SOLVED FreeNAS DC + jail + samba + winbind + pam password fail

[JR Gonzalez]

I am having problems authenticating sshd in a jail against the FreeNAS AD. From what I can tell the AD is working just fine. I was able to join and browse shares and authenticate on a Win7 laptop.

My problem is using the AD to authenticate the users in a FreeBSD jail for sshd so they can use shells and I can just use my AD for setting up accounts. Right now sshd is just a start and I plan on using pam modules in a couple of jails for shells, email, and contact/calendar information.

What I have tried so far:

Installed samba36 from ports:

# cd /usr/ports/net/samba36
# make config

OPTIONS: ACL_SUPPORT ADS AIO_SUPPORT CUPS DNSUPDATE DOCS EXAMPLES EXP_MODULES FAM IPV6 LDAP PAM_SMBPASS POPT PTHREADPOOL SYSLOG UTMP WINBIND

After the gentooesque build session I did the following:

/etc/rc.conf

# Samba
samba_enable="YES"
nmbd_enable="YES"
smbd_enable="YES"
winbindd_enable="YES"
kerberos5_server_enable="YES"
kadmind5_server_enable="YES"

/usr/local/etc/smb.conf

[global]
workgroup = DOMAIN
server string = FreeBSD Client %v
load printers = no
encrypt passwords = yes
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
dns proxy = no
smb ports = 139
security = ADS
realm = DOMAIN.ORG
;winbind separator = \
idmap uid = 10000-20000
idmap gid = 10000-20000
winbind enum users = yes
winbind enum groups = yes
template homedir = /home/%U
template shell = /usr/local/bin/bash
client ntlmv2 auth = yes
winbind use default domain = yes
restrict anonymous = 2
domain master = no
local master = no
preferred master = no
disable netbios = no
dos charset = ASCII
unix charset = UTF8
display charset = UTF8

/etc/krb5.conf

[logging]
default = SYSLOG:INFO

[libdefaults]
ticket_lifetime = 24000
clock_skew = 300
default_realm = DOMAIN.ORG
[realms]
domain.LOCAL = {
kdc = servername.domain.org:88
admin_server = servername.domain.org:464
default_domain = scientiam.org
}
[domain_realm]
.domain.local = DOMAIN.ORG
domain.local = DOMAIN.ORG

(Please note... Even tho these are example domain and server names I triple checked. These entries are correct in krb5.conf.)

[RESTART JAIL]

Then I attempted to see if I can join the DOMAIN...

# kinit administrator
administrator@DOMAIN.ORG's Password:

# /usr/local/bin/net ads join -U server.domain.org -U administrator
Enter administrator's password:
Using short domain name -- DOMAIN
Joined 'LEGACY' to dns domain 'domain.org'
No DNS domain configured for localhost. Unable to perform DNS Update.
DNS update failed!

From what I can tell the localhost DNS thing is not an issue. Am I wrong?

# wbinfo -u
administrator
jrg
krbtgt
guest

/etc/nsswitch.conf
group: files winbind
group_compat: nis
hosts: files dns
networks: files
passwd: files winbind
passwd_compat: nis
shells: files
services: compat
services_compat: nis
protocols: files
rpc: files

Installed pam_mkhomedir
# cd /usr/ports/security/pam_mkhomedir && make install clean

Then....

/etc/pam.d/sshd

# auth
auth sufficient pam_opie.so no_warn no_fake_prompts
auth requisite pam_opieaccess.so no_warn allow_local
auth sufficient /usr/local/lib/pam_winbind.so
#auth sufficient pam_krb5.so no_warn try_first_pass
#auth sufficient pam_ssh.so no_warn try_first_pass
auth required pam_unix.so no_warn try_first_pass

# account
account required pam_nologin.so
#account required pam_krb5.so
account required pam_login_access.so
account required pam_unix.so

# session
#session optional pam_ssh.so want_agent
session required /usr/local/lib/pam_mkhomedir.so
session required pam_permit.so

# password
#password sufficient pam_krb5.so no_warn try_first_pass
password required pam_unix.so no_warn try_first_pass


Then I try it...

shell% ssh jrg@legacy.domain.org
Password:
Wrong Password

The user is there. It works on a Win7 box. What on Earth am I missing here?

I'm positive the password is correct for the user I am trying to use. I also don't get much in way of logs..

Mar 26 15:23:13 legacy sshd[26383]: pam_winbind(sshd): user 'jrg' denied access (incorrect password or invalid membership)
Mar 26 15:24:10 legacy sshd[26390]: pam_winbind(sshd): request wbcLogonUser failed: WBC_ERR_AUTH_ERROR, PAM error: PAM_AUTH_ERR (9), NTSTATUS: NT_STATUS_WRONG_PASSWORD, Error message was: Wrong Password

Can someone please let me know if I missed steps. This seemed rather similar to straight openldap but for whatever reason the authentication doesn't seem to want to send the password properly.

Also...

# getent passwd

administrator:*:10001:10000:Administrator:/home/administrator:/usr/local/bin/bash
jrg:*:10000:10000:JR Gonzalez:/home/jrg:/usr/local/bin/bash
krbtgt:*:10002:10000:krbtgt:/home/krbtgt:/usr/local/bin/bash
guest:*:10003:10001:Guest:/home/guest:/usr/local/bin/bash

So it seems to be able to grab the users/groups.

The computer can also be seen in RSAT meaning it had a successful join to the domain.
The computer is properly placed in the DC's internal DNS and can be resolved.

Please help.

 

[JR Gonzalez]

Well. A real special thanks to okrad at #samba@freenode for helping me out with this. Wrote a really great article for FreeBSD 10 that explains how to set up both sides properly and it seems to be working now. I also used samba41 instead of 36. But okrad's instructions are here if anybody wishes to try it out. I managed to get it working.

This was for the initial setup just to get the jail onto the domain:
http://samba.ninja/2014/12/freebsd-10-samba-ad-member-server/

This is the writeup for how to get sshd (or anything pam) to authenticate against the DC:
http://samba.ninja/2015/03/freebsd-10-x-pam_winbind-ssh-login/

PS: I Have to modify the template stuff a bit and I also have to figure out how to set per user home dirs and shells. I believe I simply need to use a different schema when creating users. For now though winbind, pam, and ssh are getting along.

 

[JR Gonzalez]

Ok. Maybe not. I made a new jail and followed the same steps. I have no idea no idea what I did differently but I ran into the same problem. :/

 

[JR Gonzalez]

Never mind. The problem is in my smb4.conf i have:

template homedir = /home/%U
template shell = /usr/local/bin/bash

You have to make absolutely sure your home dir exists (which should be created by pam_mkhomedir if it doesn't and make absolutely sure the shell exists. Otherwise you will be unable to ssh into the box.