Cisco AAA VPN and RADIUS on Mac OS X Server 10.8 – Mountain Lion

Posted: March 27th, 2013 | Author: | Filed under: Mac OS X, Mac OS X Server, Open Directory, RADIUS, VPN | 3 Comments »

601005_10150867245812933_764239537_n

So you’re using Mountain Lion Server for Open Directory. Good for you! But beware of your users, they have requested VPN access to the network and like any good sysadmin you think, “Jesus H Christ, here’s yet another credential combo for the user to forget, for the user to call me at 10pm Friday night asking: ummmmmm, what’s my password?” FOR WHAT?!?! Jeezus Christ why don’t they ever tell us which password they forgot? Anywho, I digressed. Well with the power of RADIUS on your trusty Mac OS X Server you can now defer the authentication of your Cisco VPN gateway to your directory system. Let’s setup RADIUS on Mac OS X Server.

Prep the directory

Either you Mac an OD Master or bind to a directory, I think this is a given but, just saying. Then, whatever directory system you’re using, you must create a group called “VPN Access” or something to that effect, and subscribe the users and/or groups you want to have access to VPN. I don’t care if this is in Active Directory or Workgroup Manager or Server.app.

Build the RADIUS service

ARD into your Mac OS X server. In Server.app navigate to your hardware and then Settings. Note which SSL certificate your server is currently using and then find that certificate in Keychain Access. Right below it will be the key, right click on the key and choose Export, the destination will be /Users/Shared/cert.p12 and the password can be blank.

Open Workgroup Manager and edit local directory, authenticate yourself so you have read/write privileges. From the view menu enable Show System Records, then click on the groups tab, sort by GID. Scroll down to the 200’s and look for records like “com.apple.ard_access” “com.apple.afp_access” find the last of these groups and note the GID. Now create a new group, the long name is blank, the short name is “com.apple.access_radius” and the GID is incremented by 1 from the last GID you noted earlier. Save changes. GID  2xx

Once created click on the members tab and then “+” symbol. A side pane will appear, in this pane you can choose any directory system the OS X box is bound to, active or open. Cool hey?  Add “VPN Access” group. Save the changes.

Open a terminal and “sudo -s” up. As the root user paste in the following:
radiusconfig -setconfig auth yes
radiusconfig -setconfig auth_badpass yes
radiusconfig -setconfig auth_goodpass no
radiusconfig -autorotatelog on -n 15

Now, run these one at a time, when prompted for password, enter the password that you set when you exported the cert from Keychain, I told you to put no password but God knows that sysadmins rarely do what they’re told. 😉

paste one at a time:
WATCH THE LINE WRAP!

openssl pkcs12 -in /Users/Shared/cert.p12 -out /etc/raddb/certs/radius.key -nodes -nocerts
openssl pkcs12 -in /Users/Shared/cert.p12 -out /etc/raddb/certs/radius.crt -nodes -nokeys
radiusconfig -installcerts /etc/raddb/certs/radius.key /etc/raddb/certs/radius.crt

Finally for the server let’s grant access to our Cisco box, IP is obviously the IP of the box, short-name is just a nickname for the system.
radiusconfig -addclient <IP> <short-name> other

You should be prompted to enter a key, please remember this key, let’s call it: theKey.

finally run radius in verbose with radiusd -X Leave the terminal open, do not close. It will help us deduce answers should problems arise. If all goes well you should get something like:

Listening on authentication *:1645
Listening on accounting *:1646
Ready to process requests.

Connect your Cisco VPN gateway

conf t
radius-server host <enter IP||FQDN> auth-port 1812 acct-port 1813
radius-server key <enter theKey>
aaa new-model
aaa authentication login vpn group radius local
aaa authorization network vpn local

You’ll need to connect this AAA stanza to your crypto map, my crypto map is called VPN. This is how I did it, note the bold similarities.

crypto map VPN client authentication list vpn
crypto map VPN isakmp authorization list vpn

This will allow AAA to check the RADIUS server, but fall back to local auth if RADIUS does not respond.

Finally we’re going to test all of this by using the test command. So get out of conf t by typing exit and try the following:

test aaa group radius <username> <password> legacy

If it returns “User was successfully authenticated.” You’re in business. Also, note the terminal where radiusd -X is running, you’ll see some interesting output.

Clean Up

wr mem on your router and exit the session. Cancel that radiusd -X process we started and set the process to run. serveradmin start radius Immediately test the connection from the outside to ensure it’s stable.

Check out my next post: Authenticate APC UPS against RADIUS on Mac OS X Server 10.8 Mountain Lion


Apple Certified Technical Coordinator (ACTC) OS X Server Essentials 10.8 Test Review

Posted: March 25th, 2013 | Author: | Filed under: Blog, Mac OS X, Mac OS X Server | No Comments »

I recently submitted an application with Apple to join the Apple Consultants Network. In doing so I knew I had to pass the ACTC certification tests within 45 days of joining. Unfortunately I could not find a testing center in Vancouver so I took the test down in Seattle at Crywolf Training. Gordon Davisson was the proctor and did an amazing job, I showed up 30 mins early and was greeted with donuts and a free review of ML201. Gordon took us thru all the services associated with 10.8 server and gave a couple great tips. (DORA FTW)

The test comprised of 80 multiple choice questions, with two hours on the clock and two crullers in my gut, I began. The first thing I noticed was a lot of the questions would ask “Which is the best sentence to describe blah” and give two correct sentences out of four. This left the tested to choose one answer which they thought was the most applicable, the one that stuck out in my mind most was for the wiki service. Questions with only one possible answer were marked with radio buttons while multi-answer questions had checkboxes. The questions also told the tested how many answers were needed, pick 2, pick 3. The questions themselves were quite simple with exception given to an SSL question and two permissions questions where I had to think, OK do I answer it correctly or the way I think Apple wants me to answer it. To prepare, I used the Amsys Revise IT app to test myself before going in as well as the OS X Server Essentials book by PeachPit.

Do the tests, take screen shots of the questions you’re puzzled by and research those in the PeachPit book, if you do this you’ll be fine.


Magic Triangle, Snow Leopard Server, Lion Clients

Posted: April 19th, 2012 | Author: | Filed under: Active Directory, Blog, Mac OS X Server, Open Directory, Snow Leopard | Tags: , , , , | 1 Comment »

Just tried to bind a Lion client to our Magic Triangle infrastructure. Apple describes the problems as: A Mac OS X v10.7 Lion client may be unable to connect to a Mac OS X v10.6 Open Directory Server. This can happen if Lion uses Authenticated Binding to a Mac OS X v10.6 Open Directory Server that is also bound to Active Directory by means of a magic triangle.

Apple’s fix is to use Terminal to run a pair of shell commands on the Snow Leopard Server Open Directory Master Server and Replicas. Apple says:

Note: These commands will turn off GSSAPI authentication for the LDAP Server on the Mac OS X v10.6 Open Directory Master Server and Replicas. The servers will then use CRAM-MD5 authentication.

sudo rm /usr/lib/sasl2/openldap/libgssapiv2.2.so
sudo rm /usr/lib/sasl2/openldap/libgssapiv2.la

Restart the server after making this change.

If you want to restore the original settings, execute these commands:

cd /usr/lib/sasl2/openldap
sudo ln -s ../libgssapiv2.2.so
sudo ln -s ../libgssapiv2.la

Restart the server after making this change.


Backup and Restore Lion Wiki

Posted: November 7th, 2011 | Author: | Filed under: Blog, Collaboration, Mac OS X Server, Migrate | Tags: | No Comments »

Backup the Collaboration Database

on the server running the wiki open a terminal and paste the following into the file backup-wiki.sh

 

 

 

 

 

 

 

 


#!/bin/bash
PGUSER=_postgres

BACKUPFILE=`date +%Y%m%d`-wikibackup.tar.gz
/usr/bin/pg_dump -U $PGUSER collab -c -f /Library/Server/PostgreSQL/Backup/collab.sql
tar -cvzf /Users/admin/Backups/$BACKUPFILE /Library/Server

Save and exit the file, then do the following


chmod +x wiki-backup.sh
sudo ./wiki-backup.sh

This will create the file wiki-backup.tar.gz in the /Users/admin/Backups folder

Prep the migration file

Copy this file to the new server, untar it.

Then follow this procedure.

1. Open server.app and turn on wiki
2. Open terminal and find pgsql process (ps aux | grep pgsql) , copy it to clipboard
3. Stop wiki server
4. open terminal and enter  psql -U _postgres -d collab -f /Library/Server/PostgreSQL/Backup/collab.sql

5. a bunch of shit will fly by, forget about it.

6. copy the Wiki folder from our backup into /Library/Server

7. Repair permissions
8. Turn on wiki, pray


How to Force Propagation on Apple Secondary DNS Server

Posted: May 16th, 2011 | Author: | Filed under: Blog, DNS, Mac OS X Server, Networking, Snow Leopard | Tags: , , , , , , , | No Comments »

As you all probably know that using Apple’s DNS server can be challenging at times. If you make changes on the primary you usually have to wait some time before those changes propagate to the secondaries. However with the following commands you can force this propagation without having to nuke files or folders in /var/named

1. On the secondary server, run this command. (use whatever zone you want to transfer in place of lan.example.com
rndc -p 54 retransfer lan.example.com IN com.apple.ServerAdmin.DNS.public

2. Reload configuration
rndc -p 54 reload

3. Forcing client cache flush
dscacheutil -flushcache

The reason I think this is better in my opinion is it gets rid of the potential “oops” of deleting critical files in /var/named.


How To RAID Mac Mini Server without Reinstalling

Posted: March 14th, 2011 | Author: | Filed under: Mac OS X Server | Tags: , , , | No Comments »

Replicate boot drive to spare drive.


While this post title specifically says Mac Mini Server, this procedure will work with any Macintosh that has more than one hard drive.

  1. Open Disk Utility
      One drive should be labelled “Server HD” and the other “Macintosh HD2” Remember which one is on top and which one is on bottom.
  2. Select the Hard Drive associated with Macintosh HD2, and then click Restore
  3. Drag Server HD in to the source and Macintosh HD2 into the destination
  4. Make it go

Build the spare drive into a RAID of one disk

  1. Open Disk Utility
  2. Select the Hard Drive associated with old “Macintosh HD2”, and then click RAID.
      If you unsure as to which is which you can select the drive and note the mount point at the bottom of the window. Choose the one that DOES NOT have the mount point of “/”
  3. Set the following options
      RAID Set Name: Server HD RAID
      Format: Mac OS Extended (Case-Sensitive, Journaled)
      RAID Type: Mirrored RAID Set
  4. Drag the spare Server HD from the list on the left into the box on the right.
  5. Select Options and enable “Automatically rebuild RAID mirror sets” Click OK then Enable
  6. Rename the newly built drive to Server RAID
  7. Go to System Preferences->Startup Disk and select the newly built RAID.
  8. Reboot

Integrate Other Drive into RAID

  1. Once the system is booted verify the RAID drive is the boot volume
      To do this open Disk Utility again and select the Server RAID volume, make sure the mount point states “/”
  2. While in Disk Utility select the RAID device, which is located above “Server RAID” and click on the RAID tab
  3. Drag “Server HD” into the white box on the right to add it to the RAID
  4. Click Rebuild, it will take some time. Once done perform one more reboot and you’re finished!


Resolving HomeSync Errors on SMB

Posted: October 27th, 2010 | Author: | Filed under: Active Directory, Collaboration, Mac OS X Server, Snow Leopard | Tags: , , , , , , , | No Comments »

This is a follow up post in regards to my previous update: http://jordaneunson.com/2010/10/apple-magic-triangle-deployment-results/

A client of mine is being plagued with HomeSync errors on a Windows backed file server. One user in particular had over 2,000 file sync conflict issues, two others had around 70. After investigating the logs I believe I have an explanation as to why HomeSync is failing. To understand my theory I’m going to explain a bit about permissions on the Mac side.

When any Mac users logs into the desktop their home is mounted from the server into a “magic” folder. I say “magic” because technically it’s not a folder, it’s a program. The directory “/Network/Servers” is an auto mount program, if you enter this directory on the command line or in the GUI and specify a sub directory, such as “/Network/Servers/filer.DOMAIN.com” the computer will try to contact filer.DOMAIN.com over AFP, NFS, and SMB, to get a share listing and then display that listing as subfolder to the FQDN. For our example we would receive the following folder listing as user1:

vaW80401YGAGZ:filer.DOMAIN.com user1$ ls -al /Network/Servers/filer.DOMAIN.com
total 36
drwx—— 1 user1 wheel 16384 26 Oct 15:17 Homes
vaW80401YGAGZ:filer.DOMAIN.com user1$

We see here that there is only one entry “Homes” but notice the owner and group. The owner seems fine, user1, however the group is “wheel” Wheel is a local group on every Macintosh that is more or less a system group. The share is mounted as group wheel because the mounting program runs as “wheel” Thus all the directories inside of user1’s home folder also have the group “wheel”

Let’s compare group owner to what is assigned when we mount the share manually:

vaW80401YGAGZ:Volumes user1$ ls -al /Volumes
total 72
drwxrwxrwt@ 9 root admin 306 26 Oct 22:11 .
drwxrwxr-t 30 root admin 1088 26 Oct 13:14 ..
drwx—— 191 user1 DOMAIN\domain users 6450 21 Oct 11:05 CurrentProjects
drwx—— 1 user1 DOMAIN\domain users 16384 26 Oct 15:17 Homes
drwx—— 1 user1 DOMAIN\domain users 16384 26 Oct 15:36 Production
drwx—— 31 user1 DOMAIN\domain users 1010 15 Oct 14:11 Promo
drwx—— 41 user1 DOMAIN\domain users 1350 26 Oct 20:53 SCANS
lrwxr-xr-x 1 root admin 1 26 Oct 13:13 Workstation -> /
drwx—— 23 user1 DOMAIN\domain users 738 26 Oct 15:26 joost

See that? The group is different! The mac mounts the directory as the proper default group “DOMAIN/domain users” for the user user1. I know this is the default group for user1 by asking the AD server details about the user1 user:

vaW80401YGAGZ:Volumes user1$ id user1
uid=421864987(user1) gid=1278872894(DOMAIN\domain users) etc……

Now that we understand a little about permission sets in the Mac world I’ll explain my theory.

When I a HomeSync user authenticates for the first time the Mac must mount their home directory in /Network/Servers and thus the group owner is set to “wheel.” The contents of the users home directory is then copied to “/Users/” for our continued example it would be /Users/user1. Here’s the kicker: when the Mac wants to do any HomeSync after the initial is complete, it does not mount the user’s home directory to /Network/Servers. Instead the Mac mounts the home directory to /Volumes like a standard manual mount. Therefore the group ownership in the user’s local home folder DOES NOT match the group ownership of the user’s server side home folder. Thus, HomeSync tries to update the server side’s group ownership to the group “wheel.” This is usually when all the errors start spewing out of HomeSync because the Windows server has no record in Active Directory of the group “wheel”

I then went on to test my theory. I changed the group ownership for three separate user’s LOCAL home folders from “wheel” to “DOMAIN/domain users” For one user this resolved 68 of 70 HomeSync errors. For two others it resolved all of them.

There are other problems regarding HomeSync that are not included in this above mentioned theory such as illegal characters. For one example, Parallels is installing files into ~/Applications that have the { } characters in them. This is causing more problems to the HomeSync users. I have excluded this directory from synchronizing, however there are more HomeSync issues because of these illegal characters.


Apple Magic Triangle Deployment Results

Posted: October 15th, 2010 | Author: | Filed under: Active Directory, DNS, Kerberos, LDAP, Mac OS X Server, Migrate, Snow Leopard | Tags: , , , , , , , | No Comments »

This is a follow up to my last blog entry: Magic Triangle Setup with Windows File Server backed Portable Home Directories. Myself and a team of amazing people deployed the Magic Triangle solution in an architectural firm that recently was involved in a merger and needed to be brought into one unified “domain.” I place that word in quotations after some disagreements and long discussions with AD administrators as to the default definition of the word. Before we begin let’s just go over our Magic Triangle deployment and the roles of our servers.

  • vandc01.tld.ca is the local AD domain controller.
  • vanfile.tld.ca is the Windows based file server for all network home directories
  • od01.tld.ca is the Open Directory server which was also bound to AD
  • od02.tld.ca is the OD replica and netboot server for Deploy Studio
  • For all intensive purposes, the migration went fairly smoothly. The client was quite happy with the result, although the users of the network do not have as fast of a desktop environment as they did with a pure Macintosh network. The final outcome was Mac clients bound to both AD and OD. AD handled all the user and group authentication and authorization while OD took care of computer and group client management through MCX. I put a standard computer heirarchy in place on the OD side for computer group so different settings could be applied to different sets of computers. Such as, making all laptops automatically create portable home directories and install the HomeSync menu in the top menu bar. However, there was one very strange problem I encountered while binding the Macintosh clients to the Open Directory server.

    Normally, when you set “Require authenticated binding between directory and clients” to on in Server Admin the Mac client will prompt you for directory administrator credentials when binding a client. However, this was not happening for us. We were using 10.6.4 server and client everywhere, yet the clients were just not asking for authentication. Thus, a computer record was not being generated on the server side. What I did for the first few test cases was create computer records manually inside of Workgroup Manager, but this was not fun and tedious.

    Update: One of my readers, JJ, pointed out a great kb article from Apple on how to require directory authentication while binding. http://support.apple.com/kb/HT4068 End of Update

    I whipped up a quick AppleScript to bind the clients for me, this script had the diradmin login and pass embedded in it which I know is not best practice yet it was a temporary fix. The reason for using the script is so that the command line utility dsconfigldap is passed the ‘-f’ flag which forces the client to authenticate to the directory server.

    The script is as follows:


    tell application "Terminal"
    do shell script "dsconfigldap -u diradmin -p 'diradminpass' -f -a od01.tld.ca -c `hostname` -n od01.tld.ca -l localsudouser -q localsudopass -v > /Users/Shared/odbind.log" with administrator privileges
    do shell script "echo 'Writing Search policy to plists' >> /Users/Shared/odbind.log" with administrator privileges
    do shell script "defaults write /Library/Preferences/DirectoryService/SearchNodeConfig 'Search Node Custom Path Array' -array '/LDAPv3/od01.tld.ca'" with administrator privileges
    do shell script "defaults write /Library/Preferences/DirectoryService/SearchNodeConfig 'Search Policy' -int 3" with administrator privileges
    do shell script "defaults write /Library/Preferences/DirectoryService/ContactsNodeConfig 'Search Node Custom Path Array' -array '/LDAPv3/od01.tld.ca'" with administrator privileges
    do shell script "defaults write /Library/Preferences/DirectoryService/ContactsNodeConfig 'Search Policy' -int 3" with administrator privileges
    do shell script "echo 'Successfully added the Open Directory server to your search path' >> /Users/Shared/odbind.log" with administrator privileges
    do shell script "echo 'Writing LDAP in your search paths' >> /Users/Shared/odbind.log" with administrator privileges
    do shell script "dscl /Search -append / CSPSearchPath /LDAPv3/od01.tld.ca" with administrator privileges
    do shell script "dscl /Search/Contacts -append / CSPSearchPath /LDAPv3/od01.tld.ca" with administrator privileges
    end tell
    tell application "Finder"
    activate
    display dialog "Computer is now bound to Open Directory as " & (do shell script "hostname")
    end tell

    File Migration from Apple Filer to Windows Filer

    This was one of the more challenging issues at hand. We had a whole bunch of OD user’s home folders on two Apple XRAIDs served out via AFP and needed to move the data to the Windows Filer using SMB. What we ended up doing is creating an LACP link to a MacPro and using the following script to migrate the users one by one.

    syncit.sh is a shell script that mounts two network homes for one user, one from AD and one from OD. It then transfers all data from OD to AD via rsync. To make this script work it depends on a couple things.

  • The users to be migrated are entered into a file called ‘users’ with NO extension in the following format
    1. oduser:aduser
      oduser:aduser
      oduser:aduser
      oduser:aduser
      oduser:aduser
  • When the script executes it will create the folder /Users/Shared/syncit_logs and two log files for each user. username.log username.err. The .log is all the stdout of rsync while .err is all the errors.
  • And finally when you download the script you’ll need to edit the variables at the top of the script with the FQDN’s for you file servers and shares.

    You can get the script here.

    Caveats

    Home Directory Ghost Mount
    One issue that we’ve seen appear more than once is home directory ghost mounting. When a user logs out of their profile sometimes their home directory does not unmount cleanly. As a result when the user tries to log in again on the same workstation they are unable to due to the computer believing the home directory is already mounted. This may also affect logins of the same user account to other workstations due to the home directory filer not timing out the mount session.

    Slow Network File System Access
    There have been at times severe client stalls due to slow file system access. This was noticed on literally zero network traffic congestion. This is a noted issue from many different implementations of using SMB shares for Mac home directories. Read http://www.macwindows.com/snowleopard-filesharing.html#091709k for more information. One suggested solution is to turn on Internet Sharing on the Mac client, however this is not a wise idea.

    Portable Home Directory Will Not Sync
    Sometimes homesync will become cranky. Definitely cranky. The easier and fastest way to resolve a home directory that does not sync is to perform the following.

  • Erase the contents of the users’s ~/.FileSync and ~/Library/FileSync directories.
  • Manually mount the user’s network home directory and erase the same directories on the server
  • Try the sync process again. Note: It will take longer to catalog the file system.
  • For most HomeSync problems it usually has something to do with file conflict resolution. To find out always open Console.app and look at FileSyncAgent.log. Try to perform a FileSync and watch the output of the log. If you are having problems with an initial sync try erasing the login.keychain file found in ~/Library/KeyChains on both server and client. Many times this will cause problems due to The Chicken and The Egg issues.

    Illegal Characters in File Names
    “ ‘/ \ + * ( ) [ ] are all illegal characters for file names on the Windows File Servers, as are directories or files that end in a space. As a result you may have issues creating working with these files. The Windows file server use unicode to map these characters, however there are failures often. Resolution is done by manually replacing filenames. This is also a LARGE contributor to File Sync failing.

    Summary

    Like I mentioned at the beginning everything went quite smoothly. There were of course strange things that happened through out the deployment, and the short one week runway I had to prep for this was WAY too short but in the end we pulled it off. If any of you out there are planning on deployment or need questions answer feel free to contact me via the About Me button at the top of blog!

    Update: Please check out my next post regarding HomeSync errors on an SMB server.

    Update 2: One of my readers, JJ, pointed out a great kb article from Apple on how to require directory authentication while binding. http://support.apple.com/kb/HT4068


    Apple Magic Triangle Setup with Windows File Server backed Portable Home Directories.

    Posted: August 24th, 2010 | Author: | Filed under: Active Directory, Mac OS X Server, Snow Leopard, Work | Tags: , , , , , , , | 1 Comment »

    Recently I was hired to give my opinion about merging an existing Macintosh Open Directory(OD) network into a Windows Active Directory(AD) network. This was being done because Company A merged with Company B, and Company B being more powerful and larger wanted to stay with their AD infrastructure. My opinion was to move to a “Magic Triangle” setup where an OD server is bound to an AD Domain Controller(DC). The users and groups are managed by Active Directory, however the Mac clients are bound to both AD and OD for the purpose of being able to hand out MCX records to users, groups, and computers. I wrote this how to because no matter how much documentation I read I have not been able to find some of the key pieces of information I needed to accomplish this goal. On a side note, I would like to give a big hello to Alper Bac, current Systems Administrator of Cohos Evamy for his invaluable help in solving some of the AD configuration issues we were having.

    On the Mac Server 10.6

    Step 1: Check the Active Directory configuration.
    Make sure your Active Directory server and its DNS service is properly configured and running.

    Step 2: Turn on Open Directory service.
    Use Server Admin to turn the Open Directory service on. After the service is turned on you can configure Open Directory service settings.

    Step 3: Ensure the computer is a standalone directory service.

    Step 4: Connect to Active Directory.

    • Go to Server Admin, Open Directory.
    • Click Settings button at top, then the General tab. The window should report that its role is “Standalone Directory.” If this is correct you can now click change, otherwise go to Step 3.
    • In the pop-up dialogue choose “Connect to another Directory”
    • Then Continue, and click “Open Directory Utility”
    • The Directory Utility application will appear. If it is locked please unlock it.
    • Ensure that active directory is uncheck
    • Double click “Active Directory”
    • Type in your domain and expand the arrow beside “Show Advanced Options”
    • Ensure that “Create mobile account at login” and “Force Local home directory on startup disk” is uncheck. Then click OK
    • Quit Directory Utility
    • Back in the Open Directory Wizard box click Done
    • Open System Preferences and go to Accounts
    • Click on Login Options and Click “Join”
    • Type the name of Active Directory Domain Controller (DC) in where it says “Server:” as well as the AD Admin user/password credentials in the appropriate boxes. Also give the computer an record name. This name will be the record that is created in Active Directory.
    • Once joined the Mac will ask about Kerberos. Just ignore this for now.

    Step 5: Set up an Open Directory master.

    • Go to Server Admin, Open Directory
    • Click Settings button at top, then the General tab. The window should report that its role is “Connected to another directory” If this is correct you can now click change, otherwise go to Step 4.
    • Choose the first option “Remain connected and set up an Open Directory Master”
    • If it complains about Kerberos just ignore this again.
    • Setup the diradmin account. Give it a secure password as this is our Directory Administrator account.
    • Now type in a relevant LDAP Search Base. If you don’t know what should go here just click continue. However if you don’t know what goes here yet you’re trying to integrate a Mac into AD I must say that you may be in over your head. 😉
    • Confirm your settings and click continue.
    • Now in Server Admin we want to set a policy under Open Directory. So click on Policies tab and then Bindings subtab and enable the “Require authenticated binding….” check box.

    Step 6: Disable Kerberos on Open Directory master.
    Disable Kerberos on your Open Directory Master server to avoid conflicts with your Active Directory Kerberos realm. In a terminal type: (use the diradmin credentials)
    sudo sso_util remove -k -a username -p password -r NAME. OF.KERBEROSREALM

    Step 7: Kerberize services.
    Kerberize your Open Directory server services with the Kerberos realm of your Active Directory server, in a terminal type:
    sudo dsconfigad -enablesso

    On the Windows Server 2003

    What we need to do is assign a home folder to an existing user account. So let’s grab the user account “Test” and map a home folder to it.

    • Go to Start, Administrative Tool, Active Directory Users and Computers
    • Right click domain name and search for users
    • Open Properties and then profile tab
    • Click the “home folder” radio button and select an unused drive letter. For our example it will be “Z:” and then enter beside it the Windows File server fqdn in this format. \\fqdn\share\username
    • Once you accept Windows will go and create this folder and assign all the appropriate ACLs

    On the Mac Client 10.5

    What we need to do on the Mac client is bind it to both AD and OD.

    Active Directory

    • Login as a the local admin user
    • Open Applications/Utilities/Directory Utility.app
    • Click on “Services” and then double click “Active Directory”
    • Expand the Show Advanced Options arrow and disable “Force local home directory on startup disk”
    • Now click on “Directory Servers” and click on “+”
    • From the drop down select “Active Directory” and type the name of the DC
    • Enter the computer ID and AD username/password and click join.
    • If this fails then try clicking on Services and double click on Active Directory
    • Type in the domain and client ID here and click “Bind”

    Open Directory

    • Open Applications/Utilities/Directory Utility.app
    • Click “+” and select “Open Directory” from the drop down menu
    • Type in the name of the ODM
    • The computer should ask you for the OD diradmin password and client ID. Type in the same ID as you did for the Windows box (for consistency’s sake)

    Now you should have two directory servers listed in the Directory Utility both with green lights.

    You should now have a working Magic Triangle. The user and group accounts come from Active Directory and their home folders come from a Windows back File Server. We can now use WGM to introduce things like Portable Home Directories and MCX records. Yay!

    Portable Home Directories

    • Open WGM (WorkGroup Manager) and authenticate as diradmin
    • Create a new group called “Mobility” we’re going to use this group to designate PHD users.
    • Under the members tab click on the Plus sign, a side bar should appear.
    • At the top of the side bar will be a text string like “Directory: /LDAPv3/127.0.0.1” click on this and change it to “/Active Directory/All Domains”
    • Wait up to a couple minutes and you will start to see users from Active Directory appears. You can drag these users into the members pane of WGM. AFAIK you can also embed AD groups although I’ve never tried this.
    • Now we have an OD group with an AD user member as well as a computer record from the mac client.
    • Let’s click on Preferences for the mobility group and then click on “Mobility” under Overview tab.
    • Under account creation tab click on “Always” and check “Create mobile account when user logs into network account” a
    • Then click on rules tab and select always for all three subtabs yet leave their default values. Except for checking on “Show status in menu bar” under “options” sub tab
    • Now try logging in with your AD account again and watch as the mac creates you a PHD and enables the HomeSync menu.

    If you have problems with this process then feel free to leave a comment with some contact info and I’ll try to get back to you and help. I’ll have another post coming up for you Windows Sysadmins on how to easily managed your mac clients with Group Policy. If you would like me to help you directly then please refer to my company website and use our contact form.

    Update: Please check out next post regarding the deployment of this solution: http://jordaneunson.com/2010/10/apple-magic-triangle-deployment-results/

    Update #2:I had a reader have trouble with this above procedure, we communicated for a while about his setup here: http://www.edugeek.net/forums/mac/72958-magic-triangle-permissions.html


    Snow Leopard Server and Linux client using LDAP and libpam-krb5

    Posted: May 24th, 2010 | Author: | Filed under: Kerberos, krb5, LDAP, Linux, Mac OS X Server, Snow Leopard | 1 Comment »

    This is an extension article to my previous article Open Directory, Kerberos, Single Sign On (SSO) and CentOS with SSH and Kerberized NFS Home Directories. I had some requests from different Linux users out there how to incorporate authentication for Linux flavours other than CentOS. For this example we’re going to use Debian Lenny with some Ubuntu 10.04 refs thrown in.

    Preperation – LDAP

    First download all the packages that we’ll need.
    Debian
    apt-get install nss_updatedb ldap-utils libpam-ldap libnss-ldap nscd
    Ubuntu
    apt-get install nss_updatedb ldap-utils libpam-ldap libnss-ldap nscd nslcd
    During the installation debconf should ask you some questions, here are my answers

    LDAP server Uniform Resource Identifier: ldap:/// (Note the "ldap://", NOT "ldapi://"!)
    Distinguished name of the search base: dc=foo,dc=bar
    LDAP version to use: 3
    Does the LDAP database require login? No
    Special LDAP privileges for root? No
    Make the configuration file readable/writeable by its owner only? No
    Make local root Database admin. No
    Does the LDAP database require login? No
    Local crypt to use when changing passwords. crypt

    If you’re not on Debian you can edit these options in the file /etc/ldap/ldap.conf and /etc/libnss-ldap.conf

    Next, edit /etc/nsswitch.conf and change

    passwd: compat
    groups: compat

    --to--

    passwd: files ldap
    groups: files ldap

    Now restart the nscd service ( and nslcd if you’re using Ubuntu 10.04 )

    Verify you can see the users via LDAP with the id or getent commands

    jordan@elm:/$ id jordan
    uid=1000(jordan) gid=100(users) groups=1001(ldap-admin),1022(fgstaff),1023(ssh-access),100(users)


    jordan@elm:/$ getent passwd | grep jordan
    jordan:x:1000:100:Jordan Eunson:/net/home/jordan:/bin/bash
    jordan@elm:/$

    Preperation – libpam-krb5

    Download and install the packages
    apt-get install krb5-config libpam-krb5

    Then edit your /etc/krb5.conf file. Now here what you *could* do is copy the one from you Mac. If you have a Mac client already bound to your Open Directory installation then open the file /Library/Preferences/edu.mit.Kerberos and copy and paste the content to /etc/krb5.conf

    Here is an example of mine for the realm FOO.BAR

    [libdefaults]
    default_realm = FOO.BAR
    [realms]
    FOO.BAR = {
    admin_server = od-master.foo.bar
    kdc = od-master.foo.bar
    }
    [domain_realm]
    .foo.bar = FOO.BAR
    foo.bar = FOO.BAR
    [logging]
    admin_server = FILE:/var/log/krb5kdc/kadmin.log
    kdc = FILE:/var/log/krb5kdc/kdc.log

    To test to see if this is working type the command kinit and see if we can get a ticket from the Kerberos Key Distribution Center


    bart:~ jordan$ kinit jeunson
    Please enter the password for jeunson@FOO.BAR:
    bart:~ jordan$ klist
    Kerberos 5 ticket cache: 'API:Initial default ccache'
    Default principal: jeunson@FOO.BAR

    Valid Starting Expires Service Principal
    05/24/10 16:30:35 05/25/10 02:29:14 krbtgt/FOO.BAR@FOO.BAR
    renew until 05/31/10 16:30:35

    bart:~ jordan$

    Kerberos Authentication

    Now that we have our Kerberos client working we can integrate the local system to LDAP for user lookup and Kerberos for passwords with PAM libraries.

    /etc/pam.d/common-account

    account sufficient pam_unix.so
    account required pam_krb5.so

    /etc/pam.d/common-auth

    auth sufficient pam_unix.so nullok_secure
    auth sufficient pam_krb5.so use_first_pass
    auth required pam_deny.so

    /etc/pam.d/common-session

    session required pam_unix.so
    #session required pam_mkhomedir.so skel=/etc/skel/ umask=0022
    session optional pam_krb5.so minimum_uid=1000

    Now try to login to your Linux client either on the console to see if it works. To finish up with Kerberizing the client please read this article