CIT 470: Advanced Network and System Administration. Topics. Namespaces. Accounts and Namespaces. 1. Namespaces 2. Policies

Transcription

1 CIT 470: Advanced Network and System Administration Accounts and Namespaces CIT 470: Advanced Network and System Administration Slide #1 Topics 1. Namespaces 2. Policies 1. selection 2. lifetime 3. scope 4. security 3. User Accounts 4. PAM 5. LDAP Authentication CIT 470: Advanced Network and System Administration Slide #2 Namespaces A namespace consists of A set of unique keys A set of attributes associated with each key Example Key = Username Attributes GECOS Homedir Shell Password CIT 470: Advanced Network and System Administration Slide #3 1

2 Namespaces Systems include many namespaces User account names. addresses. Filesystem pathnames. Hostnames. IP addresses. Printer names. Service names. CIT 470: Advanced Network and System Administration Slide #4 Types of Namespaces Flat No duplicates may exist. Ex: usernames in /etc/passwd. Hierarchical Tree-structured namespace like DNS. Duplicates can exist. Ex: and CIT 470: Advanced Network and System Administration Slide #5 Namespace Problems 1. How to select names? 2. How to avoid name collisions? 3. How to ensure consistency? 4. How to distribute names? CIT 470: Advanced Network and System Administration Slide #6 2

3 Name Selection Functional Names mail hostname, /cit/470, student account Descriptive names geographic, print type, customer type Formula-based Names cvg0141 hostname, student0148 account Themed Names constellations (orion, ursa, etc.) No Standard CIT 470: Advanced Network and System Administration Slide #7 Name Lifetime When are names removed? Immediately after PC, user leaves org. Set time after resource is no longer in use. When are names re-used? Immediately: functional names. Never. After a set time: usernames, addresses. CIT 470: Advanced Network and System Administration Slide #8 Namespace Scope Geographical scopes Local machine. (e.g., /etc/passwd.) Local network. Organization. Global (e.g., DNS.) Service scopes Single username for UNIX, NT, RADIUS, , VPN? Transferring scopes Difficult without advance planning. Some names may have to change. CIT 470: Advanced Network and System Administration Slide #9 3

4 Namespace Security 1. What are you trying to protect names from and why? 2. Do the names need to be protected or just the attributes? 3. Who can add, change, or delete records? 4. Can the owner of a record change fields within the record? CIT 470: Advanced Network and System Administration Slide #10 Example Namespace: Usernames Selection policies Descriptive: waldenj, jwalden Decriptive + formulaic: waldenj1, jwalden0002 Scope Use for every campus (avoids collisions.) Use for every service (avoids collisions.) Lifetime Do not reuse until 1 year has passed since addresses derive from usernames. CIT 470: Advanced Network and System Administration Slide #11 One Big Database Centralize namespace in one big database. Use SQL or LDAP to store entire namespace. Derive other namespaces from database. Program to generate UNIX accounts. Program to generate NT accounts. etc. Advantages Consistency Ease of making changes, additions, deletions. CIT 470: Advanced Network and System Administration Slide #12 4

5 User Account Types OS files UNIX /etc/{passwd,shadow} Windows SAM Network service NIS LDAP Kerberos Active Directory RADIUS CIT 470: Advanced Network and System Administration Slide #13 UNIX Accounts Account Components Username UID Password Home directory Account Files /etc/passwd /etc/shadow /etc/group Account Management Adding users Removing and disabling users Account/password policies CIT 470: Advanced Network and System Administration Slide #14 /etc/{passwd,shadow} Central file(s) describing UNIX user accounts. /etc/passwd Username UID Default GID GCOS Home directory Login shell /etc/shadow Username Encrypted password Date of last pw change. Days til change allowed. Days `til change required. Expiration warning time. Expiration date. student:x:1000:1000:example User,, ,:/home/student:/bin/bash student:$1$w/uuktlf$otssvxtsn/xjzuogfelnz0:13226:0:99999:7::: CIT 470: Advanced Network and System Administration Slide #15 5

6 Username Syntax Each username must be unique. Length limits (8 chars on old systems) Any character except : or \n. Issues Naming standards. How to ensure that usernames are unique? System uses UIDs internally. CIT 470: Advanced Network and System Administration Slide #16 UIDs UIDs are 32-bit non-negative integers. Standards Root is UID 0. System accounts have low UIDs (<= 500) Uniqueness Multiple usernames can have same UID! Re-using UIDs may give away files to new user. Distributed systems may require unique UIDs across organizational boundaries. CIT 470: Advanced Network and System Administration Slide #17 Password Syntax Length: unlimited(md5,sha1), 8 chars(crypt) Chars: anything except \n, though certain control chars may be interpreted by system. Stored in encrypted format. Hashed: crypt, MD5, SHA1 Salted: 12-bit salt means 4096 different hashes for each password CIT 470: Advanced Network and System Administration Slide #18 6

7 GID GIDs are 32-bit non-negative integers. Each user has a default GID. File group ownership set to default GID. Temporarily change default GID: newgrp. Groups are described in /etc/group Users may belong to multiple groups. Format: group name, pw, GID, user list. wheel:x:10:root,waldenj,bergs CIT 470: Advanced Network and System Administration Slide #19 GECOS Original use General Electric Comprehensive OS data Current use User information. Full name, location, phone number, . CIT 470: Advanced Network and System Administration Slide #20 Home Directory User s CWD at login time. Typically where user stores all files. CIT 470: Advanced Network and System Administration Slide #21 7

8 Login Shell Process started when user logs in. Typically a shell like bash, tcsh, ksh,... System users may be different. Disabled accounts have a noshell program. CIT 470: Advanced Network and System Administration Slide #22 Adding a User 1. Create account with useradd. 2. Lock account until user arrives. 3. User signs account agreement. 4. Set passwd with passwd. CIT 470: Advanced Network and System Administration Slide #23 Adding a User 1. Edit /etc/{passwd,shadow} with vipw. 2. Set passwd with passwd command. 3. Edit /etc/group to add groups. 4. Create user home directory. 1. mkdir /home/studenta 2. chown studenta.student /home/studenta 3. chmod 755 /home/studenta 5. Copy default files from /etc/skel.bashrc,.xdefaults,.xsession, etc. 6. Set aliases, disk quotas, etc. 7. Verify that the account works. CIT 470: Advanced Network and System Administration Slide #24 8

9 Disabling an Account Edit account configuration: Place * or! in front of encrypted password. Replace shell with nologin program. Note: usermod -L will do this for you. Kill active logins and processes. Note: usermod -L will not do this. CIT 470: Advanced Network and System Administration Slide #25 Removing a User 1. Disable account. 2. Change shared passwords (root, etc.) 3. Kill active logins and processes. 4. Remove from local databases/files. 5. Remove from aliases. 6. Remove mail spool (backup first.) 7. Remove crontabs and pending jobs. 8. Remove temporary files. 9. Remove home directory (backup first.) 10. Remove from passwd, shadow, and group. CIT 470: Advanced Network and System Administration Slide #26 PAM Problem: Many programs require authentication. Ex: ftp, rlogin, ssh, etc. New auth schemes require rewrites. Ex: longer passwords, keys, one-time passwords Solution: Separate authentication from programs. Use Pluggable Authentication Modules. Programs choose PAMs to use at runtime by reading config files. CIT 470: Advanced Network and System Administration Slide #27 9

10 PAM Configuration Configured under /etc/pam.d Each PAM-aware service has a file there. Format: <module interface> <control flag> <module name> <module arguments> Module interface: one of 4 module types. Control flag: how module will react to failure or success (multiple successes may be required.) Module name: PAM shared library. Module args: Files to use, other options. CIT 470: Advanced Network and System Administration Slide #28 Module Interfaces auth Authenticates use of service. For example, it may request and verify a password. account Verifies that access is permitted, e.g. check for expired accounts or location/time. password Sets and verifies passwords. session Configures and manages user sessions, e.g. mounting user home directories or mailboxes. CIT 470: Advanced Network and System Administration Slide #29 Module Stacking Example rlogin PAM requirements The file /etc/nologin must not be present. Root may not login over network (securetty.) Environment variables may be loaded. ~/.rhosts entry allows login without password. Otherwise perform standard password login. PAM config file auth required pam_nologin.so auth required pam_securetty.so auth required pam_env.so auth sufficient pam_rhosts_auth.so auth required pam_stack.so service=system-auth CIT 470: Advanced Network and System Administration Slide #30 10

11 Control Flags required Module result must be successful for authentication to continue. User is not notified on failure until results on all modules referencing that interface are available. requisite Module result must be successful for authentication to continue. User is notified immediately with a message reflecting the first failed required or requisite module. sufficient Module result ignored if it fails. If a sufficient flagged module result is successful and no required flagged modules above it have failed, then no other results are required and the user is authenticated to the service. optional Module result is ignored. Only necessary for successful authentication when no other modules reference the interface. CIT 470: Advanced Network and System Administration Slide #31 PAM Files /etc/pam.d: PAM configuration files. /lib/libpam.so: Main PAM library. Reads configuration files. Loads other PAM modules. /lib/security: Pluggable modules. /usr/share/doc/*pam*: Documentation. CIT 470: Advanced Network and System Administration Slide #32 PAM Includes PAM files can include other config files. #%PAM-1.0 # /etc/pam.d/sshd auth include system-auth account required pam_nologin.so account include system-auth password include system-auth session optional pam_keyinit.so session include system-auth session required pam_loginuid.so CIT 470: Advanced Network and System Administration Slide #33 11

12 authconfig PAM system-auth Most PAM services include system-auth. #%PAM-1.0 auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so account required pam_unix.so account sufficient pam_succeed_if.so uid < 500 quiet account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok password required pam_deny.so... CIT 470: Advanced Network and System Administration Slide #34 nsswitch.conf Name Service Switch configuration file. passwd: files ldap shadow: files ldap group: files ldap hosts: files dns ethers: files netmasks: files networks: files protocols: files rpc: files services: files Use both files and ldap to failover when LDAP unavailable. Configure files first to let root login when LDAP down without long timeout. CIT 470: Advanced Network and System Administration Slide #35 Configuring LDAP Authentication 1. Configure server with People/Group schema. 2. Migrate user data to LDAP directory. 3. Point clients to hostname and rootdn of svr. /etc/ldap.conf (PAM LDAP) /etc/openldap/ldap.conf (LDAP) 4. Verify access to server with ldapsearch. 5. Edit /etc/ldap.conf to set DNs for nss_base_{passwd, shadow, and group} 6. Modify nsswitch.conf to add ldap option: passwd, shadow, and group 7. Modify PAM system-auth to use LDAP. CIT 470: Advanced Network and System Administration Slide #36 12

13 LDAP ACLs LDAP ACL format: access to <RDN> by <self anonymous DN> <read write auth> ex: Allow users to change passwords access to attr=userpassword by self write by anonymous auth by * none CIT 470: Advanced Network and System Administration Slide #37 Key Points Namespace definition and policies 1. selection 2. lifetime 3. scope 4. security UNIX Accounts File formats: passwd, shadow, group Authentication PAM: purpose, includes nsswitch.conf: purpose and failover CIT 470: Advanced Network and System Administration Slide #38 References 1. Brian Arkills, LDAP Directories Explained: An Introduction and Analysis, Addison-Wesley, Gerald Carter, LDAP System Administration, O Reilly, Thomas Limoncelli, Christine Hogan, Strata Chalup, The Practice of System and Network Administration, 2 nd ed, Limoncelli and Hogan, Addison-Wesley, Linux PAM, 5. OpenLDAP, OpenLDAP Administrator s Guide, RedHat, Red Hat Enterprise Linux 5 Deployment Guide, Sections 25.3, 43.4, US/Red_Hat_Enterprise_Linux/5.4/, CIT 470: Advanced Network and System Administration Slide #39 13