Samba4 – Active Directory

Andrew Bartlett

abartlet@samba.org

Introducing Samba

Samba provides a Linux/Unix platform with a windows compatible:

File Server

Print

Domain Controller

Open Source Software

International team of developers

Started by Andrew Tridgell, Jan 1992

My Samba History

Developer on the Samba Team

3 ½ years

Interest in Authentication Systems

Domain Controller Development

Samba 3.0 DC work in particular

Samba4

An almost complete rewrite

Spearheaded by Andrew Tridgell, Feb 2003

I Started Samba4 work in May 2004

Funded by St Bernard Software

One of three core developers

Also Stefan (metze) Metzmacher

Research Aim

To study and document the protocols that make up Active Directory

In particular:

NTLM

Kerberos

Join Process

To add Kerberos support to the Samba4 AD implementation

Authentication Systems

Proving who you are

Is that you at the ATM requesting $200?

Proving who they are

Do you trust the ATM?

Just as difficult in traditional computer networks

Windows Authentication

Samba is compatible implementation

...compatible with whatever Microsoft decides to use

NTLM

Kerberos

Added by Active Directory

Active Directory Authentication

Integrated

One password, many ways to use it

Single Sign on – never re-enter your password

NTLM

Kerberos

NTLM compatible `encryption type'

PAC

Most of my thesis is about documenting these points

Adding Kerberos to Samba4

The actual development task

Modified Heimdal Kerberos

Modified Samba

Heimdal Modifications

Samba.org SVN repository for the changes

lorikeet/heimdal

Initial `hdb-ldb' work by metze

One of the things about open source work is that somebody else can beat you to the punch...

Changes in Heimdal structure

Eventually merged back into Heimdal development versions

Actively watched by lha (Heimdal Developer)

Samba4 Modifications

Kerberos Login Handling

Based on GENSEC

Generalised Authentication layer I wrote

Again, initial work by metze

Mostly iterative bug fixing, rework

Testing the domain join

Relative Success

We complete a kerberos login for the join

But fail later

NTLM Join

Uses kerberos once joined

Fails due to subsequent Samba4 issues

Status

Allowed domain member proof-of-concept

Awaiting implementation of LDAP server

Most of the cryptographic problems now solved

Crypto Puzzles

How many different ways can you change or set a password?

15 apparently

Samba3 supported about 5 of these

Others were mostly simple variants

Some curly ones...

LSAKEY

How do you find a `secret' key, used on every windows box?

Thanks

To my supervisor, Dr Eric Charles McCreath

To the Samba Team

To those who reviewed the thesis drafts

http://hawkerc.net/staff/abartlet/thesis-gpl.ps.gz

http://hawkerc.net/staff/abartlet/thesis-pres.sxi

2004-11-14T15:26:55