安全方案应用一：FC6下OpenLDAP+SASL+Kerberos配置说明

前言

　　在开发国家商用密码研究中心的业务管理系统时客户要求使用ekey认证和进行数字签名。国家商用密码研究中心在国家PKI体系中扮演着根CA角色，朗华借着这个机会不断向客户请教相关知识，同时发现朗华作为一个小型应用服务商，深感安全应用的门槛过高。为了有效推动安全方案的普及，根据朗华在开发中积累的浅薄经验，以开源系统为例，整理了本系列文章。如有错漏，敬请原谅。

应用背景

　　在开发中，客户常常提出单点登录的需求。这种单点登录不但要考虑Web等应用，还要满足操作系统用户的单点登录，以及对用户自己的数据进行加密存储等，因此需要一个把安全应用的开发建立在一个完整的安全体系之上。安全体系可以分为公钥体系(PKI)和私钥体系两类。

FC6下OpenLDAP+SASL+Kerberos配置

　　与OpenLDAP+SASL+Kerberos类似的商业系统是微软的Active Directory等。Kerberos是私钥体系的一种协议。私钥体系较为简单，易于实施，个人感觉比较适合局域网应用。

第一步：FC6中的Kerberos 5配置

1. 配置DNS：
1.1. 编辑/etc/named.conf，增加langhua域和反向解析的配置：
zone "1.168.192.IN-ADDR.ARPA." IN {
type master;
file "192.168.1.db";
};

zone "langhua." IN {
type master;
file "named.langhua";
};


1.2 新建/var/named/named.langhua文件，内容如下：
$TTL 1H
@ SOA localhost. root.localhost. ( 2
3H
1H
1W
1H )
NS localhost.

auth IN 1H A 192.168.1.110
kerberos IN 1H A 192.168.1.110
ldap IN 1H A 192.168.1.110

_kerberos IN TXT "AUTH.LANGHUA"
_kerberos-master._udp IN SRV 0 0 88 kerberos
_kerberos-adm._tcp IN SRV 0 0 749 kerberos
_kpasswd._udp IN SRV 0 0 464 Kerberos

_kerberos._udp IN SRV 0 0 88 kerberos
_ldap._tcp.langhua IN SRV 0 0 389 ldap


1.3 新建/var/name/192.168.1.db文件，内容如下：
$TTL 1H
@ SOA localhost. root.localhost. ( 2
3H
1H
1W
1H )
NS localhost.
110 PTR auth.langhua.
110 PTR kerberos.langhua.
110 PTR ldap.langhua.

1.4 检查正向解析
运行：
nslookup auth.langhua
显示：
Server: 192.168.1.110
Address: 192.168.1.110#53

Name: auth.langhua
Address: 192.168.1.110

1.5 检查反向解析
运行：
dig -x 192.168.1.110
显示：
; <<>> DiG 9.3.4-P1 <<>> -x 192.168.1.110
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3829
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; QUESTION SECTION:
;110.1.168.192.in-addr.arpa. IN PTR

;; ANSWER SECTION:
110.1.168.192.in-addr.arpa. 3600 IN PTR auth.langhua.

;; AUTHORITY SECTION:
1.168.192.in-addr.arpa. 3600 IN NS localhost.

;; ADDITIONAL SECTION:
localhost. 86400 IN A 127.0.0.1
localhost. 86400 IN AAAA ::1

;; Query time: 1 msec
;; SERVER: 192.168.1.110#53(192.168.1.110)
;; WHEN: Thu Nov 29 04:53:02 2007
;; MSG SIZE rcvd: 137

如果域名解析有误，请重新配置直至正确。


2. 安装相应的Kerberos模块。

3. 配置/etc/krb5.conf
/etc/krb5.conf是Kerberos 5的配置入口。
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = AUTH.LANGHUA
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
forwardable = yes

[realms]
AUTH.LANGHUA = {
kdc = kerberos.langhua:88
admin_server = kerberos.langhua:749
default_domain = langhua
}

[domain_realm]
auth.langhua = AUTH.LANGHUA
.langhua = AUTH.LANGHUA

[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf

[appdefaults]
pam = {
debug = true
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}

4.Kerberos 5服务器端配置
4.1 创建数据库
kdb5_util create -s
这会在/var/kerberos/krb5kdc/目录下生成principal，principal.OK，principal.kadm5，principal.kadm5.lock文件，这些文件即是Kerberos的数据库文件。

4.2 在数据库中添加帐户
kadmin.local -q "addprinc [e-mail]"
kadmin.local -q "addprinc [e-mail]"
kadmin.local -q "addprinc host/[e-mail]"


如果遇到下面的错误，删除/var/kerberos/krb5kdc/下的数据库文件，重新执行4.1即可。
kadmin.local: Cannot find/read stored master key while initializing kadmin.local interface

4.3 配置kdc
编辑/var/kerberos/krb5kdc/kdc.conf，内容如下。这个文件是在/etc/krb5.conf的profile里配置的。
[kdcdefaults]
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
v4_mode = nopreauth

[realms]
AUTH.LANGHUA = {
master_key_type = des3-hmac-sha1
supported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal
}

4.4 配置Kerberos 5访问权限
编辑/var/kerberos/krb5kdc/kadm5.acl，内容如下。这个文件是在/var/kerberos/krb5kdc/kdc.conf中acl_file来配置的。
kadmin/[e-mail] *
[e-mail] *
host/[e-mail] *
*/*@AUTH.LANGHUA i

4.5 配置Kerberos 5的管理员密钥表
编辑/var/kerberos/krb5kdc/kadm5.keytab，内容如下。这个文件是在/var/kerberos/krb5kdc/kdc.conf中admin_keytab来配置的。
kadmin.local -q "ktadd -k /var/kerberos/krb5kdc/kadm5.keytab kadmin/admin"
kadmin.local -q "ktadd -k /var/kerberos/krb5kdc/kadm5.keytab kadmin/changepw"

参考资料：


4.6 配置域名和域的关系
编辑/etc/krb.realms，内容如下：
kerberos.langhua AUTH.LANGHUA
ldap.langhua AUTH.LANGHUA
auth.langhua AUTH.LANGHUA
.langhua AUTH.LANGHUA

4.7 配置域认证服务器
编辑/etc/krb.conf，内容如下：
AUTH.LANGHUA
AUTH.LANGHUA kerberos.langhua:88
AUTH.LANGHUA kerberos.langhua:749 admin server


5. 启动Kerberos 5服务
/etc/init.d/kadmin start
/etc/init.d/krb5kdc start

完成以上步骤后，服务端配置完成。下面验证服务器的配置是否成功：

6. 客户端应用
6.1 导出密钥
kadmin.local -q "ktadd -k /etc/krb5.keytab host/auth.langhua"
Ktelnetd、Krlogind和Krshd需要/etc/krb5.keytab来验证host/auth.langhua的身份。

6.2 制作本地缓存
kinit -k host/auth.langhua


6.2 浏览本地缓存
命令：klist
屏幕输出：
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: host/[e-mail]

Valid starting Expires Service principal
11/29/07 02:44:44 11/30/07 02:44:44 krbtgt/[e-mail]


Kerberos 4 ticket cache: /tmp/tkt0
klist: You have no tickets cached


6.4 检查密钥版本是否一致
运行：
kvno host/auth.langhua
显示：
host/[e-mail]: kvno = 5

运行：
klist -k /etc/krb5.keytab
显示：
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
5 host/[e-mail]
5 host/[e-mail]

kvno是数值，这里两个kvno的数值必须一致。如果不一致，重新执行上述步骤。

7. 启动ktelnetd, krlogind, krshd
7.1 编辑服务器上用户的~/.k5login
客户端需要建立Linux系统用户与Kerberos用户的对应关系，以root为例，编辑/root/.k5login，输入一行内容：
host/[e-mail]

7.2 启动相关服务
chkconfig klogin on
chkconfig kshell on
chkconfig eklogin on
chkconfig krb5-telnet on
/etc/init.d/xinetd restart

8. 验证host/auth.langhua的身份
运行：
krlogin 192.168.1.110 -k AUTH.LANGHUA
显示：
This rlogin session is encrypting all data transmissions.
Last login: Thu Nov 29 04:46:08 from auth.langhua
You have new mail.

运行：
telnet -x 192.168.1.110 -k AUTH.LANGHUA
Trying 192.168.1.110...
Connected to auth.langhua (192.168.1.110).
Escape character is '^]'.
Waiting for encryption to be negotiated...
[ Kerberos V5 accepts you as ``host/[e-mail]'' ]
done.
Last login: Thu Nov 29 04:46:23 from auth.langhua
You have new mail.

运行：
rsh 192.168.1.110 -k AUTH.LANGHUA
显示：
Last login: Thu Nov 29 04:47:00 from auth.langhua
You have new mail.

第二步：FC6中的Cyrus SASL GSSAPI配置

1. 安装与Cyrus SASL相关的rpm包

2. 添加名为ldap的服务用户
2.1 在Kerberos 5里添加ldap服务用户
kadmin.local -q "addprinc -randkey ldap/[e-mail]"

2.2 配置ldap服务用户的Kerberos权限
编辑/var/kerberos/krb5kdc/kadm5.acl，增加下面的配置
ldap/[e-mail] *

2.3 把ldap服务用户添加到客户端密钥表文件中
kadmin.local -q "ktadd -k /etc/krb5.keytab ldap/auth.langhua"

3. 添加一个test认证用户
3.1 在Kerberos 5里添加test认证用户
kadmin.local -q "addprinc [e-mail]"

3.2 把test认证用户添加到客户端密钥表文件中
kadmin.local -q "ktadd -k /etc/krb5.keytab test"

3.3 把test认证用户与客户端的用户关联
在这里是与root关联，编辑/root/.k5login，增加一行：
[e-mail]

4. 验证GSSAPI配置
4.1 可以在/usr/lib/sasl2下新建一个ldap.conf文件，其中ldap是服务用户名。如果没有这个文件，测试程序会使用缺省值。

4.2 运行样例服务程序
sasl2-sample-server -s ldap -m GSSAPI
屏幕输出：
trying 10, 1, 6
trying 2, 1, 6
bind: Address already in use

4.3 运行样例客户端程序
sasl2-sample-client -s ldap -m GSSAPI auth.langhua
屏幕输出：
receiving capability list... recv: {6}
GSSAPI
GSSAPI
please enter an authorization id:

输入test，回车后，屏幕输出：
send: {6}
GSSAPI
send: {1}
Y
send: {525}
`[82][2][9][6][9]*[86]H[86][F7][12][1][2][2][1][0]n[82][1][F8]0[82][1][F4][A0][3][2][1][5][A1][3][2][1][E]
[A2][7][3][5][0][0][0][0][A3][82][1][10]a[82][1][C]0[82][1][8][A0][3][2][1][5][A1][E][1B][C]AUTH.LANGHUA
[A2][1F]0[1D][A0][3][2][1][3][A1][16]0[14][1B][4]ldap[1B][C]auth.langhua[A3][81][CF]0[81][CC][A0][3]
[2][1][10][A1][3][2][1][4][A2][81][BF][4][81][BC].[A3],FO[CC][12]P{r_l[D5][A1][9F][D9][7F][FF]A2[9C]
[E1][DB]KZ%[D9][83][AD][C5]j\[84][87][FD][EB][C9]]DGS[8C]%\[16][7F]&0[BC]r([BD][11][FF]v[EE]V[DD]
I[EA]E<[B8][B][1D]2[D4]>[CB]~1[FB][1]fC[1F]5[EA][CD][7][E7][DB][B9][B1][14]S[95]6?8Ea[F5]6[8A][BB]
[8D]V[B9][C1][A5][8][C2]LH,5[1A][BC]"[91]v[CC][B2][2]QJd}[97]V[A9]g[B5][F6][D0][C4][C9],![DF][F8][8E]
[A3][16][7][E5])N[E6][11] [8]+[85][FD][1B][11][C3][96][98][80]}g<[A3]5[1E][BC]si[8A]c9[8A][1A]w[13]
[1E][18][87]([98][E5][E7][89][85]W[AC]s[A5]v[D6]5v[80][A3][FA][A4][81][CA]0[81][C7][A0][3][2][1][10]
[A2][81][BF][4][81][BC][15]>[D6][CB]h[1B][9]Y[AC][C8]hh[F1]_[D4][82]GD[FD]4[AA]"$[EC][7F]&[B8][F]D
[7][97][82][D][A7][D][A2]9[8C][88][C0]-[DC][E6][A][EB]D6[1F][A4][E2][EE][D1][6]x[15][D1][EE]4d[86]
[84][99][16][AC][F5]C[E8][A9]u#[CE][C5][E1][9B]*[E8][B4][93]z[E9])[15][D]L/E[BD][E6]`[1F]_[F2][BC]
[1A][D7]1[BF][C1][2]O[8C][1D][A0][C]\[AB][8B][AB][F5][DB][D4][B1][ED][A][AF][9][B]s[E9][10][FB]u[11]
[E]N[1F]*[15][AE]h[F5][1C][8E][92][AA]6|0[F4][FE][CB][9A][9D]c^o4[CB][8C][B8][99][89][A5][18][EA]pE
[B1][C7][E8][90][82][EE][A6]([1A]1Q[D0][81]X[C6]q[9B][EA]v[C][FA][E9]jd
[84][BD][CF][90]S[8E]P
recv: {153}
`[81][96][6][9]*[86]H[86][F7][12][1][2][2][2][0]o[81][86]0[81][83][A0][3][2][1][5][A1][3][2][1][F][A2]w0u
[A0][3][2][1][10][A2]n[4]l[5],[B7][F6][CD][C][BF][1]{*[E0][1F][92][FC][10][94]U[DF][9E][BA]k_[A4]G&
[EC]g:[BA]J[C6][C1]sQ:'[87]/[95][C8]W[C5]^47N[9B]im`[BB][B4][C5][EB][BC]w[80][A7][1D]Q[89][8B]L
[8D]N[E7][87][C2][EB][D9]k{j[D][AD][A3]w[B1][A2][B3]X[FD]"[99]LG[88]^[DE][CD][ED][AC][F8][10]([FA]
h[2][B7]L[E2]K6[2][F5]C[91]u
send: {0}

recv: {65}
`?[6][9]*[86]H[86][F7][12][1][2][2][2][1][4][0][FF][FF][FF][FF][91]w[FA]J[96][9D]4[8F]Is[90][89][F][B2]
[BC]X[2].[C];[89][9A][3][F9][CF]DU[BA][98]x#[CF][FF]G[9E]:[1][0][0][0][4][4][4][4]
send: {73}
`G[6][9]*[86]H[86][F7][12][1][2][2][2][1][4][0][FF][FF][FF][FF][CB][9F]K[D1][81]m[E4][A2][A6][E2][C][7F]
a[8C][1B][A5][CC]m[E6][BB][E4][A4][9F]s[B5][F8][1F][D1][3]}[95][F1][5][C2]s[16][1][0][0][0]test[8][8][8]
[8][8][8][8][8]
successful authentication
closing connection

GSSAPI通过Kerberos 5验证成功。

第三步：FC6中的OpenLDAP GSSAPI Kerberos配置

1. 使用GSSAPI进行ldap查询，以确认所安装的OpenLDAP支持GSSAPI
ldapsearch -Y GSSAPI -b'o=langhua,c=cn' '(ou=worldwide)'
没有证书时，屏幕显示下列内容：
SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Local error (-2)
additional info: SASL(-1): generic failure: GSSAPI Error: Miscellaneous failure (No credentials cache found)
证书过期时，屏幕显示下列内容：
SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Local error (-2)
additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Ticket expired)

执行kinit -k test后再次执行，屏幕显示正确的查询结果：
SASL/GSSAPI authentication started
SASL username: [e-mail]
SASL SSF: 56
SASL installing layers
# extended LDIF
#
# LDAPv3
# base with scope subtree
# filter: (ou=worldwide)
# requesting: ALL
#

# worldwide, langhua, cn
dn:ou=worldwide,o=langhua,c=cn
objectClass: organizationalUnit
objectClass: top
ou: worldwide

# martin.peschke, worldwide, langhua, cn
dn:uid=martin.peschke,ou=worldwide,o=langhua,c=cn
uid: martin.peschke
ou: worldwide
objectClass: organizationalPerson
objectClass: uidObject
objectClass: person
objectClass: top
sn: Martin Peschke
cn: Martin Peschke

# search result
search: 4
result: 0 Success

# numResponses: 3
# numEntries: 2

2. GSSAPI用户的权限控制
把/etc/slapd.conf修改为如下内容
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/krb5-kdc.schema

# Allow LDAPv2 client connections. This is NOT the default.
allow bind_v2

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral ldap://root.openldap.org

pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args

# Load dynamic backend modules:
# modulepath /usr/lib/openldap
# moduleload back_bdb.la
# moduleload back_ldap.la
# moduleload back_ldbm.la
# moduleload back_passwd.la
# moduleload back_shell.la

# The next three lines allow use of TLS for encrypting connections using a
# dummy test certificate which you can generate by changing to
# /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on
# slapd.pem so that the ldap user or group can read it. Your client software
# may balk at self-signed certificates, however.
# TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
# TLSCertificateFile /etc/pki/tls/certs/slapd.pem
# TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem
# TLSCACertificateFile /etc/openldap/cacerts/server.pem
# TLSCertificateFile /etc/openldap/cacerts/server.pem
# TLSCertificateKeyFile /etc/openldap/cacerts/server.pem
TLSCACertificateFile /etc/pki/demoCA/cacert.pem
TLSCertificateFile /etc/pki/demoCA/ldapcert.pem
TLSCertificateKeyFile /etc/pki/demoCA/ldapreq.pem
TLSVerifyClient demand


# Sample security restrictions
# Require integrity protection (prevent hijacking)
# Require 112-bit (3DES or better) encryption for updates
# Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64

# disallow bind_simple

# Sample access control policy:
# Root DSE: allow anyone to read it
# Subschema (sub)entry DSE: allow anyone to read it
# Other DSEs:
# Allow self write access
# Allow authenticated users read access
# Allow anonymous users to authenticate
# Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read

#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn. (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!
# access to * by * read

##################################################
# ldbm and/or bdb database definitions
##################################################

database bdb
suffix"o=langhua,c=cn"
#rootdn"uid=root,o=langhua,c=cn"
# Cleartext passwords, especially for the rootdn, should
# be avoided. See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
# rootpw {SSHA}mpfjTVX6cJ+oMgoB1wIjJ8HTR/2kyBga

# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory /var/lib/ldap

# Indices to maintain for this database
index objectClass eq,pres
index ou,cn,mail,surname,givenname eq,pres,sub
index uidNumber,gidNumber,loginShell eq,pres
index uid,memberUid eq,pres,sub
index nisMapName,nisMapEntry eq,pres,sub

# Replicas of this database
#replogfile /var/lib/ldap/openldap-master-replog
#replica host=ldap-1.example.com:389 starttls=critical
# bindmethod=sasl saslmech=GSSAPI
# authcId=host/[e-mail]


sasl-realm AUTH.LANGHUA
sasl-host auth.langhua

access to attrs=userPassword
by self write
bydn="uid=test,cn=auth.langhua,cn=gssapi,cn=auth" write
by anonymous auth
by * none
access to *
bydn="uid=test,cn=auth.langhua,cn=gssapi,cn=auth" write
by self write
by * read

3. 重新启动ldap

4. 使用JXplorer，选择gssapi登录
连接正常。由于当前用户是dn="uid=test,cn=auth.langhua,cn=gssapi,cn=auth"，所以有修改用户的权限。

使用gssapi方式后，不需要在/etc/slapd.conf填写rootdn和rootdn的密码了。

OpenLDAP + SASL + Kerberos认证方式配置完成。