Integrating non-dce/dfs Desktops into an existing DCE/DFS Environment

Transcription

1 Integrating non-dce/dfs Desktops into an existing DCE/DFS Environment Markus Zahn Computer Centre Augsburg University May 2000

2 Integrating non-dce/dfs Desktops into an existing DCE/DFS Environment Overview Introduction Environment and Goals Solution for Linux Clients Upcoming Solution for Windows Clients Conclusions References Markus Zahn Augsburg University, Computer Centre 1

3 Introduction, assumptions and environment Introduction Large computing environments consist of many different platforms. Unix(Solaris,HP/UX,AIX,...includingLinux) Windows 3.x/95/98/NT Mac... Each platform has its own native authentication mechanism. Each platform has its own native file sharing facilities. There is definitely a great demand for both a single sign on solution and a common file system. Markus Zahn Augsburg University, Computer Centre 2

4 Introduction, assumptions and environment Basic Approach Idea: Make use of a distributed system based on Unix and handle desktop access via gateway solutions (e.g. Samba, netatalk,...). NIS/NFS is not really desireable (security, scalability). Make use of DCE/DFS: Implementations for most Unix systems. Windows and Mac implementation. Markus Zahn Augsburg University, Computer Centre 3

5 Introduction, assumptions and environment Advantages Leverage existing capital investment and expertise to provide file services from Unix to the different desktop systems. Increase service by providing one single password for login, mail service etc. Provide for Unix-based account mangement. Markus Zahn Augsburg University, Computer Centre 4

6 Introduction, assumptions and environment Caveats No DCE/DFS for Linux (at least no DFS): How to authenticate against DCE? Using the DFS/NFS gateway is far too much trouble (regarding authentication/authorization). No DFS support for Mac and Windows NT Samba, netatalk. Login integration not too smart on Windows: Accounts have to be known by DCE and Windows. Make use of a customized GINA or find a different approach. Markus Zahn Augsburg University, Computer Centre 5

7 Introduction, assumptions and environment Augsburg University s Environment Overall enrolled students employees. DCE cell (growing since 1994) DCE/DFS is backbone of account management and file sharing registered student accounts. 600 registered employee accounts. 400 affiliates with accounts. Windows NT domain (students only, since 1996) Student accounts derived from DCE registry. Continued for traditional reasons mainly. Markus Zahn Augsburg University, Computer Centre 6

8 Our Solution In general Modify client systems as few as possible. Make use of SSL to secure connections. Linux integration Pluggable Authentication Module (PAM) to allow integrated login. Implicit DFS/NFS Gateway authentication/mapping. Extend Name Service Switch (NSS) for DCE registry lookups. Markus Zahn Augsburg University, Computer Centre 7

9 Our Solution, continued Windows integration (in progress) Synchronize Windows NT and DCE registry. Use integrated login (login against NT and DCE registry) and native DFS support on DCE/DFS-integrated systems. Use SMB gateways elsewhere (e.g. Samba with Paul Henson s extensions). No modifications on the clients (except installation of DCE/DFS). Markus Zahn Augsburg University, Computer Centre 8

10 Inside PAM/NSS for Linux Extending Linux Major Components Pluggable Authentication Module (pam dce.so) to authenticate users. Name Service Switch extension (libnss dce.so.2) to make DCE registry lookups. PAM-Dæmon on DFS/NFS Gateway server to process PAM requests and establish DFS/NFS mapping. NSS-Dæmon on any DCE client to process NSS requests. Markus Zahn Augsburg University, Computer Centre 9

11 Inside PAM/NSS for Linux Conceptual Overview Linux Client libnss_dce.so.2 pam_dce.so SSL NFS Client DCE Client DCE Registry nssdced pamdced DFS/NFS Gateway NFS Server DFS Markus Zahn Augsburg University, Computer Centre 10

12 Inside PAM/NSS for Linux Linux Configuration Compile/install modules (/lib/security/pam dce.so and /lib/libnss dce.so.2). Setup PAM/DCE configuration (/etc/security/pam dce.conf). Install SSL certificate (/etc/security/pam dce.pem). Modify PAM configuration (e.g. /etc/pam.d/login): auth required /lib/security/pam_dce.so NSS/DCE configuration (/etc/nss dce.conf). Modify NSS configuration (/etc/nsswitch.conf): passwd: files dce group: files dce Markus Zahn Augsburg University, Computer Centre 11

13 Inside PAM/NSS for Linux Dæmon Setup Compile/install dæmons on DCE client (/usr/local/pam nss/pamdced and /usr/local/pam nss/nssdced). Create/install SSL certificate. Add pamdced to /etc/inetd.conf. Add nssdced to /etc/rc.local. Markus Zahn Augsburg University, Computer Centre 12

14 Inside PAM/NSS for Linux Current Status What is implemented... Authentication via PAM. Establish DFS/NFS mapping via PAM. SSL to secure PAM connections (i.e. password transfers). Support for the most important lookup methods (getpwnam(), getpwuid(), getgrnam() and getgrgid()). Markus Zahn Augsburg University, Computer Centre 13

15 Inside PAM/NSS for Linux Current Status, continued What is not implemented (yet)... No session support, no kdestroy equivalent ( security issue). No password managment yet. Not all lookup methods implemented for performace reasons (setpwent(), endpwent(), getpwent(), setgrent(), endgrent() and getgrent()). No support for multiple nssdced Dæmons (within client configuraton) yet. Markus Zahn Augsburg University, Computer Centre 14

16 Integrating Windows clients We are planning to... make use of existing Windows NT servers (mainly for traditional reasons). synchronize DCE registry and Windows NT registry. Add new accounts to both registries. Propagate password changes from DCE to NT and vice versa. Use password stength facilities of DCE (password strength server) and NT (password strength DLL) use patched Samba to export DFS home directories. Markus Zahn Augsburg University, Computer Centre 15

17 Integrating Windows clients Conceptual Overview Windows 3.x/95/98 Windows NT DCE/DFS Client authentication DFS access Integrated Login authentication authentication Windows NT PDC DCE Client DCE/DFS Client DCE/DFS Client DCE/DFS Client PWD Strength DLL PWD Strength Server SMB Gateway SMB Gateway SMB Gateway SSL password propagation DCE registry Markus Zahn Augsburg University, Computer Centre 16

18 Conclusions PAM/NSS-DCE integration for Linux in production use for > 2 months now. DFS access over DFS/NFS Gateway is restricted to NFS capabilities (e.g. no ACL support). Installation is plug & play. No major problems up to now. Additional features on wish list. Markus Zahn Augsburg University, Computer Centre 17

19 PAM/NSS-DCE Homepage: References Linux-PAM: ftp://ftp.kernel.org/pub/linux/libs/pam/index.html The GNU C Library System Databases and Name Service Switch: Paul Henson s Samba patches and authentication extensions: Synchronizing NT and Unix passwords with DCE: Markus Zahn Augsburg University, Computer Centre 18