Re: LDAP bind authentication

david.magda@xxxxxxxxx wrote:
On Feb 16, 5:45 pm, "Neal A. Lucier" <nluc...@xxxxxxxxxxxxxxx> wrote:
Solaris doesn't need to use a proxy account. The main reason it does is
because virtual list view indexes aren't available to non-authenticated
users using Sun's Directory Server, IIRC. VLVs are designed to return

Well my situation will probably be against Windows 2000/3 Active
Directory. Not sure how much this buys us with that. It may be better
to not use SSL for GECOS look ups just to reduce load on the server.


These are my thoughts on why in general I think proxy users are good, but that they are bad when used with ADS. Since Solaris doesn't care if the client is configured to connect anonymously or via proxy, just do whatever works best for you.

In a "native" LDAP environment you put the proxy user object in the directory information tree (DIT) such that your OSes cannot see that user, thus the user is only an LDAP user and is not a logon user for any of your OSes. Then using access control instructions (ACIs) you limit explicitly what attributes/objects that user has rights to. Because of this, you can treat the proxy user just as an authenticated anonymous user from a security stand-point; yet, they are still very useful for accounting and other management tasks. It also allows you to lock down anonymous even tighter if you are super paranoid.

In the ADS world there is a single ou for Users and Groups (and proxy users), and these users are visible to all clients of the domain. You would then have to use the windows management functions to make sure that the proxy user couldn't log on, had guest rights, etc. I think this method makes the proxy user unappealing to use with ADS.

I also came across these instructions about AD integration, but
Kerberos is used for authentication rather than LDAP:

http://blog.scottlowe.org/2006/10/16/refined-solaris-10-ad-integration-instructions/
http://blog.scottlowe.org/2006/08/29/follow-ups-on-solaris-native-kerberos-authentication/


These are not bad, the only real difference is how you configure pam and nss. You don't need such a large 'ldapclient' string since LDAP attribute and object names are case insensitive. I would suggest the following base config to see how things work.

ldapclient manual \
-a credentialLevel=anonymous \
-a authenticationMethod=tls:simple \
-a proxyDN=cn=proxyuser,cn=Users,dc=example,dc=com \
-a defaultSearchBase=dc=example,dc=com \
-a domainName=example.com \
-a “defaultServerList=172.16.1.10” \
-a attributeMap=passwd:gecos=cn \
-a attributeMap=passwd:homedirectory=unixHomeDirectory \
-a objectClassMap=group:posixGroup=group \
-a objectClassMap=passwd:posixAccount=user \
-a objectClassMap=shadow:shadowAccount=user \
-a serviceSearchDescriptor=passwd:cn=users,dc=example,dc=com?one \
-a serviceSearchDescriptor=group:cn=users,dc=example,dc=com?one


I think one should use a more specific serviceSearchDescriptors than the blog. Also, the Sun doc on naming is an excellent read.

http://docs.sun.com/app/docs/doc/816-4556

Now, to force the client to perform a bind to authenticate instead of
having the client compare the hashes locally you have to:

1. make sure the proxy user can't see the hash
2. everywhere in /etc/pam.conf that you see:
<servicename> auth required pam_unix_auth.so.1

change this to:
<servicename> auth binding pam_unix_auth.so.1 server_policy
<servicename> auth required pam_ldap.so.1

Is this in addition to the ldapclient(1M) argument that Chriss Ridd
suggested

-a serviceAuthenticationMethod=pam_ldap:tls:simple

or in place of it?


The authenticationMethod and serviceAuthenticationMethod arguments do not describe how the ldapclient should fucntion in terms of authentication, rather how authentication data should be transmitted. So that command just tells pam_ldap to use SSL for all LDAP traffic, 'tls', and to send the password in plaintext inside the SSL tunnel, 'simple'. You still need to configure the pam stack to use pam_ldap correctly.

To change a password via LDAP in ADS you need to use SSL and you need to connect on port 636. You will need to get the certificate of the CA that signed your DCs certificate and put it in /var/ldap/cert8.db.

Since you will need the 'passwd-cmd' as well as the 'pam_ldap' service to use SSL I would suggest using the non-service specific option:
-a authenticationMethod=tls:simple

The man page on 'ladpclient' describes all the options in more detail.

Neal
.

Relevant Pages

  • Re: LDAP authentication security ?
    ... If the application supports SASL bind with either GSS-SPNEGO or DIGEST authentication, then you can use that directly with AD without needing to secure the channel as those authentication mechanisms are already secure without channel encryption. ... Simple bind is the authentication mechanism in the LDAP V3 spec and is supported by all LDAP directories. ... If you need SSL, AD supports SSL LDAP just fine, assuming you get a certificate for your domain controllers. ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ...
    (microsoft.public.windows.server.security)
  • Re: How to add an extra password field to an AD?
    ... that the device in question uses a standard LDAP bind to do LDAP ... you can't change how bind authentication works. ... SSL cannot be used here since the protocol being used does not have an SSL ... My concern is not the LDAP traffic between the service server and the LDAP ...
    (microsoft.public.windows.server.active_directory)
  • Re: DirectoryEntry.NativeObject slow with ASP.Net, but fast in exe
    ... Ah, you are using SSL. ... account doesn't have a client certificate available that the server trusts. ... have a schema caching issue that is causing ADSI to download the LDAP schema ... >> Note that the ADSI approach to authentication doesn't really scale well. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: pam_ldap
    ... On Tue, 2005-04-05 at 10:30 -0400, Jon Thompson wrote: ... >> user names that are available through ldap. ... > LDAP while not utilizing SSL. ... > authentication portion dies while the getent still works. ...
    (Fedora)