Updating Winbindd Privileged Socket Path
Hi FreeRADIUS, I'm running Winbindd on some other directory. I have to update winbindd prieveleged socket path on FreeRADIUS side. I've read some documents but I couldn't find a configuration for this. My samba config: # cat /etc/samba/smb.conf [global] winbindd socket directory = /mydir/var/run/winbindd state directory = / mydir /var/run/samba/locks/state pid directory = / mydir /var/run/ cache directory = / mydir /var/run/samba/locks/cache lock directory = / mydir /var/run/samba/locks FreeRADIUS looks for the default winbindd socket directory (/var/run/samba/winbindd), but actually it should look for /permanent/var/run/samba/winbindd, how can I configure FreeRADIUS for that? Thanks in advance..
There's a typo in the last sentence; it should look for /mydir/var/run/samba/winbindd. Sorry about that. On Mon, 21 Jun 2021 at 17:36, Vertigo Altair <vertigo.altair@gmail.com> wrote:
Hi FreeRADIUS,
I'm running Winbindd on some other directory. I have to update winbindd prieveleged socket path on FreeRADIUS side. I've read some documents but I couldn't find a configuration for this.
My samba config: # cat /etc/samba/smb.conf [global] winbindd socket directory = /mydir/var/run/winbindd state directory = / mydir /var/run/samba/locks/state pid directory = / mydir /var/run/ cache directory = / mydir /var/run/samba/locks/cache lock directory = / mydir /var/run/samba/locks
FreeRADIUS looks for the default winbindd socket directory (/var/run/samba/winbindd), but actually it should look for /permanent/var/run/samba/winbindd, how can I configure FreeRADIUS for that?
Thanks in advance..
On Jun 21, 2021, at 10:36 AM, Vertigo Altair <vertigo.altair@gmail.com> wrote:
I'm running Winbindd on some other directory. I have to update winbindd prieveleged socket path on FreeRADIUS side. I've read some documents but I couldn't find a configuration for this.
My samba config: # cat /etc/samba/smb.conf [global] winbindd socket directory = /mydir/var/run/winbindd state directory = / mydir /var/run/samba/locks/state pid directory = / mydir /var/run/ cache directory = / mydir /var/run/samba/locks/cache lock directory = / mydir /var/run/samba/locks
FreeRADIUS looks for the default winbindd socket directory (/var/run/samba/winbindd), but actually it should look for /permanent/var/run/samba/winbindd, how can I configure FreeRADIUS for that?
So far as I can tell, it's impossible. I presume that you're using v3, and the mschap module with "winbind_username", etc. I *think* you can change this via the WINBINDD_SOCKET_DIR environment variable. But that definition comes from (and is used by) the Samba libraries. FreeRADIUS doesn't use it at all. In 3.0.23, there's an ENV section in radiusd.conf. You should be able to set: ENV { ... WINBINDD_SOCKET_DIR = /mydir/var/run/winbindd ... } It might work. https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html ... Client tools must then be advised of the altered path with the WINBINDD_SOCKET_DIR environment variable. That might work. But if it doesn't, it's the fault of Samba, and not FreeRADIUS. :( Alan DeKok.
On 21/06/2021 15:57, Alan DeKok wrote:
It might work. https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html
... Client tools must then be advised of the altered path with the WINBINDD_SOCKET_DIR environment variable.
I wasn't aware of that one - the code seems to have something slightly different, "SELFTEST_WINBINDD_SOCKET_DIR", so maybe try that, too (but from its name it sounds like its intended for internal use only): https://git.samba.org/?p=samba.git;a=blob;f=nsswitch/wb_common.c;h=45c1969ac... But the documentation seems to indicate that it's not safe to use as not everything will honour it. If ntlm_auth doesn't, then the wbclient code should do as it uses the wb_common library stuff above. I'd be surprised if ntlm_auth doesn't use the same client code though. The only time I've done it before I build Samba twice with two different paths, and called each one separately. That will work with ntlm_auth, but not wbclient as you can't link FreeRADIUS against both versions. The answer is pretty much "don't move the privileged socket location, or if you do, rebuild Samba with a different location". -- Matthew
On 21/06/2021 15:36, Vertigo Altair wrote:
I'm running Winbindd on some other directory. I have to update winbindd prieveleged socket path on FreeRADIUS side. I've read some documents but I couldn't find a configuration for this.
There is no configuration for it. FreeRADIUS just uses either ntlm_auth or the libwbclient library, both from the Samba project. They connect to the privileged socket, not FreeRADIUS. Actually, IIRC they will connect to winbind on the non-privileged socket, and that will tell them where to connect to for the privileged socket. But it's been a while since I worked on the Samba code so I may have forgotten the exact method. -- Matthew
participants (3)
-
Alan DeKok -
Matthew Newton -
Vertigo Altair