Translated using DeepL

Machine-translated page for increased accessibility for English questioners.

Page in original, Czech language.

Faculty authentication on a machine on the FI network

You can enable authentication using a faculty account on your own machine via the Lightweight Directory Access Protocol (LDAP) and Kerberos.

If you manage an official service against which faculty accounts authenticate, or if you wish to authenticate this service against another service, we support the issuance of Kerberos principals (in the formatservice/hostname.fi.muni.cz) and making them available in the form of keytabs. For further information, please contact unix@fi.muni.cz .

The guide below is aimed at Unix-based operating systems, specifically the Linux distribution Ubuntu 18.04 LTS. The procedure for other distributions and operating systems may differ.

General information

The Lightweight Directory Access Protocol (LDAP) is available on the FI network and provides information about individual users and user groups. The ellipsis (…) in the output indicates omitted text (here and in other examples in this text):

$ ldapsearch -H ldap://ldap.fi.muni.cz/,ldap://ldap1.fi.muni.cz/ \
    -o nettimeout=2 -b ou=People,dc=fi,dc=muni,dc=cz uid=xlogin -x
# xlogin, People, fi.muni.cz
dn: uid=xlogin,ou=People,dc=fi,dc=muni,dc=cz
uid: xlogin
cn: Honza Login
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
userPassword:: e1NBU0x9bXl4bG9naW5ARkkuTVVOSS5DWg==
loginShell: /bin/bash
uidNumber: 12345
gidNumber: 10100
homeDirectory: /home/xlogin
gecos: Honza Login
sn: Login
givenName: Honza
displayName: Honza Login
mail: xlogin@fi.muni.cz
description: UCO=54321
host: aisa
host: anxur

$ ldapsearch -H ldap://ldap.fi.muni.cz/,ldap://ldap1.fi.muni.cz/ \
    -o nettimeout=2 -b ou=Group,dc=fi,dc=muni,dc=cz cn=student -x
# student, Group, fi.muni.cz
dn: cn=student,ou=Group,dc=fi,dc=muni,dc=cz
objectClass: posixGroup
objectClass: top
cn: student
gidNumber: 10100
memberUid: xlogin1
memberUid: xlogin2
…

This information can subsequently be used as an additional source for Unix user and group tables via the Name Service Switch (NSS) framework. Among other things, this enables file systems to be shared across Unix machines.

The Kerberos protocol is also available on the FI network and allows users to authenticate against faculty user accounts using their faculty password via the Pluggable Authentication Modules (PAM) framework. This enables single sign-on on faculty Unix machines.

Lightweight Directory Access Protocol

The LDAP protocol is utilised by the Name Service Switch (NSS) module in conjunction with the NSCD caching daemon, which reduces response times and network load. Both projects are available in the Ubuntu repositories as the packagesnscd andlibnss-ldap:

# apt install nscd libnss-ldap

You will then need to download a certificate for an encrypted connection to the LDAP servers:

$ wget https://fadmin.fi.muni.cz/cacert/FI_CA.crt
# openssl x509 -in FI_CA.crt -out /etc/openldap/certs/FI_CA.pem -inform DER -outform PEM
# chmod u=rw,g=r,o=r /etc/openldap/certs/FI_CA.pem
# chown root:root /etc/openldap/certs/FI_CA.pem

Next, configure the LDAP NSS module:

$ cat /etc/ldap.conf
base dc=fi,dc=muni,dc=cz
uri ldaps://ldap1.fi.muni.cz ldaps://ldap.fi.muni.cz
nss_base_passwd ou=People,dc=fi,dc=muni,dc=cz?one
nss_base_group  ou=Group,dc=fi,dc=muni,dc=cz?one
ssl yes
tls_reqcert hard
tls_checkpeer yes
tls_cacert /etc/openldap/certs/FI_CA.pem

$ cat /etc/ldap/ldap.conf
…
# TLS certificates (needed for GnuTLS)
TLS_CACERT /etc/openldap/certs/FI_CA.pem

Finally, we’ll configure NSS so that the LDAP NSS module is used for the Unix user and group tables.

$ cat /etc/nsswitch.conf
…
passwd:         compat systemd ldap
group:          compat systemd ldap
shadow:         compat ldap
…

We should now be able to see users and user groups:

$ id xlogin
uid=12345(xlogin) gid=10100(student) groups=10340(account_myhost),10000(staff),10100(student)

Restricting the list of users

If we wish to restrict the list of users permitted to log in to the Unix machine, we can modify the value of the `nss_base_passwd ` entry in the LDAP NSS module’s configuration file as follows:

$ grep nss_base_passwd /etc/ldap.conf
nss_base_passwd ou=People,dc=fi,dc=muni,dc=cz?one?host=myhost

We will then ask technical support to create the group ‘account_myhost ’, in which we will have administrator rights. Next, in the faculty administration system, we will populate the list of group members and click the ‘Regenerate email groups and LDAP’ button. Afterwards, for users who are members of the ‘account_myhost ’ group, we will see the ‘host ’ attribute in LDAP with the value ‘myhost ’. Only these users will then be visible to our machine. Similarly, we can filter users and groups according to any other LDAP attributes.

Kerberos

Support for the Kerberos protocol is provided by a client programme for requesting tickets and the Pluggable Authentication Modules (PAM) library for authentication using the Kerberos client. Both projects are available in the Ubuntu repositories as the packageskrb5-user andlibpam-krb5:

# apt install krb5-user libpam-krb5

The Kerberos client configuration is as follows:

$ cat /etc/krb5.conf

[libdefaults]
        default_realm = FI.MUNI.CZ
…
[realms]
…
        FI.MUNI.CZ = {
                kdc = krb.fi.muni.cz
                kdc = krb1.fi.muni.cz
                default_domain = fi.muni.cz
        }
…
[domain_realm]
…
        .fi.muni.cz = FI.MUNI.CZ
        fi.muni.cz = FI.MUNI.CZ

Kerberos ticket retrieval should now be working:

$ kinit xlogin
Password for xlogin@FI.MUNI.CZ:

$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: xlogin@FI.MUNI.CZ

Valid starting      Expires             Service principal
2.10.2019 17:55:39  3.10.2019 17:55:35  krbtgt/FI.MUNI.CZ@FI.MUNI.CZ

By default, Kerberos only allows users with a UID greater than or equal to 1000 to log in. This restriction prevents a user’s LDAP UID from conflicting with the system user’s UID. Unfortunately, for historical reasons, some users’ faculty UIDs are less than 1000. We will therefore adjust the PAM configuration to allow users with a UID greater than or equal to 200 to log in:

$ cat /usr/share/pam-configs/krb5
Name: Kerberos authentication (MIN_UID=200)
Default: yes
Priority: 704
Conflicts: krb5-openafs
Auth-Type: Primary
Auth:
        [success=end default=ignore]    pam_krb5.so minimum_uid=200 try_first_pass
Auth-Initial:
        [success=end default=ignore]    pam_krb5.so minimum_uid=200
Account-Type: Additional
Account:
        required                        pam_krb5.so minimum_uid=200
Password-Type: Primary
Password:
        [success=end default=ignore]    pam_krb5.so minimum_uid=200 try_first_pass use_authtok
Password-Initial:
        [success=end default=ignore]    pam_krb5.so minimum_uid=200
Session-Type: Additional
Session:
        optional                        pam_krb5.so minimum_uid=200

We will finalise the configuration by running the PAM configuration tool. If you want a home directory to be created for the user on their first login, select the ‘Create home directory on login’ option from the menu displayed and confirm by clicking ‘OK’:

# pam-auth-update

We should now be able to log in to the system:

$ ssh xlogin@localhost id
Password: 
Creating directory '/home/xlogin'.
uid=12345(xlogin) gid=10100(student) groups=10340(account_myhost),10000(staff),10100(student)

Useful links