- This topic has 2 replies, 2 voices, and was last updated 15 years ago by
.
-
Posts
-
I’m setting up an Ubuntu Linux server with OpenLDAP and Kerberos to provide authentication and directory services for a mixture of Linux and Mac (Snow Leopard) clients. Mostly following http://www.siriusit.co.uk/siriuslabs/09-nov-2009/osx-and-openldap-taming-leopard I’ve added the Apple schema to OpenLDAP and got the Mac clients to read user details off the OpenLDAP server. Then, by adding the right authAuthority attribute to each user record in OpenLDAP, I can make the Mac clients authenticate users against the Linux Kerberos server, too. I’ve also set up SASL GSSAPI binding on the OpenLDAP server, so once users have a Kerberos ticket they can authenticate to the LDAP server.
The question is, can I now ensure that all communication from clients to the LDAP server is authenticated via Kerberos? With Linux clients this is possible – I can configure nss_ldap to use the user’s Kerberos credentials if possible, and if not (i.e. if it’s the client system itself communicating with OpenLDAP), use the host/clientname@REALM principal in the client’s keytab file.
If I could get this all working I could disable anonymous bind & anonymous reading of user information in the directory for extra security. It isn’t clear how to do the same with the Mac clients though. In the Security tab of the configuration window for the LDAP connection in Directory Utility, there’s a checkbox ‘Use authentication when connecting’ but it seems to only allow using a DN and password. There’s also the ‘Security Policy’ checkboxes, which seem to do nothing when enabled – I tried checking ‘Digitally sign all packets’ and ‘Encrypt all packets’, but after restarting the Mac I could see communications with the LDAP server were going on unencrypted and unauthenticated (using tcpdump).I believe this is possible if using a real Open Directory server (As far as I know it’s termed ‘Authenticated binding’ a client to the directory server) but I can’t figure out what settings to change on the client (and possibly the server) to get it working. Has anyone else tried this or had any luck with it?
If anyone was wondering about this, I figured out a way to do it. Firstly, it’s too complicated to get authenticated binding actually working in this setup without an Open Directory server. During the authenticated bind, the client will try and (1) authenticate as a given directory administrator, (2) create an entry for itself in the directory with cn=clientname$, (3) set the password for that entry, then (4) try and extract information from the created entry to set up Kerberos on the client.
Step (1) will fail if only GSSAPI authentication is allowed for a directory administrator (Apple’s DS LDAPv3 plugin doesn’t seem to support this), and even if other auth. methods are allowed, (3) will run into trouble as if it doesn’t find an AuthenticationAuthority record on the computer entry containing ApplePasswordServer, it’ll fall back to setting the password for the computer entry using an LDAP modify password operation, which will normally fail since the schema doesn’t allow putting a userPassword attribute on a computer entry. Even if you edit the schema to allow it, (4) won’t really work as there will be no information on the computer record telling the client how to set up Kerberos (I assume this is added by some interaction with the Password Server and KDC on a real Open Directory server).
Instead, you can work around the lack of binding support by adding the OpenLDAP server config to the client in Directory Utility as normal (i.e. without ‘authenticated binding’), ticking the “Use authentication when connecting” box and filling in the client machine’s DN and a password (20+ random characters). Also check the “Disable clear text passwords”, “Block man-in-the-middle attacks”, “Digitally sign all packets” and “Encrypt all packets” as necessary. On the KDC, create a Kerberos principal for host/clientmachine@REALM as normal, but instead of giving it a random key, give it the same password as you entered in Directory Utility. Then, (and this is the step I was missing before), close Directory Utility and edit the file /Library/Preferences/DirectoryService/DSLDAPv3PlugInConfig.plist on the client. Find the dict entry for the OpenLDAP server, it should have “Server Account” and “Server Password” values corresponding to what you entered in Directory Utility. Now, add another key-value mapping to the dict with key “Kerberos Id” and value “host/clientmachine@REALM”.
This should cause the client machine to attempt to get a TGT for the host/clientmachine principal, using the “Server Password” value you entered earlier, and use it to authenticate to the OpenLDAP server before doing any directory access. Unfortunately it doesn’t support getting credentials from a keytab, only password-based credentials.
Hopefully this information will be useful to someone since I can’t find it documented anywhere (apart from the DS LDAPv3 plugin source code which I read to figure this out).
- You must be logged in to reply to this topic.