特殊:Badtitle/NS100:SingleSignOn

{{#ifexist: :SingleSignOn/zh | | {{#ifexist: SingleSignOn/zh | | {{#ifeq: {{#titleparts:SingleSignOn|1|-1|}} | zh | | }} }} }} {{#ifeq: {{#titleparts:SingleSignOn|1|-1|}} | zh | | }}

<!> WORK IN PROGRESS - This HOWTO is not complete! <!> See also: OpenLDAPServer IMPORTANT: Before you get started you must enable the Universe Repository! See AddingRepositoriesHowto for info on how to do this.

Introduction

This page describes how to set up network-connected Ubuntu machines to support Single Sign On (SSO). SSO refers to the capability to only enter your logon credentials one time and then have those crendentials automatically passed to authenticate you to other services available on your network. You will also have a central location that stores all username, groupname, and password data for the users on your network. This solution uses OpenLDAP to provide authorization and MIT Kerberos to provide authentication. This document is divided in to several sections that describe installation of required server software, testing, and installation of software on the client. There are two functions that a Single Sign On solution must perform:

• Authentication: Determining if a user or server is who they claim to be and providing a mechanism for passing that information throughout the network.
• Authorization: Information on what priviledges are possessed by authorized entities on the network

This solution uses Keberos 5 for authentication and OpenLDAP for authorization.

Target Audience

To properly implement the practical steps found in this guide, the reader should be a user of Ubuntu who is comfortable with the use command-line applications, using the Bourne Again SHell (bash) environment, and editing system configuration files with their preferred text editor application. While previous familiarity with OpenLDAP or Kerberos is not required for this guide, the reader is advised to pursue further learning from the resources listed in the Resources section of this guide in order to broaden understanding of the technologies involved in SSO.

Server Installation

Installing MIT Kerberos 5

Overview of Kerberos

This section describes how to install and configure a Kerberos 5 Key Distribution Center (KDC) and establish a realm for your network. The KDC is used to store password information for all users on your network. Kerberos allows users and services to securly authenticate with each other by passing around encrypted tickets. Tickets allow users and servers to know that each party is who they say they are. At logon, the KDC generates a ticket granting ticket (TGT) that the user can use with subsequent transactions to request access. A more detailed explaination of Kerberos is available at [1].

Pre-installation Decisions

Before you install the KDC, you must decide on the following:

• What machine do you want to use as your KDC? Security of this machine is important, since compromising the KDC could compromise the security of your entire network.
• Determine a name for your realm. The convention for realm names is to use the site's domain name fully capitalized. For instance, the site somerealm.com would use the realm name SOMEREALM.COM.

Software Installation

Once you have decided where to install the KDC, and determined your realm name, install the Kerberos server software on the machine that will be the KDC:

sudo apt-get install krb5-kdc krb5-admin-server

The package install will step you through defining the basic Kerberos configuration parameters. Recommended settings are:

• disable Kerberos 4 compatibility mode
• do not run krb524d (daemon to convert Kerberos tickets between versions)
• defaults for the other settings are acceptable

IMPORTANT: You need to remember the admin username and password you create during this step! The configuration file for Kerberos is /etc/krb5kdc/kdc.conf. This file provides settings for your Kerberos realm. Important settings here are the locations of the KDC's data files, and the default settings for the durations that tickets are valid. Here is an example configuration file:

[kdcdefaults]
kdc_ports = 750,88
[realms]
SOMEREALM.COM = {
database_name = /var/lib/krb5kdc/principal
admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab
acl_file = /etc/krb5kdc/kadm5.acl
key_stash_file = /etc/krb5kdc/stash
kdc_ports = 750,88
max_life = 10h 0m 0s
max_renewable_life = 7d 0h 0m 0s
master_key_type = des3-hmac-sha1
supported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal des:normal des:v4 des:norealm des:onlyrealm
default_principal_flags = +preauth
}

Kerberos uses an Access Control List (ACL) to specify the access a principal will have to the Kerberos admin deamon. This file is /etc/krb5kdc/kadm5.acl. The default, as shown below will suffice to get started. You may need to add additional ACLs depending on the needs of your network configuration.

# This file Is the access control list for krb5 administration.
# When this file is edited run /etc/init.d/krb5-admin-server restart to activate
# One common way to set up Kerberos administration is to allow any principal
# ending in /admin  is given full administrative rights.
# To enable this, uncomment the following line:
*/[email protected]    *

Creating Principals

Create the Kerberos database (if not found) using the following command: kdb5_util create -r YOUR-REALM -s Principals are items in the Kerberos database that represent users, hosts, or services on your network. There are two types of Principals that you need to create. Obviously, you will need a Principal for each user that you want to allow access to your network. You'll also need a host Principal for each computer on your network. Finally, you will need to create a service Principal for your LDAP server. Use the program `kadmin` or `kadmin.local` to create principals. If the admin Principal you created when you installed the KDC is `<your username>/admin`, then `kadmin` will automatically ask you for the admin Principal's password. If your admin principal is called something different use `kadmin -p <principal_name>`.

Installing OpenLDAP

Overview of LDAP

LDAP is the Lightweight Directory Access Protocol. It is designed to store data records and allow for easy access to the records via a simple network interface. LDAP can provide access to directory type information such as an address book for your email client, or a list of users and groups that have access to services on your network. This guide will show you how to install OpenLDAP to use SASL binds with TLS encrypted network sessions.

Software Installation

Installing OpenLDAP

To install OpenLDAP execute the following on the machine that will be your server:

sudo apt-get install slapd libsasl2-gssapi-mit

Creating SSL Certificates

Since you will be using OpenLDAP to provide authentication information to your network, you should encrypt all of the traffic between the server and clients. This will be done using SSL encryption. In order to do this, you must create keys for the server. First, you will need a certification authority to sign your certificates. You can use one of the CAs on the net or create your own.FootNote(Fedora: cd /etc/pki/tls/certs && make slapd.pem) See the OpenSSL page for info on how to create a certificate authority and your own certificates. Import your new CA certificate into /usr/share/ca-certificates, as described on the OpenSSL page, so that other software on your system will recognize your CA as trusted. When you create a certificate for your ldap server, make sure the Common Name (CN) matches the hostname of the server where you are running slapd. Copy both the public and private key files to `/etc/slapd/certs`. In the `/etc/slapd/certs` directory, do the following:

sudo chown root:ldap *.pem
sudo chmod 640 *.pem

Creating self-signed Certificate

Use the following commands to create a self-signed certificate to use with your OpenLDAP server:

1. Create the cert directory: `mkdir /etc/ldap/ssl ; cd /etc/ldap/ssl`

2. Create the certificate: `openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout server.pem -days 3650` 3. Answer the questions and make sure to enter the name of your server to answer the 'Common Name' question

Configuring OpenLDAP

To use the self-signed certificate:

1. edit the `slapd.conf` file and include the following lines:

TLSCipherSuite HIGH:MEDIUM:-SSLv2
TLSCACertificateFile /etc/ldap/ssl/server.pem
TLSCertificateFile /etc/ldap/ssl/server.pem
TLSCertificateKeyFile /etc/ldap/ssl/server.pem 

2. edit `/etc/default/slapd`FootNote(Fedora: follow the instructions in /etc/sysconfig/ldap) and include the following line:

SLAPD_SERVICES="ldaps://SERVER-NAME" 

Note that the above line enables only SSL access to your OpenLDAP server (port 636) 3. edit `/etc/hosts` and change SERVER-NAME to resolve to its IP not 127.0.0.1 4. You may need to create two IPtables rules to open the port 636, for example:

iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d {SERVER-IP} --dport 636 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s {SERVER-IP} --sport 636 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT 

Don't forget to replace the {SERVER-IP} and SERVER-NAME with the correct custom values. 5. Restart `slapd` 6. You may test the SSL response using: `openssl s_client -connect SERVER-NAME:636 -showcerts` 7. On the client machine, edit `/etc/ldap/ldap.conf` and include the following lines:

BASE    YOUR-BASE
URI     ldaps://SERVER-NAME
TLS_REQCERT allow 

Don't forget to replace the {SERVER-IP} & YOUR-BASE with the correct values. 8. test using `ldapsearch -x`

• need to add instructions on configuring OpenLDAP

Server Testing

Testing Kerberos 5

From the KDC, type the following:

$ kinit

Type your password when prompted. If this was successful, you won't receieve any error messages. Next, test that you got a Ticket Granting Ticket (TGT) from the KDC. To do this type the following:

$ klist

The response should look something like this:

Ticket cache: FILE:/tmp/krb5cc_5001_PpRNvF
Default principal: [email protected]
Valid starting     Expires            Service principal
05/28/06 08:18:09  05/28/06 18:18:09  krbtgt/[email protected]
renew until 05/29/06 08:18:06
Kerberos 4 ticket cache: /tmp/tkt5001
klist: You have no tickets cached

Try these same two commands from another machine on your network. If these commands succeed, you have successfully installed the KDC.

Testing OpenLDAP

• test SASL binds to the OpenLDAP directory

Client Installation

Installing required packages

You need to install these packages on all machines on your network where you want to be able to use SSO. At the command line, type the following:

sudo apt-get install ldap-utils libsasl2-modules-gssapi-mit libpam-krb5 libnss-ldap nscd

Configuring libnss-ldap

The libnss-ldap package has a debconf script to help you create the libnss-ldap configuration file. This script will be run automatically when you install the package.

• The first step is to enter the URI for your LDAP server. If you followed this howto's instructions on installing your server, this URI will be ldaps://<your server IP>/.

• Next, you need to enter the DN of your search base. Use the same DN that you used as the base for your user database.

• You will only be using LDAPv3, so choose the default on this screen.

• Delete the default entry for this step. You will not need to provide a root DN for this setup.

• Finally, leave the root account password screen blank as well.

Rough Outline:

• install packages
• create host principal / add to client's keytab
• test kinit / klist
• test SASL binds
• modify /etc/ldap/ldap.conf, /etc/libnss-ldap.conf, /etc/nsswitch.conf
• check that getent can retrieve user information from the LDAP server
• modify PAM configuration to use LDAP and Kerberos
• information on configuring nss-updatedb and nscd to cache LDAP information

---