I have covered FreeBSD with FreeIPA/IDM stuff many times before – and this time I did one step further. This guide will show you step by step how to setup FreeBSD based Samba server and serve shares with FreeIPA/IDM credentials. Many people do not reach reading to the end of the article so I will point that in the beginning that I am really grateful to Mariusz Zaborski (oshogbo) for his help – because without it – it just would not happen.
Last time I used Alma Linux 9.3 and many things seem to also change after I used the latest 9.4 version. First was different way of setting IP and gateway addresses and the second was different package names and other stuff related to yum(8) (or dnf(8) if you prefer – by some referred as Did Not Finished) package manager.
Older entries related to FreeBSD and FreeIPA/IDM are listed below:
- Connect FreeBSD to FreeIPA/IDM
- Connect FreeBSD 13.2 to FreeIPA/IDM
- FreeBSD on FreeIPA/IDM with Poudriere Repo
- Connect FreeBSD 14.1-RELEASE to FreeIPA/IDM
This article will try to address and contain all steps needed – including setting up the FreeIPA/IDM server and Poudriere setup. All of these systems will be Bhyve virtual machines. Below You will find Table of Contents for this article.
- List of Machines
- FreeIPA/IDM Server – OS Install
- FreeIPA/IDM Server – Setup
- FreeIPA/IDM Server – Config
- Poudriere Server – Setup
- Poudriere Server – Build FreeIPA/IDM Client Packages
- Poudriere Server – Update Repo/Packages
- FreeBSD Samba Server – FreeIPA/IDM Connect
- FreeBSD Samba Server – Configuration
- Samba Linux Client
- Samba Windows Client
- Summary
Now to the content …
List of Machines
For the FreeIPA/IDM server and Linux test client I have used Alma Linux RHEL clone in most recent 9.4 version – but we know that Rocky Linux or Oracle Linux would also work well. I also tested some Windows 10 version to make sure it also works there.
If there is some reason I should use Rocky or Oracle instead – please let me know.
Linux FreeIPA/IDM server – idm.lab.org.
OS: Alma Linux 9.4 amd64
IP: 10.1.1.200/24
GW: 10.1.1.1
domain: lab.org
realm: LAB.ORG
hostname: idm.lab.org
FreeBSD Poudriere Harvester – poudriere.lab.org.
OS: FreeBSD 14.1-RELEASE amd64
IP: 10.1.1.123/24
GW: 10.1.1.1
DNS: 1.1.1.1
domain: -
realm: -
hostname: poudriere.lab.org
FreeBSD Samba server – samba.lab.org.
OS: FreeBSD 14.1-RELEASE amd64
IP: 10.1.1.203/24
GW: 10.1.1.1
DNS: 10.1.1.200 (idm.lab.org)
domain: lab.org
realm: LAB.ORG
hostname: samba.lab.org
Linux Samba client – linux.lab.org.
OS: Alma Linux 9.4 amd64
IP: 10.1.1.202/24
GW: 10.1.1.1
DNS: 10.1.1.200 (idm.lab.org)
domain: lab.org
realm: LAB.ORG
hostname: linux.lab.org
Windows Samba client – windows.lab.org.
OS: Windows 10 amd64
IP: 10.1.1.201/24
GW: 10.1.1.1
DNS: 1.1.1.1
domain: -
realm: -
hostname: windows.lab.org
Here is how these machines are listed in vm(8) command.
host # vm list NAME DATASTORE LOADER CPU MEMORY VNC AUTO STATE BASE-alma-9.4 default uefi 2 2G - No Stopped BASE-freebsd-14.1 default bhyveload 2 2G - No Stopped ghostbsd default uefi 2 8G - No Stopped idm default uefi 2 2G 0.0.0.0:5900 No Running (82395) samba default bhyveload 2 2G - No Running (82431) client default uefi 2 2G 0.0.0.0:5902 No Running (27815) poudriere default uefi 4 12G 0.0.0.0:5901 No Running (14495) windows10 default uefi 2 4G 0.0.0.0:5903 No Running (37341) windows7 default uefi 2 4G - No Stopped
FreeBSD project provides ZFS based VM images … and we will use them – FreeBSD-14.1-RELEASE-amd64-zfs.raw.xz – this one exactly. As this guide will be too long anyway – please refer to previous articles about FreeBSD and FreeIPA/IDM on how to setup the VMs in Bhyve π
Now some legend and colors.
host # vm list // COMMANDS ON HOST SYSTEM [root@idm ~]# kinit admin // COMMANDS ON FreeIPA/IDM root@poudriere:~ # service nginx enable // COMMANDS ON FreeBSD Poudriere SERVER root@samba:~ # net getdomainsid // COMMANDS ON FreeBSD SAMBA SERVER [root@client ~]# yum install cifs-utils // COMMANDS ON Linux CLIENT
… and for the Windows machine we will point and click instead π
FreeIPA/IDM Server – OS Install
The installation of Alma Linux 9.4 is the default UEFI/LVM setup – I only added hostname – added IPv4 address and gateway – disabled IPv6 support.
In the earlier versions IP/GW information usually landed in the /etc/sysconfig/network-scripts/ifcfg-enp0s5 file for enp0s5 interface … not anymore. Whenever you like it or not – meet new nmcli(8) interface.
[root@idm ~]# nmcli enp0s5: connected to enp0s5 "Red Hat Virtio" ethernet (virtio_net), 58:9C:FC:0D:4C:DF, hw, mtu 1500 ip4 default inet4 10.1.1.200/24 route4 10.1.1.0/24 metric 100 route4 default via 10.1.1.1 metric 100 lo: connected (externally) to lo "lo" loopback (unknown), 00:00:00:00:00:00, sw, mtu 65536 inet4 127.0.0.1/8 inet6 ::1/128 DNS configuration: servers: 127.0.0.1 servers: 1.1.1.1 domains: lab.org interface: enp0s5 Use "nmcli device show" to get complete information about known devices and "nmcli connection show" to get an overview on active connection profiles. Consult nmcli(1) and nmcli-examples(7) manual pages for complete usage details.
… and now for some example – to change IP address and gateway on a such Linux system you need to do these.
[root@idm ~]# nmcli con mod enp0s5 ipv4.address 10.1.1.202/24 [root@idm ~]# nmcli con mod enp0s5 ipv4.gateway 10.1.1.1 [root@idm ~]# nmcli networking off [root@idm ~]# nmcli networking on
… and no – the old service network restart also does not work anymore.
[root@idm ~]# service network restart
Redirecting to /bin/systemctl restart network.service
Failed to restart network.service: Unit network.service not found.
… and keep in mind that You will be disconnected after the nmcli networking off so better run it inside GNU screen(1) for example … but Alma Linux repositories (same as RHEL ones) does not contain GNU screen(1) anymore.
[root@idm ~]# yum search screen
Last metadata expiration check: 2:30:04 ago on Thu Jun 20 11:03:55 2024.
====================================== Name & Summary Matched: screen ======================================
gnome-screenshot.x86_64 : A screenshot utility for GNOME
gnome-shell-extension-screenshot-window-sizer.noarch : Screenshot window sizer for GNOME Shell
=========================================== Name Matched: screen ===========================================
kacst-screen-fonts.noarch : Fonts for arabic from arabeyes project
========================================= Summary Matched: screen ==========================================
gnome-remote-desktop.x86_64 : GNOME Remote Desktop screen share service
gnome-shell-extension-heads-up-display.noarch : Display persistent on-screen message
gnome-shell-extension-window-list.noarch : Display a window list at the bottom of the screen in GNOME Shell
perl-Dumpvalue.noarch : Screen dump of Perl data
perl-Term-ANSIColor.noarch : Color screen output using ANSI escape sequences
Fortunately you can just download GNU screen(1) RPM from page like https://pkgs.org π
FreeIPA/IDM Server – Setup
Some more basic setup commands below.
[root@idm ~]# echo 10.1.1.200 idm.lab.org idm >> /etc/hosts [root@idm ~]# hostnamectl set-hostname idm.lab.org [root@idm ~]# timedatectl set-timezone Europe/Warsaw [root@idm ~]# timedatectl set-local-rtc 0 [root@idm ~]# yum update -y [root@idm ~]# reboot
This part is different then earlier as we do not do yum module enable idm:DL1 anymore … but its still needed on RHEL 8.x systems … consistency is not very well between RHEL and its clones these days.
[root@idm ~]# yum install -y bind-utils chrony nc ipa-server ipa-server-dns [root@idm ~]# ipa-server-install \ --domain lab.org \ --realm LAB.ORG \ --reverse-zone=1.1.10.in-addr.arpa. \ --allow-zone-overlap \ --no-forwarders \ --ntp-pool pool.ntp.org \ --setup-dns \ --ds-password password \ --admin-password password \ --unattended (...) This includes: * Configure a stand-alone CA (dogtag) for certificate management * Configure the NTP client (chronyd) * Create and configure an instance of Directory Server * Create and configure a Kerberos Key Distribution Center (KDC) * Configure Apache (httpd) * Configure DNS (bind) * Configure SID generation * Configure the KDC to enable PKINIT (...) ============================================================================== Setup complete Next steps: 1. You must make sure these network ports are open: TCP Ports: * 80, 443: HTTP/HTTPS * 389, 636: LDAP/LDAPS * 88, 464: kerberos * 53: bind UDP Ports: * 88, 464: kerberos * 53: bind * 123: ntp 2. You can now obtain a kerberos ticket using the command: 'kinit admin' This ticket will allow you to use the IPA tools (e.g., ipa user-add) and the web user interface. Be sure to back up the CA certificates stored in /root/cacert.p12 These files are required to create replicas. The password for these files is the Directory Manager password The ipa-server-install command was successful [root@idm ~]# ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful [root@idm ~]# systemctl enable httpd [root@idm ~]# systemctl start httpd [root@idm ~]# systemctl disable firewalld [root@idm ~]# systemctl stop firewalld
You can now login to the FreeIPA/IDM web management at https://10.1.1.200/ page. Keep in mind that you will be redirected to https://idm.lab.org/ipa/ui/ immediately – so add 10.1.1.200 idm.lab.org idm to the hosts(5) file on the system from which you will be accessing it.
host # grep idm /etc/hosts
10.1.1.200 idm.lab.org idm
After accessing it in the browser it will look like that.
You may login with admin username and the password you specified for the ipa-server-install(8) command or password if you just copy pasted that command π
We have our FreeIPA/IDM server installed.
FreeIPA/IDM Server – Config
… and after logging in I created a regular vermaden user as shown below.
Remember to reset your password by connecting to FreeIPA/IDM server with ssh(1) command.
host # ssh -l vermaden 10.1.1.200
(vermaden@10.1.1.200) Password:
(vermaden@10.1.1.200) Password expired. Change your password now.
Current Password:
(vermaden@10.1.1.200) New password:
(vermaden@10.1.1.200) Retype new password:
[vermaden@idm /]$
We need to now setup a HBAC Rule and Sudo Rule at FreeIPA/IDM.
Below HBAC Rule settings.
… and the Sudo Rule part.
Poudriere Server – Setup
One note for the FreeBSD commands below – please use /bin/sh shell (default for root since 14.0-RELEASE) for the commands … or zsh(1) for example … or other POSIX compatible shell. Some of these commands may not work properly on C based shells or in fish(1) shell.
If you want to know exact instructions to setup Bhyve VMs – please check my earlier FreeBSD with FreeIPA/IDM guides listed in the beginning of this article.
Configuration inside poudriere VM is defined below.
root@poudriere:~ # :> ~/.hushlogin root@poudriere:~ # cat /etc/rc.conf clear_tmp_enable="YES" hostname="poudriere.lab.org" ifconfig_vtnet0="inet 10.1.1.123/24" defaultrouter="10.1.1.1" sshd_enable="YES" dumpdev="NO" zfs_enable="YES" nginx_enable="YES" root@poudriere:~ # cat /etc/hosts ::1 localhost localhost.my.domain 127.0.0.1 localhost localhost.my.domain 10.1.1.123 poudriere.lab.org poudriere root@poudriere:~ # service sshd start root@poudriere:~ # mkdir -p /usr/local/etc/pkg/repos root@poudriere:~ # sed -e 's|quarterly|latest|g' /etc/pkg/FreeBSD.conf > /usr/local/etc/pkg/repos/FreeBSD.conf root@poudriere:~ # pkg install -y \ beadm \ lsblk \ poudriere-devel \ nginx \ git-lite \ ccache4 \ tree root@poudriere:~ # reboot
We will now setup actual Poudriere server.
root@poudriere:~ # export SSL=/usr/local/etc/ssl root@poudriere:~ # mkdir -p \ /usr/ports/distfiles \ ${SSL}/keys \ ${SSL}/certs root@poudriere:~ # chmod 0600 ${SSL}/keys root@poudriere:~ # openssl genrsa -out ${SSL}/keys/poudriere.key 4096 root@poudriere:~ # openssl rsa \ -in ${SSL}/keys/poudriere.key -pubout \ -out ${SSL}/certs/poudriere.cert root@poudriere:~ # zfs create -p -o mountpoint=/var/ccache zroot/var/ccache root@poudriere:~ # zfs list NAME USED AVAIL REFER MOUNTPOINT zroot 213K 96.4G 24K none zroot/var 48K 96.4G 24K none zroot/var/ccache 24K 96.4G 24K /var/ccache root@poudriere:~ # cat /usr/local/etc/poudriere.conf ZPOOL=zroot FREEBSD_HOST=ftp://ftp.freebsd.org BASEFS=/usr/local/poudriere ZROOTFS=/dev/null POUDRIERE_DATA=/usr/local/poudriere/data DISTFILES_CACHE=/usr/ports/distfiles CCACHE_DIR=/var/ccache CHECK_CHANGED_OPTIONS=verbose CHECK_CHANGED_DEPS=yes PKG_REPO_SIGNING_KEY=/usr/local/etc/ssl/keys/poudriere.key URL_BASE=http://0.0.0.0/ USE_TMPFS=no TMPFS_LIMIT=12 MAX_MEMORY=12 PARALLEL_JOBS=8 PREPARE_PARALLEL_JOBS=8 MAX_FILES=4096 KEEP_OLD_PACKAGES=yes KEEP_OLD_PACKAGES_COUNT=3 CHECK_CHANGED_OPTIONS=verbose CHECK_CHANGED_DEPS=yes RESTRICT_NETWORKING=no root@poudriere:~ # mkdir -p /usr/local/poudriere/data/logs/bulk root@poudriere:~ # ln -s \ /usr/local/etc/ssl/certs/poudriere.cert \ /usr/local/poudriere/data/logs/bulk/poudriere.cert root@poudriere:~ # service nginx enable root@poudriere:~ # sed -i '' -E 's|text/plain[\t\ ]*txt|text/plain txt log|g' /usr/local/etc/nginx/mime.types root@poudriere:~ # cat /usr/local/etc/nginx/nginx.conf events { worker_connections 1024; } http { include mime.types; default_type application/octet-stream; server { listen 80 default; server_name 0.0.0.0; root /usr/local/share/poudriere/html; location /data { alias /usr/local/poudriere/data/logs/bulk; autoindex on; } location /packages { root /usr/local/poudriere/data; autoindex on; } } } root@poudriere:~ # service nginx restart root@poudriere:~ # ln -sf /var/ccache /root/.cache/ccache root@poudriere:~ # cat /usr/local/etc/poudriere.d/make.conf # general ALLOW_UNSUPPORTED_SYSTEM=yes DISABLE_LICENSES=yes # ccache(1) WITH_CCACHE_BUILD=yes # ports options FORCE_MAKE_JOBS=yes MAKE_JOBS_UNSAFE=yes MAKE_JOBS_NUMBER=8 root@poudriere:~ # cat /var/ccache/ccache.conf max_size = 0 cache_dir = /var/ccache base_dir = /var/ccache hash_dir = false root@poudriere:~ # poudriere jail -c -j 14-1-R-amd64 -v 14.1-RELEASE (...) [00:20:45] Jail 14-1-R-amd64 14.1-RELEASE amd64 is ready to be used root@poudriere:~ # poudriere jail -l JAILNAME VERSION ARCH METHOD TIMESTAMP PATH 14-1-R-amd64 14.1-RELEASE amd64 http 2024-06-21 09:44:27 /usr/local/poudriere/jails/14-1-R-amd64
Now … in the previous guides I just cloned the official FreeBSD Ports tree … not this time.
We will need Mariusz Zaborski (oshogbo) fork of the FreeBSD Ports tree.
If you would just want to clone it with git(1) command – then this is how to do this:
root@poudriere:~ # git clone - -depth=1 --branch oshogbo/freeipa https://github.com/oshogbo/freebsd-ports
… but we want to do this Poudriere way – so this is how to do it.
root@poudriere:~ # poudriere ports -c -p osho -B oshogbo/freeipa -U https://github.com/oshogbo/freebsd-ports [00:00:00] Creating osho fs at /usr/local/poudriere/ports/osho... done [00:00:00] Cloning the ports tree... done root@poudriere:~ # poudriere ports -l PORTSTREE METHOD TIMESTAMP PATH osho git+https 2024-06-21 11:42:53 /usr/local/poudriere/ports/osho
We now have needed FreeBSD Jail version and FreeBSD Ports tree that we can use to build needed packages.
Poudriere Server – Build FreeIPA/IDM Client Packages
Now we need to choose options for our FreeBSD Ports and then start the bulk process of fetching and building them.
root@poudriere:~ # poudriere options -c -n -p osho security/cyrus-sasl2-gssapi // SELECT: (*) GSSAPI_MIT root@poudriere:~ # poudriere options -c -n -p osho net/openldap26-client // SELECT: [x] GSSAPI root@poudriere:~ # poudriere options -c -n -p osho security/sudo // DESELECT: [ ] PAM // SELECT: (*) GSSAPI_MIT // SELECT: (*) SSSD2 root@poudriere:~ # poudriere options -c -n -p osho net/samba416 // SELECT: (*) GSSAPI_MIT root@poudriere:~ # cat /usr/local/etc/poudriere.d/osho security/krb5 security/sudo security/sssd2 security/cyrus-sasl2 security/cyrus-sasl2-gssapi security/pam_mkhomedir net/openldap26-client net/samba416 net/freeipa-client root@poudriere:~ # poudriere bulk -j 14-1-R-amd64 -b latest -p osho -f /usr/local/etc/poudriere.d/osho
You can follow the status of the build process in the browser at https://10.1.1.123 page.
Poudriere Server – Update Repo/Packages
Everytime you will need to update the packages in that FreeIPA/IDM repo You will need to run these commands.
root@poudriere:~ # poudriere ports -u -p osho -B oshogbo/freeipa -U https://github.com/oshogbo/freebsd-ports root@poudriere:~ # poudriere bulk -j 14-1-R-amd64 -b latest -p osho -f /usr/local/etc/poudriere.d/osho
You may as well update the FreeBSD Jail when needed.
root@poudriere:~ # poudriere jail -u -j 14-1-R-amd64
FreeBSD Samba Server – FreeIPA/IDM Connect
Same as with Poudriere server – you need to create FreeBSD Samba server as Bhyve VM.
Now – the needed configuration on FreeBSD 14.1-RELEASE system to first connect it to FreeIPA/IDM server.
root@samba:~ # mkdir -p \ /usr/local/etc/ipa \ /var/log/sssd \ /var/run/sss/private \ /var/db/sss root@samba:~ # echo 10.1.1.203 samba.lab.org samba >> /etc/hosts root@samba:~ # echo 10.1.1.200 idm.lab.org idm >> /etc/hosts root@samba:~ # hostname samba.lab.org root@samba:~ # sysrc hostname=samba.lab.org root@samba:~ # fetch -o /usr/local/etc/ipa/ca.crt http://idm.lab.org/ipa/config/ca.crt
Now we will need to add or FreeBSD Samba server to FreeIPA/IDM – instructions below.
[root@idm ~]# kinit admin Password for admin@LAB.ORG: [root@idm ~]# ipa dnsrecord-add lab.org samba --a-rec=10.1.1.203 --a-create-reverse Record name: samba A record: 10.1.1.203 [root@idm ~]# ipa host-add samba.lab.org ------------------------------- Added host "samba.lab.org" ------------------------------- Host name: samba.lab.org Principal name: host/samba.lab.org@LAB.ORG Principal alias: host/samba.lab.org@LAB.ORG Password: False Keytab: False Managed by: samba.lab.org [root@idm ~]# ipa-getkeytab -s idm.lab.org -p host/samba.lab.org@LAB.ORG -k /root/samba.lab.org.keytab Keytab successfully retrieved and stored in: /root/samba.lab.org.keytab [root@idm ~]# cp /root/samba.lab.org.keytab /usr/share/ipa/html/ [root@idm ~]# chmod 644 /usr/share/ipa/html/samba.lab.org.keytab
Now lets get back to our FreeBSD Samba server.
root@samba:~ # fetch -o /usr/local/etc/ipa/krb5.keytab \ http://idm.lab.org/ipa/config/samba.lab.org.keytab root@samba:~ # chmod 600 /usr/local/etc/ipa/krb5.keytab root@samba:~ # mkdir -p /usr/local/etc/ssl/certs root@samba:~ # mkdir -p /usr/local/etc/pkg/repos root@samba:~ # sed 's|quarterly|latest|g' /etc/pkg/FreeBSD.conf > /usr/local/etc/pkg/repos/FreeBSD.conf root@samba:~ # pkg install -y beadm root@samba:~ # fetch -o /usr/local/etc/ssl/certs/poudriere.cert \ http://10.1.1.123/data/poudriere.cert root@samba:~ # export IP=10.1.1.123 root@samba:~ # cat /usr/local/etc/pkg/repos/14-1-R-amd64-osho.conf 14-1-R-amd64-osho: { url: "http://${IP}/packages/14-1-R-amd64-osho/", mirror_type: "http", signature_type: "pubkey", pubkey: "/usr/local/etc/ssl/certs/poudriere.cert", enabled: yes, priority: 100 } root@samba:~ # pkg update -f root@samba:~ # pkg install -y \ -r 14-1-R-amd64-osho \ krb5 \ sudo \ sssd2 \ cyrus-sasl \ cyrus-sasl-gssapi \ openldap26-client \ freeipa-client \ pam_mkhomedir root@samba:~ # cat << EOF >> /etc/ssh/ssh_config GSSAPIAuthentication yes EOF root@samba:~ # cat << EOF >> /etc/ssh/sshd_config GSSAPIAuthentication yes UsePAM yes EOF root@samba:~ # cat << EOF > /usr/local/etc/sssd/sssd.conf [sssd] config_file_version = 2 services = pam, ssh, sudo, ifp, pac, nss domains = lab.org timeout = 20 [domain/lab.org] ipa_server = idm.lab.org ipa_domain = lab.org pam_gssapi_services = sudo, sudo-i enumerate = True cache_credentials = True override_homedir = /home/%u default_shell = /bin/sh ldap_group_nesting_level = 10 default_ccache_template = FILE:/tmp/krb5cc_:%U krb5_ccache_template = FILE:/tmp/krb5cc_:%U krb5_server = idm.lab.org:88 krb5_realm = LAB.ORG krb5_keytab = /usr/local/etc/ipa/krb5.keytab krb5_auth_timeout = 20 id_provider = ipa sudo_provider = ipa access_provider = ipa subdomains_provider = ipa auth_provider = ipa chpass_provider = ipa selinux_provider = none EOF root@samba:~ # chmod 600 /usr/local/etc/sssd/sssd.conf root@samba:~ # cat << EOF > /etc/nsswitch.conf group: files sss group_compat: nis hosts: files dns networks: files passwd: files sss passwd_compat: nis shells: files services: compat services_compat: nis protocols: files rpc: files sudoers: sss files netgroup: files EOF root@samba:~ # cat << EOF > /etc/rc.conf hostname="samba.lab.org" ifconfig_vtnet0="inet 10.1.1.203/24" defaultrouter="10.1.1.1" syslogd_flags="-ss" clear_tmp_enable="YES" sshd_enable="YES" zfs_enable="YES" sssd_enable="YES" EOF root@samba:~ # cat << EOF > /usr/local/etc/openldap/ldap.conf BASE dc=org,dc=lab URI ldap://idm.lab.org/ SASL_MECH GSSAPI SASL_REALM LAB.ORG ssl start_tls TLS_CACERT /usr/local/etc/ipa/ca.crt EOF root@samba:~ # cat << EOF > /etc/krb5.conf [libdefaults] default_realm = LAB.ORG default_keytab_name = FILE:/usr/local/etc/ipa/krb5.keytab default_tkt_enctypes = aes256-cts des-cbc-crc aes128-cts arcfour-hmac default_tgs_enctypes = aes256-cts des-cbc-crc aes128-cts arcfour-hmac dns_lookup_realm = false dns_lookup_kdc = false rdns = false ticket_lifetime = 24h forwardable = yes [realms] LAB.ORG = { kdc = idm.lab.org:88 master_kdc = idm.lab.org:88 admin_server = idm.lab.org:749 default_domain = lab.org pkinit_anchors = FILE:/usr/local/etc/ipa/ca.crt } [domain_realm] .lab.org = LAB.ORG lab.org = LAB.ORG [logging] kdc = FILE:/var/log/krb5/krb5kdc.log admin_server = FILE:/var/log/krb5/kadmin.log kadmin_local = FILE:/var/log/krb5/kadmin_local.log default = FILE:/var/log/krb5/krb5lib.log EOF root@samba:~ # cat << EOF > /etc/pam.d/system # AUTH auth sufficient pam_krb5.so no_warn try_first_pass auth sufficient /usr/local/lib/pam_sss.so no_warn use_first_pass auth required pam_unix.so no_warn try_first_pass nullok # ACCOUNT account required pam_login_access.so account required /usr/local/lib/pam_sss.so ignore_unknown_user ignore_authinfo_unavail account required pam_unix.so # SESSION session required pam_lastlog.so no_fail session required /usr/local/lib/pam_mkhomedir.so mode=0700 # PASSWORD password sufficient /usr/local/lib/pam_sss.so no_warn use_authtok password required pam_unix.so no_warn try_first_pass EOF root@samba:~ # cat << EOF > /etc/pam.d/sshd # AUTH auth sufficient pam_krb5.so no_warn try_first_pass auth sufficient /usr/local/lib/pam_sss.so no_warn use_first_pass auth required pam_unix.so no_warn try_first_pass # ACCOUNT account required pam_nologin.so account required pam_login_access.so account required pam_unix.so account required /usr/local/lib/pam_sss.so ignore_unknown_user ignore_authinfo_unavail # SESSION session required pam_permit.so session required /usr/local/lib/pam_mkhomedir.so mode=0700 session optional /usr/local/lib/pam_sss.so # PASSWORD password sufficient /usr/local/lib/pam_sss.so no_warn use_authtok password required pam_unix.so no_warn try_first_pass EOF
Our samba.lab.org in the FreeIPA/IDM below.
[root@idm ~]# ipa host-find samba
--------------
1 host matched
--------------
Host name: samba.lab.org
Principal name: host/samba.lab.org@LAB.ORG
Principal alias: host/samba.lab.org@LAB.ORG
----------------------------
Number of entries returned 1
----------------------------
Now reboot(8) your samba.lab.org and You should be able to login to it with FreeIPA/IDM account.
host # ssh vermaden@10.1.1.203 (vermaden@10.1.1.203) Password: Last login: Wed Mar 6 07:04:42 2024 vermaden@samba:~ $ grep vermaden /etc/group wheel:*:0:root,vermaden operator:*:5:root,vermaden vermaden@samba:~ $ klist klist: No ticket file: /tmp/krb5cc_1000 vermaden@samba:~ $ kinit vermaden vermaden@LAB.ORG's Password: vermaden@samba:~ $ klist Credentials cache: FILE:/tmp/krb5cc_1000 Principal: vermaden@LAB.ORG Issued Expires Principal Jun 20 21:36:41 2024 Jun 21 20:38:26 2024 krbtgt/LAB.ORG@LAB.ORG vermaden@samba:~ $ sudo -i Password for vermaden@LAB.ORG: root@samba:~ #
Now we have FreeBSD 14.1-RELEASE connected to FreeIPA/IDM server.
FreeBSD Samba Server – Configuration
Now we will make configurations on both FreeBSD Samba server and FreeIPA/IDM.
First tasks on FreeIPA/IDM.
[root@idm ~]# yum install -y ipa-server-trust-ad [root@idm ~]# ipa-adtrust-install \ --unattended \ --enable-compat \ --add-sids \ --admin-name=admin \ --admin-password=password
Generally we want to add SIDs for existing users/groups and enable support for trusted domains for old clients.
Now more FreeIPA/IDM groups/permissions/roles settings.
[root@idm ~]# ipa group-add cifs-share -------------------- Added group "cifs-share" -------------------- Group name: cifs-share GID: 1930000005 [root@idm ~]# ipa group-add-member cifs-share --users=vermaden Group name: cifs-share GID: 1930000005 Member users: vermaden ------------------------- Number of members added 1 [root@idm ~]# ipa permission-add "CIFS-Server-Read-Passwords" \ --attrs={ipaNTHash,ipaNTSecurityIdentifier} \ --type=user \ --right={read,search,compare} \ --bindtype=permission ------------------------------------------------------ Added permission "CIFS-Server-Read-Passwords" ------------------------------------------------------ Permission name: CIFS-Server-Read-Passwords Granted rights: read, search, compare Effective attributes: ipaNTHash, ipaNTSecurityIdentifier Bind rule type: permission Subtree: cn=users,cn=accounts,dc=lab,dc=org Type: user Permission flags: SYSTEM, V2 [root@idm ~]# ipa privilege-add "CIFS-Server-Privilege" --------------------------------------- Added privilege "CIFS-Server-Privilege" --------------------------------------- Privilege name: CIFS-Server-Privilege [root@idm ~]# ipa privilege-add-permission "CIFS-Server-Privilege" --permission="CIFS-Server-Read-Passwords" Privilege name: CIFS-Server-Privilege Permissions: CIFS-Server-Read-Passwords ----------------------------- Number of permissions added 1 ----------------------------- [root@idm ~]# ipa role-add "CIFS-Server" ------------------------ Added role "CIFS-Server" ------------------------ Role name: CIFS-Server [root@idm ~]# ipa role-add-privilege "CIFS-Server" --privilege="CIFS-Server-Privilege" Role name: CIFS-Server Privileges: CIFS-Server-Privilege ---------------------------- Number of privileges added 1 ---------------------------- [root@idm ~]# ipa service-add cifs/samba.lab.org ------------------------------------------------------------- Added service "cifs/idm-freebsd-samba.lab.org@LAB.ORG" ------------------------------------------------------------- Principal name: cifs/samba.lab.org@LAB.ORG Principal alias: cifs/samba.lab.org@LAB.ORG Managed by: samba.lab.org [root@idm ~]# ipa role-add-member "CIFS-Server" --services=cifs/samba.lab.org Role name: CIFS-Server Privileges: CIFS-Server-Privilege Member services: cifs/samba.lab.org@LAB.ORG ------------------------- Number of members added 1 ------------------------- [root@idm ~]# ipa-getkeytab -s idm.lab.org -p cifs/samba.lab.org -k cifs-samba.keytab Keytab successfully retrieved and stored in: samba.keytab [root@idm ~]# mv cifs-samba.keytab /usr/share/ipa/html/ [root@idm ~]# chmod 644 /usr/share/ipa/html/cifs-samba.keytab
Now we need to set some things on the FreeBSD Samba server.
root@samba:~ # fetch -o /usr/local/etc/smb4.keytab \ http://idm.lab.org/ipa/config/cifs-samba.keytab root@samba:~ # cat << SAMBA > /usr/local/etc/smb4.conf [global] workgroup = LAB realm = LAB.ORG netbios name = SAMBA security = user log file = /var/log/samba.log log level = 1 passdb backend = ipasam:ldap://idm.lab.org ldapsam:trusted = yes ldap suffix = dc=lab,dc=org ldap user suffix = cn=users,cn=accounts ldap machine suffix = cn=computers,cn=accounts ldap group suffix = cn=groups,cn=accounts ldap ssl = no idmap config * : backend = tdb create krb5 conf = no dedicated keytab file = FILE:/usr/local/etc/smb4.keytab kerberos method = dedicated keytab state directory = /var/lib/samba4 cache directory = /var/lib/samba4 include = registry [data] path = /data writeable = yes browsable = yes public = no write list = vermaden SAMBA root@samba:~ # mkdir /var/lib/samba4 root@samba:~ # mkdir /data root@samba:~ # echo 1 > /data/1.txt root@samba:~ # chown -R root:cifs-share /data root@samba:~ # chmod 775 /data root@samba:~ # pkg info -l net/freeipa-client | grep ipasam /usr/local/lib/ipasam.so root@samba:~ # mkdir -p /usr/local/lib/samba4/modules/pdb root@samba:~ # cp /usr/local/lib/ipasam.so /usr/local/lib/samba4/modules/pdb/ipasam.so root@samba:~ # service samba_server enable root@samba:~ # service samba_server start
There is now one small and tricky part w/o which it will still do not work. The SIDs needs to be the same. It is done by net(8) command installed by net/samba416 package.
root@samba:~ # pkg which -o $( which net )
/usr/local/bin/net was installed by package net/samba416
We will use two net(8) subcommands here – getdomainsid and sedlocalsid.
Lets start with the first one.
root@samba:~ # net getdomainsid SID for local machine CIFS is: S-1-5-21-1629303435-4165009306-2230089581 SID for domain LAB is: S-1-5-21-547807538-239846452-1502288973
As you can see the local SID and domain SID are different – and this way it will not work.
The domain SID comes from FreeIPA/IDM and we need to copy it and set it also as local SID on FreeBSD Samba server.
root@samba:~ # net setlocalsid S-1-5-21-547807538-239846452-1502288973 root@samba:~ # net getdomainsid SID for local machine CIFS is: S-1-5-21-547807538-239846452-1502288973 SID for domain LAB is: S-1-5-21-547807538-239846452-1502288973
Now we have Samba server on FreeBSD configured to serve shares by using credentials from FreeIPA/IDM.
The most important part of this setup is using ipasam.so Samba backend for FreeIPA/IDM users and passwords.
This ipasam.so file is installed by the net/freeipa-client package.
Samba Linux Client
The Samba client on Alma Linux 9.4 is installed in the same way as IDM so no need to repeat myself – only IP and hostname are different – and a set of installed packages of course.
First – lets make sure the local SID on the Linux Samba client is the same as domain SID from FreeIPA/IDM.
[root@client ~]# yum install -y samba-common-tools [root@client ~]# net setlocalsid S-1-5-21-547807538-239846452-1502288973
Now we will try to use smbclient(1) to check if we can list contents of the Samba share from FreeBSD server.
[root@client ~]# yum install -y samba-client [root@client ~]# smbclient //10.1.1.203/data -U LAB.ORG/vermaden Password for [LAB.ORG\vermaden]: Try "help" to get a list of possible commands. smb: \> ls . D 0 Wed Jun 19 22:37:05 2024 .. D 0 Sat Jun 22 19:05:30 2024 1.txt N 2 Wed Jun 19 16:31:40 2024 13345400 blocks of size 1024. 11608920 blocks available smb: \> exit
So it works! … at least in read only mode. Now lets try to mount it to write something there.
[root@client ~]# yum install -y cifs-utils [root@client ~]# mount.cifs -v //10.1.1.203/data /mnt -o username=vermaden,domain=LAB.ORG,password=password mount.cifs kernel mount options: ip=10.1.1.203,unc=\\10.1.1.203\data,user=vermaden,domain=LAB.ORG,pass=******** [root@client ~]# ls -l /mnt total 2 -rwxr-xr-x. 1 root root 2 Jun 19 16:31 1.txt [root@client ~]# cat /mnt/1.txt 1 [root@client ~]# echo 2 > /mnt/2.txt [root@client ~]# cat /mnt/2.txt 2
The read/write mode also works.
Lets verify that the 2.txt is also present on the FreeBSD Samba server.
root@samba:~ # find /data -ls
48606 1 drwxrwxr-x 2 root cifs-share 6 Jun 19 22:37 /data
68704 1 -rwxr--r-- 1 vermaden wheel 2 Jun 23 17:25 /data/2.txt
68788 1 -rw-r--r-- 1 root cifs-share 2 Jun 19 16:31 /data/1.txt
Lets create another 3.txt file from the FreeBSD Samba server for another verification.
root@samba:~ # echo 3 > /data/3.txt
… and back to Linux client.
[root@client ~]# ls -l /mnt
total 2
-rwxr-xr-x. 1 root root 2 Jun 19 16:31 1.txt
-rwxr-xr-x. 1 root root 2 Jun 23 17:25 2.txt
-rwxr-xr-x. 1 root root 2 Jun 19 16:35 3.txt
So we have Linux client covered. It all works as desired.
One important thing here – the Linux client DID NOT joined the FreeIPA/IDM domain – its just a regular Linux system.
The FreeBSD Samba server displayed as SAMBA below.
[root@client ~]# net getdomainsid SID for local machine CLIENT is: S-1-5-21-547807538-239846452-1502288973 SID for domain SAMBA is: S-1-5-21-547807538-239846452-1502288973
Now we will move to Windows platform.
Samba Windows Client
As Windows is GUI focused system we will present that information in Board of Directors friendly way – in graphical form π
Below you will see the process of typical Map Network Drive job.
I was able to read existing content and also to create new 4.win.txt file with some garbage content – so read/write access from Windows also works.
Summary
Let me know in comments how it went.
EOF
ππππππππ 