From 90bc041b2730f79d60c6fb853a2cdf8ed2c5d93c Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Sat, 25 Sep 2004 00:20:54 +0000 Subject: See, I really can write documentation when I put my mind to it... This updates the ntlm_auth manpage to detail some of the new helper prototcols, and updates the winbind manpage to reflect some of the changes over it's life. Jelmer - you might want to look over this, and check if it's all really valid docbook, but 'make manapges' works for me. Andrew Bartlett (This used to be commit d2440e9847502cf35bfae0b2014f632d840488c1) --- docs/manpages/ntlm_auth.1.xml | 140 +++++++++++++++++++++++++++++++++++++++++- docs/manpages/winbindd.8.xml | 58 +++++++++++------ 2 files changed, 175 insertions(+), 23 deletions(-) (limited to 'docs') diff --git a/docs/manpages/ntlm_auth.1.xml b/docs/manpages/ntlm_auth.1.xml index 61fcaa8408..ae03fd35d9 100644 --- a/docs/manpages/ntlm_auth.1.xml +++ b/docs/manpages/ntlm_auth.1.xml @@ -35,7 +35,8 @@ users using NT/LM authentication. It returns 0 if the users is authenticated successfully and 1 if access was denied. ntlm_auth uses winbind to access the user and authentication data for a domain. This utility - is only indended to be used by other programs (currently squid). + is only indended to be used by other programs (currently + Squid). @@ -90,7 +91,11 @@ winbindd_privileged in $LOCKDIR. The protocol used is described here: http://devel.squid-cache.org/ntlm/squid_helper_protocol.html + url="http://devel.squid-cache.org/ntlm/squid_helper_protocol.html">http://devel.squid-cache.org/ntlm/squid_helper_protocol.html. + This protocol has been extended to allow the + NTLMSSP Negotiate packet to be included as an argument + to the YR command. (Thus avoiding + loss of information in the protocol exchange). @@ -132,6 +137,130 @@ + + + ntlm-server-1 + + Server-side helper protocol, intended for use by a + RADIUS server or the 'winbind' plugin for pppd, for + the provision of MSCHAP and MSCHAPv2 authentication. + + This protocol consists of lines in for form: + Parameter: value and Paramter:: + Base64-encode value. The presence of a single + period . indicates that one side has + finished supplying data to the other. (Which in turn + could cause the helper to authenticate the + user). + + Curently implemented parameters from the + external program to the helper are: + + + Username + + The username, expected to be in + Samba's unix charset. + + + Username: bob + Username:: Ym9i + + + + Username + The user's domain, expected to be in + Samba's unix charset. + + + Domain: WORKGROUP + Domain:: V09SS0dST1VQ + + + + Full-Username + The fully qualified username, expected to be in + Samba's unix + charset and qualified with the + winbind separator. + + + Full-Username: WORKGROUP\bob + Full-Username:: V09SS0dST1VQYm9i + + + + LANMAN-Challenge + + The 8 byte LANMAN Challenge value, + generated randomly by the server, or (in cases such as + MSCHAPv2) generated in some way by both the server and + the client. + + LANMAN-Challege: 0102030405060708 + + + + LANMAN-Response + + The 24 byte LANMAN Response value, + calculated from the user's password and the supplied + LANMAN Challenge. Typically, this + is provided over the network by a client wishing to authenticate. + + LANMAN-Response: 010203040506070809101112131415161718192021222324 + + + + + NT-Response + The >= 24 byte NT Response + calculated from the user's password and the supplied + LANMAN Challenge. Typically, this is + provided over the network by a client wishing to authenticate. + + NT-Response: 010203040506070809101112131415161718192021222324 + + + + + Password + The user's password. This would be + provided by a network client, if the helper is being + used in a legacy situation that exposes plaintext + passwords in this way. + + Password: samba2 + Password:: c2FtYmEy + + + + + Request-User-Session-Key + Apon sucessful authenticaiton, return + the user session key associated with the login. + + Request-User-Session-Key: Yes + + + + + Request-LanMan-Session-Key + Apon sucessful authenticaiton, return + the LANMAN session key associated with the login. + + Request-LanMan-Session-Key: Yes + + + + Implementors should take care to base64 encode + any data (such as usernames/passwords) that may contain malicous user data, such as + a newline. They may also need to decode strings from + the helper, which likewise may have been base64 encoded. + + + + @@ -178,7 +307,12 @@ --password=PASSWORD User's plaintext passwordIf not specified on the command line, this is prompted for when - required. + required. + + For the NTLMSSP based server roles, this paramter + specifies the expected password, allowing testing without + winbindd operational. + diff --git a/docs/manpages/winbindd.8.xml b/docs/manpages/winbindd.8.xml index 9f552661de..e027428d16 100644 --- a/docs/manpages/winbindd.8.xml +++ b/docs/manpages/winbindd.8.xml @@ -37,8 +37,18 @@ 7 suite. winbindd is a daemon that provides - a service for the Name Service Switch capability that is present - in most modern C libraries. The Name Service Switch allows user + a number of services to the Name Service Switch capability found + in most modern C libraries, to arbitary applications via PAM + and ntlm_auth and to Samba itself. + + Even if winbind is not used for nsswitch, it still provides a + service to smbd, ntlm_auth and the PAM modules, by managing connections to + domain controllers. In this configuraiton the + idmap uid and + idmap gid + parameters are not required. (This is known as `netlogon proxy only mode'.) + + The Name Service Switch allows user and system information to be obtained from different databases services such as NIS or DNS. The exact behaviour can be configured throught the /etc/nsswitch.conf file. @@ -52,12 +62,15 @@ services via an associated PAM module. - The pam_winbind module in the 2.2.2 release only - supports the auth and account - module-types. The latter simply - performs a getpwnam() to verify that the system can obtain a uid for the - user. If the libnss_winbind library has been correctly - installed, this should always succeed. + The pam_winbind module supports the + auth, account + and password + module-types. It should be noted that the + account module simply performs a getpwnam() to verify that + the system can obtain a uid for the user, as the domain + controller has already performed access control. If the + libnss_winbind library has been correctly + installed, or an alternate source of names configured, this should always succeed. The following nsswitch databases are implemented by @@ -180,9 +193,9 @@ hosts: files wins NAME AND ID RESOLUTION Users and groups on a Windows NT server are assigned - a relative id (rid) which is unique for the domain when the + a security id (SID) which is globally unique when the user or group is created. To convert the Windows NT user or group - into a unix user or group, a mapping between rids and unix user + into a unix user or group, a mapping between SIDs and unix user and group ids is required. This is one of the jobs that winbindd performs. @@ -194,11 +207,16 @@ hosts: files wins in a database file under the Samba lock directory and will be remembered. - WARNING: The rid to unix id database is the only location + WARNING: The SID to unix id database is the only location where the user and group mappings are stored by winbindd. If this file is deleted or corrupted, there is no way for winbindd to determine which user and group ids correspond to Windows NT user and group rids. + + See the idmap + backend parameter in + smb.conf for options for sharing this + database, such as via LDAP. @@ -219,6 +237,8 @@ hosts: files wins idmap gid + idmap backend + winbind cache time winbind enum users @@ -317,11 +337,7 @@ auth required /lib/security/pam_pwdb.so use_first_pass shadow nullok nmbd 8 must be running on the local machine - for winbindd to work. winbindd queries - the list of trusted domains for the Windows NT server - on startup and when a SIGHUP is received. Thus, for a running - winbindd to become aware of new trust relationships between - servers, it must be sent a SIGHUP signal. + for winbindd to work. PAM is really easy to misconfigure. Make sure you know what you are doing when modifying PAM configuration files. It is possible @@ -330,9 +346,10 @@ auth required /lib/security/pam_pwdb.so use_first_pass shadow nullok If more than one UNIX machine is running winbindd, then in general the user and groups ids allocated by winbindd will not be the same. The user and group ids will only be valid for the local - machine. + machine, unless a shared idmap + backend is configured. - If the the Windows NT RID to UNIX user and group id mapping + If the the Windows NT SID to UNIX user and group id mapping file is damaged or destroyed then the mappings will be lost. @@ -358,8 +375,7 @@ auth required /lib/security/pam_pwdb.so use_first_pass shadow nullok SIGUSR2 The SIGUSR2 signal will cause winbindd to write status information to the winbind - log file including information about the number of user and - group ids allocated by winbindd. + log file. Log files are stored in the filename specified by the log file parameter. @@ -440,6 +456,8 @@ auth required /lib/security/pam_pwdb.so use_first_pass shadow nullok samba 7, wbinfo + 1, + ntlm_auth 8, smb.conf 5 -- cgit