&author.tridge;
&author.jelmer;
&author.jht;
Server Types and Security Modes
This chapter provides information regarding the types of server that Samba may be
configured to be. A Microsoft network administrator who wishes to migrate to or to
use Samba will want to know what within a Samba context, terms familiar to MS Windows
adminstrator mean.
The chapter also provides an overview of the security modes of which Samba is capable
and how these relate to MS Windows servers and clients.
Server TypesAdminstrators of Microsoft networks often refer to there being three
different type of servers:Domain ControllerPrimary Domain ControllerBackup Domain ControllerADS Domain ControllerDomain Member ServerActive Directory Member ServerNT4 Style Domain Member ServerStand Alone Server
The chapters covering Domain Control, Backup Domain Control and Domain Membership provide
pertinent information regarding Samba-3 configuration for each of these server roles.
The reader is strongly encouraged to become intimately familiar with the information
presented.
Samba Security Modes
In this section the function and purpose of Samba's security
modes are described. An acurate understanding of how Samba implements each security
mode as well as how to configure MS Windows clients for each mode will significantly
reduce user complaints and administrator heartache.
A SMB server tells the client at startup what security level
it is running. There are two options share level and
user level. Which of these two the client receives affects
the way the client then tries to authenticate itself. It does not directly affect
(to any great extent) the way the Samba server does security. This may sound strange,
but it fits in with the client/server approach of SMB. In SMB everything is initiated
and controlled by the client, and the server can only tell the client what is
available and whether an action is allowed.
User Level Security
We will describeuser level security first, as its simpler.
In user level security the client will send a
session setup command directly after the protocol negotiation.
This contains a username and password. The server can either accept or reject that
username/password combination. Note that at this stage the server has no idea what
share the client will eventually try to connect to, so it can't base the
accept/reject on anything other than:
The username/passwordThe name of the client machine
If the server accepts the username/password then the client expects to be able to
mount shares (using a tree connection) without specifying a
password. It expects that all access rights will be as the username/password
specified in the session setup.
It is also possible for a client to send multiple session setup
requests. When the server responds it gives the client a uid to use
as an authentication tag for that username/password. The client can maintain multiple
authentication contexts in this way (WinDD is an example of an application that does this).
Example Configuration
The &smb.conf; parameter that sets User Level Security is:
security = user
This is the default setting since samba-2.2.x.
Share Level Security
Ok, now for share level security. In share level security the client authenticates
itself separately for each share. It will send a password along with each
tree connection (share mount). It does not explicitly send a
username with this operation. The client is expecting a password to be associated
with each share, independent of the user. This means that samba has to work out what
username the client probably wants to use. It is never explicitly sent the username.
Some commercial SMB servers such as NT actually associate passwords directly with
shares in share level security, but samba always uses the unix authentication scheme
where it is a username/password pair that is authenticated, not a share/password pair.
To gain understanding of the MS Windows networking parallels to this, one should think
in terms of MS Windows 9x/Me where one can create a shared folder that provides read-only
or full access, with or without a password.
Many clients send a session setup even if the server is in share
level security. They normally send a valid username but no password. Samba records
this username in a list of possible usernames. When the client
then does a tree connection it also adds to this list the name
of the share they try to connect to (useful for home directories) and any users
listed in the user = &smb.conf; line. The password is then checked
in turn against these possible usernames. If a match is found
then the client is authenticated as that user.
Example Configuration
The &smb.conf; parameter that sets Share Level Security is:
security = share
Plese note that there are reports that recent MS Widows clients do not like to work
with share mode security servers. You are strongly discouraged from use of this parameter.
Server Level Security
Now to review server level security. In server level security the samba
server reports to the client that it is in user level security. The client then does a
session setup as described earlier. The samba server takes the
username/password that the client sends and attempts to login to the
password server by sending exactly the same username/password that
it got from the client. If that server is in user level security and accepts the password
then samba accepts the clients connection. This allows the samba server to use another SMB
server as the password server.
You should also note that at the very start of all this, where the server tells the client
what security level it is in, it also tells the client if it supports encryption. If it
does then it supplies the client with a random cryptkey. The client will then send all
passwords in encrypted form. Samba supports this type of encryption by default.
The parameter security = server means that Samba reports to clients that
it is running in user mode but actually passes off all authentication
requests to another user mode server. This requires an additional
parameter password server that points to the real authentication server.
That real authentication server can be another Samba server or can be a Windows NT server,
the later natively capable of encrypted password support.
When Samba is running in server level security it is essential that
the parameter password server is set to the precise netbios machine
name of the target authentication server. Samba can NOT determine this from NetBIOS name
lookups because the choice of the target authentication server arbitrary and can not
be determined from a domain name. In essence a samba server that is in
server level security is operating in what used to be known as
workgroup mode.
Server level security is incompatible with what is known as
schannel or sign and seal protocols. This means that
if you want to use server level security you must disable the use of
sign and seal on all machines on your network.
Example Configuration - Using MS Windows NT as an authentication server
This method involves the additions of the following parameters in the &smb.conf; file:
encrypt passwords = Yes
security = server
password server = "NetBIOS_name_of_a_DC"
There are two ways of identifying whether or not a username and password pair was valid
or not. One uses the reply information provided as part of the authentication messaging
process, the other uses just an error code.
The down-side of this mode of configuration is the fact that for security reasons Samba
will send the password server a bogus username and a bogus password and if the remote
server fails to reject the username and password pair then an alternative mode of
identification of validation is used. Where a site uses password lock out after a
certain number of failed authentication attempts this will result in user lockouts.
Use of this mode of authentication does require there to be a standard Unix account
for the user, this account can be blocked to prevent logons by other than MS Windows clients.
Domain Level Security
When samba is operating in security = domain mode this means that
the Samba server has a domain security trust account (a machine account) and will cause
all authentication requests to be passed through to the domain controllers.
Example Configuration - Samba as a Domain Member Server
This method involves addition of the following parameters in the &smb.conf; file:
encrypt passwords = Yes
security = domain
workgroup = "name_of_NT_domain"
password server = *
The use of the "*" argument to password server will cause samba to locate the
domain controller in a way analogous to the way this is done within MS Windows NT.
This is the default behaviour.
In order for this method to work the Samba server needs to join the MS Windows NT
security domain. This is done as follows:
On the MS Windows NT domain controller using
the Server Manager add a machine account for the Samba server.
Next, on the Linux system execute:smbpasswd -r PDC_NAME -j DOMAIN_NAME (samba 2.x)
net join -U administrator%password (samba-3)
Use of this mode of authentication does require there to be a standard Unix account
for the user in order to assign a uid once the account has been authenticated by
the remote Windows DC. This account can be blocked to prevent logons by clients other than
MS Windows through things such as setting an invalid shell in the
/etc/passwd entry.
An alternative to assigning UIDs to Windows users on a Samba member server is
presented in the Winbind Overview chapter
in this HOWTO collection.
ADS Level Security
Samba-2.2.x could join and Active Directory domain so long as the Active Directory domain
controller is configured for mixed mode operation, and is running NetBIOS over TCP/IP. MS
Windows 2000 and later can be configured to run without NEtBIOS over TCP/IP, instead it
can run SMB natively over TCP/IP.
The ability to natively join an Active Directory domain requires the use of Kerberos
based authentication. The Kerberos protocols have been extended by Microsoft so that
a plain MIT Kerberos, or a Heimdal client is not sufficient. Samba-3 now has the ability
to be a native Active Directory member server.
Example Configuration
realm = your.kerberos.realm
security = ADS
encrypt passwords = Yes
The following parameter may be required:
ads server = your.kerberos.server
Please refer to the Domain Membership section, Active Directory Membership for more information
regarding this configuration option.
Seamless Windows Network Integration
MS Windows clients may use encrypted passwords as part of a challenege/response
authentication model (a.k.a. NTLMv1) or alone, or clear text strings for simple
password based authentication. It should be realized that with the SMB protocol
the password is passed over the network either in plain text or encrypted, but
not both in the same authentication request.
When encrypted passwords are used a password that has been entered by the user
is encrypted in two ways:
An MD4 hash of the UNICODE of the password
string. This is known as the NT hash.
The password is converted to upper case,
and then padded or trucated to 14 bytes. This string is
then appended with 5 bytes of NULL characters and split to
form two 56 bit DES keys to encrypt a "magic" 8 byte value.
The resulting 16 bytes for the LanMan hash.
MS Windows 95 pre-service pack 1, MS Windows NT versions 3.x and version 4.0
pre-service pack 3 will use either mode of password authentication. All
versions of MS Windows that follow these versions no longer support plain
text passwords by default.
MS Windows clients have a habit of dropping network mappings that have been idle
for 10 minutes or longer. When the user attempts to use the mapped drive
connection that has been dropped, the client re-establishes the connection using
a cached copy of the password.
When Microsoft changed the default password mode, support was dropped for caching
of the plain text password. This means that when the registry parameter is changed
to re-enable use of plain text passwords it appears to work, but when a dropped
service connection mapping attempts to revalidate it will fail if the remote
authentication server does not support encrypted passwords. This means that it
is definitely not a good idea to re-enable plain text password support in such clients.
The following parameters can be used to work around the issue of Windows 9x client
upper casing usernames and password before transmitting them to the SMB server
when using clear text authentication.
passsword level = integerusername level = integer
By default Samba will lower case the username before attempting to lookup the user
in the database of local system accounts. Because UNIX usernames conventionally
only contain lower case character, the username level parameter
is rarely needed.
However, passwords on UNIX systems often make use of mixed case characters.
This means that in order for a user on a Windows 9x client to connect to a Samba
server using clear text authentication, the password level
must be set to the maximum number of upper case letter which could
appear is a password. Note that the server OS uses the traditional DES version
of crypt(), a password level of 8 will result in case
insensitive passwords as seen from Windows users. This will also result in longer
login times as Samba has to compute the permutations of the password string and
try them one by one until a match is located (or all combinations fail).
The best option to adopt is to enable support for encrypted passwords where ever
Samba is used. Most attempts to apply the registry change to re-enable plain text
passwords will eventually lead to user complaints and unhappiness.