Using Cross-Platform Authentication with Linux and Windows

195

If you’re adding Linux systems to an existing Windows network, connect PAM to your domain controller to centralize your user database. If you’re setting a (mostly) Linux network, consider using Kerberos to give secure, singlelogin access to your users.

At the time we’re writing this, Mandrake Linux is not shipped with the software required to handle crossplatform authentication. SuSE Linux does ship with the required software, but the necessary configuration tools in SuSE’s YaST control center don’t seem to work. The methods that we describe in this technique will only work with Fedora Linux.

Using Cross-Platform

Authentication with

Linux and Windows

If you already have a medium-sized or large network of Windows computers, you’re probably using a Windows domain to manage security. A Windows domain is a network of computers that uses a single database to hold user information (user names, user IDs, passwords, and the like). A single machine, called the primary domain controller, stores all user information and provides authentication services to the rest of the computers in the domain. A Windows domain often contains backup domain controllers to lighten the load on the primary controller (and to provide authentication should the primary controller fail).

Don’t confuse a Windows domain with a DNS domain name. A Windows domain is a network of computers that consolidates all user information in a single database. A DNS domain name is a name that you give to a network of computers.

PAM (the basic authentication framework on Fedora computers) can rely on a Windows domain to authenticate users. If you keep your authentication

information on a Windows machine, a simple addition to your PAM configuration lets you share your Windows authentication files with your Linux systems.

Keeping your network user database up-to-date and secure is a lot quicker if you have only one file to maintain. You need to update the user information in only one database, and PAM allows all the Linux machines on your network to use that database for authentication. This streamlined setup also increases network security, because you aren’t storing password files all over your network.

Prepping for cross-platform authentication

You need three pieces of information to set up PAM/ Windows authentication — get these from your Windows administrator (if that’s you, odds are you know these tidbits of trivia):

Your Windows domain name: Your domain name is the name assigned to your network of trust. It’s often the same as the name of your physical network.

The primary domain controller’s name: This is the computer on your network that holds the primary authentication database.

A backup domain controller’s name: This machine keeps a backup of the authentication database. This is important because if the machine holding your primary authentication database goes down, you still want your users to have access to the other machines on the network.

To set up cross-platform authentication, you also need to have the pam_smb-1.1.7-2.i386.rpm package installed.

Check to see if the RPM package is installed with the following command:

# rpm -q pam_smb

196 Technique 29: Securing a Large Network with Custom Authentication

If the program isn’t installed, you need to add it. Conveniently, it’s included with the Fedora distribution. Insert and mount your Fedora media and enter this command:

#rpm -Uhv /mnt/cdrom/Fedora/RPMS/pam_smb- 1.1.7-2.i386.rpm

Now you’re ready to follow the steps in the next section, where you actually set up authentication.

Setting up cross-platform authentication

With the pam_smb package in place, you’re ready to set up cross-platform authentication:

1. Open the Main Menu and choose System Settings Authentication.

A dialog may appear, prompting you for the root password.

2. Type the root password (if prompted) and press Enter.

The Authentication Configuration window opens.

3. Choose the Authentication tab to view authentication options, as shown in Figure 29-1.

• Figure 29-1: The Authentication tab.

4. Check the Enable SMB Support box and then click the Configure SMB button.

The SMB Settings dialog opens, as shown in Figure 29-2.

•Figure 29-2: The SMB Settings dialog.

5.Enter the workgroup (domain) name in the Workgroup field.

6.Enter the name of the primary domain controller in the Domain Controllers field, followed by a comma and the backup domain controller’s name.

Don’t add any spaces between the names and the comma.

7.Click the OK button to close the dialog.

8.Click the OK button on the Authentication Configuration window to close that window.

Now, whenever you log in to your Linux computer, Fedora asks the domain controller to validate your password. If the primary domain controller fails to respond in a reasonable period of time, Fedora contacts the backup domain controller. You still need a user account on your Linux computer (your Linux user ID, home directory, and login shell information are stored in Linux), but the password comes from Windows.

After you follow the preceding steps, there’s one more trick to setting up cross-platform authentication: When you create a user account on the Linux machine, leave the password blank. If you want to change the password you use to log in to Linux, change your Windows password.