Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Edit: Reformatted this as Q&A. If anyone can change this from Community Wiki to a typical question, that's probably more appropriate as well.

How can I authenticate OpenBSD against Active Directory?

share|improve this question
    
Very nice! That looks very thorough and well written. I don't use OpenBSD, but the AD parts look spot-on. –  Evan Anderson Jun 5 '09 at 1:57
    
+1 for a nice guide, although it is not really a question. –  David Schmitt Jun 8 '09 at 16:31
    
You should change this into a Question & Answer format. –  Doug Luxem Jun 9 '09 at 14:52
    
Changed, though it's still a Community Wiki. If someone else can change that, go ahead. –  sh-beta Jun 9 '09 at 19:23

1 Answer 1

up vote 13 down vote accepted

Preface

Authenticating against Active Directory with Kerberos is pretty simple on systems using PAM, but OpenBSD doesn't and makes it more difficult. From a tcpdump, it looks like the PAM systems are just doing pre-authentication while OpenBSD's bsd_auth system is using the whole Kerberos authentication process.

Anyway, this took me a while to figure out so hopefully some concise instructions will save you time.

A few quick notes before we begin:

  • Users must exist on the OpenBSD system before attempting to login. They are not autocreated.
  • If you want users autocreated, look into Samba/Winbind. I've had nothing but trouble (inexplicable crashes, serious log spamming, unreliable authentication) from it, so I only use it when I have to.
  • This was tested on OpenBSD 4.5 and Windows Server 2003. I'm pretty sure it'll work with Win2k, but YMMV.
  • This version of OpenBSD uses Heimdal 0.7.2. Everything here aside from the paths and login.conf stuff will probably work on other *nixes running the same Heimdal, but again, YMMV.

Instructions

These steps assume you are trying to authenticate myuser@myhost.fqdn against the domain EXAMPLE.COM. The domain controller is pdc.EXAMPLE.COM.

  1. Create an Active Directory User account named myhost (that's not a typo, these instructions won't work with a Computer account). Disable password expiration and don't let the user change its own password. Set the password to whatever you like - it'll be changed soon.

  2. It's probably a good idea to create the User account under a new OU, remove it from the Domain Users group and add it to a dedicated group. This is all a matter of taste and your security layout.

  3. On pdc.EXAMPLE.COM, download and install Windows Server Support Tools (specifically, you'll need ktpass.exe)

  4. On pdc.EXAMPLE.COM, run:

    ktpass -out c:\temp\myhost.keytab -princ host/myhost.fqdn@EXAMPLE.COM -mapuser myhost -pType KRB5_NT_PRINCIPAL +rndpass

    This updates the myhost user's password to something random (+rndpass), maps the Kerberos principal "host/myhost.fqdn@EXAMPLE.COM" to the user "myhost" in Active Directory, and then dumps the principal and private key info into the -out keytab file.

  5. Securely copy c:\temp\myhost.keytab to myhost and delete the file from pdc.EXAMPLE.COM

  6. On myhost, add the AD keytab to your main keytab:

    ktutil copy /path/to/myhost.keytab /etc/kerberosV/krb5.keytab

  7. Configure /etc/krb5.conf. Below is the bare minimum that you need. There's a lot of options available, take a look at the manpage for more details. This just sets the maximum acceptable clock skew to 5 minutes, makes EXAMPLE.COM the default realm, and tells Kerberos how to translate between DNS and Kerberos realms.

    [libdefaults]
    clockskew = 300
    default_realm = EXAMPLE.COM

    [realms]
    EXAMPLE.COM = {
    default_domain = EXAMPLE.COM
    }

    [domain_realm]
    .EXAMPLE.COM = EXAMPLE.COM

  8. Verify that you can get a ticket:

    # kinit Administrator@EXAMPLE.COM
    Administrator@EXAMPLE.COM's Password:
    # klist
    Credentials cache: FILE:/tmp/krb5cc_0
    Principal: Administrator@EXAMPLE.COM

    Issued Expires Principal
    Jun 4 21:41:05 Jun 5 07:40:28 krbtgt/EXAMPLE.COM@EXAMPLE.COM

  9. Modify /etc/login.conf to use Kerberos authentication. Your exact login.conf configuration will vary depending on how you use your system, but to go from a vanilla install to using Kerberos, just edit and comment this line under the default login class:

    :tc=auth-defaults:\

    And add above it:

    :auth=krb5-or-pwd:\

    This checks Kerberos first unless the user is root. If Kerberos fails, it will use local passwords.

  10. Add the users you'd like to authenticate on this host. Leave the passwords blank unless you want them to be able to use both Active Directory and local passwords (not recommended).

    You can blank existing users' passwords "chpass <user>" and replacing the "Encrypted password:" value with an asterisk (*)

  11. Test SSH and Sudo. Both should work flawlessly with your Active Directory credentials.

That's all there is to it.

Links

A couple useful sites:
http://technet.microsoft.com/en-us/library/bb742433.aspx
http://publib.boulder.ibm.com/infocenter/wasinfo/v7r0/index.jsp?topic=/com.ibm.websphere.express.doc/info/exp/ae/tsec_kerb_create_spn.html

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.