mirror of
https://github.com/samba-team/samba.git
synced 2024-12-25 23:21:54 +03:00
3ea1c55921
To run these tests standalone, you will need the certificate and private key of the Certificate Authority. These can be specified together in the same file with the environment variable CA_CERT, or the private key may be specified in its own file with CA_PRIVATE_KEY. If either of these files are encrypted, you can specify the password in the environment variable CA_PASS. These tests create a new certificate for the user account, signed with the private key of the Certificate Authority. We negotiate the reply key with either of the public-key and Diffie-Hellman PK-INIT variants, and use the reply key to decrypt the enc-part in the response. We also check that the KDC’s signatures are valid. Most of the failures with the Heimdal KDC are due to the wrong nonce being returned in the reply compared to Windows, which issue is simple enough to correct. An example command line for manual testing against Windows: SMB_CONF_PATH=ad_dc.conf KRB5_CONFIG=krb5.conf SERVICE_USERNAME=win2k19-dc.example.com ADMIN_USERNAME=Administrator ADMIN_PASSWORD=locDCpass ADMIN_KVNO=1 FOR_USER=Administrator USERNAME=Administrator PASSWORD=locDCpass DC_SERVER=win2k19-dc.example.com SERVER=win2k19-dc.example.com DOMAIN=example REALM=example.com PYTHONPATH=bin/python STRICT_CHECKING=1 FAST_SUPPORT=1 CLAIMS_SUPPORT=1 COMPOUND_ID_SUPPORT=1 TKT_SIG_SUPPORT=1 FULL_SIG_SUPPORT=1 GNUTLS_PBKDF2_SUPPORT=1 EXPECT_PAC=1 EXPECT_EXTRA_PAC_BUFFERS=1 CHECK_CNAME=1 CHECK_PADATA=1 KADMIN_IS_TGS=0 FORCED_RC4=1 DEFAULT_ETYPES=36 CA_CERT=./win2k19-ca.pfx CA_PASS=1234 python3 python/samba/tests/krb5/pkinit_tests.py To set up windows for this I first installed an Certificate Authority with an Enterprise CA. Then I exported the private key and certificate of the CA: 1. go into the Certification Authority snap-in for the relevant computer, 2. right-clicking the CA 3. clicking ‘All Tasks’ → ‘Back up CA...’ 4. and exporting the private key and CA certificate. (I downloaded the resulting file via smbclient). After setting up an Enterprise CA, I also needed to edit the domain controller GPO to enable auto-enrollment, otherwise Windows would refuse to accept as legitimate any certificates provided by the client. That can be done by first enabling the policy: ‘Computer Configuration/Policies/Windows Settings/Security Settings/Public Key Policies/Certificate Services Client — Auto-Enrollment’, and then ticking both ‘Renew expired certificates…’ and ‘Update certificates…’) Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> |
||
|---|---|---|
| .. | ||
| provisions | ||
| win | ||
| test_samba3dump.sh | ||
| test_w2k3_file.sh | ||
| test_w2k3.sh | ||
| test_win.sh | ||
| tests_win2k3_dc.sh | ||
| tests_win.sh | ||
| tests.py | ||