1<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter�11.�Active Directory, Kerberos, and Security</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part�III.�Reference Section"><link rel="prev" href="RefSection.html" title="Part�III.�Reference Section"><link rel="next" href="DomApps.html" title="Chapter�12.�Integrating Additional Services"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter�11.�Active Directory, Kerberos, and Security</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="RefSection.html">Prev</a>�</td><th width="60%" align="center">Part�III.�Reference Section</th><td width="20%" align="right">�<a accesskey="n" href="DomApps.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="kerberos"></a>Chapter�11.�Active Directory, Kerberos, and Security</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="kerberos.html#id372607">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id373189">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id373203">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id373574">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id375060">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id375395">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id375952">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id376321">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id377005">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id377127">Questions and Answers</a></span></dt></dl></div><p><a class="indexterm" name="id372556"></a> 2 By this point in the book, you have been exposed to many Samba-3 features and capabilities. 3 More importantly, if you have implemented the examples given, you are well on your way to becoming 4 a Samba-3 networking guru who knows a lot about Microsoft Windows. If you have taken the time to 5 practice, you likely have thought of improvements and scenarios with which you can experiment. You 6 are rather well plugged in to the many flexible ways Samba can be used. 7 </p><p><a class="indexterm" name="id372570"></a> 8 This is a book about Samba-3. Understandably, its intent is to present it in a positive light. 9 The casual observer might conclude that this book is one-eyed about Samba. It is what 10 would you expect? This chapter exposes some criticisms that have been raised concerning 11 the use of Samba. For each criticism, there are good answers and appropriate solutions. 12 </p><p> 13 Some criticism always comes from deep inside ranks that one would expect to be supportive of a particular 14 decision. Criticism can be expected from the outside. Let's see how the interesting dynamic of 15 criticism develops with respect to Abmas. 16 </p><p><a class="indexterm" name="id372594"></a> 17 This chapter provides a shameless self-promotion of Samba-3. The objections raised were not pulled 18 out of thin air. They were drawn from comments made by Samba users and from criticism during 19 discussions with Windows network administrators. The tone of the objections reflects as closely 20 as possible that of the original. The case presented is a straw-man example that is designed to 21 permit each objection to be answered as it might occur in real life. 22 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id372607"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id372613"></a><a class="indexterm" name="id372621"></a><a class="indexterm" name="id372629"></a><a class="indexterm" name="id372637"></a><a class="indexterm" name="id372645"></a> 23 Abmas is continuing its meteoric growth with yet further acquisitions. The investment community took 24 note of the spectacular projection of Abmas onto the global business stage. Abmas is building an 25 interesting portfolio of companies that includes accounting services, financial advice, investment 26 portfolio management, property insurance, risk assessment, and the recent addition of a a video rental 27 business. The pieces do not always appear to fit together, but Mr. Meany is certainly executing an 28 interesting business growth and development plan. Abmas Video Rentals was recently acquired. 29 During the time that the acquisition was closing, the Video Rentals business upgraded its Windows 30 NT4-based network to Windows 2003 Server and Active Directory. 31 </p><p><a class="indexterm" name="id372662"></a> 32 You have accepted the fact that Abmas Video Rentals will use Microsoft Active Directory. 33 The IT team, led by Stan Soroka, is committed to Samba-3 and to maintaining a uniform technology platform. 34 Stan Soroka's team voiced its disapproval over the decision to permit this business to continue to 35 operate with a solution that is viewed by Christine and her group as “<span class="quote">an island of broken 36 technologies.</span>” This comment was made by one of Christine's staff as they were installing a new 37 Samba-3 server at the new business. 38 </p><p><a class="indexterm" name="id372681"></a><a class="indexterm" name="id372689"></a> 39 Abmas Video Rentals' head of IT heard of this criticism. He was offended that a junior engineer 40 should make such a comment. He felt that he had to prepare in case he might be criticized for his 41 decision to use Active Directory. He decided he would defend his decision by hiring the services 42 of an outside security systems consultant to report<sup>[<a name="id372701" href="#ftn.id372701">12</a>]</sup> on his unit's operations 43 and to investigate the role of Samba at his site. Here are key extracts from this hypothetical 44 report: 45 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id372710"></a><a class="indexterm" name="id372718"></a><a class="indexterm" name="id372726"></a><a class="indexterm" name="id372733"></a> 46 ... the implementation of Microsoft Active Directory at the Abmas Video Rentals, Bamingsham site, 47 has been examined. We find no evidence to support a notion that vulnerabilities exist at your site. 48 ... we took additional steps to validate the integrity of the installation and operation of Active 49 Directory and are pleased that your staff are following sound practices. 50 </p><p> 51 ... 52 </p><p><a class="indexterm" name="id372751"></a><a class="indexterm" name="id372763"></a><a class="indexterm" name="id372774"></a><a class="indexterm" name="id372782"></a><a class="indexterm" name="id372790"></a><a class="indexterm" name="id372798"></a> 53 User and group accounts, and respective privileges, have been well thought out. File system shares are 54 appropriately secured. Backup and disaster recovery plans are well managed and validated regularly, and 55 effective off-site storage practices are considered to exceed industry norms. 56 </p><p><a class="indexterm" name="id372811"></a><a class="indexterm" name="id372819"></a><a class="indexterm" name="id372827"></a> 57 Your staff are justifiably concerned that the use of Samba may compromise their good efforts to maintain 58 a secure network. 59 </p><p><a class="indexterm" name="id372843"></a><a class="indexterm" name="id372850"></a><a class="indexterm" name="id372858"></a><a class="indexterm" name="id372866"></a> 60 The recently installed Linux file and application server uses a tool called <code class="literal">winbind</code> 61 that is indiscriminate about security. All user accounts in Active Directory can be used to access data 62 stored on the Linux system. We are alarmed that secure information is accessible to staff who should 63 not even be aware that it exists. We share the concerns of your network management staff who have gone 64 to great lengths to set fine-grained controls that limit information access to those who need access. 65 It seems incongruous to us that Samba winbind should be permitted to be used considering that it voids this fine work. 66 </p><p><a class="indexterm" name="id372892"></a><a class="indexterm" name="id372900"></a><a class="indexterm" name="id372908"></a> 67 Graham Judd [head of network administration] has locked down the security of all systems and is following 68 the latest Microsoft guidelines. ... null session connections have been disabled ... the internal network 69 is isolated from the outside world, the [product name removed] firewall is under current contract 70 maintenance support from [the manufacturer]. ... our attempts to penetrate security of your systems 71 failed to find problems common to Windows networking sites. We commend your staff on their attention to 72 detail and for following Microsoft recommended best practices. 73 </p><p> 74 ... 75 </p><p><a class="indexterm" name="id372927"></a><a class="indexterm" name="id372935"></a><a class="indexterm" name="id372943"></a><a class="indexterm" name="id372951"></a> 76 Regarding the use of Samba, we offer the following comments: Samba is in use in nearly half of 77 all sites we have surveyed. ... It is our opinion that Samba offers no better security than Microsoft 78 ... what worries us regarding Samba is the need to disable essential Windows security features such as 79 secure channel support, digital sign'n'seal on all communication traffic, and running Active Directory in 80 mixed mode so that Samba clients and servers can authenticate all of it. Additionally, we are concerned that 81 Samba is not at the full capabilities of Microsoft Windows NT4 server. Microsoft has moved well beyond that 82 with trusted computing initiatives that the Samba developers do not participate in. 83 </p><p><a class="indexterm" name="id372968"></a><a class="indexterm" name="id372976"></a><a class="indexterm" name="id372984"></a><a class="indexterm" name="id372992"></a><a class="indexterm" name="id373000"></a><a class="indexterm" name="id373007"></a><a class="indexterm" name="id373015"></a> 84 One wonders about the integrity of an open source program that is developed by a team of hackers 85 who cannot be held accountable for the flaws in their code. The sheer number of updates and bug 86 fixes they have released should ring alarm bells in any business. 87 </p><p><a class="indexterm" name="id373029"></a><a class="indexterm" name="id373037"></a><a class="indexterm" name="id373044"></a> 88 Another factor that should be considered is that buying Microsoft products and services helps to 89 provide employment in the IT industry. Samba and Open Source software place those jobs at risk. 90 </p></blockquote></div><p><a class="indexterm" name="id373057"></a><a class="indexterm" name="id373065"></a> 91 This is also a challenge to rise above the trouble spot. You call Stan's team together for a simple 92 discussion, but it gets further out of hand. When you return to your office, you find the following 93 email in your in-box: 94 </p><p> 95 Good afternoon, 96 </p><div class="blockquote"><table border="0" width="100%" cellspacing="0" cellpadding="0" class="blockquote" summary="Block quote"><tr><td width="10%" valign="top">�</td><td width="80%" valign="top"><p> 97 I apologize for the leak of internal discussions to the new business. It reflects poorly on our 98 professionalism and has put you in an unpleasant position. I regret the incident. 99 </p><p> 100 I also wish to advise that two of the recent recruits want to implement Kerberos authentication 101 across all systems. I concur with the desire to improve security. One of the new guys who is championing 102 the move to Kerberos was responsible for the comment that caused the embarrassment. 103 </p><p><a class="indexterm" name="id373096"></a><a class="indexterm" name="id373104"></a><a class="indexterm" name="id373111"></a><a class="indexterm" name="id373119"></a> 104 I am experiencing difficulty in handling the sharp push for Kerberos. He claims that Kerberos, OpenLDAP, 105 plus Samba-3 will seamlessly replace Microsoft Active Directory. I am a little out of my depth with respect 106 to the feasibility of such a move, but have taken steps to pull both of them into line. With your consent, 107 I would like to hire the services of a well-known Samba consultant to set the record straight. 108 </p><p><a class="indexterm" name="id373134"></a><a class="indexterm" name="id373142"></a><a class="indexterm" name="id373150"></a><a class="indexterm" name="id373158"></a><a class="indexterm" name="id373166"></a><a class="indexterm" name="id373173"></a> 109 I intend to use this report to answer the criticism raised and would like to establish a policy that we 110 will approve the use of Microsoft Windows Servers (and Active Directory) subject to all costs being covered 111 out of the budget of the division that wishes to go its own way. I propose that dissenters will still remain 112 responsible to meet the budgeted contribution to IT operations as a whole. I believe we should not coerce 113 use of any centrally proposed standards, but make all noncompliance the financial responsibility of the 114 out-of-step division. Hopefully, this will encourage all divisions to walk with us and not alone. 115 </p></td><td width="10%" valign="top">�</td></tr><tr><td width="10%" valign="top">�</td><td colspan="2" align="right" valign="top">--<span class="attribution">Stan</span></td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id373189"></a>Assignment Tasks</h3></div></div></div><p> 116 You agreed with Stan's recommendations and hired a consultant to help defuse the powder 117 keg. The consultant's task is to provide a tractable answer to each of the issues raised. The consultant must be able 118 to support his or her claims, keep emotions to the side, and answer technically. 119 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id373203"></a>Dissection and Discussion</h2></div></div></div><p><a class="indexterm" name="id373209"></a><a class="indexterm" name="id373217"></a><a class="indexterm" name="id373225"></a><a class="indexterm" name="id373233"></a><a class="indexterm" name="id373241"></a><a class="indexterm" name="id373249"></a><a class="indexterm" name="id373257"></a> 120 Samba-3 is a tool. No one is pounding your door to make you use Samba. That is a choice that you are free to 121 make or reject. It is likely that your decision to use Samba can greatly benefit your company. 122 The Samba Team obviously believes that the Samba software is a worthy choice. 123 If you hire a consultant to assist with the installation and/or deployment of Samba, or if you hire 124 someone to help manage your Samba installation, you can create income and employment. Alternately, 125 money saved by not spending in the IT area can be spent elsewhere in the business. All money saved 126 or spent creates employment. 127 </p><p><a class="indexterm" name="id373273"></a><a class="indexterm" name="id373281"></a><a class="indexterm" name="id373289"></a><a class="indexterm" name="id373297"></a><a class="indexterm" name="id373305"></a> 128 In the long term, the use of Samba must be economically sustainable. In some situations, Samba is adopted 129 purely to provide file and print service interoperability on platforms that otherwise cannot provide 130 access to data and to printers for Microsoft Windows clients. Samba is used by some businesses to 131 effect a reduction in the cost of providing IT services. Obviously, it is also used by some as an 132 alternative to the use of a Microsoft file and print serving platforms with no consideration of costs. 133 </p><p><a class="indexterm" name="id373320"></a><a class="indexterm" name="id373328"></a><a class="indexterm" name="id373336"></a><a class="indexterm" name="id373343"></a> 134 It would be foolish to adopt a technology that might put any data or users at risk. Security affects 135 everyone. The Samba-Team is fully cognizant of the responsibility they have to their users. 136 The Samba documentation clearly reveals that full responsibility is accepted to fix anything 137 that is broken. 138 </p><p><a class="indexterm" name="id373357"></a><a class="indexterm" name="id373365"></a><a class="indexterm" name="id373373"></a><a class="indexterm" name="id373381"></a><a class="indexterm" name="id373392"></a><a class="indexterm" name="id373400"></a><a class="indexterm" name="id373408"></a><a class="indexterm" name="id373416"></a><a class="indexterm" name="id373424"></a><a class="indexterm" name="id373432"></a><a class="indexterm" name="id373439"></a> 139 There is a mistaken perception in the IT industry that commercial software providers are fully 140 accountable for the defects in products. Open Source software comes with no warranty, so it is 141 often assumed that its use confers a higher degree of risk. Everyone should read commercial software 142 End User License Agreements (EULAs). You should determine what real warranty is offered and the 143 extent of liability that is accepted. Doing so soon dispels the popular notion that 144 commercial software vendors are willingly accountable for product defects. In many cases, the 145 commercial vendor accepts liability only to reimburse the price paid for the software. 146 </p><p><a class="indexterm" name="id373462"></a><a class="indexterm" name="id373470"></a><a class="indexterm" name="id373477"></a><a class="indexterm" name="id373485"></a><a class="indexterm" name="id373493"></a><a class="indexterm" name="id373501"></a> 147 The real issues that a consumer (like you) needs answered are What is the way of escape from technical 148 problems, and how long will it take? The average problem turnaround time in the Open Source community is 149 approximately 48 hours. What does the EULA offer? What is the track record in the commercial software 150 industry? What happens when your commercial vendor decides to cease providing support? 151 </p><p><a class="indexterm" name="id373516"></a><a class="indexterm" name="id373523"></a><a class="indexterm" name="id373531"></a><a class="indexterm" name="id373539"></a><a class="indexterm" name="id373547"></a><a class="indexterm" name="id373555"></a><a class="indexterm" name="id373562"></a> 152 Open Source software at least puts you in possession of the source code. This means that when 153 all else fails, you can hire a programmer to solve the problem. 154 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id373574"></a>Technical Issues</h3></div></div></div><p> 155 Each issue is now discussed and, where appropriate, example implementation steps are 156 provided. 157 </p><div class="variablelist"><dl><dt><span class="term">Winbind and Security</span></dt><dd><p><a class="indexterm" name="id373594"></a><a class="indexterm" name="id373601"></a><a class="indexterm" name="id373609"></a><a class="indexterm" name="id373621"></a><a class="indexterm" name="id373628"></a><a class="indexterm" name="id373636"></a><a class="indexterm" name="id373644"></a><a class="indexterm" name="id373652"></a><a class="indexterm" name="id373660"></a><a class="indexterm" name="id373668"></a> 158 Windows network administrators may be dismayed to find that <code class="literal">winbind</code> 159 exposes all domain users so that they may use their domain account credentials to 160 log on to a UNIX/Linux system. The fact that all users in the domain can see the 161 UNIX/Linux server in their Network Neighborhood and can browse the shares on the 162 server seems to excite them further. 163 </p><p><a class="indexterm" name="id373688"></a><a class="indexterm" name="id373696"></a><a class="indexterm" name="id373704"></a><a class="indexterm" name="id373712"></a> 164 <code class="literal">winbind</code> provides for the UNIX/Linux domain member server or 165 client, the same as one would obtain by adding a Microsoft Windows server or 166 client to the domain. The real objection is the fact that Samba is not MS Windows 167 and therefore requires handling a little differently from the familiar Windows systems. 168 One must recognize fear of the unknown. 169 </p><p><a class="indexterm" name="id373734"></a><a class="indexterm" name="id373742"></a><a class="indexterm" name="id373750"></a><a class="indexterm" name="id373758"></a><a class="indexterm" name="id373766"></a><a class="indexterm" name="id373777"></a> 170 Windows network administrators need to recognize that <code class="literal">winbind</code> does 171 not, and cannot, override account controls set using the Active Directory management 172 tools. The control is the same. Have no fear. 173 </p><p><a class="indexterm" name="id373796"></a><a class="indexterm" name="id373804"></a><a class="indexterm" name="id373815"></a><a class="indexterm" name="id373823"></a><a class="indexterm" name="id373831"></a><a class="indexterm" name="id373839"></a><a class="indexterm" name="id373847"></a><a class="indexterm" name="id373855"></a><a class="indexterm" name="id373862"></a><a class="indexterm" name="id373870"></a> 174 Where Samba and the ADS domain account information obtained through the use of 175 <code class="literal">winbind</code> permits access, by browsing or by the drive mapping to 176 a share, to data that should be better protected. This can only happen when security 177 controls have not been properly implemented. Samba permits access controls to be set 178 on: 179 </p><div class="itemizedlist"><ul type="disc"><li><p>Shares themselves (i.e., the logical share itself)</p></li><li><p>The share definition in <code class="filename">smb.conf</code></p></li><li><p>The shared directories and files using UNIX permissions</p></li><li><p>Using Windows 2000 ACLs if the file system is POSIX enabled</p></li></ul></div><p> 180 Examples of each are given in <a href="kerberos.html#ch10expl" title="Implementation">???</a>. 181 </p></dd><dt><span class="term">User and Group Controls</span></dt><dd><p><a class="indexterm" name="id373940"></a><a class="indexterm" name="id373947"></a><a class="indexterm" name="id373959"></a><a class="indexterm" name="id373970"></a><a class="indexterm" name="id373978"></a><a class="indexterm" name="id373986"></a><a class="indexterm" name="id373993"></a><a class="indexterm" name="id374001"></a><a class="indexterm" name="id374009"></a> 182 User and group management facilities as known in the Windows ADS environment may be 183 used to provide equivalent access control constraints or to provide equivalent 184 permissions and privileges on Samba servers. Samba offers greater flexibility in the 185 use of user and group controls because it has additional layers of control compared to 186 Windows 200x/XP. For example, access controls on a Samba server may be set within 187 the share definition in a manner for which Windows has no equivalent. 188 </p><p><a class="indexterm" name="id374029"></a><a class="indexterm" name="id374037"></a><a class="indexterm" name="id374045"></a><a class="indexterm" name="id374053"></a><a class="indexterm" name="id374064"></a><a class="indexterm" name="id374072"></a><a class="indexterm" name="id374080"></a> 189 In any serious analysis of system security, it is important to examine the safeguards 190 that remain when all other protective measures fail. An administrator may inadvertently 191 set excessive permissions on the file system of a shared resource, or he may set excessive 192 privileges on the share itself. If that were to happen in a Windows 2003 Server environment, 193 the data would indeed be laid bare to abuse. Yet, within a Samba share definition, it is 194 possible to guard against that by enforcing controls on the share definition itself. You 195 see a practical example of this a little later in this chapter. 196 </p><p><a class="indexterm" name="id374096"></a><a class="indexterm" name="id374104"></a> 197 The report that is critical of Samba really ought to have exercised greater due 198 diligence: the real weakness is on the side of a Microsoft Windows environment. 199 </p></dd><dt><span class="term">Security Overall</span></dt><dd><p><a class="indexterm" name="id374124"></a> 200 Samba is designed in such a manner that weaknesses inherent in the design of 201 Microsoft Windows networking ought not to expose the underlying UNIX/Linux file 202 system in any way. All software has potential defects, and Samba is no exception. 203 What matters more is how defects that are discovered get dealt with. 204 </p><p><a class="indexterm" name="id374138"></a><a class="indexterm" name="id374146"></a><a class="indexterm" name="id374154"></a><a class="indexterm" name="id374162"></a> 205 The Samba Team totally agrees with the necessity to observe and fully implement 206 every security facility to provide a level of protection and security that is necessary 207 and that the end user (or network administrator) needs. Never would the Samba Team 208 recommend a compromise to system security, nor would deliberate defoliation of 209 security be publicly condoned; yet this is the practice by many Windows network 210 administrators just to make happy users who have no notion of consequential risk. 211 </p><p><a class="indexterm" name="id374178"></a><a class="indexterm" name="id374186"></a><a class="indexterm" name="id374193"></a><a class="indexterm" name="id374201"></a><a class="indexterm" name="id374209"></a><a class="indexterm" name="id374217"></a><a class="indexterm" name="id374225"></a> 212 The report condemns Samba for releasing updates and security fixes, yet Microsoft 213 online updates need to be applied almost weekly. The answer to the criticism 214 lies in the fact that Samba development is continuing, documentation is improving, 215 user needs are being increasingly met or exceeded, and security updates are issued 216 with a short turnaround time. 217 </p><p><a class="indexterm" name="id374239"></a><a class="indexterm" name="id374247"></a><a class="indexterm" name="id374255"></a><a class="indexterm" name="id374263"></a><a class="indexterm" name="id374271"></a> 218 The release of Samba-4 is expected around late 2004 to early 2005 and involves a near 219 complete rewrite to permit extensive modularization and to prepare Samba for new 220 functionality planned for addition during the next-generation series. The Samba Team 221 is responsible and can be depended upon; the history to date suggests a high 222 degree of dependability and on charter development consistent with published 223 roadmap projections. 224 </p><p><a class="indexterm" name="id374289"></a><a class="indexterm" name="id374297"></a><a class="indexterm" name="id374309"></a><a class="indexterm" name="id374320"></a><a class="indexterm" name="id374328"></a><a class="indexterm" name="id374336"></a><a class="indexterm" name="id374343"></a> 225 Not well published is the fact that Microsoft was a foundation member of 226 the Common Internet File System (CIFS) initiative, together with the participation 227 of the network attached storage (NAS) industry. Unfortunately, for the past few years, 228 Microsoft has been absent from active involvement at CIFS conferences and has 229 not exercised the leadership expected of a major force in the networking technology 230 space. The Samba Team has maintained consistent presence and leadership at all 231 CIFS conferences and at the interoperability laboratories run concurrently with 232 them. 233 </p></dd><dt><span class="term">Cryptographic Controls (schannel, sign'n'seal)</span></dt><dd><p><a class="indexterm" name="id374368"></a><a class="indexterm" name="id374376"></a><a class="indexterm" name="id374383"></a> 234 The report correctly mentions that Samba did not support the most recent 235 <code class="constant">schannel</code> and <code class="constant">digital sign'n'seal</code> features 236 of Microsoft Windows NT/200x/XPPro products. This is one of the key features 237 of the Samba-3 release. Market research reports take so long to generate that they are 238 seldom a reflection of current practice, and in many respects reports are like a 239 pathology report they reflect accurately (at best) status at a snapshot in time. 240 Meanwhile, the world moves on. 241 </p><p><a class="indexterm" name="id374409"></a><a class="indexterm" name="id374416"></a><a class="indexterm" name="id374424"></a><a class="indexterm" name="id374432"></a><a class="indexterm" name="id374440"></a><a class="indexterm" name="id374455"></a><a class="indexterm" name="id374463"></a> 242 It should be pointed out that had clear public specifications for the protocols 243 been published, it would have been much easier to implement these features and would have 244 taken less time to do. The sole mechanism used to find an algorithm that is compatible 245 with the methods used by Microsoft has been based on observation of network traffic 246 and trial-and-error implementation of potential techniques. The real value of public 247 and defensible standards is obvious to all and would have enabled more secure networking 248 for everyone. 249 </p><p><a class="indexterm" name="id374478"></a><a class="indexterm" name="id374486"></a> 250 Critics of Samba often ignore fundamental problems that may plague (or may have plagued) 251 the users of Microsoft's products also. Those who are first to criticize Samba 252 for not rushing into release of <code class="constant">digital sign'n'seal</code> support 253 often dismiss the problems that Microsoft has 254 <a href="http://support.microsoft.com/default.aspx?kbid=321733" target="_top">acknowledged</a> 255 and for which a fix was provided. In fact, 256 <a href="http://www.tangent-systems.com/support/delayedwrite.html" target="_top">Tangent Systems</a> 257 have documented a significant problem with delays writes that can be connected with the 258 implementation of sign'n'seal. They provide a work-around that is not trivial for many 259 Windows networking sites. From notes such as this it is clear that there are benefits 260 from not rushing new technology out of the door too soon. 261 </p><p><a class="indexterm" name="id374519"></a><a class="indexterm" name="id374527"></a><a class="indexterm" name="id374535"></a><a class="indexterm" name="id374543"></a><a class="indexterm" name="id374551"></a><a class="indexterm" name="id374558"></a><a class="indexterm" name="id374566"></a><a class="indexterm" name="id374574"></a><a class="indexterm" name="id374582"></a> 262 One final comment is warranted. If companies want more secure networking protocols, 263 the most effective method by which this can be achieved is by users seeking 264 and working together to help define open and publicly refereed standards. The 265 development of closed source, proprietary methods that are developed in a 266 clandestine framework of secrecy, under claims of digital rights protection, does 267 not favor the diffusion of safe networking protocols and certainly does not 268 help the consumer to make a better choice. 269 </p></dd><dt><span class="term">Active Directory Replacement with Kerberos, LDAP, and Samba</span></dt><dd><p> 270 </p><div class="literallayout"><p>����</p></div><p> 271 The Microsoft networking protocols extensively make use of remote procedure call (RPC) 272 technology. Active Directory is not a simple mixture of LDAP and Kerberos together 273 with file and print services, but rather is a complex, intertwined implementation 274 of them that uses RPCs that are not supported by any of these component technologies 275 and yet by which they are made to interoperate in ways that the components do not 276 support. 277 </p><p><a class="indexterm" name="id374664"></a><a class="indexterm" name="id374675"></a><a class="indexterm" name="id374683"></a><a class="indexterm" name="id374691"></a><a class="indexterm" name="id374699"></a> 278 In order to make the popular request for Samba to be an Active Directory Server a 279 reality, it is necessary to add to OpenLDAP, Kerberos, as well as Samba, RPC calls 280 that are not presently supported. The Samba Team has not been able to gain critical 281 overall support for all project maintainers to work together on the complex 282 challenge of developing and integrating the necessary technologies. Therefore, if 283 the Samba Team does not make it a priority to absorb Kerberos and LDAP functionality 284 into the Samba project, this dream request cannot become a reality. 285 </p><p><a class="indexterm" name="id374715"></a><a class="indexterm" name="id374723"></a><a class="indexterm" name="id374731"></a><a class="indexterm" name="id374742"></a><a class="indexterm" name="id374750"></a> 286 At this time, the integration of LDAP, Kerberos, and the missing RPCs is not on the 287 Samba development roadmap. If it is not on the published roadmap, it cannot be delivered 288 anytime soon. Ergo, ADS server support is not a current goal for Samba development. 289 The Samba Team is most committed to permitting Samba to be a full ADS domain member 290 that is increasingly capable of being managed using Microsoft Windows MMC tools. 291 </p></dd></dl></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id374766"></a>Kerberos Exposed</h4></div></div></div><p><a class="indexterm" name="id374772"></a><a class="indexterm" name="id374780"></a><a class="indexterm" name="id374788"></a> 292 Kerberos is a network authentication protocol that provides secure authentication for 293 client-server applications by using secret-key cryptography. Firewalls are an insufficient 294 barrier mechanism in today's networking world; at best they only restrict incoming network 295 traffic but cannot prevent network traffic that comes from authorized locations from 296 performing unauthorized activities. 297 </p><p><a class="indexterm" name="id374802"></a><a class="indexterm" name="id374810"></a><a class="indexterm" name="id374818"></a> 298 Kerberos was created by MIT as a solution to network security problems. The Kerberos protocol uses 299 strong cryptography so that a client can prove its identity to a server (and vice versa) across an 300 insecure network connection. After a client and server has used Kerberos to prove their identity, 301 they can also encrypt all of their communications to assure privacy and data integrity as they go 302 about their business. 303 </p><p><a class="indexterm" name="id374833"></a><a class="indexterm" name="id374841"></a><a class="indexterm" name="id374849"></a><a class="indexterm" name="id374857"></a><a class="indexterm" name="id374868"></a> 304 Kerberos is a trusted third-party service. That means that there is a third party (the kerberos 305 server) that is trusted by all the entities on the network (users and services, usually called 306 principals). All principals share a secret password (or key) with the kerberos server and this 307 enables principals to verify that the messages from the kerberos server are authentic. Therefore, 308 trusting the kerberos server, users and services can authenticate each other. 309 </p><p> 310 <a class="indexterm" name="id374884"></a> 311 <a class="indexterm" name="id374891"></a> 312 <a class="indexterm" name="id374898"></a> 313 Kerberos was, until recently, a technology that was restricted from being exported from the United States. 314 For many years that hindered global adoption of more secure networking technologies both within the United States 315 and abroad. A free and unencumbered implementation of MIT Kerberos has been produced in Europe 316 and is available from the <a href="http://www.pdc.kth.se/heimdal/" target="_top">Royal Institute</a> of 317 Technology (KTH), Sweden. It is known as the Heimdal Kerberos project. In recent times the U.S. government 318 has removed sanctions affecting the global distribution of MIT Kerberos. It is likely that there will be a 319 significant surge forward in the development of Kerberos-enabled applications and in the general deployment 320 and use of Kerberos across the spectrum of the information technology industry. 321 </p><p> 322 <a class="indexterm" name="id374920"></a> 323 A storm has broken out concerning interoperability between MIT Kerberos and Microsofts' implementation 324 of it. For example, a 2002 325 <a href="http://www.idg.com.sg/idgwww.nsf/0/5DDA8D153A7505A748256BAB000D992A?OpenDocument" target="_top">IDG</a> 326 report<sup>[<a name="id374937" href="#ftn.id374937">13</a>]</sup> by 327 states: 328 </p><div class="blockquote"><blockquote class="blockquote"><p> 329 A Microsoft Corp. executive testified at the software giant's remedy hearing that the company goes to 330 great lengths to disclose interfaces and protocols that allow third-party software products to interact 331 with Windows. But a lawyer with the states suing Microsoft pointed out that when it comes to the company's 332 use of the Kerberos authentication specification, not everyone agrees. 333 </p><p> 334 <a class="indexterm" name="id374958"></a> 335 Robert Short, vice president of Windows core technology at Microsoft, wrote in his direct testimony prepared 336 before his appearance that non-Microsoft operating systems can disregard the portion of the Kerberos version 337 5 specification that Windows clients use for proprietary purposes and still achieve interoperability with 338 the Microsoft OS. Microsoft takes advantage of unspecified fields in the Kerberos specification for storing 339 Windows-specific authorization data, Short wrote. The designers of Kerberos left these fields undefined so 340 that software developers could add their own authorization information, he said. 341 </p></blockquote></div><p> 342 <a class="indexterm" name="id374976"></a> 343 <a class="indexterm" name="id374983"></a> 344 It so happens that Microsoft Windows clients depend on and expect the contents of the <span class="emphasis"><em>unspecified 345 fields</em></span> in the Kerberos 5 communications data stream for their Windows interoperability, 346 particularly when Samba is expected to emulate a Windows Server 200x domain controller. But the interoperability 347 issue goes far deeper than this. In the domain control protocols that are used by MS Windows XP Professional, 348 there is a tight interdependency between the Kerberos protocols and the Microsoft distributed computing environment 349 (DCE) RPCs that themselves are an integral part of the SMB/CIFS protocols as used by 350 Microsoft. 351 </p><p> 352 Microsoft makes the following comment in a reference in a 353 <a href="http://www.microsoft.com/technet/itsolutions/interop/mgmt/kerberos.asp" target="_top"> 354 technet</a> article: 355 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id375016"></a><a class="indexterm" name="id375028"></a> 356 The DCE Security Services are also layered on the Kerberos protocol. DCE authentication services use RPC 357 representation of Kerberos protocol messages. In addition, DCE uses the authorization data field in Kerberos 358 tickets to convey Privilege Attribute Certificates (PACs) that define user identity and group membership. 359 The DCE PAC is used in a similar manner as Windows NT Security IDs for user authorization and access control. 360 Windows NT services will not be able to translate DCE PACs into Windows NT user and group identifiers. This 361 is not an issue with Kerberos interoperability, but rather an issue of interoperability between DCE and 362 Windows NT access control information. 363 </p></blockquote></div></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch10expl"></a>Implementation</h2></div></div></div><p> 364 The following procedures outline the implementation of the security measures discussed so far. 365 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id375060"></a>Share Access Controls</h3></div></div></div><p><a class="indexterm" name="id375067"></a><a class="indexterm" name="id375075"></a><a class="indexterm" name="id375082"></a> 366 Access control entries placed on the share itself act as a filter at the time a when CIFS/SMB client (such as 367 Windows XP Pro) attempts to make a connection to the Samba server. 368 </p><div class="procedure"><a name="id375094"></a><p class="title"><b>Procedure�11.1.�Create/Edit/Delete Share ACLs</b></p><ol type="1"><li><p><a class="indexterm" name="id375104"></a><a class="indexterm" name="id375112"></a> 369 From a Windows 200x/XP Professional workstation, log on to the domain using the Domain Administrator 370 account (on Samba domains, this is usually the account called <code class="constant">root</code>). 371 </p></li><li><p> 372 Click 373 <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Control Panel</span> → <span class="guimenuitem">Administrative Tools</span> → <span class="guimenuitem">Computer Management</span>. 374 </p></li><li><p> 375 In the left panel, 376 <span class="guimenu">[Right mouse menu item] Computer Management (Local)</span> → <span class="guimenuitem">Connect to another computer ...</span> → <span class="guimenuitem">Browse...</span> → <span class="guimenuitem">Advanced</span> → <span class="guimenuitem">Find Now</span>. In the lower panel, click on the name of the server you wish to 377 administer. Click <span class="guimenu">OK</span> → <span class="guimenuitem">OK</span> → <span class="guimenuitem">OK</span>.<a class="indexterm" name="id375232"></a> 378 In the left panel, the entry <span class="guimenu">Computer Management (Local)</span> should now reflect 379 the change made. For example, if the server you are administering is called <code class="constant">FRODO</code>, 380 the Computer Management entry should now say <span class="guimenu">Computer Management (FRODO)</span>. 381 </p></li><li><p> 382 In the left panel, click <span class="guimenu">Computer Management (FRODO)</span> → <span class="guimenuitem">[+] Shared Folders</span> → <span class="guimenuitem">Shares</span>. 383 </p></li><li><p><a class="indexterm" name="id375293"></a><a class="indexterm" name="id375301"></a> 384 In the right panel, double-click on the share on which you wish to set/edit ACLs. This 385 will bring up the Properties panel. Click the <span class="guimenu">Share Permissions</span> tab. 386 </p></li><li><p><a class="indexterm" name="id375323"></a><a class="indexterm" name="id375331"></a><a class="indexterm" name="id375339"></a><a class="indexterm" name="id375347"></a><a class="indexterm" name="id375354"></a><a class="indexterm" name="id375362"></a> 387 You may now edit/add/remove access control settings. Be very careful. Many problems have been 388 created by people who decided that everyone should be rejected but one particular group should 389 have full control. This is a catch-22 situation because members of that particular group also 390 belong to the group <code class="constant">Everyone</code>, which therefore overrules any permissions 391 set for the permitted group. 392 </p></li><li><p> 393 When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span> 394 buttons. 395 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id375395"></a>Share Definition Controls</h3></div></div></div><p><a class="indexterm" name="id375401"></a><a class="indexterm" name="id375413"></a><a class="indexterm" name="id375421"></a><a class="indexterm" name="id375428"></a><a class="indexterm" name="id375436"></a><a class="indexterm" name="id375444"></a> 396 Share-definition-based access controls can be used like a checkpoint or like a pile-driver. Just as a 397 checkpoint can be used to require someone who wants to get through to meet certain requirements, so 398 it is possible to require the user (or group the user belongs to) to meet specified credential-related 399 objectives. It can be likened to a pile-driver by overriding default controls in that having met the 400 credential-related objectives, the user can be granted powers and privileges that would not normally be 401 available under default settings. 402 </p><p><a class="indexterm" name="id375460"></a><a class="indexterm" name="id375468"></a><a class="indexterm" name="id375476"></a><a class="indexterm" name="id375484"></a> 403 It must be emphasized that the controls discussed here can act as a filter or give rights of passage 404 that act as a superstructure over normal directory and file access controls. However, share-level 405 ACLs act at a higher level than do share definition controls because the user must filter through the 406 share-level controls to get to the share-definition controls. The proper hierarchy of controls implemented 407 by Samba and Windows networking consists of: 408 </p><div class="orderedlist"><ol type="1"><li><p>Share-level ACLs</p></li><li><p>Share-definition controls</p></li><li><p>Directory and file permissions</p></li><li><p>Directory and file POSIX ACLs</p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id375528"></a>Checkpoint Controls</h4></div></div></div><p><a class="indexterm" name="id375535"></a> 409 Consider the following extract from a <code class="filename">smb.conf</code> file defining the share called <code class="constant">Apps</code>: 410</p><pre class="screen"> 411[Apps] 412 comment = Application Share 413 path = /data/apps 414 read only = Yes 415 valid users = @Employees 416</pre><p> 417 This definition permits only those who are members of the group called <code class="constant">Employees</code> to 418 access the share. 419 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p><a class="indexterm" name="id375568"></a><a class="indexterm" name="id375579"></a><a class="indexterm" name="id375587"></a><a class="indexterm" name="id375595"></a><a class="indexterm" name="id375603"></a> 420 On domain member servers and clients, even when the <em class="parameter"><code>winbind use default domain</code></em> has 421 been specified, the use of domain accounts in security controls requires fully qualified domain specification, 422 for example, <a class="indexterm" name="id375620"></a>valid users = @"MEGANET\Northern Engineers". 423 Note the necessity to use the double quotes to avoid having the space in the Windows group name interpreted as a 424 delimiter. 425 </p></div><p><a class="indexterm" name="id375630"></a><a class="indexterm" name="id375638"></a><a class="indexterm" name="id375646"></a> 426 If there is an ACL on the share itself to permit read/write access for all <code class="constant">Employees</code> 427 as well as read/write for the group <code class="constant">Doctors</code>, both groups are permitted through 428 to the share. However, at the moment an attempt is made to set up a connection to the share, a member of 429 the group <code class="constant">Doctors</code>, who is not also a member of the group <code class="constant">Employees</code>, 430 would immediately fail to validate. 431 </p><p><a class="indexterm" name="id375674"></a> 432 Consider another example. In this case, you want to permit all members of the group <code class="constant">Employees</code> 433 except the user <code class="constant">patrickj</code> to access the <code class="constant">Apps</code> share. This can be 434 easily achieved by setting a share-level ACL permitting only <code class="constant">Employees</code> to access the share, 435 and then in the share definition controls excluding just <code class="constant">patrickj</code>. Here is how that might 436 be done: 437</p><pre class="screen"> 438[Apps] 439 comment = Application Share 440 path = /data/apps 441 read only = Yes 442 invalid users = patrickj 443</pre><p> 444 <a class="indexterm" name="id375711"></a> 445 Let us assume that you want to permit the user <code class="constant">gbshaw</code> to manage any file in the 446 UNIX/Linux file system directory <code class="filename">/data/apps</code>, but you do not want to grant any write 447 permissions beyond that directory tree. Here is one way this can be done: 448</p><pre class="screen"> 449[Apps] 450 comment = Application Share 451 path = /data/apps 452 read only = Yes 453 invalid users = patrickj 454 admin users = gbshaw 455</pre><p> 456 <a class="indexterm" name="id375738"></a> 457 Now we have a set of controls that permits only <code class="constant">Employees</code> who are also members of 458 the group <code class="constant">Doctors</code>, excluding the user <code class="constant">patrickj</code>, to have 459 read-only privilege, but the user <code class="constant">gbshaw</code> is granted administrative rights. 460 The administrative rights conferred upon the user <code class="constant">gbshaw</code> permit operation as 461 if that user has logged in as the user <code class="constant">root</code> on the UNIX/Linux system and thus, 462 for access to the directory tree that has been shared (exported), permit the user to override controls 463 that apply to all other users on that resource. 464 </p><p> 465 There are additional checkpoint controls that may be used. For example, if for the same share we now 466 want to provide the user <code class="constant">peters</code> with the ability to write to one directory to 467 which he has write privilege in the UNIX file system, you can specifically permit that with the 468 following settings: 469</p><pre class="screen"> 470[Apps] 471 comment = Application Share 472 path = /data/apps 473 read only = Yes 474 invalid users = patrickj 475 admin users = gbshaw 476 write list = peters 477</pre><p> 478 <a class="indexterm" name="id375789"></a> 479 This is a particularly complex example at this point, but it begins to demonstrate the possibilities. 480 You should refer to the online manual page for the <code class="filename">smb.conf</code> file for more information regarding 481 the checkpoint controls that Samba implements. 482 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id375808"></a>Override Controls</h4></div></div></div><p><a class="indexterm" name="id375815"></a> 483 Override controls implemented by Samba permit actions like the adoption of a different identity 484 during file system operations, the forced overwriting of normal file and directory permissions, 485 and so on. You should refer to the online manual page for the <code class="filename">smb.conf</code> file for more information regarding 486 the override controls that Samba implements. 487 </p><p> 488 In the following example, you want to create a Windows networking share that any user can access. 489 However, you want all read and write operations to be performed as if the user <code class="constant">billc</code> 490 and member of the group <code class="constant">Mentors</code> read/write the files. Here is one way this 491 can be done: 492</p><pre class="screen"> 493[someshare] 494 comment = Some Files Everyone May Overwrite 495 path = /data/somestuff 496 read only = No 497 force user = billc 498 force group = Mentors 499</pre><p> 500 <a class="indexterm" name="id375852"></a><a class="indexterm" name="id375860"></a> 501 That is all there is to it. Well, it is almost that simple. The downside of this method is that 502 users are logged onto the Windows client as themselves, and then immediately before accessing the 503 file, Samba makes system calls to change the effective user and group to the forced settings 504 specified, completes the file transaction, and then reverts to the actually logged-on identity. 505 This imposes significant overhead on Samba. The alternative way to effectively achieve the same result 506 (but with lower system CPU overheads) is described next. 507 </p><p><a class="indexterm" name="id375876"></a><a class="indexterm" name="id375884"></a><a class="indexterm" name="id375892"></a><a class="indexterm" name="id375903"></a><a class="indexterm" name="id375911"></a> 508 The use of the <em class="parameter"><code>force user</code></em> or the <em class="parameter"><code>force group</code></em> may 509 also have a severe impact on system (particularly on Windows client) performance. If opportunistic 510 locking is enabled on the share (the default), it causes an <code class="constant">oplock break</code> to be 511 sent to the client even if the client has not opened the file. On networks that have high traffic 512 density, or on links that are routed to a remote network segment, <code class="constant">oplock breaks</code> 513 can be lost. This results in possible retransmission of the request, or the client may time-out while 514 waiting for the file system transaction (read or write) to complete. The result can be a profound 515 apparent performance degradation as the client continually attempts to reconnect to overcome the 516 effect of the lost <code class="constant">oplock break</code>, or time-out. 517 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id375952"></a>Share Point Directory and File Permissions</h3></div></div></div><p><a class="indexterm" name="id375958"></a><a class="indexterm" name="id375966"></a><a class="indexterm" name="id375974"></a><a class="indexterm" name="id375982"></a> 518 Samba has been designed and implemented so that it respects as far as is feasible the security and 519 user privilege controls that are built into the UNIX/Linux operating system. Samba does nothing 520 with respect to file system access that violates file system permission settings, unless it is 521 explicitly instructed to do otherwise through share definition controls. Given that Samba obeys 522 UNIX file system controls, this chapter does not document simple information that can be obtained 523 from a basic UNIX training guide. Instead, one common example of a typical problem is used 524 to demonstrate the most effective solution referred to in the immediately preceding paragraph. 525 </p><p><a class="indexterm" name="id375999"></a><a class="indexterm" name="id376007"></a><a class="indexterm" name="id376015"></a> 526 One of the common issues that repeatedly pops up on the Samba mailing lists involves the saving of 527 Microsoft Office files (Word and Excel) to a network drive. Here is the typical sequence: 528 </p><div class="orderedlist"><ol type="1"><li><p> 529 A user opens a Work document from a network drive. The file was owned by user <code class="constant">janetp</code> 530 and [users], and was set read/write-enabled for everyone. 531 </p></li><li><p> 532 File changes and edits are made. 533 </p></li><li><p> 534 The file is saved, and MS Word is closed. 535 </p></li><li><p> 536 The file is now owned by the user <code class="constant">billc</code> and group <code class="constant">doctors</code>, 537 and is set read/write by <code class="constant">billc</code>, read-only by <code class="constant">doctors</code>, and 538 no access by everyone. 539 </p></li><li><p> 540 The original owner cannot now access her own file and is “<span class="quote">justifiably</span>” upset. 541 </p></li></ol></div><p> 542 There have been many postings over the years that report the same basic problem. Frequently Samba users 543 want to know when this “<span class="quote">bug</span>” will be fixed. The fact is, this is not a bug in Samba at all. 544 Here is the real sequence of what happens in this case. 545 </p><p><a class="indexterm" name="id376099"></a><a class="indexterm" name="id376107"></a><a class="indexterm" name="id376115"></a> 546 When the user saves a file, MS Word creates a new (temporary) file. This file is naturally owned 547 by the user who creates the file (<code class="constant">billc</code>) and has the permissions that follow 548 that user's default settings within the operating system (UNIX/Linux). When MS Word has finished writing 549 the file to disk, it then renames the new (temporary) file to the name of the old one. MS Word does not 550 change the ownership or permissions to what they were on the original file. The file is thus a totally 551 new file, and the old one has been deleted in the process. 552 </p><p> 553 Samba received a request to create a new file, and then to rename the file to a new name. The old file that 554 has the same name is now automatically deleted. Samba has no way of knowing that the new file should 555 perhaps have the same ownership and permissions as the old file. To Samba, these are entirely independent 556 operations. 557 </p><p> 558 The question is, “<span class="quote">How can we solve the problem?</span>” 559 </p><p> 560 The solution is simple. Use UNIX file system permissions and controls to your advantage. Follow these 561 simple steps to create a share in which all files will consistently be owned by the same user and the 562 same group: 563 </p><div class="procedure"><a name="id376152"></a><p class="title"><b>Procedure�11.2.�Using Directory Permissions to Force File User and Group Ownership</b></p><ol type="1"><li><p> 564 Change your share definition so that it matches this pattern: 565</p><pre class="screen"> 566[finance] 567 path = /usr/data/finance 568 browseable = Yes 569 read only = No 570</pre><p> 571 </p></li><li><p><a class="indexterm" name="id376176"></a><a class="indexterm" name="id376187"></a> 572 Set consistent user and group permissions recursively down the directory tree as shown here: 573</p><pre class="screen"> 574<code class="prompt">root# </code> chown -R janetp.users /usr/data/finance 575</pre><p> 576 </p></li><li><p><a class="indexterm" name="id376218"></a> 577 Set the files and directory permissions to be read/write for owner and group, and not accessible 578 to others (everyone), using the following command: 579</p><pre class="screen"> 580<code class="prompt">root# </code> chmod ug+rwx,o-rwx /usr/data/finance 581</pre><p> 582 </p></li><li><p><a class="indexterm" name="id376245"></a> 583 Set the SGID (supergroup) bit on all directories from the top down. This means all files 584 can be created with the permissions of the group set on the directory. It means all users 585 who are members of the group <code class="constant">finance</code> can read and write all files in 586 the directory. The directory is not readable or writable by anyone who is not in the 587 <code class="constant">finance</code> group. Simply follow this example: 588</p><pre class="screen"> 589<code class="prompt">root# </code> find /usr/data/finance -type d -exec chmod ug+s {}\; 590</pre><p> 591 592 </p></li><li><p><a class="indexterm" name="id376282"></a><a class="indexterm" name="id376290"></a><a class="indexterm" name="id376298"></a> 593 Make sure all users that must have read/write access to the directory have 594 <code class="constant">finance</code> group membership as their primary group, 595 for example, the group they belong to in <code class="filename">/etc/passwd</code>. 596 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id376321"></a>Managing Windows 200x ACLs</h3></div></div></div><p><a class="indexterm" name="id376328"></a><a class="indexterm" name="id376335"></a><a class="indexterm" name="id376343"></a><a class="indexterm" name="id376351"></a> 597 Samba must translate Windows 2000 ACLs to UNIX POSIX ACLs. This has some interesting side effects because 598 there is not a one-to-one equivalence between them. The as-close-as-possible ACLs match means 599 that some transactions are not possible from MS Windows clients. One of these is to reset the ownership 600 of directories and files. If you want to reset ownership, this must be done from a UNIX/Linux login. 601 </p><p> 602 There are two possible ways to set ACLs on UNIX/Linux file systems from a Windows network workstation, 603 either via File Manager or via the Microsoft Management Console (MMC) Computer Management interface. 604 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id376370"></a>Using the MMC Computer Management Interface</h4></div></div></div><div class="procedure"><ol type="1"><li><p> 605 From a Windows 200x/XP Professional workstation, log on to the domain using the Domain Administrator 606 account (on Samba domains, this is usually the account called <code class="constant">root</code>). 607 </p></li><li><p> 608 Click 609 <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Control Panel</span> → <span class="guimenuitem">Administrative Tools</span> → <span class="guimenuitem">Computer Management</span>. 610 </p></li><li><p> 611 In the left panel, 612 <span class="guimenu">[Right mouse menu item] Computer Management (Local)</span> → <span class="guimenuitem">Connect to another computer ...</span> → <span class="guimenuitem">Browse...</span> → <span class="guimenuitem">Advanced</span> → <span class="guimenuitem">Find Now</span>. In the lower panel, click on the name of the server you wish to 613 administer. Click <span class="guimenu">OK</span> → <span class="guimenuitem">OK</span> → <span class="guimenuitem">OK</span>. 614 In the left panel, the entry <span class="guimenu">Computer Management (Local)</span> should now reflect 615 the change made. For example, if the server you are administering is called <code class="constant">FRODO</code>, 616 the Computer Management entry should now say: <span class="guimenu">Computer Management (FRODO)</span>. 617 </p></li><li><p> 618 In the left panel, click <span class="guimenu">Computer Management (FRODO)</span> → <span class="guimenuitem">[+] Shared Folders</span> → <span class="guimenuitem">Shares</span>. 619 </p></li><li><p><a class="indexterm" name="id376547"></a><a class="indexterm" name="id376555"></a><a class="indexterm" name="id376562"></a><a class="indexterm" name="id376570"></a> 620 In the right panel, double-click on the share on which you wish to set/edit ACLs. This 621 brings up the Properties panel. Click the <span class="guimenu">Security</span> tab. It is best 622 to edit ACLs using the <code class="constant">Advanced</code> editing features. Click the 623 <span class="guimenu">Advanced</span> button. This opens a panel that has four tabs. Only the 624 functionality under the <code class="constant">Permissions</code> tab can be utilized with respect 625 to a Samba domain server. 626 </p></li><li><p><a class="indexterm" name="id376607"></a><a class="indexterm" name="id376615"></a> 627 You may now edit/add/remove access control settings. Be very careful. Many problems have been 628 created by people who decided that everyone should be rejected but one particular group should 629 have full control. This is a catch-22 situation because members of that particular group also 630 belong to the group <code class="constant">Everyone</code>, which therefore overrules any permissions 631 set for the permitted group. 632 </p></li><li><p> 633 When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span> 634 buttons until the last panel closes. 635 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id376647"></a>Using MS Windows Explorer (File Manager)</h4></div></div></div><p> 636 The following alternative method may be used from a Windows workstation. In this example we work 637 with a domain called <code class="constant">MEGANET</code>, a server called <code class="constant">MASSIVE</code>, and a 638 share called <code class="constant">Apps</code>. The underlying UNIX/Linux share point for this share is 639 <code class="filename">/data/apps</code>. 640 </p><div class="procedure"><ol type="1"><li><p> 641 Click <span class="guimenu">Start</span> → <span class="guimenuitem">[right-click] My Computer</span> → <span class="guimenuitem">Explore</span> → <span class="guimenuitem">[left panel] [+] My Network Places</span> → <span class="guimenuitem">[+] Entire Network</span> → <span class="guimenuitem">[+] Microsoft Windows Network</span> → <span class="guimenuitem">[+] Meganet</span> → <span class="guimenuitem">[+] Massive</span> → <span class="guimenuitem">[right-click] Apps</span> → <span class="guimenuitem">Properties</span> → <span class="guimenuitem">Security</span> → <span class="guimenuitem">Advanced</span>. This opens a panel that has four tabs. Only the functionality under the 642 <code class="constant">Permissions</code> tab can be utilized for a Samba domain server. 643 </p></li><li><p><a class="indexterm" name="id376768"></a><a class="indexterm" name="id376775"></a> 644 You may now edit/add/remove access control settings. Be very careful. Many problems have been 645 created by people who decided that everyone should be rejected but one particular group should 646 have full control. This is a catch-22 situation because members of that particular group also 647 belong to the group <code class="constant">Everyone</code>, which therefore overrules any permissions 648 set for the permitted group. 649 </p></li><li><p> 650 When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span> 651 buttons until the last panel closes. 652 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id376809"></a>Setting Posix ACLs in UNIX/Linux</h4></div></div></div><p><a class="indexterm" name="id376816"></a><a class="indexterm" name="id376824"></a> 653 Yet another alternative method for setting desired security settings on the shared resource files and 654 directories can be achieved by logging into UNIX/Linux and setting POSIX ACLs directly using command-line 655 tools. Here is an example session on the same resource as in the immediately preceding example on a SUSE 9 656 Linux system: 657 </p><div class="procedure"><ol type="1"><li><p> 658 Log into the Linux system as the user <code class="constant">root</code>. 659 </p></li><li><p> 660 Change directory to the location of the exported (shared) Windows file share (Apps), which is in 661 the directory <code class="filename">/data</code>. Execute the following: 662</p><pre class="screen"> 663<code class="prompt">root# </code> cd /data 664</pre><p> 665 Retrieve the existing POSIX ACLs entry by executing: 666</p><pre class="screen"> 667<code class="prompt">root# </code> getfacl apps 668# file: apps 669# owner: root 670# group: root 671user::rwx 672group::rwx 673other::r-x 674</pre><p> 675 </p></li><li><p><a class="indexterm" name="id376892"></a> 676 You want to add permission for <code class="constant">AppsMgrs</code> to enable them to 677 manage the applications (apps) share. It is important to set the ACL recursively 678 so that the AppsMgrs have this capability throughout the directory tree that is 679 being shared. This is done using the <code class="constant">-R</code> option as shown. 680 Execute the following: 681</p><pre class="screen"> 682<code class="prompt">root# </code> setfacl -m -R group:AppsMgrs:rwx /data/apps 683</pre><p> 684 Because setting an ACL does not provide a response, you immediately validate the command executed 685 as follows: 686</p><pre class="screen"> 687<code class="prompt">root# </code> getfacl /data/apps 688# file: apps 689# owner: root 690# group: root 691user::rwx 692group::rwx 693group:AppsMgrs:rwx 694mask::rwx 695other::r-x 696</pre><p> 697 This confirms that the change of POSIX ACL permissions has been effective. 698 </p></li><li><p><a class="indexterm" name="id376942"></a><a class="indexterm" name="id376950"></a><a class="indexterm" name="id376958"></a><a class="indexterm" name="id376965"></a><a class="indexterm" name="id376973"></a> 699 It is highly recommended that you read the online manual page for the <code class="literal">setfacl</code> 700 and <code class="literal">getfacl</code> commands. This provides information regarding how to set/read the default 701 ACLs and how that may be propagated through the directory tree. In Windows ACLs terms, this is the equivalent 702 of setting <code class="constant">inheritance</code> properties. 703 </p></li></ol></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id377005"></a>Key Points Learned</h3></div></div></div><p> 704 The mish-mash of issues were thrown together into one chapter because it seemed like a good idea. 705 Looking back, this chapter could be broken into two, but it's too late now. It has been done. 706 The highlights covered are as follows: 707 </p><div class="itemizedlist"><ul type="disc"><li><p><a class="indexterm" name="id377020"></a><a class="indexterm" name="id377028"></a><a class="indexterm" name="id377036"></a><a class="indexterm" name="id377043"></a> 708 Winbind honors and does not override account controls set in Active Directory. 709 This means that password change, logon hours, and so on, are (or soon will be) enforced 710 by Samba winbind. At this time, an out-of-hours login is denied and password 711 change is enforced. At this time, if logon hours expire, the user is not forcibly 712 logged off. That may be implemented at some later date. 713 </p></li><li><p><a class="indexterm" name="id377059"></a><a class="indexterm" name="id377067"></a> 714 Sign'n'seal (plus schannel support) has been implemented in Samba-3. Beware of potential 715 problems acknowledged by Microsoft as having been fixed but reported by some as still 716 possibly an open issue. 717 </p></li><li><p><a class="indexterm" name="id377081"></a><a class="indexterm" name="id377089"></a><a class="indexterm" name="id377097"></a><a class="indexterm" name="id377104"></a> 718 The combination of Kerberos 5, plus OpenLDAP, plus Samba, cannot replace Microsoft 719 Active Directory. The possibility to do this is not planned in the current Samba-3 720 roadmap. Samba-3 does aim to provide further improvements in interoperability so that 721 UNIX/Linux systems may be fully integrated into Active Directory domains. 722 </p></li><li><p> 723 This chapter reviewed mechanisms by which Samba servers may be kept secure. Each of 724 the four key methodologies was reviewed with specific reference to example deployment 725 techniques. 726 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id377127"></a>Questions and Answers</h2></div></div></div><p> 727 </p><div class="qandaset"><dl><dt> <a href="kerberos.html#id377142"> 728 Does Samba-3 require the Sign'n'seal registry hacks needed by Samba-2? 729 </a></dt><dt> <a href="kerberos.html#id377210"> 730 Does Samba-3 support Active Directory? 731 </a></dt><dt> <a href="kerberos.html#id377238"> 732 When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was 733 necessary with Samba-2? 734 </a></dt><dt> <a href="kerberos.html#id377273"> 735 Is it safe to set share-level access controls in Samba? 736 </a></dt><dt> <a href="kerberos.html#id377300"> 737 Is it mandatory to set share ACLs to get a secure Samba-3 server? 738 </a></dt><dt> <a href="kerberos.html#id377372"> 739 The valid users did not work on the [homes]. 740 Has this functionality been restored yet? 741 </a></dt><dt> <a href="kerberos.html#id377431"> 742 Is the bias against use of the force user and force group 743 really warranted? 744 </a></dt><dt> <a href="kerberos.html#id377492"> 745 The example given for file and directory access control forces all files to be owned by one 746 particular user. I do not like that. Is there any way I can see who created the file? 747 </a></dt><dt> <a href="kerberos.html#id377536"> 748 In the book, “The Official Samba-3 HOWTO and Reference Guide”, you recommended use 749 of the Windows NT4 Server Manager (part of the SRVTOOLS.EXE) utility. Why 750 have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility? 751 </a></dt><dt> <a href="kerberos.html#id377596"> 752 I tried to set valid users = @Engineers, but it does not work. My Samba 753 server is an Active Directory domain member server. Has this been fixed now? 754 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id377142"></a><a name="id377144"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id377147"></a><a class="indexterm" name="id377155"></a> 755 Does Samba-3 require the <code class="constant">Sign'n'seal</code> registry hacks needed by Samba-2? 756 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id377174"></a><a class="indexterm" name="id377182"></a><a class="indexterm" name="id377190"></a> 757 No. Samba-3 fully supports <code class="constant">Sign'n'seal</code> as well as <code class="constant">schannel</code> 758 operation. The registry change should not be applied when Samba-3 is used as a domain controller. 759 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id377210"></a><a name="id377212"></a></td><td align="left" valign="top"><p> 760 Does Samba-3 support Active Directory? 761 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id377222"></a> 762 Yes. Samba-3 can be a fully participating native mode Active Directory client. Samba-3 does not 763 provide Active Directory services. It cannot be used to replace a Microsoft Active Directory 764 server implementation. Samba-3 can function as an Active Directory client (workstation) toolkit, 765 and it can function as an Active Directory domain member server. 766 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id377238"></a><a name="id377240"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id377243"></a> 767 When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was 768 necessary with Samba-2? 769 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id377259"></a> 770 No. Samba-3 can be used with NetBIOS over TCP/IP disabled, just as can be done with Windows 200x 771 Server and 200x/XPPro client products. It is no longer necessary to run mixed-mode operation, 772 because Samba-3 can join a native Windows 2003 Server ADS domain. 773 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id377273"></a><a name="id377275"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id377278"></a> 774 Is it safe to set share-level access controls in Samba? 775 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 776 Yes. Share-level access controls have been supported since early versions of Samba-2. This is 777 very mature technology. Not enough sites make use of this powerful capability, neither on 778 Windows server or with Samba servers. 779 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id377300"></a><a name="id377302"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id377305"></a> 780 Is it mandatory to set share ACLs to get a secure Samba-3 server? 781 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id377320"></a><a class="indexterm" name="id377328"></a><a class="indexterm" name="id377336"></a><a class="indexterm" name="id377344"></a><a class="indexterm" name="id377352"></a> 782 No. Samba-3 honors UNIX/Linux file system security, supports Windows 200x ACLs, and provides 783 means of securing shares through share definition controls in the <code class="filename">smb.conf</code> file. The additional 784 support for share-level ACLs is like frosting on the cake. It adds to security but is not essential 785 to it. 786 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id377372"></a><a name="id377374"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id377378"></a> 787 The <em class="parameter"><code>valid users</code></em> did not work on the <em class="parameter"><code>[homes]</code></em>. 788 Has this functionality been restored yet? 789 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id377404"></a> 790 Yes. This was fixed in Samba-3.0.2. The use of this parameter is strongly recommended as a safeguard 791 on the <em class="parameter"><code>[homes]</code></em> meta-service. The correct way to specify this is: 792 <a class="indexterm" name="id377421"></a>valid users = %S. 793 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id377431"></a><a name="id377433"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id377436"></a><a class="indexterm" name="id377444"></a><a class="indexterm" name="id377452"></a> 794 Is the bias against use of the <em class="parameter"><code>force user</code></em> and <em class="parameter"><code>force group</code></em> 795 really warranted? 796 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id377479"></a> 797 There is no bias. There is a determination to recommend the right tool for the task at hand. 798 After all, it is better than putting users through performance problems, isn't it? 799 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id377492"></a><a name="id377494"></a></td><td align="left" valign="top"><p> 800 The example given for file and directory access control forces all files to be owned by one 801 particular user. I do not like that. Is there any way I can see who created the file? 802 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id377506"></a> 803 Sure. You do not have to set the SUID bit on the directory. Simply execute the following command 804 to permit file ownership to be retained by the user who created it: 805</p><pre class="screen"> 806<code class="prompt">root# </code> find /usr/data/finance -type d -exec chmod g+s {}\; 807</pre><p> 808 Note that this required no more than removing the <code class="constant">u</code> argument so that the 809 SUID bit is not set for the owner. 810 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id377536"></a><a name="id377538"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id377541"></a> 811 In the book, “<span class="quote">The Official Samba-3 HOWTO and Reference Guide</span>”, you recommended use 812 of the Windows NT4 Server Manager (part of the <code class="filename">SRVTOOLS.EXE</code>) utility. Why 813 have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility? 814 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id377567"></a><a class="indexterm" name="id377575"></a> 815 Either tool can be used with equal effect. There is no benefit of one over the other, except that 816 the MMC utility is present on all Windows 200x/XP systems and does not require additional software 817 to be downloaded and installed. Note that if you want to manage user and group accounts in your 818 Samba-controlled domain, the only tool that permits that is the NT4 Domain User Manager, which 819 is provided as part of the <code class="filename">SRVTOOLS.EXE</code> utility. 820 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id377596"></a><a name="id377599"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id377602"></a><a class="indexterm" name="id377610"></a><a class="indexterm" name="id377618"></a> 821 I tried to set <em class="parameter"><code>valid users = @Engineers</code></em>, but it does not work. My Samba 822 server is an Active Directory domain member server. Has this been fixed now? 823 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 824 The use of this parameter has always required the full specification of the domain account, for 825 example, <em class="parameter"><code>valid users = @"MEGANET2\Domain Admins"</code></em>. 826 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"></div><div class="footnote"><a href="http://199.105.191.226/Man/2699/020430msdoj/" target="_top"><sup>[<a name="ftn.id374937" href="#id374937">13</a>] </sup>ITWorld.com</a></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="RefSection.html">Prev</a>�</td><td width="20%" align="center"><a accesskey="u" href="RefSection.html">Up</a></td><td width="40%" align="right">�<a accesskey="n" href="DomApps.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Part�III.�Reference Section�</td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top">�Chapter�12.�Integrating Additional Services</td></tr></table></div></body></html> 827