Kerberos and LDAP Client on OpenBSD 7.3 - Revision history

ToroidalCore at 03:29, 22 May 2023

2023-05-22T03:29:46Z

← Older revision		Revision as of 03:29, 22 May 2023
Line 115:		Line 115:
	= 3. Configuring System Logins =		= 3. Configuring System Logins =

			The above sections allow a user to get a Kerberos ticket and use it to retrieve information from LDAP. Now, we need to allow the system to do this so that a user can actually log in at the console or via a display manager.

			=== Kerberos Authentication ===
	First, we need to configure the system to check passwords against Kerberos. Edit <code>/etc/login.conf</code> and look for the same <code>default:\</code> block as in Section 1, and edit it to add the line <code>:auth=-krb5-or-pwd:\</code> third from the bottom. The whole block should now look like this:		First, we need to configure the system to check passwords against Kerberos. Edit <code>/etc/login.conf</code> and look for the same <code>default:\</code> block as in Section 1, and edit it to add the line <code>:auth=-krb5-or-pwd:\</code> third from the bottom. The whole block should now look like this:

Line 131:		Line 134:
	:tc=auth-defaults:\		:tc=auth-defaults:\
	:tc=auth-ftp-defaults:		:tc=auth-ftp-defaults:

			=== LDAP Authorization ===
			This allows the system to retrieve information from LDAP about users and groups. OpenBSD does not directly support doing this with LDAP, but it does support network information services (NIS), and provides a bridge called <code>ypldap</code> to interface with an LDAP server.

ToroidalCore at 03:26, 22 May 2023

2023-05-22T03:26:30Z

← Older revision		Revision as of 03:26, 22 May 2023
Line 88:		Line 88:
	BASE dc=example,dc=net		BASE dc=example,dc=net
	URI ldap://krbldapsrv.example.net		URI ldap://krbldapsrv.example.net
	~~ode~~
	SASL_MECH GSSAPI		SASL_MECH GSSAPI

ToroidalCore at 03:25, 22 May 2023

2023-05-22T03:25:34Z

← Older revision		Revision as of 03:25, 22 May 2023
Line 113:		Line 113:
	openbsd$		openbsd$

	== Configuring System ~~Login =~~=		= 3. Configuring System Logins =

	First, we need to configure the system to check passwords against Kerberos. Edit <code>/etc/login.conf</code> and look for the same <code>default:\</code> block as in Section 1, and edit it to add the line <code>:auth=-krb5-or-pwd:\</code> third from the bottom. The whole block should now look like this:		First, we need to configure the system to check passwords against Kerberos. Edit <code>/etc/login.conf</code> and look for the same <code>default:\</code> block as in Section 1, and edit it to add the line <code>:auth=-krb5-or-pwd:\</code> third from the bottom. The whole block should now look like this:

ToroidalCore at 03:25, 22 May 2023

2023-05-22T03:25:05Z

← Older revision		Revision as of 03:25, 22 May 2023
Line 112:		Line 112:
	dn:uid=ben,ou=users,dc=example,dc=net		dn:uid=ben,ou=users,dc=example,dc=net
	openbsd$		openbsd$

			== Configuring System Login ==

			First, we need to configure the system to check passwords against Kerberos. Edit <code>/etc/login.conf</code> and look for the same <code>default:\</code> block as in Section 1, and edit it to add the line <code>:auth=-krb5-or-pwd:\</code> third from the bottom. The whole block should now look like this:

			default:\
			:path=/usr/bin /bin /usr/sbin /sbin /usr/X11R6/bin /usr/local/bin /usr/local/sbin /usr/local/heimdal/bin:\
			:umask=022:\
			:datasize-max=1024M:\
			:datasize-cur=1024M:\
			:maxproc-max=256:\
			:maxproc-cur=128:\
			:openfiles-max=1024:\
			:openfiles-cur=512:\
			:stacksize-cur=4M:\
			:localcipher=blowfish,a:\
			:auth=-krb5-or-pwd:\
			:tc=auth-defaults:\
			:tc=auth-ftp-defaults:

ToroidalCore: /* Testing the LDAP Client */

2023-05-15T05:06:47Z

Testing the LDAP Client

← Older revision		Revision as of 05:06, 15 May 2023
Line 104:		Line 104:

	Issued Expires Principal		Issued Expires Principal
	May 15 12:57:30 2023 May 17 12:57:30 2023 krbtgt/EXAMPLE.NET@EXAMPLE.NET		May 15 12:57:30 2023 May 16 12:57:30 2023 krbtgt/EXAMPLE.NET@EXAMPLE.NET
	openbsd$ ldapwhoami		openbsd$ ldapwhoami
	SASL/GSSAPI authentication started		SASL/GSSAPI authentication started

ToroidalCore: /* 2. LDAP Client */

2023-05-15T05:06:25Z

2. LDAP Client

@@ Line 80: / Line 80: @@
   openbsd# pkg_add -iv openldap-client
-Select the option for the package supporting GSSAPI and hit Enter.  Next, edit <code>/etc/openldap/openldap.conf</code>.  The uncommented lines should look something like this:
+Select the option for the package supporting GSSAPI and hit Enter.
   BASE            dc=example,dc=net
   URI             ldap://krbldapsrv.example.net
+  ode
   SASL_MECH       GSSAPI
-Change <code>dc=example,dc=net</code> and <code>krbldapsrv.example.net</code> to reflect your LDAP server's DN and DNS name, respectively
+Change <code>dc=example,dc=net</code> and <code>krbldapsrv.example.net</code> to reflect your LDAP server's DN and DNS name, respectively.  This not only points the LDAP client programs to your LDAP server by default, but it also tells them to use GSSAPI.

ToroidalCore: /* Prerequisites */

2023-05-15T04:57:18Z

Prerequisites

← Older revision		Revision as of 04:57, 15 May 2023
Line 22:		Line 22:
	** An account/LDAP entry in the above directory server, with a host principal for the OpenBSD machine.		** An account/LDAP entry in the above directory server, with a host principal for the OpenBSD machine.
	** A normal user account with an LDAP entry and Kerberos principal, that you want to be able to use to log into the OpenBSD machine.		** A normal user account with an LDAP entry and Kerberos principal, that you want to be able to use to log into the OpenBSD machine.
	* The LDAP server configured with an SSL server certificate, and ~~a client~~ certificate ~~for~~ the OpenBSD machine.		** Another client machine pointing toward the Kerberos/LDAP server for troubleshooting purposes is helpful.
			* The LDAP server configured with an SSL server certificate, and the appropriate CA certificate installed on the OpenBSD machine.
	* An up-to-date OpenBSD system you want to set up as a client, with root access. I recommend having a local user set up as well. (Created during the install process, for instance.)		* An up-to-date OpenBSD system you want to set up as a client, with root access. I recommend having a local user set up as well. (Created during the install process, for instance.)

ToroidalCore: /* 2. LDAP Client */

2023-05-15T04:55:43Z

2. LDAP Client

← Older revision		Revision as of 04:55, 15 May 2023
Line 77:		Line 77:
	Install the LDAP client with GSSAPI support as follows:		Install the LDAP client with GSSAPI support as follows:

	openbsd# pkg_add -iv		openbsd# pkg_add -iv openldap-client

			Select the option for the package supporting GSSAPI and hit Enter. Next, edit <code>/etc/openldap/openldap.conf</code>. The uncommented lines should look something like this:

			BASE dc=example,dc=net
			URI ldap://krbldapsrv.example.net

			SASL_MECH GSSAPI

			Change <code>dc=example,dc=net</code> and <code>krbldapsrv.example.net</code> to reflect your LDAP server's DN and DNS name, respectively

ToroidalCore: /* 2. LDAP Client */

2023-05-12T04:23:32Z

2. LDAP Client

← Older revision		Revision as of 04:23, 12 May 2023
Line 69:		Line 69:
	= 2. LDAP Client =		= 2. LDAP Client =

	~~Usually, on a Unix~~-~~like system, authorization~~ information ~~would be stored in the files <code>/etc/passwd</code> and <code>/etc/group</code>. In this case, we~~ want to ~~pull this information from our LDAP server~~. ~~Depending on your setup~~, ~~there may be~~ other information ~~stored in LDAP as well,~~ such as email addresses or SSH keys. ~~This means that there needs~~ to be ~~a way for~~ the ~~system itself~~ to ~~access~~ the ~~directory~~, ~~as well as normal users through~~ the ~~LDAP command line clients~~.		You probably have user-related information that you want to store centrally. This includes not only system-related things like user and group IDs, but also other user information such as email addresses, SSH keys, phone numbers, etc. LDAP can even be used to store things like photos, and with some scripting you have a lot of options. Some of what is stored in LDAP should be restricted, eg the user shouldn't be able to change their UID. On the other hand, they may need to edit something else, like their phone number. What they can and can't edit and how to set this up is outside the scope of this document.

	This guide assumes you are authenticating the users connecting to the LDAP server. The command line client can do this using the user's Kerberos principal using the Generic Security Services Application Programming Interface (GSSAPI). ~~For authorization~~, ~~OpenBSD uses~~ the ~~<code>ypldap</code> daemon, which acts as a translation layer between Network Information Service (NIS) and an LDAP server. This does not support GSSAPI~~.		This guide assumes you are authenticating the users connecting to the LDAP server. The command line client can do this using the user's Kerberos principal using the Generic Security Services Application Programming Interface (GSSAPI). In order to use it, you must have set up Kerberos as in the previous section.

	~~The first task will be to~~		=== Install the LDAP Client ===

			Install the LDAP client with GSSAPI support as follows:

			openbsd# pkg_add -iv

ToroidalCore: /* 2. LDAP Client */

2023-05-12T04:16:42Z

2. LDAP Client

← Older revision		Revision as of 04:16, 12 May 2023
Line 69:		Line 69:
	= 2. LDAP Client =		= 2. LDAP Client =

	Usually, on a Unix-like system, ~~user and group~~ information would be stored in the files <code>/etc/passwd</code> and <code>/etc/group</code>. In this case, we want to pull this information from our LDAP server. Depending on your setup, there may be other information stored in LDAP as well, such as email addresses or SSH keys. This means that there needs to be a way for the system itself to access the directory, as well as normal users through the LDAP command line clients.		Usually, on a Unix-like system, authorization information would be stored in the files <code>/etc/passwd</code> and <code>/etc/group</code>. In this case, we want to pull this information from our LDAP server. Depending on your setup, there may be other information stored in LDAP as well, such as email addresses or SSH keys. This means that there needs to be a way for the system itself to access the directory, as well as normal users through the LDAP command line clients.

			This guide assumes you are authenticating the users connecting to the LDAP server. The command line client can do this using the user's Kerberos principal using the Generic Security Services Application Programming Interface (GSSAPI). For authorization, OpenBSD uses the <code>ypldap</code> daemon, which acts as a translation layer between Network Information Service (NIS) and an LDAP server. This does not support GSSAPI.

			The first task will be to