topic Re: Limit non-samba access using Winbind? in Operating System - HP-UX

Limit non-samba access using Winbind?

George A Bodnar — Fri, 24 Mar 2006 11:03:49 GMT

Trying to find the best way to implement Samba in our environment.

Using Active Directory integration and Winbind I can control access to the specific shares we want to create by using the Active Directory groups to limit access.

Since doing this requires adding winbind into nsswitch for passwd and group my question becomes ... what is the easiest/safest way to NOT compromise security on the server.

Specifically we only want a defined set of users (i.e. the ones with local accounts for now) to have access to the server via telnet, ftp, etc.

For Linux PAM is more granular and I can think of some ways to do this, but am not sure how this translates to HP-UX.

Anyone else dealing with this and suggestions on how to get around?

Re: Limit non-samba access using Winbind?

Ivan Ferreira — Fri, 24 Mar 2006 11:22:58 GMT

I believe that the:

template shell = /bin/false

Parameter in the smb.conf file may help. If this shell is not known by the ftp server, ftp session will also be refused.

Re: Limit non-samba access using Winbind?

George A Bodnar — Fri, 24 Mar 2006 12:57:04 GMT

I thought of the "dummy" shell too, but looking to see if there is a more elegant way to do this.

Re: Limit non-samba access using Winbind?

eric roseme — Fri, 24 Mar 2006 13:49:27 GMT

Hi George,

Most of the time I get the opposite question: How can I allow HP-UX logon/InetSvcs access using winbind, and the answer is that you cannot unless using pam_winbind, which we are not delivering with HP CIFS Server (yet). But you can always compile Opensource Samba --with-pam_winbind and do-it-yourself.

So for your question, you cannot get logon/InetSvcs access without a PAM module for winbind (which we do not have), and then configure it in pam.conf. For nsswitch, the current winbind entries are just for the UID/GID lookup for getpwent. I believe that "template shell" is intended for pam_winbind usage.

On a related note, when addressing this issue for unified login users (using the same LDAP/ADS user container for both HP-UX logon/InetSvc *and* CIFS/Samba) I recommend just setting the RFC 2307 attribute loginShell to /bin/false, or using pam_authz.

Eric Roseme

Re: Limit non-samba access using Winbind?

George A Bodnar — Fri, 24 Mar 2006 14:27:06 GMT

Excellent - my ignorance was the answer :)

That makes perfect sense - if the PAM modules aren't changed access isn't modified.

I'm not as familiar with the HP setup for pam vs. Linux but looking now I do see it just says libpam_unix

Thank you