9

I'm looking into software which provides a user with a single identity across multiple computers. That is, a user should have the same permissions on each computer, and the user should have access to all of his or her files (roaming home directory) on each computer. There seem to be many solutions for this general idea, but I'm trying to determine the best one for me. Here are some details along with requirements:

  1. The network of machines are Amazon EC2 instances running Ubuntu.
    • We access the machines with SSH.
    • Some machines on this LAN may have different uses, but I am only discussing machines for a certain use (running a multi-tenancy platform).
  2. The system will not necessarily have a constant amount of machines.
    • We may have to permanently or temporarily alter the amount of machines running. This is the the reason why I'm looking into centralized authentication/storage.
  3. The implementation of this effect should be a secure one.
    • We're unsure if users will have direct shell access, but their software will potentially be running (under restricted Linux user names, of course) on our systems, which is as good as direct shell access.
    • Let's assume that their software could potentially be malicious for the sake of security.

I have heard of several technologies/combinations to achieve my goal, but I'm unsure of the ramifications of each.

  • An older ServerFault post recommended NFS & NIS, though the combination has security problems according to this old article by Symantec. The article suggests moving to NIS+, but, as it is old, this Wikipedia article has cited statements suggesting a trending away from NIS+ by Sun. The recommended replacement is another thing I have heard of...
  • LDAP. It looks like LDAP can be used to save user information in a centralized location on a network. NFS would still need to be used to cover the 'roaming home folder' requirement, but I see references of them being used together. Since the Symantec article pointed out security problems in both NIS and NFS, is there software to replace NFS, or should I heed that article's suggestions for locking it down? I'm tending toward LDAP because another fundamental piece of our architecture, RabbitMQ, has a authentication/authorization plugin for LDAP. RabbitMQ will be accessible in a restricted manner to users on the system, so I would like to tie the security systems together if possible.
  • Kerberos is another secure authentication protocol that I have heard of. I learned a bit about it some years ago in a cryptography class but don't remember much about it. I have seen suggestions online that it can be combined with LDAP in several ways. Is this necessary? What are the security risks of LDAP without Kerberos? I also remember Kerberos being used in another piece of software developed by Carnegie Mellon University...
  • Andrew File System, or AFS. OpenAFS is available for use, though its setup seems a bit complicated. At my university, AFS provides both requirements... I can log in to any machine, and my "AFS folder" is always available (at least when I acquire an AFS token).

Along with suggestions for which path I should look into, does anybody have any guides which were particularly helpful? As the bold text pointed out, LDAP looks to be the best choice, but I'm particularly interested in the implementation details (Keberos? NFS?) with respect to security.

2 Answers 2

7

Authentication, authorization, and directory information

This isn't a complete answer to your question, but I thought it might help address your questions about NIS vs. LDAP vs. Kerberos.

Start with this, which provides a good overview of the difference between authentication and authorization, which is important to understand for this sort of discussion.

Kerberos is, as you say, just an authentication protocol. Given a set of credentials -- e.g., a username and password -- it will tell you whether they're valid or not. This is all it does.

In contrast, both NIS and LDAP are directory services. They allow a client to query them for information about users (what is your home directory? What is your user ID?). Both can be used as authentication sources with varying degress of problems.

NIS doesn't really perform any authentication for you on its own. Rather, it exposes a password hash to client machines, and your local system performs the actual authentication step the same way it would for local accounts. The problem here is that anyone with an account on one of your NIS clients can grab all your password hashes, and then mount a brute-force attack on them at their leisure.

LDAP is somewhat more secure, since the authentication step is actually performed on the server. You have to make sure you're encrypting your LDAP sessions with SSL or TLS, otherwise the password is exposed in cleartext on the wire, where it is vulnerable to packet sniffing.

It is very common to use Kerberos for authentication and then either NIS or LDAP for authorization (typically this means "group membership") and directory information. I would argue that NIS, once you have removed the password hashes (by moving your authentication to Kerberos) is not really less secure than LDAP, and has the advantage of being available "out of the box" on any modern Linux distribution.

LDAP, on the other hand, is generally far more extensible, scales better if you have a large number of users (or other directory objects), provides for rich queries, and is generally more manageable. LDAP is also supported natively in a variety of applications, while NIS has a weird incestuous relationship with the core operating system that may be undesirable.

If you are building things from scratch, I would suggest Kerberos for authentication and LDAP for your directory service.

Filesystems

NFS has a big advantage: you already have it, it's widely deployed, and it's generally stable. There are two primary downsides to NFS:

  • It doesn't scale well for parallel i/o. If you've got a large number of machines hitting the same filesystem, your single NFS server may have a hard time keeping up. This is why larger clusters typically use a cluster filesystem (like Lustre, GlusterFS, GPFS, GFS, etc) that has been designed to supported parallel i/o.

  • It has a bad security model. Generally, NFS security decisions are based entirely on your numeric user ID. If you have root on a system that can mount an NFS filesystem, you have access to all of the files -- because you can always create a local user with the appropriate user ID. This isn't strictly true, because both NFSv3 and NFSv4 have various levels of support for Kerberos authentication, but I have yet to meet anyone using this...so your milage may vary.

For small deployments, most people just use NFS despite its limitations.

There are a variety of other solutions -- the cluster filesystems I mentioned above, as well as AFS and others -- but most of these will require some work on your part to get them running on whatever distribution you have selected. I've heard good things about GlusterFS recently, so if I were looking for an NFS alternative that might be the first place I look.

6
  • Thanks for clearing up those things. I actually have a good foundation in authorization vs. authentication; I'm just unsure of the capabilities of each piece of software. The storage portion is important also; do you know how the security model of Kerberos/LDAP ties into NFS?
    – Brian
    Sep 9, 2011 at 21:19
  • I've updated the answer with some information about NFS.
    – larsks
    Sep 9, 2011 at 21:48
  • In this case I see no reason to be limited to a single NFS server, though one may be sufficient, and more can be added in later. help.ubuntu.com/community/AutofsLDAP
    – 84104
    Sep 10, 2011 at 3:49
  • I have tried going through that AutofsLDAP guide as well as others. It is either poorly written or out of date, as my results differ, and I cannot proceed beyond a certain point. :(
    – Brian
    Sep 16, 2011 at 14:23
  • You might want to open a new question with the appropriate details.
    – larsks
    Sep 16, 2011 at 14:24
0

This is a partial answer.

NIS/NIS+
Do not use NIS. Use LDAP with nis schema.

OpenLDAP (a.k.a. slapd on Ubuntu)
Be sure to setup proper ACLs and SSF (security strength factors).
It is very easy to send passwords in the clear if you're not careful.
http://www.openldap.org/doc/

NFS
NFS is not an encrypted.
It can be wrapped in ssl with some trickery.
Without Kerberos is relies on ip_addr for auth.
With Kerberos it's possible that SASL is used to encrypt everything.

Kerberos
Requires OpenLDAP to have SASL pass-through authentication for LDAP authentication. (Not difficult.)
Should use DNS entries. (Not required, but very useful).
GSSAPI can be used instead of ssh-keys. (Can co-exist.)
KDC machines should be separate from your client machines.

OpenAFS
Encrypted with DES. (Not considered secure.)
Requires either kerberos or it's own legacy authserver.
Has it's own file system ACLs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .