfile option and it looks like it ignores the options for the socket dir and priv dir directives in the config file. Creating additional VM's isnt under my control unfortunately and it sounds like a huge waste of resource to me :( Any chance I can simply recompile the NTLM auth binary and specify a different winbind sockets ? I know again this should be a question the guys at Samba should be responding but nobody responds their .. Many Thanks Arnab Sent: Monday, May 22, 2017 at 12:41 PM From: "Herwin Weststrate" <herwin@quarantainenet.nl> To: freeradius-users@lists.freeradius.org Subject: Re: Freeradius Multiple Disjoint Ad Domains On 22-05-17 13:27, Arnab Roy wrote: - List info/subscribe/unsubscribe? See [1]http://www.freeradius.org/list/users.html References 1. http://www.freeradius.org/list/users.html
participants (4)
-
Arnab Roy -
Herwin Weststrate -
Matthew Newton -
Matthew Newton