sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-27 03:21:53 +03:00
Code
a949db7c6d
samba-mirror/source4/setup/secrets.ldif

56 lines
1.3 KiB
Plaintext
Raw Normal View History

r4682: A LDB-based secrets implementation in Samba4. This uses LDB (a local secrets.ldb and the global samdb) to fill out the secrets from an LSA perspective. Some small changes to come, but the bulk of the work is now done. A re-provision is required after this change. Andrew Bartlett (This used to be commit ded33033521a6a1c7ea80758c5c5aeeebb182a51)
2005-01-11 17:04:58 +03:00
dn: @INDEXLIST
@IDXATTR: cn
r5984: Add index and attributes to default ldif for secrets.ldb Andrew Bartlett (This used to be commit 41dea45892362c4b25a93d8719fb7843485a7b98)
2005-03-23 03:07:21 +03:00
@IDXATTR: flatname
r5091: The Kerberos secrets are queried by realm Andrew Bartlett (This used to be commit 8f38b5ae229984c9f9b0d7721d04da6a45c16f13)
2005-01-29 07:03:12 +03:00
@IDXATTR: realm
r4682: A LDB-based secrets implementation in Samba4. This uses LDB (a local secrets.ldb and the global samdb) to fill out the secrets from an LSA perspective. Some small changes to come, but the bulk of the work is now done. A re-provision is required after this change. Andrew Bartlett (This used to be commit ded33033521a6a1c7ea80758c5c5aeeebb182a51)
2005-01-11 17:04:58 +03:00
r5984: Add index and attributes to default ldif for secrets.ldb Andrew Bartlett (This used to be commit 41dea45892362c4b25a93d8719fb7843485a7b98)
2005-03-23 03:07:21 +03:00
dn: @ATTRIBUTES
realm: CASE_INSENSITIVE
flatname: CASE_INSENSITIVE
sAMAccountName: CASE_INSENSITIVE
r8999: Use the timestamps module to ensure we update times. Andrew Bartlett (This used to be commit e6abd9f70449e9c5716cd36565442873bdc7d44c)
2005-08-03 11:25:36 +04:00
#Add modules to the list to activate them by default
#beware often order is important
dn: @MODULES
r10916: - finished the 'operational' ldb module - removed the timestamps module, replacing it with the operational module - added a ldb_msg_copy_shallow() function which should be used when a module wants to add new elements to a message on add/modify. This is needed because the caller might be using a constant structure, or may want to re-use the structure again - enabled the UTC time attribute syntaxes in the operational module (This used to be commit 61e8b010223ac6a0573185008f3719ba29574688)
2005-10-12 11:57:39 +04:00
@LIST: operational
r8999: Use the timestamps module to ensure we update times. Andrew Bartlett (This used to be commit e6abd9f70449e9c5716cd36565442873bdc7d44c)
2005-08-03 11:25:36 +04:00
r4682: A LDB-based secrets implementation in Samba4. This uses LDB (a local secrets.ldb and the global samdb) to fill out the secrets from an LSA perspective. Some small changes to come, but the bulk of the work is now done. A re-provision is required after this change. Andrew Bartlett (This used to be commit ded33033521a6a1c7ea80758c5c5aeeebb182a51)
2005-01-11 17:04:58 +03:00
dn: CN=LSA Secrets
objectClass: top
objectClass: container
cn: LSA Secrets
r4763: Join Samba4 to itself during the provision process. Andrew Bartlett (This used to be commit feca96fe5a1612592757f53f7aa4eb5a39fd24ff)
2005-01-16 01:15:12 +03:00
dn: CN=Primary Domains
objectClass: top
objectClass: container
cn: Primary Domains
r5900: Use flatname to specify the netbios domain name (matches what win2k3 uses for trusted domain records) in the secrets join records. Andrew Bartlett (This used to be commit a6c502832c4ef471bd423b795f210abf3bb96ca5)
2005-03-19 11:11:49 +03:00
dn: flatname=${DOMAIN},CN=Primary Domains
r4763: Join Samba4 to itself during the provision process. Andrew Bartlett (This used to be commit feca96fe5a1612592757f53f7aa4eb5a39fd24ff)
2005-01-16 01:15:12 +03:00
objectClass: top
objectClass: primaryDomain
r11995: A big kerberos-related update. This merges Samba4 up to current lorikeet-heimdal, which includes a replacement for some Samba-specific hacks. In particular, the credentials system now supplies GSS client and server credentials. These are imported into GSS with gss_krb5_import_creds(). Unfortunetly this can't take an MEMORY keytab, so we now create a FILE based keytab as provision and join time. Because the keytab is now created in advance, we don't spend .4s at negprot doing sha1 s2k calls. Also, because the keytab is read in real time, any change in the server key will be correctly picked up by the the krb5 code. To mark entries in the secrets which should be exported to a keytab, there is a new kerberosSecret objectClass. The new routine cli_credentials_update_all_keytabs() searches for these, and updates the keytabs. This is called in the provision.js via the ejs wrapper credentials_update_all_keytabs(). We can now (in theory) use a system-provided /etc/krb5.keytab, if krb5Keytab: FILE:/etc/krb5.keytab is added to the secrets.ldb record. By default the attribute privateKeytab: secrets.keytab is set, pointing to allow the whole private directory to be moved without breaking the internal links. (This used to be commit 6b75573df49c6210e1b9d71e108a9490976bd41d)
2005-12-01 08:20:39 +03:00
objectClass: kerberosSecret
r5900: Use flatname to specify the netbios domain name (matches what win2k3 uses for trusted domain records) in the secrets join records. Andrew Bartlett (This used to be commit a6c502832c4ef471bd423b795f210abf3bb96ca5)
2005-03-19 11:11:49 +03:00
flatname: ${DOMAIN}
r4914: Fill in the realm for the self-join. Andrew Bartlett (This used to be commit bc901ecfb4babe72858185e79b91f6a53c04b71f)
2005-01-22 02:15:18 +03:00
realm: ${REALM}
r8158: - use the timestring for the serial number of the bind zone file - add --krbtgtpass and --machinepass options, with them you can easy set them to default values for testing so that you don't need to setup a new keytab file when you rerun provision.pl metze (This used to be commit cfb72455970c182aaba67bf9cf9775a854f143ff)
2005-07-05 11:10:52 +04:00
secret: ${MACHINEPASS}
r6698: Our domain join code requires that the secureChannelType be set. Type 6 is BDC, which is correct for a self-join. Andrew Bartlett (This used to be commit cd61ff80f886bcb4a8c6b681879ee269604e98f3)
2005-05-10 13:49:45 +04:00
secureChannelType: 6
r5983: Start support for being a domain member in Samba4. This adds the auth_domain module to the auth subsystem, and cleans up some small details around the join process (ensuring all the right info is in the DB). Andrew Bartlett (This used to be commit 858cbfb8210239aa85a01da95e5beb9546a998a5)
2005-03-23 03:05:44 +03:00
sAMAccountName: ${NETBIOSNAME}$
r4763: Join Samba4 to itself during the provision process. Andrew Bartlett (This used to be commit feca96fe5a1612592757f53f7aa4eb5a39fd24ff)
2005-01-16 01:15:12 +03:00
whenCreated: ${LDAPTIME}
whenChanged: ${LDAPTIME}
r7988: Store the KVNO for the machine account, and set it up in the provision. Andrew Bartlett (This used to be commit 90e94a4630c24282cd93ee05e258877b38e24a57)
2005-06-29 06:28:57 +04:00
msDS-KeyVersionNumber: 1
r10855: Put the domain SID in secrets.ldb by default, and add http as a default SPN alias. Andrew Bartlett (This used to be commit e4fe5802dae544f4dabf0c6d04a55be1144d8820)
2005-10-10 02:19:20 +04:00
objectSid: ${DOMAINSID}
r11995: A big kerberos-related update. This merges Samba4 up to current lorikeet-heimdal, which includes a replacement for some Samba-specific hacks. In particular, the credentials system now supplies GSS client and server credentials. These are imported into GSS with gss_krb5_import_creds(). Unfortunetly this can't take an MEMORY keytab, so we now create a FILE based keytab as provision and join time. Because the keytab is now created in advance, we don't spend .4s at negprot doing sha1 s2k calls. Also, because the keytab is read in real time, any change in the server key will be correctly picked up by the the krb5 code. To mark entries in the secrets which should be exported to a keytab, there is a new kerberosSecret objectClass. The new routine cli_credentials_update_all_keytabs() searches for these, and updates the keytabs. This is called in the provision.js via the ejs wrapper credentials_update_all_keytabs(). We can now (in theory) use a system-provided /etc/krb5.keytab, if krb5Keytab: FILE:/etc/krb5.keytab is added to the secrets.ldb record. By default the attribute privateKeytab: secrets.keytab is set, pointing to allow the whole private directory to be moved without breaking the internal links. (This used to be commit 6b75573df49c6210e1b9d71e108a9490976bd41d)
2005-12-01 08:20:39 +03:00
privateKeytab: secrets.keytab
r11200: Reposition the creation of the kerberos keytab for GSSAPI and Krb5 authentication. This pulls the creating of the keytab back to the credentials code, and removes the special case of 'use keberos keytab = yes' for now. This allows (and requires) the callers to specify the credentials for the server credentails to GENSEC. This allows kpasswdd (soon to be added) to use a different set of kerberos credentials. The 'use kerberos keytab' code will be moved into the credentials layer, as the layers below now expect a keytab. We also now allow for the old secret to be stored into the credentials, allowing service password changes. Andrew Bartlett (This used to be commit 205f77c579ac8680c85f713a76de5767189c627b)
2005-10-20 07:47:55 +04:00
r13107: Follow the lead of Heimdal's kpasswdd and use the HDB (hdb-ldb in our case) as the keytab. This avoids issues in replicated setups, as we will replicate the kpasswd key correctly (including from windows, which is why I care at the moment). Andrew Bartlett (This used to be commit 849500d1aa658817052423051b1f5d0b7a1db8e0)
2006-01-24 08:31:08 +03:00
# A hook from our credentials system into HDB, as we must be on a KDC,
# we can look directly into the database.
r11200: Reposition the creation of the kerberos keytab for GSSAPI and Krb5 authentication. This pulls the creating of the keytab back to the credentials code, and removes the special case of 'use keberos keytab = yes' for now. This allows (and requires) the callers to specify the credentials for the server credentails to GENSEC. This allows kpasswdd (soon to be added) to use a different set of kerberos credentials. The 'use kerberos keytab' code will be moved into the credentials layer, as the layers below now expect a keytab. We also now allow for the old secret to be stored into the credentials, allowing service password changes. Andrew Bartlett (This used to be commit 205f77c579ac8680c85f713a76de5767189c627b)
2005-10-20 07:47:55 +04:00
dn: samAccountName=krbtgt,flatname=${DOMAIN},CN=Principals
objectClass: top
objectClass: secret
r11995: A big kerberos-related update. This merges Samba4 up to current lorikeet-heimdal, which includes a replacement for some Samba-specific hacks. In particular, the credentials system now supplies GSS client and server credentials. These are imported into GSS with gss_krb5_import_creds(). Unfortunetly this can't take an MEMORY keytab, so we now create a FILE based keytab as provision and join time. Because the keytab is now created in advance, we don't spend .4s at negprot doing sha1 s2k calls. Also, because the keytab is read in real time, any change in the server key will be correctly picked up by the the krb5 code. To mark entries in the secrets which should be exported to a keytab, there is a new kerberosSecret objectClass. The new routine cli_credentials_update_all_keytabs() searches for these, and updates the keytabs. This is called in the provision.js via the ejs wrapper credentials_update_all_keytabs(). We can now (in theory) use a system-provided /etc/krb5.keytab, if krb5Keytab: FILE:/etc/krb5.keytab is added to the secrets.ldb record. By default the attribute privateKeytab: secrets.keytab is set, pointing to allow the whole private directory to be moved without breaking the internal links. (This used to be commit 6b75573df49c6210e1b9d71e108a9490976bd41d)
2005-12-01 08:20:39 +03:00
objectClass: kerberosSecret
r11200: Reposition the creation of the kerberos keytab for GSSAPI and Krb5 authentication. This pulls the creating of the keytab back to the credentials code, and removes the special case of 'use keberos keytab = yes' for now. This allows (and requires) the callers to specify the credentials for the server credentails to GENSEC. This allows kpasswdd (soon to be added) to use a different set of kerberos credentials. The 'use kerberos keytab' code will be moved into the credentials layer, as the layers below now expect a keytab. We also now allow for the old secret to be stored into the credentials, allowing service password changes. Andrew Bartlett (This used to be commit 205f77c579ac8680c85f713a76de5767189c627b)
2005-10-20 07:47:55 +04:00
flatname: ${DOMAIN}
realm: ${REALM}
sAMAccountName: krbtgt
whenCreated: ${LDAPTIME}
whenChanged: ${LDAPTIME}
objectSid: ${DOMAINSID}
servicePrincipalName: kadmin/changepw
r13320: Fix kpasswd's use of the local HDB. /dev/null was a bad idea, we want 'no filename' instead. Andrew Bartlett (This used to be commit 7de385dca4c40e98a40ef1e769826de8bff64323)
2006-02-04 02:07:58 +03:00
krb5Keytab: HDB:ldb:sam.ldb:
#The trailing : here is a HACK, but it matches the Heimdal format.
Copy Permalink