1 Notes on using Moonshot with Samba4. Replace paths as appropriate.
6 * Download Samba4 and apply patches for mechanism agnosticism
7 * Join Samba as a member server or domain controller (only tested former)
8 * Extract local service principal key to keytab (currently there do not
9 appear to be tools to do this, but you can get the cleartext password
10 from /usr/local/samba/private/secrets.ldb)
15 * Add a mapping from the PAC RADIUS attribute to urn:mspac: in the file
16 /usr/local/etc/shibboleth/attribute-map.xml:
18 <GSSAPIAttribute name="urn:ietf:params:gss-eap:radius-avp urn:x-radius:1679163525"
19 id="urn:mspac:" binary="true"/>
24 Install the rlm_mspac module and configure per below.
26 * Install dictionary.ukerna so MS-Windows-Auth-Data is defined
27 * Create /usr/local/etc/raddb/modules/mspac with the following:
30 keytab = /etc/krb5.keytab
31 spn = host/host.fqdn@KERBEROS.REALM
34 * Add mspac to instantiate stanza in radiusd.conf
35 * Add mspac to post-auth stanza in sites-enabled/inner-tunnel
37 You will need to have a TGT for the host service principal before starting
38 radiusd. It's easiest to do this with kinit -k.
43 The Samba server doesn't require any specific command line arguments, although
44 on OS X it was necessary to start it with -M single to function under gdb.
46 For the client, the GSS EAP mechanism can be specified on the command line:
48 smbclient --password samba --mechanism 1.3.6.1.4.1.5322.22.1.18 '\\host\share'".
50 There is no Moonshot SSPI implementation as yet, so it is not possible to test
51 with a Windows client.