MIT KDC integration Andreas Schneider <asn@samba.org> G unther - - PowerPoint PPT Presentation

▶

Aug 11, 2023 868 likes •1.18k views

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices MIT KDC integration Andreas Schneider <asn@samba.org> G unther Deschner <gd@samba.org> Red Hat May 21th, 2015 Andreas Schneider <asn@samba.org> G

SLIDE 1

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices

MIT KDC integration

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org>

Red Hat

May 21th, 2015

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 2

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices

Who we are?

We both are Samba Team members work for Red Hat on Samba love rock climbing and love Frankonian beer (an important part of rock climbing)

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 3

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices

MIT KDC integration

1 MIT KDB Design

The SDB Layer

2 Ongoing development

Microsoft Interop Lab cwrap Kadmind NETLOGON Generic PAC Validation What has gone upstream?

3 Remaining bits

What is remaining?

4 Heimdal sacrifices

Has Heimdal gone to Valhalla ? The End

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 4

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices The SDB Layer

MIT KDC integration

1 MIT KDB Design

The SDB Layer

2 Ongoing development

Microsoft Interop Lab cwrap Kadmind NETLOGON Generic PAC Validation What has gone upstream?

3 Remaining bits

What is remaining?

4 Heimdal sacrifices

Has Heimdal gone to Valhalla ? The End

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 5

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices The SDB Layer

HDB, KDB, SDB

New SDB layer simple abstraction of samba kdc routines into a new sdb layer provides conversion routines into HDB and KDB formats (for Heimdal and MIT KDCs) Samba builds either MIT or Heimdal plugin, not both KDB plugin works for a MIT KDC (version greater 1.10)

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 6

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices The SDB Layer

New KDC backend layering

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 7

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices Microsoft Interop Lab

MIT KDC integration

1 MIT KDB Design

The SDB Layer

2 Ongoing development

Microsoft Interop Lab cwrap Kadmind NETLOGON Generic PAC Validation What has gone upstream?

3 Remaining bits

What is remaining?

4 Heimdal sacrifices

Has Heimdal gone to Valhalla ? The End

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 8

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices Microsoft Interop Lab

Microsoft Kerberos Testsuite

Microsoft Interopability Event September 2014 in Redmond MS testsuite testing Samba/MIT KDC with new kdb samba driver Some issues found:

kdb samba driver failed encryption type negotiation ARCFOUR-HMAC-MD5 was the only enctype used Re-ordering enabled AES enctypes Salting issues with salting principals for AES kpasswd support via kadmind

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 9

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices Microsoft Interop Lab

Microsoft Protocol Test Suites

Publically available: ”Kerberos Protocol Test Suite” Supports different scenarios Report generation See ”Open Specifications Dev Center” for further details https://msdn.microsoft.com/openspecifications

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 10

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices cwrap

MIT KDC integration

1 MIT KDB Design

The SDB Layer

2 Ongoing development

Microsoft Interop Lab cwrap Kadmind NETLOGON Generic PAC Validation What has gone upstream?

3 Remaining bits

What is remaining?

4 Heimdal sacrifices

Has Heimdal gone to Valhalla ? The End

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 11

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices cwrap

The libkrb5 DNS discovery problem

libkrb5 could not find its DC We needed support for service discovery via DNS We had some DNS faking in the Samba developer build BUT: Samba DNS faking did not work with system libraries

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 12

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices cwrap

resolv wrapper

This wraps functions from libresolv.so; res query(3), res search(3) We have two modes:

1 Create your own resolv.conf and redirect everything to your

DNS server

2 Fake queries from a simple DNS file

This is for querying SRV, SOA or CNAME records ... https://cwrap.org/resolv_wrapper.html

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 13

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices cwrap

resolv wrapper in Samba Selftest

resolv wrapper is preloaded in Selftest Currently only supports DNS faking

The internal DNS implementation does not correctly handle SOA records, so we can’t send DNS queries to it yet

The system libkrb5 can now do SRV record lookups to discover the KDC

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 14

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices Kadmind

MIT KDC integration

1 MIT KDB Design

The SDB Layer

2 Ongoing development

Microsoft Interop Lab cwrap Kadmind NETLOGON Generic PAC Validation What has gone upstream?

3 Remaining bits

What is remaining?

4 Heimdal sacrifices

Has Heimdal gone to Valhalla ? The End

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 15

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices Kadmind

kpasswd support

”Microsoft Windows 2000 Kerberos Change Password and Set Password Protocols” (RFC3244) The ’kpasswd’ client from MIT Kerberos did not work In MIT Kerberos the kpasswd protocol is implemented in kadmind ⇒ We needed to start kadmind Password Set variant still needs ACL handling

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 16

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices Kadmind

kadmind

The MIT Kerberos administration server Allows administrative tasks via kadmin or kadmin.local tool ⇒ e.g. modify principals, export keytabs

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 17

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices NETLOGON Generic PAC Validation

MIT KDC integration

1 MIT KDB Design

The SDB Layer

2 Ongoing development

Microsoft Interop Lab cwrap Kadmind NETLOGON Generic PAC Validation What has gone upstream?

3 Remaining bits

What is remaining?

4 Heimdal sacrifices

Has Heimdal gone to Valhalla ? The End

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 18

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices NETLOGON Generic PAC Validation

Netlogon PAC validation

Netlogon has a logon mode to validate a PAC Samba implements an IRPC service to allow that Basically the service checks if the signature of the PAC is valid When we start the MIT KDC we also set up the IRPC service

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 19

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices What has gone upstream?

MIT KDC integration

1 MIT KDB Design

The SDB Layer

2 Ongoing development

Microsoft Interop Lab cwrap Kadmind NETLOGON Generic PAC Validation What has gone upstream?

3 Remaining bits

What is remaining?

4 Heimdal sacrifices

Has Heimdal gone to Valhalla ? The End

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 20

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices What has gone upstream?

What has gone upstream?

Bugfixes, bugfixes, bugfixes... New cwrap components e.g. resolv wrapper Fixes for enabling/disabling parts of the Samba DC for MIT

r Heimdal

Switch to krb5 API calls and structs from private HDB calls and structs General migration away from HDB where possible

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 21

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices What is remaining?

MIT KDC integration

1 MIT KDB Design

The SDB Layer

2 Ongoing development

Microsoft Interop Lab cwrap Kadmind NETLOGON Generic PAC Validation What has gone upstream?

3 Remaining bits

What is remaining?

4 Heimdal sacrifices

Has Heimdal gone to Valhalla ? The End

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 22

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices What is remaining?

Under review:

SDB database abstraction KDB samba module Automatic MIT KDC detection and/or startup selftest and autobuild integration

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 23

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices What is remaining?

Under discussion:

Removal of Heimdal codebase or at least moving it to the ”thirdparty” repository last Heimdal import was: Mon Jul 25 18:51:53 2011 +0200

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 24

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices What is remaining?

TODOs:

Password set protocol with ACL support Full gss wrap iov support for Heimdal? S4U2SELF/S4U2PROXY support Client application (kinit, kpasswd) parameters used in selftest Porting new smbtorture krb5 tests to MIT samba-tool support for provisioning an MIT KDC with samba backend

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 25

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices What is remaining?

How to set it up?

Fetch git repository from:

https://git.samba.org/?p=asn/samba.git;a=shortlog;h= refs/heads/master-mit-kdc

Install a MIT Kerberos KDC package Compile Samba with –with-system-mitkrb5 Create kdc.conf and krb5.conf, FIXME: example Start samba binary

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 26

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices Has Heimdal gone to Valhalla ?

MIT KDC integration

1 MIT KDB Design

The SDB Layer

2 Ongoing development

Microsoft Interop Lab cwrap Kadmind NETLOGON Generic PAC Validation What has gone upstream?

3 Remaining bits

What is remaining?

4 Heimdal sacrifices

Has Heimdal gone to Valhalla ? The End

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 27

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices Has Heimdal gone to Valhalla ?

The problem of Heimdal development

Core maintainer at Apple Project is unactive, no releases Maintenance repository on github Unclear roadmap (if any) Example: gss wrap iov

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 28

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices The End

MIT KDC integration

1 MIT KDB Design

The SDB Layer

2 Ongoing development

Microsoft Interop Lab cwrap Kadmind NETLOGON Generic PAC Validation What has gone upstream?

3 Remaining bits

What is remaining?

4 Heimdal sacrifices

Has Heimdal gone to Valhalla ? The End

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration

SLIDE 29

MIT KDB Design Ongoing development Remaining bits Heimdal sacrifices The End

Questions & Answers

Andreas Schneider <asn@samba.org> G¨ unther Deschner <gd@samba.org> Red Hat MIT KDC integration