mirror of
https://github.com/samba-team/samba.git
synced 2025-02-22 05:57:43 +03:00
541 lines
14 KiB
HTML
541 lines
14 KiB
HTML
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML
|
|
><HEAD
|
|
><TITLE
|
|
>Samba as Stand-Alone Server</TITLE
|
|
><META
|
|
NAME="GENERATOR"
|
|
CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK
|
|
REL="HOME"
|
|
TITLE="SAMBA Project Documentation"
|
|
HREF="samba-howto-collection.html"><LINK
|
|
REL="UP"
|
|
TITLE="Type of installation"
|
|
HREF="type.html"><LINK
|
|
REL="PREVIOUS"
|
|
TITLE="Nomenclature of Server Types"
|
|
HREF="servertype.html"><LINK
|
|
REL="NEXT"
|
|
TITLE="Samba as an NT4 or Win2k Primary Domain Controller"
|
|
HREF="samba-pdc.html"></HEAD
|
|
><BODY
|
|
CLASS="CHAPTER"
|
|
BGCOLOR="#FFFFFF"
|
|
TEXT="#000000"
|
|
LINK="#0000FF"
|
|
VLINK="#840084"
|
|
ALINK="#0000FF"
|
|
><DIV
|
|
CLASS="NAVHEADER"
|
|
><TABLE
|
|
SUMMARY="Header navigation table"
|
|
WIDTH="100%"
|
|
BORDER="0"
|
|
CELLPADDING="0"
|
|
CELLSPACING="0"
|
|
><TR
|
|
><TH
|
|
COLSPAN="3"
|
|
ALIGN="center"
|
|
>SAMBA Project Documentation</TH
|
|
></TR
|
|
><TR
|
|
><TD
|
|
WIDTH="10%"
|
|
ALIGN="left"
|
|
VALIGN="bottom"
|
|
><A
|
|
HREF="servertype.html"
|
|
ACCESSKEY="P"
|
|
>Prev</A
|
|
></TD
|
|
><TD
|
|
WIDTH="80%"
|
|
ALIGN="center"
|
|
VALIGN="bottom"
|
|
></TD
|
|
><TD
|
|
WIDTH="10%"
|
|
ALIGN="right"
|
|
VALIGN="bottom"
|
|
><A
|
|
HREF="samba-pdc.html"
|
|
ACCESSKEY="N"
|
|
>Next</A
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
><HR
|
|
ALIGN="LEFT"
|
|
WIDTH="100%"></DIV
|
|
><DIV
|
|
CLASS="CHAPTER"
|
|
><H1
|
|
><A
|
|
NAME="SECURITYLEVELS"
|
|
></A
|
|
>Chapter 6. Samba as Stand-Alone Server</H1
|
|
><P
|
|
>In this section the function and purpose of Samba's <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="EMPHASIS"
|
|
>security</I
|
|
></SPAN
|
|
>
|
|
modes are described.</P
|
|
><DIV
|
|
CLASS="SECT1"
|
|
><H1
|
|
CLASS="SECT1"
|
|
><A
|
|
NAME="AEN896"
|
|
>6.1. User and Share security level</A
|
|
></H1
|
|
><P
|
|
>A SMB server tells the client at startup what "security level" it is
|
|
running. There are two options "share level" and "user level". Which
|
|
of these two the client receives affects the way the client then tries
|
|
to authenticate itself. It does not directly affect (to any great
|
|
extent) the way the Samba server does security. I know this is
|
|
strange, but it fits in with the client/server approach of SMB. In SMB
|
|
everything is initiated and controlled by the client, and the server
|
|
can only tell the client what is available and whether an action is
|
|
allowed. </P
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN899"
|
|
>6.1.1. User Level Security</A
|
|
></H2
|
|
><P
|
|
>I'll describe user level security first, as its simpler. In user level
|
|
security the client will send a "session setup" command directly after
|
|
the protocol negotiation. This contains a username and password. The
|
|
server can either accept or reject that username/password
|
|
combination. Note that at this stage the server has no idea what
|
|
share the client will eventually try to connect to, so it can't base
|
|
the "accept/reject" on anything other than:</P
|
|
><P
|
|
></P
|
|
><OL
|
|
TYPE="1"
|
|
><LI
|
|
><P
|
|
>the username/password</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>the machine that the client is coming from</P
|
|
></LI
|
|
></OL
|
|
><P
|
|
>If the server accepts the username/password then the client expects to
|
|
be able to mount any share (using a "tree connection") without
|
|
specifying a password. It expects that all access rights will be as
|
|
the username/password specified in the "session setup". </P
|
|
><P
|
|
>It is also possible for a client to send multiple "session setup"
|
|
requests. When the server responds it gives the client a "uid" to use
|
|
as an authentication tag for that username/password. The client can
|
|
maintain multiple authentication contexts in this way (WinDD is an
|
|
example of an application that does this)</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN909"
|
|
>6.1.2. Share Level Security</A
|
|
></H2
|
|
><P
|
|
>Ok, now for share level security. In share level security the client
|
|
authenticates itself separately for each share. It will send a
|
|
password along with each "tree connection" (share mount). It does not
|
|
explicitly send a username with this operation. The client is
|
|
expecting a password to be associated with each share, independent of
|
|
the user. This means that samba has to work out what username the
|
|
client probably wants to use. It is never explicitly sent the
|
|
username. Some commercial SMB servers such as NT actually associate
|
|
passwords directly with shares in share level security, but samba
|
|
always uses the unix authentication scheme where it is a
|
|
username/password that is authenticated, not a "share/password".</P
|
|
><P
|
|
>Many clients send a "session setup" even if the server is in share
|
|
level security. They normally send a valid username but no
|
|
password. Samba records this username in a list of "possible
|
|
usernames". When the client then does a "tree connection" it also adds
|
|
to this list the name of the share they try to connect to (useful for
|
|
home directories) and any users listed in the <B
|
|
CLASS="COMMAND"
|
|
>user =</B
|
|
> <TT
|
|
CLASS="FILENAME"
|
|
>smb.conf</TT
|
|
>
|
|
line. The password is then checked in turn against these "possible
|
|
usernames". If a match is found then the client is authenticated as
|
|
that user.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN915"
|
|
>6.1.3. Server Level Security</A
|
|
></H2
|
|
><P
|
|
>Finally "server level" security. In server level security the samba
|
|
server reports to the client that it is in user level security. The
|
|
client then does a "session setup" as described earlier. The samba
|
|
server takes the username/password that the client sends and attempts
|
|
to login to the "password server" by sending exactly the same
|
|
username/password that it got from the client. If that server is in
|
|
user level security and accepts the password then samba accepts the
|
|
clients connection. This allows the samba server to use another SMB
|
|
server as the "password server". </P
|
|
><P
|
|
>You should also note that at the very start of all this, where the
|
|
server tells the client what security level it is in, it also tells
|
|
the client if it supports encryption. If it does then it supplies the
|
|
client with a random "cryptkey". The client will then send all
|
|
passwords in encrypted form. You have to compile samba with encryption
|
|
enabled to support this feature, and you have to maintain a separate
|
|
smbpasswd file with SMB style encrypted passwords. It is
|
|
cryptographically impossible to translate from unix style encryption
|
|
to SMB style encryption, although there are some fairly simple management
|
|
schemes by which the two could be kept in sync.</P
|
|
><P
|
|
>"security = server" means that Samba reports to clients that
|
|
it is running in "user mode" but actually passes off all authentication
|
|
requests to another "user mode" server. This requires an additional
|
|
parameter "password server =" that points to the real authentication server.
|
|
That real authentication server can be another Samba server or can be a
|
|
Windows NT server, the later natively capable of encrypted password support.</P
|
|
><DIV
|
|
CLASS="SECT3"
|
|
><H3
|
|
CLASS="SECT3"
|
|
><A
|
|
NAME="AEN920"
|
|
>6.1.3.1. Configuring Samba for Seemless Windows Network Integration</A
|
|
></H3
|
|
><P
|
|
>MS Windows clients may use encrypted passwords as part of a challenege/response
|
|
authentication model (a.k.a. NTLMv1) or alone, or clear text strings for simple
|
|
password based authentication. It should be realized that with the SMB protocol
|
|
the password is passed over the network either in plain text or encrypted, but
|
|
not both in the same authentication requests.</P
|
|
><P
|
|
>When encrypted passwords are used a password that has been entered by the user
|
|
is encrypted in two ways:</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>An MD4 hash of the UNICODE of the password
|
|
string. This is known as the NT hash.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>The password is converted to upper case,
|
|
and then padded or trucated to 14 bytes. This string is
|
|
then appended with 5 bytes of NULL characters and split to
|
|
form two 56 bit DES keys to encrypt a "magic" 8 byte value.
|
|
The resulting 16 bytes for the LanMan hash.
|
|
</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
>MS Windows 95 pre-service pack 1, MS Windows NT versions 3.x and version 4.0
|
|
pre-service pack 3 will use either mode of password authentication. All
|
|
versions of MS Windows that follow these versions no longer support plain
|
|
text passwords by default.</P
|
|
><P
|
|
>MS Windows clients have a habit of dropping network mappings that have been idle
|
|
for 10 minutes or longer. When the user attempts to use the mapped drive
|
|
connection that has been dropped, the client re-establishes the connection using
|
|
a cached copy of the password.</P
|
|
><P
|
|
>When Microsoft changed the default password mode, support was dropped for caching
|
|
of the plain text password. This means that when the registry parameter is changed
|
|
to re-enable use of plain text passwords it appears to work, but when a dropped
|
|
service connection mapping attempts to revalidate it will fail if the remote
|
|
authentication server does not support encrypted passwords. This means that it
|
|
is definitely not a good idea to re-enable plain text password support in such clients.</P
|
|
><P
|
|
>The following parameters can be used to work around the issue of Windows 9x client
|
|
upper casing usernames and password before transmitting them to the SMB server
|
|
when using clear text authentication.</P
|
|
><P
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
> <A
|
|
HREF="smb.conf.5.html#PASSWORDLEVEL"
|
|
TARGET="_top"
|
|
>passsword level</A
|
|
> = <VAR
|
|
CLASS="REPLACEABLE"
|
|
>integer</VAR
|
|
>
|
|
<A
|
|
HREF="smb.conf.5.html#USERNAMELEVEL"
|
|
TARGET="_top"
|
|
>username level</A
|
|
> = <VAR
|
|
CLASS="REPLACEABLE"
|
|
>integer</VAR
|
|
></PRE
|
|
></P
|
|
><P
|
|
>By default Samba will lower case the username before attempting to lookup the user
|
|
in the database of local system accounts. Because UNIX usernames conventionally
|
|
only contain lower case character, the <VAR
|
|
CLASS="PARAMETER"
|
|
>username level</VAR
|
|
> parameter
|
|
is rarely needed.</P
|
|
><P
|
|
>However, passwords on UNIX systems often make use of mixed case characters.
|
|
This means that in order for a user on a Windows 9x client to connect to a Samba
|
|
server using clear text authentication, the <VAR
|
|
CLASS="PARAMETER"
|
|
>password level</VAR
|
|
>
|
|
must be set to the maximum number of upper case letter which <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="EMPHASIS"
|
|
>could</I
|
|
></SPAN
|
|
>
|
|
appear is a password. Note that is the server OS uses the traditional DES version
|
|
of crypt(), then a <VAR
|
|
CLASS="PARAMETER"
|
|
>password level</VAR
|
|
> of 8 will result in case
|
|
insensitive passwords as seen from Windows users. This will also result in longer
|
|
login times as Samba hash to compute the permutations of the password string and
|
|
try them one by one until a match is located (or all combinations fail).</P
|
|
><P
|
|
>The best option to adopt is to enable support for encrypted passwords
|
|
where ever Samba is used. There are three configuration possibilities
|
|
for support of encrypted passwords:</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT3"
|
|
><H3
|
|
CLASS="SECT3"
|
|
><A
|
|
NAME="AEN946"
|
|
>6.1.3.2. Use MS Windows NT as an authentication server</A
|
|
></H3
|
|
><P
|
|
>This method involves the additions of the following parameters in the <TT
|
|
CLASS="FILENAME"
|
|
>smb.conf</TT
|
|
> file:</P
|
|
><P
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
> encrypt passwords = Yes
|
|
security = server
|
|
password server = "NetBIOS_name_of_PDC"</PRE
|
|
></P
|
|
><P
|
|
>There are two ways of identifying whether or not a username and
|
|
password pair was valid or not. One uses the reply information provided
|
|
as part of the authentication messaging process, the other uses
|
|
just and error code.</P
|
|
><P
|
|
>The down-side of this mode of configuration is the fact that
|
|
for security reasons Samba will send the password server a bogus
|
|
username and a bogus password and if the remote server fails to
|
|
reject the username and password pair then an alternative mode
|
|
of identification of validation is used. Where a site uses password
|
|
lock out after a certain number of failed authentication attempts
|
|
this will result in user lockouts.</P
|
|
><P
|
|
>Use of this mode of authentication does require there to be
|
|
a standard Unix account for the user, this account can be blocked
|
|
to prevent logons by other than MS Windows clients.</P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN955"
|
|
>6.1.4. Domain Level Security</A
|
|
></H2
|
|
><P
|
|
>When samba is operating in <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="EMPHASIS"
|
|
>security = domain</I
|
|
></SPAN
|
|
> mode this means that
|
|
the Samba server has a domain security trust account (a machine account) and will cause
|
|
all authentication requests to be passed through to the domain controllers.</P
|
|
><DIV
|
|
CLASS="SECT3"
|
|
><H3
|
|
CLASS="SECT3"
|
|
><A
|
|
NAME="AEN959"
|
|
>6.1.4.1. Samba as a member of an MS Windows NT security domain</A
|
|
></H3
|
|
><P
|
|
>This method involves additon of the following paramters in the <TT
|
|
CLASS="FILENAME"
|
|
>smb.conf</TT
|
|
> file:</P
|
|
><P
|
|
><PRE
|
|
CLASS="PROGRAMLISTING"
|
|
> encrypt passwords = Yes
|
|
security = domain
|
|
workgroup = "name of NT domain"
|
|
password server = *</PRE
|
|
></P
|
|
><P
|
|
>The use of the "*" argument to <B
|
|
CLASS="COMMAND"
|
|
>password server</B
|
|
> will cause samba to locate the
|
|
domain controller in a way analogous to the way this is done within MS Windows NT.
|
|
This is the default behaviour.</P
|
|
><P
|
|
>In order for this method to work the Samba server needs to join the
|
|
MS Windows NT security domain. This is done as follows:</P
|
|
><P
|
|
></P
|
|
><UL
|
|
><LI
|
|
><P
|
|
>On the MS Windows NT domain controller using
|
|
the Server Manager add a machine account for the Samba server.
|
|
</P
|
|
></LI
|
|
><LI
|
|
><P
|
|
>Next, on the Linux system execute:
|
|
<B
|
|
CLASS="COMMAND"
|
|
>smbpasswd -r PDC_NAME -j DOMAIN_NAME</B
|
|
>
|
|
</P
|
|
></LI
|
|
></UL
|
|
><P
|
|
>Use of this mode of authentication does require there to be a standard Unix account
|
|
for the user in order to assign a uid once the account has been authenticated by
|
|
the remote Windows DC. This account can be blocked to prevent logons by other than
|
|
MS Windows clients by things such as setting an invalid shell in the
|
|
<TT
|
|
CLASS="FILENAME"
|
|
>/etc/passwd</TT
|
|
> entry. </P
|
|
><P
|
|
>An alternative to assigning UIDs to Windows users on a Samba member server is
|
|
presented in the <A
|
|
HREF="winbind.html"
|
|
TARGET="_top"
|
|
>Winbind Overview</A
|
|
> chapter
|
|
in this HOWTO collection.</P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="SECT2"
|
|
><H2
|
|
CLASS="SECT2"
|
|
><A
|
|
NAME="AEN978"
|
|
>6.1.5. ADS Level Security</A
|
|
></H2
|
|
><P
|
|
>For information about the configuration option please refer to the entire section entitled
|
|
<SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="EMPHASIS"
|
|
>Samba as an ADS Domain Member.</I
|
|
></SPAN
|
|
></P
|
|
></DIV
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="NAVFOOTER"
|
|
><HR
|
|
ALIGN="LEFT"
|
|
WIDTH="100%"><TABLE
|
|
SUMMARY="Footer navigation table"
|
|
WIDTH="100%"
|
|
BORDER="0"
|
|
CELLPADDING="0"
|
|
CELLSPACING="0"
|
|
><TR
|
|
><TD
|
|
WIDTH="33%"
|
|
ALIGN="left"
|
|
VALIGN="top"
|
|
><A
|
|
HREF="servertype.html"
|
|
ACCESSKEY="P"
|
|
>Prev</A
|
|
></TD
|
|
><TD
|
|
WIDTH="34%"
|
|
ALIGN="center"
|
|
VALIGN="top"
|
|
><A
|
|
HREF="samba-howto-collection.html"
|
|
ACCESSKEY="H"
|
|
>Home</A
|
|
></TD
|
|
><TD
|
|
WIDTH="33%"
|
|
ALIGN="right"
|
|
VALIGN="top"
|
|
><A
|
|
HREF="samba-pdc.html"
|
|
ACCESSKEY="N"
|
|
>Next</A
|
|
></TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
WIDTH="33%"
|
|
ALIGN="left"
|
|
VALIGN="top"
|
|
>Nomenclature of Server Types</TD
|
|
><TD
|
|
WIDTH="34%"
|
|
ALIGN="center"
|
|
VALIGN="top"
|
|
><A
|
|
HREF="type.html"
|
|
ACCESSKEY="U"
|
|
>Up</A
|
|
></TD
|
|
><TD
|
|
WIDTH="33%"
|
|
ALIGN="right"
|
|
VALIGN="top"
|
|
>Samba as an NT4 or Win2k Primary Domain Controller</TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
></BODY
|
|
></HTML
|
|
> |