We're working towards a zero trust security model in our office, with servers secured behind a WireGuard VPN. We already use WireGuard for remote access, so this is the simplest way to ensure encryption for all network traffic. WireGuard guarantees a specific IP address for each user.
We would like to authenticate file server access with both username and IP address, to prevent lateral movement in the event of a breach. We're using Samba 4.13 with the simple default
passdb backend = tdbsam (no domain controller).
I was hoping for a simple solution with PAM, but although the default configuration file still includes
auth, I've read that it isn't supported (Samba uses challenge-response authentication, which isn't the PAM way). When I added
auth required pam_rhosts.so to
/etc/pam.d/samba, there was no change in my ability to authenticate. Adding it to the
session sections caused authentication to fail, even from the authorized IP address.
Other solutions I can see are to modify the source code or run an Active Directory Domain Controller, but those seem like a much bigger job to implement and maintain. An application firewall might also work, but I'm not aware of anything that can inspect Samba traffic.
Is there a simple way to add this user-host pair restriction (or MFA in general) to Samba 4?
-- Edit --
/etc/pam.d/samba configuration clearly has some effect, because adding a 'debug' option to any of the lines in the
auth section gives debug logging as follows, though additional
required lines make no difference to the outcome of authentication:
[2022/11/10 15:56:56.258835, 3] ../../auth/ntlmssp/ntlmssp_server.c:509(ntlmssp_server_preauth) Got user=[username] domain=[FILESERVER] workstation=[COMPUTER-NAME] len1=24 len2=190 [2022/11/10 15:56:56.258932, 3] ../../source3/auth/auth.c:200(auth_check_ntlm_password) check_ntlm_password: Checking password for unmapped user [FILESERVER]\[username]@[COMPUTER-NAME] with the new password interface [2022/11/10 15:56:56.258959, 3] ../../source3/auth/auth.c:203(auth_check_ntlm_password) check_ntlm_password: mapped user is: [FILESERVER]\[username]@[COMPUTER-NAME] [2022/11/10 15:56:56.259651, 4] ../../source3/auth/check_samsec.c:183(sam_account_ok) sam_account_ok: Checking SMB password for user username [2022/11/10 15:56:56.262124, 3] ../../source3/auth/auth.c:267(auth_check_ntlm_password) auth_check_ntlm_password: sam_ignoredomain authentication for user [username] succeeded [2022/11/10 15:56:56.262230, 4] ../../source3/auth/pampass.c:485(smb_pam_start) smb_pam_start: PAM: Init user: username [2022/11/10 15:56:56.267184, 4] ../../source3/auth/pampass.c:494(smb_pam_start) smb_pam_start: PAM: setting rhost to: 10.1.2.3 [2022/11/10 15:56:56.267246, 4] ../../source3/auth/pampass.c:503(smb_pam_start) smb_pam_start: PAM: setting tty [2022/11/10 15:56:56.267285, 4] ../../source3/auth/pampass.c:511(smb_pam_start) smb_pam_start: PAM: Init passed for user: username [2022/11/10 15:56:56.267323, 4] ../../source3/auth/pampass.c:569(smb_pam_account) smb_pam_account: PAM: Account Management for User: username [2022/11/10 15:56:56.267907, 4] ../../source3/auth/pampass.c:588(smb_pam_account) smb_pam_account: PAM: Account OK for User: username [2022/11/10 15:56:56.268550, 4] ../../source3/auth/pampass.c:467(smb_pam_end) smb_pam_end: PAM: PAM_END OK. [2022/11/10 15:56:56.268641, 2] ../../source3/auth/auth.c:323(auth_check_ntlm_password) check_ntlm_password: authentication for user [username] -> [username] -> [username] succeeded