Unix Linux Administration III

1. Unix Linux Administration III Class 9: SAMBA and Windows Kerberos integration. NFS

2. Agenda • Review last lecture. • Review homework • Kerberos and SAMBA. • Centralized user management. • NFS

3. Review: Kerberos • client-server architecture • provides strong authentication, integrity and privacy. • sso solution, limits need to authentication for services and per session. • supported by sun since 2.6 (circa 1997) • GSSAPI provides the framework for Kerberos to create a secure environment, manages tokens. • Kerberos revolves around the "ticket" • Tickets have attributes such as forwardable, postdated, proxiable, renewable, etc.

4. Review • Kerberos authentication session starts at login. • The client in a Kerberos session is identified by its principal. • primary/user/realm • e.g. angus/user@AD.ULCERT.UW.EDU • Kerberos realms are similar to a domain, each includes a master copy of the principal database. • Kerberos components divided between the kdc and the user programs.

5. Q3, Class 10, Unit 1 What we are going to cover: • Kerberos and samba What you should leave this session with: • Basic understanding of samba. • services used by samba to provide authentication.

6. samba • Provides compatibility and integration with Windows systems • Commonly used for file sharing • Useful for user account information and authentication integration

7. SAMBA can: • Share directory trees • Share Distributed file system (DFS) trees • Share printers • Support and assist network browsing • Authenticate clients logging onto a windows NT domain • Provide or assist with Windows Internet Name Service (WINS, which is still around in 2008 longhorn).

8. What else can SAMBA help with? • Provide an alternative to a windows server • Avoid having to pay for Client Access Licenses (CALs) for each windows client access to a windows server • Provide a common share point for both UNIX and windows systems • Share printers between windows and UNIX systems • Integrate UNIX and windows auth maintain a single database a user accounts that work for both systems • Network windows, Mac and UNIX systems using one protocol.

9. Windows and Samba • SAMBA cannot act as a Domain Controller (DC) in windows 2x. In Win 2x domains SAMBA is limited to becoming a member server. • A Samba server can authenticate against Active Directory (AD). • Brief outline of steps required rights required • Samba 3.0.20 or newer • Kerberos • NTP • A user with root access on the UNIX server and a user with rights to add a machine to the domain for AD

10. Setting up a basic smb.conf As always backup the existing smb.conf file. It is should be under /etc/samba/smb.conf. The new file will contain a Global section, a user section, a public section and a private section. Once you have created the new smb.conf file run testparm against it, assuming it is good restart the smb service.

11. Setting up a basic smb.conf As always backup the existing smb.conf file. It is should be under /etc/samba/smb.conf. If you review the sample smb.conf file you will notice it contains sections such as: • Global • user section • public • private you can test your smb.conf using testparm. /usr/sfw/bin/testparm

12. Smb.conf config • The smb.conf file is broken into sections. Sections are defined the square brackets [global] [home] • Global setting can be over ridden within any other section. • SAMBA preserves white space in values e.g. comment = User Home Directories • Capitalization is not important to samba but it may be to the host system • Line continuation can be defined with “\” • Comments can be defined with either # or ; • The SAMBA config file is re-read every 60 seconds. • The SAMBA config supports some dynamic variable substitution. • Do not end path definitions with a slash

13. SMB tools and services • Tools • /usr/bin/smbstatus report current network connections info. • /usr/bin/smbclient – UNIX ftp like tool for use with smb shares. • /usr/bin/smbpasswd – manage password used by samba • /usr/bin/smbtar –unix tar command for backing up smb shares • /usr/bin/testparm – test samba config file • /usr/bin/findsmb – finds local network computers with SMB on • Services • smbd – manages the shared resources between samba servers and their resources • nmdb – simple name server that provides WINS funtionality.

14. GSSAPI (Generic Security Services Application Program Interface) • An authentication API • Most commonly used with Kerberos • SSH support available • LDAP support available

15. Kerberos and GSSAPI • Kerberos provides a security mechanism that supports applications using the GSS-API (Generic Security Service Application Programming Interface). • The GSS-API does not provide security but provides the framework for security services such as Kerberos so that they can accomplish that goal.

16. Kerberos and keytab files. All Kerberos server machines need a keytab to authenticate to the KDC To allow remote login to a system using Kerberos authentication, that system must have a host service principal defined. The keytab for that service principal must be installed locally in the path expected by the login servers (usually /etc/krb5.keytab). The keytab file is like a stash file.

17. kerberos keytab utilities • klist can be used to list existing kerberos tickets. • ktutil can be used to read in the details about an existing keytab file. • ktadmin allows you to edit the existing keytab file.

18. Review: SAMBA can provide services within a standard Windows domain. SAMBA can provide resources to Windows clients. The primary SAMBA config file is smb.conf broken into sections. tools provided for testing and managing samba. GSSAPI is commonly used with kerberos but not limited to that technology. GSSAPI provides the framework for security services The keytab are service specific, should owned by root, and helps to allow for authentication without manually providing credentials.

19. In class Q3 lab 10a • Lab notes for this session can be found here: http://www.ulcert.uw.edu -> Class Content -> InClass labs ->

20. Q3, Class 10, Unit 2 What we are going to cover: Centralized user management. What you should leave this session with: • How to manage users external to the system. • Using Active Directory to provide this resource.

21. Centralized User Management • Can be accomplished a number of different ways using various back-end databases • User Attribute Mapping can be managed within AD for UNIX systems. • Samba allows for requesting data from external systems. • using LDAP we can store details about objects external to the system.

22. LDAP Concepts • Distinguished Names • Common Names • Attributes and Attribute Mapping • Search filters • SSL via SSL (LDAPS)

23. Windows and Unix attributes Using Windows 2008 servers we can simply enable NIS services in order to track UNIX specific attributes. Using NIS services we can also track group attributes.

24. NSS (Name Switch Service) • Defines where the system gets information on users, groups, hosts, etc. • User and group information pulled from files by default • Supports a variety of back-end databases

25. NSS cont. NSS is sometimes referred to as "the switch". The switch decides what naming service a given application will leverage. We have seen many sample switch file. /etc/nsswitch.ldap /etc/nsswitch.nis /etc/nsswitch.files etc.. we commonly edit the ipnodes and hosts values.

26. ldapclient The ldapclient command is used to set up LDAP clients on an Oracle Solaris system. It can be used with either a profile or a manual configuration.

27. ldapclient configuration Before you set up an LDAP client the following must already be configured: • One or more Kerberos key distribution center (KDC) servers must be configured and running. • DNS, client access to a DNS server, and at least one DNS server must be configured and running. • Kerberos on the client machine must be configured and enabled.

28. getent - get entries from administrative database getent command displays entries from databases supported by the Name Service Switch libraries, which are configured in: • /etc/nsswitch.conf This is why if the name-service-cache is not running these tools will not function.

29. review External users repositories can be various back-end resources. LDAP or in this case AD is just one example. Using the NIS role is one way we can store UNIX attributes in AD. NSS (nsswitch.conf) determines which service will respond for a given application.

30. review The ldapclient can be used with either a profile or manually. The ldap client requires a KDC to be available and configured. Access to a working DNS resolver. Kerberos must be configured on the given client. The genent (get entries) requires the NSS service to be available.

31. In class Q3 lab 10b • Lab notes for this session can be found here: http://www.ulcert.uw.edu -> Class Content -> InClass labs ->

32. Q3, Class 10, Unit 2 What we are going to cover: • NFS What you should leave this session with: • Understand the basics behind NFS • How to work with NFS shares from your Linux/UNIX host.

33. NFS – Network file system NFS allows for mounting local file systems on remote hosts. NFS is supported on a wide range of systems including mainframes computers, Linux, UNIX and windows.

34. NFS provides • Provides access to content from multiple points • Reduced storage costs • Data consistency as all users access the same content. • Transparent process for users • Reduces complexity to accessing remote files • Reduce admin workload • Support heterogeneous environments.

35. NFS v4 enhancements • UserID and GroupID represented as strings. • Improved protocol support available RDMA (remote direct memory access) tcp fallback • State and lock information destroyed when file system unshared • Stateful protocol now (nfs v4) • No need for mountd, statd or nfslogd • Delegation support provided to the client by the server.

36. Basic NFS configuration Standard client server design • Server defines where the file are stored • Client mounts the remote NFS share. • The default nfs configuration is managed in /etc/default/nfs

37. NFS daemons • nfsd – manages the file system exporting and file access request from remote systems. • nfsmapid – new daemon that maps NFS v4 owner and user UID and GID numbers. • nfslogd – provides optional logging for the solaris server.

38. Managing NFS services NFS can be managed with the SMF framework • svcs nfs/server • svcs nfs/client and • svcadm enable nfs/server • svcadm disable nfs/server

39. Temporary NFS server setup. Assuming the NFS server is running you can create new shares dynamically using the share command: • share -F nfs -o ro /opt/nfs-content • This will create an NFS share with read only permissions under /opt/nfs-content.

40. Temporary NFS client setup. Assuming the NFS client is running you can mount new shares dynamically using the share command: • sudo mount server.edu:/opt/nfs-content /tmp/content This will mount the NFS share from server.edu to the local mount /tmp/content

41. Persistent NFS server setup When working with Solaris systems NFS resources are defined in: /etc/dfs/dfstab share -F nfs -o ro -d "description" /opt/content Once defined restart the service to enable. These will now auto-share on restart also. • sudo svcadm restart nfs/server or • sudo /usr/sbin/shareall you can limit the clients also based on IP or hostnames, individually or by subnet.

42. Persistent NFS client mounts. If you want the client to establish the NFS share each time it boots you will need to update /etc/vfstab • server.edu:/content - /opt/content nfs - yes ro The Solaris NFS client also supports failover for the client when working with read-only shares. • server.edu,server2.edu:/content - /opt/content nfs - yes ro

43. NFS autoFS maps Autofs calls automountd which mounts the requested file system. 3 types of automounts • Master maps • Direct maps - lists of unrelated mount points. • Indirect maps - simplest nfs shares

44. NFS autoFS When your environment grows it can become time consuming and confusing trying to manage NFS mounts. AutoFS (automounter) provides a method to mount remote directories automatically, only when being used. We are not going to cover but it is something you should be aware of and it is covered in your Solaris text fairly well.

45. NFS tool: nfsstat nfsstat will provide details about the NFS shares and versions in use. version info for a specific mount • nfsstat -m /opt/content Just nfsv3 or 4 details • nfsstat nfsv3 or nfsstat nfsv4 I/O stats and naming information • nfsstat -i • nfsstat -a

46. NFS tool: clear_locks You can clear all file, record and share locks for an NFS client on the server using: • clear_locks <server> Or from the client you can clear the locks on the server using the -s option. clear_locks -s <nfs-server>.

47. NFS and Linux Linux also support NFS. The configuration file and tools a slightly different. To mount your Solars NFS share on your linux host try: sudo mount –t nfs server:/content /tmp/nfs-share if you want to persist this mount add it to /etc/fstab • server.edu:/content /share nfs rsize=8192,wsize=8192,timeo=14,intr wsize = write size rsize = read size The option "intr" allows NFS requests to be interrupted if the server goes down or cannot be reached.

48. Linux NFS server. Persistent Linux NFS shares are defined in: • /etc/exports The configuration can be as simple as content and clients. /shared server.edu here /shared is available to server.edu Of course you can be much more granular. /usr/sbin/exportfs exports the shares.

49. Review: NFS • Mount local file systems on remote hosts. • Supported from a wide range of host systems. • Provides improved access to content, reduces complexity, supports heterogeneous environments. • NFSv4 brings improved stability and security. • Standard client/server design • nfsd manages exported filesystems, nfsmapid manages user and group info. • managed using SMF framework\ • svcadm disable nfs/server • configuration stored in /etc/dfs/dfstab • NFS autoFS for managing increasing NFS shares.

50. In class Q3 lab 10c • Lab notes for this session can be found here: http://www.ulcert.uw.edu -> Class Content -> InClass labs ->