[SOLVED] Slackware + Samba + AD

xj25vm · 04-14-2022, 07:18 AM

This is to help anyone who might hit the same issue. It looks like some time in the past year or so Slackware has changed from compiling Samba with internal Heimdal kerberos support to compiling against external MIT kerberos libraries (at least it looks like that, please correct me if I am wrong). If doing a Slackware upgrade on an existing Samba box already configured with Active Directory mode, this breaks Samba and at least for me, it took a whole morning to figure out how or why. To fix this you need to migrate the Samba AD config from Heimdal to MIT kerberos using the instructions below:

https://wiki.samba.org/index.php/Run...he_Heimdal_KDC

Notes:

1. Follow the instructions carefully and amend the kdc.conf file correctly - not like I did the first time around :-\

2. The kerberos daemon (/etc/rc.d/rc.krb5dc) does not need and should not be started separately for Samba to work.

Searching the net for "slackware samba heimdal mit kerberos" or similar combinations didn't return anything specific or of much use for me - hence I thought I would post this info here.

Good luck! :-)

rkelsen · 04-14-2022, 10:07 PM

This extract from the Slackware Changelog explains it:

Code:

Fri Jul 14 22:11:58 UTC 2017
...
n/samba-4.6.6-x86_64-1.txz:  Upgraded.
  This update fixes an authentication validation bypass security issue:
  "Orpheus' Lyre mutual authentication validation bypass"
  All versions of Samba from 4.0.0 onwards using embedded Heimdal
  Kerberos are vulnerable to a man-in-the-middle attack impersonating
  a trusted server, who may gain elevated access to the domain by
  returning malicious replication or authorization data.
  Samba binaries built against MIT Kerberos are not vulnerable.
  For more information, see:
    https://www.samba.org/samba/security/CVE-2017-11103.html
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11103
  (* Security fix *)
...

This change was made between the 14.2 and 15.0 releases.

Good thing too, by the looks of it.