From b5fbbd1957873207afc2542a9d32246bccca0556 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Fri, 12 Apr 2019 16:30:07 +0300 Subject: [PATCH] Keytab retrieval: allow requesting arcfour-hmac for SMB services With system-wide crypto policy in use, arcfour-hmac encryption type might be removed from the list of permitted encryption types in the MIT Kerberos library. Applications aren't prevented to use the arcfour-hmac enctype if they operate on it directly. Since FreeIPA supported and default encryption types stored in LDAP, on the server side we don't directly use a set of permitted encryption types provided by the MIT Kerberos library. However, this set will be trimmed to disallow arcfour-hmac and other weaker types by default. While the arcfour-hmac key can be generated and retrieved, MIT Kerberos library will still not allow its use in Kerberos protocol if it is not on the list of permitted encryption types. We only need this workaround to allow setting up arcfour-hmac key for SMB services where arcfour-hmac key is used to validate communication between a domain member and its domain controller. Without this fix it will not be possible to request setting up a machine account credential from the domain member side. The latter is needed for Samba running on IPA client. Thus, extend filtering facilities in ipa-pwd-extop plugin to explicitly allow arcfour-hmac encryption type for SMB services (Kerberos principal name starts with cifs/). Reviewed-By: Christian Heimes --- .../ipa-pwd-extop/ipa_pwd_extop.c | 35 ++++++++++++++++--- install/updates/60-trusts.update | 6 ++++ 2 files changed, 37 insertions(+), 4 deletions(-) diff --git a/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c b/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c index 7e52a8855..b34038767 100644 --- a/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c +++ b/daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c @@ -97,7 +97,8 @@ void *ipapwd_get_plugin_id(void) } static void filter_keys(struct ipapwd_krbcfg *krbcfg, - struct ipapwd_keyset *kset) + struct ipapwd_keyset *kset, + bool allow_nthash) { int i, j; @@ -108,6 +109,14 @@ static void filter_keys(struct ipapwd_krbcfg *krbcfg, break; } } + + /* if requested by the caller, allow arcfour-hmac even + * if it is missing in the list of supported enctypes. */ + if (allow_nthash && + (ENCTYPE_ARCFOUR_HMAC == kset->keys[i].key_data_type[0])) { + break; + } + if (j == krbcfg->num_supp_encsalts) { /* not valid */ /* free key */ @@ -130,7 +139,8 @@ static void filter_keys(struct ipapwd_krbcfg *krbcfg, static void filter_enctypes(struct ipapwd_krbcfg *krbcfg, krb5_key_salt_tuple *kenctypes, - int *num_kenctypes) + int *num_kenctypes, + bool allow_nthash) { /* first filter for duplicates */ for (int i = 0; i + 1 < *num_kenctypes; i++) { @@ -158,6 +168,12 @@ static void filter_enctypes(struct ipapwd_krbcfg *krbcfg, break; } } + /* if requested by the caller, allow arcfour-hmac even + * if it is missing in the list of supported enctypes. */ + if (allow_nthash && + (ENCTYPE_ARCFOUR_HMAC == kenctypes[i].ks_enctype)) { + break; + } if (j == krbcfg->num_supp_encsalts) { /* Unsupported, filter out */ for (int k = i; k + 1 < *num_kenctypes; k++) { @@ -1198,6 +1214,7 @@ static int ipapwd_setkeytab(Slapi_PBlock *pb, struct ipapwd_krbcfg *krbcfg) int kvno; char *svcname; bool allowed_access = false; + bool is_nthash_allowed = false; struct berval *bvp = NULL; LDAPControl new_ctrl; @@ -1270,7 +1287,12 @@ static int ipapwd_setkeytab(Slapi_PBlock *pb, struct ipapwd_krbcfg *krbcfg) for (int i = 0; i < kset->num_keys; i++) { kset->keys[i].key_data_kvno = kvno; } - filter_keys(krbcfg, kset); + + /* Only allow generating arcfour-hmac keys for cifs/.. services + * unless the enctype is allowed by the IPA configuration for use + * by the all principals */ + is_nthash_allowed = (0 == strncmp("cifs/", serviceName, 5)); + filter_keys(krbcfg, kset, is_nthash_allowed); /* check if we have any left */ if (kset->num_keys == 0) { @@ -1579,6 +1601,7 @@ static int ipapwd_getkeytab(Slapi_PBlock *pb, struct ipapwd_krbcfg *krbcfg) struct berval *bvp = NULL; LDAPControl new_ctrl; bool wantold = false; + bool is_nthash_allowed = false; /* Get Bind DN */ slapi_pblock_get(pb, SLAPI_CONN_DN, &bind_dn); @@ -1664,7 +1687,11 @@ static int ipapwd_getkeytab(Slapi_PBlock *pb, struct ipapwd_krbcfg *krbcfg) goto free_and_return; } - filter_enctypes(krbcfg, kenctypes, &num_kenctypes); + /* Only allow generating arcfour-hmac keys for cifs/.. services + * unless the enctype is allowed by the IPA configuration for use + * by the all principals */ + is_nthash_allowed = (0 == strncmp("cifs/", service_name, 5)); + filter_enctypes(krbcfg, kenctypes, &num_kenctypes, is_nthash_allowed); /* check if we have any left */ if (num_kenctypes == 0 && kenctypes != NULL) { diff --git a/install/updates/60-trusts.update b/install/updates/60-trusts.update index 90201e1b4..6d8cccc38 100644 --- a/install/updates/60-trusts.update +++ b/install/updates/60-trusts.update @@ -41,6 +41,12 @@ dn: $SUFFIX add:aci: (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read and write NT passwords"; allow (read,write) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,$SUFFIX";) remove:aci: (targetattr = "ipaNTHash")(version 3.0; acl "Samba system principals can read NT passwords"; allow (read) groupdn="ldap:///cn=adtrust agents,cn=sysaccounts,cn=etc,$SUFFIX";) +# For Samba as a domain member setup we need to allow synchronizing ipaNTHash value +dn: cn=services,cn=accounts,$SUFFIX +add:aci: (target="ldap:///krbprincipalname=cifs/($$dn),cn=services,cn=accounts,$SUFFIX")(targetattr="ipaNTHash")(version 3.0; acl "CIFS service can modify own ipaNTHash"; allow(write) userdn="ldap:///krbprincipalname=cifs/($$dn),cn=services,cn=accounts,$SUFFIX" or userattr="managedby#SELFDN";) +add:aci: (target="ldap:///krbprincipalname=cifs/($$dn),cn=services,cn=accounts,$SUFFIX")(targattrfilters="add=objectClass:(objectClass=ipaNTUserAttrs)")(version 3.0; acl "CIFS service can add ipaNTUserAttrs to itself"; allow(write) userdn="ldap:///krbprincipalname=cifs/($$dn),cn=services,cn=accounts,$SUFFIX" or userattr="managedby#SELFDN";) + + # Add the default PAC type to configuration dn: cn=ipaConfig,cn=etc,$SUFFIX addifnew: ipaKrbAuthzData: MS-PAC