[SOLVED] Pam + krb5 + samba

mfoley · 09-29-2016, 12:08 AM

bassmadrigal/ivandi, thanks for that info.

Now, an actual problem: I can log into the lightdm/KDE desktop with Domain credentials just fine, and can use the Settings > Account Details > Change Password, to change the domain password. Works great.

Not working: I "locked" the screen, got a dialog asking for password to unlock it. Nothing I typed in worked. That module is apparently not pamified. Is something specific to KDE (which, I supposed is not build with PAM)? Is there a fix?

ivandi · 09-29-2016, 07:47 AM

Code:

dm-tool lock

Cheers

mfoley · 09-29-2016, 10:38 AM

Quote:

Originally Posted by ivandi

Code:

dm-tool lock

The man page for that says, "dm-tool is a tool to communicate with the LightDM display manager ... lock Lock the current seat. This will switch to a greeter with a hint that the screen is locked. You can return to this session by authenticating in the greeter."

The problem here is a) the screen is already locked, the trick is to get it unlocked; and b) I believe this "session has been locked" window is put up by KDE, not lightDM (lightDM is PAMified).

I can think of 2 approaches: 1) PAMify KDE. 2) find the module that does the "session had been locked" dialog and replace that with e.g. a YAD script that uses samba-tool to authenticate. The latter is essentially what Roland Penny did for Ubuntu domain password changing. I'll investigate this approach since it seems simpler (to me) than PAMifying KDE -- provided the locking dialog is isolated in some easily replaced module.

ivandi · 09-29-2016, 06:23 PM

Just replace /usr/lib64/kde4/libexec/kscreenlocker_greet by a script that excutes "dm-tool lock":

Code:

#!/bin/sh

exec dm-tool lock

For example:

Code:

cd /usr/lib64/kde4/libexec

mv kscreenlocker_greet kscreenlocker_greet.kde

cat > kscreenlocker_greet << EOF
#!/bin/sh

exec dm-tool lock
EOF

chmod +x kscreenlocker_greet

Cheers

mfoley · 09-30-2016, 04:13 PM

Ah! Excellent! I've been searching and posting messages looking for the location of that kscreenlocker_greet module. Thanks (another) million. I'll play with that as soon as I get back in front of my test computer.

In anticipation ...

the manpage for `dm-tool lock` says, "Lock the current seat. This will switch to a greeter with a hint that the screen is locked. You can return to this session by authenticating in the greeter."

I'll check what you've posted and see if it's there, but I'll need to modify the module that does the authenticating.

mfoley · 09-30-2016, 08:12 PM

Some progress ... I created the script /usr/lib64/kde4/libexec/kscreenlocker_greet

Code:

#!/bin/bash

yad --title="testing" --text="Enter something:" --entry --button "myButton"

exit 0

which does put up that dialog on the screen when Launcher > Leave > Lock, is clicked. So far so good. That means that /usr/lib64/kde4/libexec/kscreenlocker_greet is, in fact, the module run when doing the 'screen lock' bit.

However, I can enter nothing into the input field, nor can I click on the button. I can move the cursor all over, but neither keyboard nor mouse buttons are operational. These things do work if I run the yad manually in a Konsole window logged into KDE as the domain user.

If I replace the yad command with `sleep 20`. The keyboard and mouse keys are hung for 20 seconds, but I still can move the cursor all over.

So, any ideas how I can give control to the yad program for keyboard/mouse input in this case?

mfoley · 10-01-2016, 01:17 AM

yad has a parameter "--parent-win=XID" which is described as, "Specify a parent window for the dialog. This makes YAD possible to use as embedded GUI tool." Might be worth experimenting to see if my yad dialog gets the focus.

But how do I find my XID?

ivandi · 10-01-2016, 10:20 PM

mfoley, I gave up on KDE long ago and if I remember well I have never used yad.

SlackMATE is a consistent PAMified and Kerberized desktop/server on top of the Slackware64-14.2 core. You could give it a try or go your own way.

Cheers

kjhambrick · 10-02-2016, 07:04 AM

mfoley --

Sorry about my absence -- been out of town for work.

Where did you get yad ?

Did it come from SBo or did you build it via ( configure && make && make install ) ?

OTOH, since you're working with KDE, maybe the native KDialog will do the same thing as you're trying to do with yad ?

Potentially {?} useful links:

Zenity-and-KDialog ( may be useful because yad is a fork of zenity )
KDialog Examples
yad SlackBuild
yad Examples

HTH

-- kjh( playing catch-up again )

kjhambrick · 10-02-2016, 10:20 AM

mfoley --

On second thought, the symptoms you describe with your yad script may be because the screen is locked so you cannot type or click or do anything else in the yad dialog while the screen is locked ...

Catch 22.

There are some links out on google concerning unlocking a KDE session remotely.

Here is One That Is Said to Work for Some Versions of KDE ( Ubuntu )

But that would require that you unlock the screen before invoking the yad dialog ( ? does not sound secure ? ) and then it would still leave the task of Authenticating an AD User's Password after they type 'something' into the yad or KDialog Box ...

Another Catch 22 ...

All the hits for 'check password from command line' that I found on google involved re-hashing whatever password the user entered and then comparing the computed hash to the record in /etc/shadow.

No joy since AD users are not in /etc/shadow.

Maybe ivandi's PAM-enabled light-dm-greeter could be used ? ... I dunno ...

You might be able to do something clever and SECURE with ivandi's sudo ( which is PAM-enabled ) ? ... I dunno that either ...

But I wonder if after all is said and done, the only proper solution will be to rebuild KDE with Pat's KDE SlackBuild Scripts on a PAM-enabled system ( see http://www.linuxquestions.org/questi...8/#post5612717 ) ?

-- kjh

ivandi · 10-02-2016, 07:51 PM

I have three screenshots here:

CL1 (SlackMATE)
User: Administrator

A document is opened in LibreOffice. The document is in a shared folder Share.

CL2 (SlackMATE)
User: Administrator

The user is connected to the shared folder on CL1 and tries to open the same document.
As you can see the user is warned that the document is already locked.

SLACK (PAMified Slackware running KDE and LibreOffice from Alien Bob)
User: Administrator

The user is connected to the shared folder on CL1 and tries to open the same document.
As you can see the user receives a copy (2013_0_test.odt) of the file without any warning that the same document is already locked/edited.

Cheers

mfoley · 10-03-2016, 10:44 AM

Ivandi - SlackMATE might very well work better, but my project involve migrating (actually, coaxing) people away from Windows to something more secure. KDE was chosen because it can be made to look virtually identical to Windows 7 -- the idea is the inflict the least apparent change as possible on humans reluctant to change.

kjhambrick: I got YAD from the Slackbuilds repo, but as you concluded, the keyboard is locked before YAD runs, so that approach isn't going to work.

I was not able to get Ivandi's suggestion working to replace the standard kscreenlocker_greet with a same-named script having `exec dm-tool lock`. It does appear that the lightdm-gtk-greeter runs, but I can't see it on my desktop -- possibly it is running in the "background"?

My current solution is posted in the thread http://www.linuxquestions.org/questi...ml#post5613045, wherein I replace the kcheckpass program with a script to snag the entered password, then do AD Authentication via ntlm_auth.

kjhambrick · 10-03-2016, 01:25 PM

Quote:

Originally Posted by ivandi

I have three screenshots here:

CL1 (SlackMATE)
User: Administrator

A document is opened in LibreOffice. The document is in a shared folder Share.

CL2 (SlackMATE)
User: Administrator

The user is connected to the shared folder on CL1 and tries to open the same document.
As you can see the user is warned that the document is already locked.

SLACK (PAMified Slackware running KDE and LibreOffice from Alien Bob)
User: Administrator

The user is connected to the shared folder on CL1 and tries to open the same document.
As you can see the user receives a copy (2013_0_test.odt) of the file without any warning that the same document is already locked/edited.
Cheers

Thanks ivandi.

I've done some tests on my main, non-PAM-enabled laptop ( Slackware64-14.2 + Multilib ) and I see somewhat odd behaviour with Alien Bob's LibreOffice there as well.

1. open two terminals ( aka konsoles ), both logged in as me ( konrad ).
2. start libreoffice --writer in terminal 1 on 'any writer file'
3. start libreoffice --writer in terminal 2 on the same writer file.

I instantly lose the first session and the second session takes over without warning that the file is already open.

I need to test further ( different users, etc ) but IMO, this is very odd ???

-- kjh

ivandi · 10-03-2016, 01:54 PM

Quote:

Originally Posted by mfoley

KDE was chosen because it can be made to look virtually identical to Windows 7 -- the idea is the inflict the least apparent change as possible on humans reluctant to change.

I see.

Well, I think it will be easier to recompile kde-workspace. Lets try something like this:

Code:

mkdir -p /home/source/kde

lftp -e "mirror --delete --only-newer --verbose /.2/slackware/slackware64-14.2/source/kde /home/source/kde ; quit" ftp://ftp.osuosl.org

cd /home/source/kde

chmod +x ./KDE.SlackBuild
./KDE.SlackBuild kdebase:kde-workspace

upgradepkg --reinstall /tmp/kde-build/kde-workspace/*.txz

And create some configs for PAM:

/etc/pam.d/kde

Code:

auth		required	pam_access.so
auth		required	pam_shells.so
auth		required	pam_env.so
auth		include		system-auth

account		required	pam_nologin.so
account		required	pam_time.so
account		include		system-auth

session		required	pam_loginuid.so
session		required	pam_limits.so
session		optional	pam_umask.so
session		include		system-auth

password	include		system-auth

/etc/pam.d/kde-np

Code:

auth		required	pam_access.so
auth		required	pam_shells.so
auth		required	pam_env.so
auth		required	pam_permit.so

account		required	pam_nologin.so
account		required	pam_time.so
account		include		system-auth

session		required	pam_loginuid.so
session		required	pam_limits.so
session		optional	pam_umask.so
session		include		system-auth

password	required	pam_deny.so

/etc/pam.d/kscreensaver

Code:

auth		required	pam_shells.so
auth		include		system-auth

account		required	pam_nologin.so
account		required	pam_time.so
account		include		system-auth

/etc/pam.d/kcheckpass

Code:

auth		required	pam_access.so
auth		required	pam_shells.so
auth		include		system-auth

account		required	pam_nologin.so
account		required	pam_time.so
account		include		system-auth

Cheers

ivandi · 10-03-2016, 08:43 PM

kde-workspace-4.11.22-x86_64-1_pam.txz

And the slackbuild.

Works fine.

Cheers