Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Samba 4 Technology Preview Released

ScuttleMonkey posted more than 8 years ago | from the it-may-eat-your-cat dept.

Software 167

daria42 writes "Samba creator Andrew Tridgell has officially released a technology preview of Samba 4 at the Linux.conf.au conference in New Zealand, ending a three-year wait for users. But wait before upgrading those servers. 'It may eat your cat,' says the Samba team in a statement, 'but is far more likely to choose to munch on your password database.'" From the article: "'Samba 4 supports the server-side of the Active Directory logon environment used by Windows 2000 and later, so we can do full domain join and domain logon operations with these clients,' the group said in a statement on its Web site, noting this feature was 'the main emphasis' for the new software."

cancel ×

167 comments

fp (-1, Offtopic)

Anonymous Coward | more than 8 years ago | (#14556203)

fp

I dislike the new slashdot layout. (1)

Fecal Troll Matter (445929) | more than 8 years ago | (#14556209)

I dislike change. Fix it.

Jeremy Allison on Samba 4 (5, Informative)

Anonymous Coward | more than 8 years ago | (#14556205)

Came across this (short but interesting) interview with Jeremy Allison, one of the project's lead developers, where he talks about Samba 4:

http://www.linuxformat.co.uk/modules.php?op=modloa d&name=News&file=article&sid=217 [linuxformat.co.uk]

Any software that has a 'Susan Stage' has got to be cool :-)

Re:Jeremy Allison on Samba 4 (3, Informative)

laptop006 (37721) | more than 8 years ago | (#14556238)

Erm, he's not a major developer of samba 4, Tridge is, Andrew Bartlett is, and a few others are, but Jeremy isn't (at least according to Andrew Bartlett yesterday).

I'm at LCA2006 and have spent several hours with both Tridge and Andrew Bartlett, testing, fixing bugs, and identifing missing features of samba4. I'm not a samba team member, just a sys-admin who wants samba4 to be the best code possible before I deploy it.

Re:Jeremy Allison on Samba 4 (0)

Anonymous Coward | more than 8 years ago | (#14556749)

I think you'll find Jeremy Allison is a "core" Samba team member.

He is often referred to as joint leader or co-founder etc. on the web,
but I don't think it goes quite that far.

I believe Tridge does consider him his right hand man though, but I
can't find a link to back that up.

Definitely he features highly on the samba website and cvs logs.

Re:Jeremy Allison on Samba 4 (5, Interesting)

node 3 (115640) | more than 8 years ago | (#14556428)

There's a very interesting quote at the end of that article:
"Let's be honest, we don't really care about selling it, we're just having fun doing it. So long as we're having fun and we're working on problems that interest us then other people can worry about market share and how you sell it to the government or whoever, because that's the stuff that interests them."

If you think about it for a minute, if you consider how Open Source functions, where people work on the things that interest them, the "suits" that are often derided from some quarters are just filling a non-technical need in the Open Source community. There are often calls for people to test, write manuals, and create artwork as something they can do if they aren't programmers, but perhaps "marketing, sales, build corporations" are things that also should be added to that list?

To clarify, I'm certainly not talking about the CherryOS-style GPL-theives, but honest and earnest businesspeople (even though their motives may be primarily cash, they still must abide by proper Open Source rules).

Anyway, thought it was interesting.

Re:Jeremy Allison on Samba 4 (3, Insightful)

smitty_one_each (243267) | more than 8 years ago | (#14556693)

where people work on the things that interest them
Let's not kid ourselves: this is the good news/bad news of FOSS.
The genius of proprietary software: getting you to trade your sovreignty for code that does a lot of the less interesting stuff.
Unless you're actually selling that printer, are you going to want to spend all day writing a driver for it, much less testing it against a bazillion OS's?

Re:Jeremy Allison on Samba 4 (0)

Anonymous Coward | more than 8 years ago | (#14557029)

No, people might write drivers for their own printers, and printer manufacturers might
write drivers for their printers as well.

_That_ is "the good news / bad news of FOSS".

Re:Jeremy Allison on Samba 4 (2, Insightful)

smitty_one_each (243267) | more than 8 years ago | (#14557402)

Oh, come on: how many people, seriously, are going to write printer drivers?
Sure, there may be a generic project that dumps courier on paper, and mostly gets the margins right.
But the annoyance of getting it RIGHT across a variety of printers/operating systems could lead to madness [planetmirror.com]

Re:Jeremy Allison on Samba 4 (3, Interesting)

DocLandolt (920512) | more than 8 years ago | (#14557155)

"even though their motives may be primarily cash, they still must abide by proper Open Source rules"

Just out of curiosity, what are these? Not 'all' rules -- but does anybody know (or offer wild speculation on) what happens when open source and fat wads of cash collide?

For true emulation.... (-1, Flamebait)

ehaggis (879721) | more than 8 years ago | (#14556218)

Can it attract viruses? Does it come with a BSOD? Will it generate flamebait comments like this on Slashdot? Inquiring minds want to know.

It may eat my cat...? (-1, Offtopic)

Anonymous Coward | more than 8 years ago | (#14556223)

Pah, I won't give you my cat. Eat my shorts!

What Kind of Passwords Does It Prefer? (3, Funny)

gurutc (613652) | more than 8 years ago | (#14556232)

Smooth or Crunchy?

Re:Smooth or Cruchy (0, Redundant)

Jeremy Singer (717636) | more than 8 years ago | (#14556421)

It tastes like chicken.

Re:What Kind of Passwords Does It Prefer? (0, Redundant)

Anonymous Coward | more than 8 years ago | (#14556503)

Neither. It prefers salted.

Re:What Kind of Passwords Does It Prefer? (4, Funny)

DeadRoman (753427) | more than 8 years ago | (#14556956)

I was going to say that it likes them hashed.

Just Work (TM) (4, Insightful)

ObsessiveMathsFreak (773371) | more than 8 years ago | (#14556242)

But can I make an anonymous read/write share without performing invasive surery on config files. And can I then easily mount that share?

Samba is great as a home network share, but it's not a single click system. Security on a home netowrk doesn't really interest me. I'd like to be able to "just share" the files without setting up users etc, etc.

Re:Just Work (TM) (5, Funny)

tpgp (48001) | more than 8 years ago | (#14556299)

Security on a home netowrk doesn't really interest me.

I know - thats why I'm posting this from your home PC.

I'd like to be able to "just share" the files without setting up users etc, etc.

Just post your requirements here I'll set them up for you... after all I don't want your home net to be locked down ;-)

Seriously - just because you would like software to be shipped insecure (and easy) by default doesn't mean that it should be. Have a look at this guide - Samba-3: A Simple Anonymous Read-Write Server [informit.com]

Re:Just Work (TM) (4, Interesting)

Pecisk (688001) | more than 8 years ago | (#14556492)

What he meant there should be definetly easy way to turn it on, of course, with warning that some security problems could arise. AFAIK, KDE and GNOME has both easy ways to create shares for now, but there is no way to configure SAMBA for just several default scenarios which could be - anonymous read-only, anonymous read-write, user-based read-only, user-based read-write, custom. Default could be user-based read-only. Or something like that.

For example, OS X Tiger server uses SAMBA for Windows support. Any mangling with configuration goes trough Server Admin GUI (you can mess with configuration file too), but any changes gets written back to standard smb.conf.

It could be very good and nice present for common crowd.

Re:Just Work (TM) (3, Informative)

HoosierPeschke (887362) | more than 8 years ago | (#14556668)

Easy... as in SWAT? [samba.org]

Re:Just Work (TM) (0)

Anonymous Coward | more than 8 years ago | (#14556302)

Use e.g. KDE where they've made it very easy to share files (just point and click as you're saying) while still maintaining high security.

Re:Just Work (TM) (1, Insightful)

Anonymous Coward | more than 8 years ago | (#14556341)

Samba isn't meant to provide a friendly user interface, it's meant to do the bit that makes it all work. Look to your desktop environment to provide a nice, friendly interface. And whaddaya know, KDE does it just fine.

Re:Just Work (TM) (2, Informative)

rpbailey1642 (766298) | more than 8 years ago | (#14556368)

Well, granted I did have to set up the config file, but it wasn't too terribly difficult:
[global]
workgroup = WORKGROUP
server string = Description of Server
security = share

( Rpbailey Notes: This might be where you were led astray. You probably had samba set to use passwords instead of share security. )

[Multimedia]
path = /usr/multimedia
writable = yes
comment = Multimedia
browseable = yes
public = yes
---
Just make sure that the directory in question is writable by your samba user (assuming you have a user that samba runs as) or is otherwise writable. The most "playing around" you have to do is with permissions on that one folder.

Good luck!

Re:Just Work (TM) (0)

Anonymous Coward | more than 8 years ago | (#14556682)

You're right; the biggest problem most people seem to have with Samba is understanding user v's share security. Synonyms such as "public" (guest ok) don't really help matters either; any newbie searching Google for examples or HOWTOs may find themselves looking at several different configuration files that do exactly the same thing, leaving many of them trying to work out how.

Better PAM integration (instead of having to use smbpasswd) and a configuration format that can either be streamed or an extended libsamba API that allows configuration tools to modify smb.conf as well as reading would help improve configuration tool, too.

Re:Just Work (TM) (2, Interesting)

zerocool^ (112121) | more than 8 years ago | (#14556374)


That's exactly what I thought. Samba is for network shares in a relatively simple environment. Authentication via Windows domain could be accomplished with more stability with Kerbeos / LDAP. It's what we do with our lab machines.

And I would much prefer to use samba to share out my oggs and mp3s without needing a volcano and a goat.

~Will

Re:Just Work (TM) (0)

Anonymous Coward | more than 8 years ago | (#14556854)

And I would much prefer to use samba to share out my oggs and mp3s without needing a volcano and a goat.

A Will Dunn goat? To fuck? With a volcano?

Re:Just Work (TM) (1)

ettlz (639203) | more than 8 years ago | (#14556416)

Just use SSH.

Re:Just Work (TM) (0)

Anonymous Coward | more than 8 years ago | (#14556420)

Security on a home netowrk doesn't really interest me.

If your home network is connected to the internet, it should.

Re:Just Work (TM) (1)

dan the person (93490) | more than 8 years ago | (#14556652)

mark the share as "guest only" then give the guest user ( usually the user nobody ) full rights to the shared directory.

Re:Just Work (TM) (1)

DrSkwid (118965) | more than 8 years ago | (#14557058)

http://www.faqs.org/rfcs/rfc959.html [faqs.org] File Transfer Protocol

http://www.ccp14.ac.uk/ccp14admin/security/secure_ tunnelling_ftp.htm [ccp14.ac.uk]
Secure FTP transfers via Secure Shell Tunnelling

http://winscp.net/eng/docs/introduction [winscp.net]
WinSCP is an open source freeware SFTP client for Windows using SSH. Legacy SCP protocol is also supported. Its main function is safe copying of files between a local and a remote computer.

etc. etc.

Re:Just Work (TM) (1)

Chineseyes (691744) | more than 8 years ago | (#14557350)

While we are on the topic does anyone know if there is a way to access a directory via sftp in windows the same way you would in kde with fish://? Or at a bare minimum be able mount a remote directory via sftp and access it as a local drive??

it's in Debian (5, Informative)

CAPSLOCK2000 (27149) | more than 8 years ago | (#14556244)

Debian allready has packages.
Install them by running:
aptitude install -t experimental samba

But you'll need to add an entry for experimental to /etc/apt/sources.list first.
If you don't know how to, you shouldn't be messing with experimental software anyway.

Re:it's in Debian (3, Informative)

Thing 1 (178996) | more than 8 years ago | (#14556690)

"If you don't know how to breathe, you shouldn't bother taking your first breath."

Or, closer to the original: "Breathing. If you don't know how to, you shouldn't be messing with environmental oxygenation anyway."

Here's a link to a howto [debian.org] for configuring your Debian installation to use the experimental packages. (It's in section 4.6.4.3, or just search on the page for "experimental".)

Samba 4 (5, Informative)

YearOfTheDragon (527417) | more than 8 years ago | (#14556250)

There has been info about Samba 4 for some time. Andrew Bartlett [samba.org] wrote a year ago an interesting thesis about Samba 4 and Active Directory [samba.org] (PDF).

But the release of this TP is good news, I hope that the use of Microsoft's Active Directory as an authentication service for Linux systems [securityfocus.com] is coming to an end. All what we need now is a nice GUI [samba.org] .

Finally! (0, Troll)

Sircus (16869) | more than 8 years ago | (#14556251)

They've implemented the long awaited pussy-eating feature!

Re:Finally! (1)

gurutc (613652) | more than 8 years ago | (#14556349)

Finally, an Open Source Software Feature Set to help the love life of Geeks!

Simba was the cat, Samba is the dance (0, Interesting)

Anonymous Coward | more than 8 years ago | (#14556255)

Simba was the cat, Samba is the dance

Only 6 years (-1, Troll)

dJOEK (66178) | more than 8 years ago | (#14556282)

So, in 2006, Samba is finally able to do what windows was able in 2000?

Way to innovate, OSS community!

(Yes, i know i'm burning karma here. See if i care. you know that i'm right on this)

Re:Only 6 years (1)

OffTheLip (636691) | more than 8 years ago | (#14556308)

True but this if free as in beer and as in $0.

Re:Only 6 years (0)

Anonymous Coward | more than 8 years ago | (#14556444)

Wrong!, it's "``free'' as in ``free speech,'' not as in ``free beer.''" as described in The Free Software Definition [gnu.org] . There's a direct link to it on the samba site [samba.org] ;)

Re:Only 6 years (3, Informative)

RenatoRam (446720) | more than 8 years ago | (#14556309)

Actually, windows copied in 2000 what was available in other environments for many years. AD is the bastard son of ldap+kerberos+smb.

What took years is reverse-engineering all the weird quirks MS introduced in the previously standard systems.

Besides, Samba can do a lot nifty things AD can't, so who's behind?

Re:Only 6 years (1)

drsmithy (35869) | more than 8 years ago | (#14556807)

Actually, windows copied in 2000 what was available in other environments for many years. AD is the bastard son of ldap+kerberos+smb.

And,most importantly, made it trivially easy for most people to use.

Re:Only 6 years (2, Insightful)

RenatoRam (446720) | more than 8 years ago | (#14556924)

Trivially easy?
Do you manage many Active Directory servers?

The ones I know about (in a EU wide bank) are a mess, and require an entire team of people just to let them run. And even so it is very simple to screw them up.

Not counting the fact that AD is horridly delicate: un-join a machine from the domain for long enough, and you are done.

AD is NOT easy. Clicking on "Share this folder" might look so, but managing AD is not.

Re:Only 6 years (1)

4b696e67 (670803) | more than 8 years ago | (#14556316)

Actually I think its quite good concidering how they are doing all of it without looking at the windows source code. The linux NTFS driver is in a similar camp (implementing without access to the closed source).

Re:Only 6 years (1)

AntiDragon (930097) | more than 8 years ago | (#14556322)

Yes. Not bad going for reverse engineering a deliberatley obsfucated and poorly documented proprietary set of protocols plus an open standard security protocol that was subtley altered and therefore incompatible with other standard implementations. Yep. Pretty good job for something that was done completely voluntarily. Sheesh...

Re:Only 6 years (3, Insightful)

tpgp (48001) | more than 8 years ago | (#14556330)

So, in 2006, Samba is finally able to do what windows was able in 2000?

Five years to reverse engineer a difficult, obfuscated protocol is quite frankly amazing.

And you see - they don't really have to offer full compatability immediately - but if they do it before win2k ends its lifecycle, SAMBA + *nix offers companies dependant on AD a way out without having to go the win2k3 route.

Way to innovate, OSS community!

Way to troll dJOEK!

There is virtually no innovation in software, proprietary or OSS - everyone is just copying everyone elses ideas & making incremental improvements...

I mean we're all using the same desktop paradigm from 30 years ago - and the only substatial innovation I've seen in that is overlapping windows (from maybe 25 years ago)

Re:Only 6 years (2, Insightful)

SteveAyre (209812) | more than 8 years ago | (#14556477)

There's virtually no innovation in anything - we're all "standing on the shoulders of giants".

Re:Only 6 years (1)

Daytona955i (448665) | more than 8 years ago | (#14556887)

There's no innovation in OSS? Sure, maybe not on the desktop or with Samba but I certainly see it with Firefox. Firefox has had a lot of great things (like tabs) before IE does. In fact, IE is in a major state of catch up right now.

Re:Only 6 years (1)

tpgp (48001) | more than 8 years ago | (#14557266)

There's no innovation in OSS?

I should have said "There's no more innovation in proprietary software then OSS software (or vice versa)

Sure, maybe not on the desktop or with Samba but I certainly see it with Firefox. Firefox has had a lot of great things (like tabs) before IE does. In fact, IE is in a major state of catch up right now.

Interesting example - I think however you're in the wrong thread (you're looking for the Microsoft vs OSS innovation thread, this is the proprietary vs OSS innovation thread).

Firefox is mildly innovative, but the first browser (I think) that had tabs was Opera, and they borrowed them from other windowing software that used tabs, I think they first appeared in OS/2 as a minor innovation for preference dialogues.

So - you see, as Newtown (and someone else in this thread) pointed out: "If I have seen further [than certain other men] it is by standing upon the shoulders of giants." holds true for everyone.

Iironically, Newton probably borrowed & incrementally improved [aerospaceweb.org] upon earlier saying from others.

Re:Only 6 years (-1, Troll)

dJOEK (66178) | more than 8 years ago | (#14556897)

Five years to reverse engineer a difficult, obfuscated protocol is quite frankly amazing

Five years of poking a black box with a stick is such an immense waste of time that it's only possible in academic circles, and only applauded by free-hugging hippies that have spent those 5 years playing nethack to kill time, then go off ranting about how great and amazing an accomplishment Samba is.

If they focused their time, energy and skill on something that would integrate seamlessly with windows, unix and others, would be a breeze to set up and have more features, be free, faster and more secure, everybody would've used that, and they would've been done 3 years ago.

Re:Only 6 years (0)

Anonymous Coward | more than 8 years ago | (#14557384)

If they focused their time, energy and skill on something that would integrate seamlessly with windows, unix and others, would be a breeze to set up and have more features, be free, faster and more secure, everybody would've used that, and they would've been done 3 years ago.

No real reason for quoting, i just wanted everybody to see how much of an idiot you are twice in one go. Sort of like idioicy in dolby surround sound.

Re:Only 6 years (1)

malkavian (9512) | more than 8 years ago | (#14556346)

Yet Novell was able to do just the same in the early to mid 1990s, soundly beating Microsoft to that post (NDS, of which Active Directory is a poor ripoff).
And for the sharing of network filesystems, this was pegged in open release in 1985 by NFS. Which was on UNIX.
Yet again, Windows is late to the game in all aspects, playing catchup with the rest of the world.
Apart from Windows compatibility, which, for some older applications, it's currently almost as good as WINE and FreeDOS.
Not to knock Windows too much, it does what it was originally intended to do pretty well (i.e. be a desktop that people sit at and do work).

Re:Only 6 years (1)

frankm_slashdot (614772) | more than 8 years ago | (#14556545)

dude.. thats so out of line its not even funny. i dont know who you are or what groups you run with - but im stitting here at my windows desktop and im NOT doing any work. im reading slashdot and making funny comments. haha.

you know im just joking around =)

hah. later.

Indeed (1)

DrYak (748999) | more than 8 years ago | (#14556576)

Not to knock Windows too much, it does what it was originally intended to do pretty well (i.e. be a desktop that people sit at and do work).


Yes, it has managed to fulfil it's original intent to be a GUI inside which one could run a word processor or/and a spreadsheet app.
The scary thing is the incredible amount of other usages for which Microsoft is trying to push a product that *isn't* designed for.

Re:Only 6 years (4, Informative)

TallMatthew (919136) | more than 8 years ago | (#14556409)

So, in 2006, Samba is finally able to do what windows was able in 2000?

Um, no. LDAP and Kerberos weren't invented by Microsoft. They put the two together and called it Active Directory, straying away from the RFCs and throwing in all manner of tweaks that required extensive reverse engineering on the part of the Samba team to figure out. That means figuring out the protocol from the packets, which is an incredible feat, especially as Microsoft's protocol designs aren't easily discerned and contain all sorts of weird gotchas (purposefully).

There's a lot of complexity under that GUI of yours and, whether you want to believe it or not, Microsoft isn't such an innovative organization. Generally, they poach something that's already widely available and tweak it so it won't be interoperable with other systems. If you call that innovation, then I guess that speaks for itself.

Mod Parent Down, Not Up (1)

xeno314 (661565) | more than 8 years ago | (#14556627)

Um, no. LDAP and Kerberos weren't invented by Microsoft.

I don't see where he said that Microsoft invented anything, just that they did AD in 2000.

Re:Mod Parent Down, Not Up (0)

Anonymous Coward | more than 8 years ago | (#14557031)

thing is, if the samba team wanted to make their own revision of the protocol, they could. they're doing something much harder - figuring out what someone ELSE did.

Re:Only 6 years (1)

wetfeetl33t (935949) | more than 8 years ago | (#14556486)

Fine! Have fun spending $$$$$$$$ on Windows server. I'll just go ahead and pick up Samba 4 for free.

Re:Only 6 years (1)

DrSkwid (118965) | more than 8 years ago | (#14557078)

Let's not list all the things Windows can't do after 30 years

What is this samba you speak of? (4, Interesting)

squoozer (730327) | more than 8 years ago | (#14556287)

Since discovering the joys of NFS I've not looked back (yes I do know what samba is and I run a samba server). Compared to Samba, NFS is almost too simple and reliable. Give me my complixity and unreliablity back!

Re:What is this samba you speak of? (3, Interesting)

BenjyD (316700) | more than 8 years ago | (#14556403)

I'm not a sysadmin, but I never got how NFS prevented a user plugging a computer which they have root access on into the network, mounting a common NFS mount, "su"ing to somebody's UID and then deleting their files. AFAICS, SMB handles this by requiring credentials of some kind from the computer. Can anyone explain this?

Re:What is this samba you speak of? (5, Informative)

Spacelord (27899) | more than 8 years ago | (#14556471)

I'm not a sysadmin, but I never got how NFS prevented a user plugging a computer which they have root access on into the network, mounting a common NFS mount, "su"ing to somebody's UID and then deleting their files. AFAICS, SMB handles this by requiring credentials of some kind from the computer. Can anyone explain this?

"Authentication" with NFS is IP based. You grant access to NFS mounts by specifying which hosts can mount that share. This implies that the hosts you allow are trusted, and that your network is trusted as well. So yes, if a computer you have root access to has been granted read/write access to an NFS mount then you can just su to someone else's UID and delete their files on that NFS mount.

Is it a good idea to use NFS in a security sensitive environment? Probably not.

Re:What is this samba you speak of? (1)

squoozer (730327) | more than 8 years ago | (#14556473)

I believe it is done via root squashing. Unless you specifically allow it you can't do root like things on the NFS mounts (such as deleting arbitary files) even if you are root on your machine. I forget exactly how it works as I set up and forgot about my NFS system a while ago but I left root squash on and it trips me up now and then. Physical intruders (someone pluging a computer into the network) aren't something I particularly worry about as I have a large iron bar next to me to hit anyone breaking in to my house with.

How to lock down NFS in 5 lines or less (1)

mitcheli (894743) | more than 8 years ago | (#14556560)

A bit off topic, but good info anyways...

you'll want to set anon=-1 which will disable connection attempts that don't have a username associated to it, then you'll want to use the access option to limit what users can connect to the shares (obviously root wouldn't be on that list), then you'll want to use the nosuid and nosgid options to prevent suid scripts and such from stealing root. If you're running NIS+ you'll want to use the secure option too. And finally, you'll probably want to ensure that shared files are not world writable. But that's just me ;)

Re:What is this samba you speak of? (2, Informative)

StressedEd (308123) | more than 8 years ago | (#14556635)

The default behaviour is to not allow this. From the manual,
man -S 5 exports

              Very often, it is not desirable that the root user on a client machine
              is also treated as root when accessing files on the NFS server. To this
              end, uid 0 is normally mapped to a different id: the so-called anony-
              mous or nobody uid. This mode of operation (called 'root squashing') is
              the default, and can be turned off with no_root_squash.

Re:What is this samba you speak of? (3, Insightful)

BenjyD (316700) | more than 8 years ago | (#14556672)

That doesn't help when the root user creates a user account with the correct UID and then logs in as that user, does it?

Re:What is this samba you speak of? (2, Informative)

Professor_UNIX (867045) | more than 8 years ago | (#14556845)

That doesn't help when the root user creates a user account with the correct UID and then logs in as that user, does it?

Nope. That's how I used to update some web files on a central NFS server here long after the person left. I just added an account with his UID on my workstation, mounted the central NFS server's web share and voila. I could read/write his files just fine. Traditional NFS is HORRIBLE from a security standpoint since the only authentication involved is IP based and the only authorization is to rely on the UID/GID to prevent other users from munging with your files. This relies on only having trusted hosts having read/write access to your network. Newer versions of NFS add additional security mechanisms in place for both authentication and authorization, but they are rarely used from what I've seen since most people still use it the way NFS v2 behaved (relying on IP address and UID/GID) rather than Kerberos and certificates.

Re:What is this samba you speak of? (1)

StressedEd (308123) | more than 8 years ago | (#14557018)

Agreed.

In my opinion traditional NFS is not that secure, either against reading things "on the wire" or spoofing.

As another poster has mentioned you can export the filesystem on a client by client basis. As a "bad guy" you have to take over the identity of one of those trusted clients (steal the IP address). Tricky but not impossible.

The basic problem here is authenticating that the client really is the right client. IP addresses are not sufficient in this regard. For those that deem this necessary Secure NFS [ibm.com] is key. (excuse the DES pun).

For the extra paranoid you can even tunnel the connection [linuxsecurity.com] with SSH.

-ed

Re:What is this samba you speak of? (0, Flamebait)

kylegordon (159137) | more than 8 years ago | (#14556824)

You let unknown MAC addresses on your network? Oooh, let me come play...

Re:What is this samba you speak of? (1)

BenjyD (316700) | more than 8 years ago | (#14556858)

But MAC addresses can be spoofed too - just get the MAC of a trusted machine, unplug it from the network and plug in a laptop with the other machine's MAC set.

Re:What is this samba you speak of? (1)

scumbaguk (918201) | more than 8 years ago | (#14556866)

if you had physical access to the network, sniffing and then spoffing ip adds and mac adds' wouldn't be too dificult.

Re:What is this samba you speak of? (0)

Anonymous Coward | more than 8 years ago | (#14556840)

I'm not a sysadmin, but I never got how NFS prevented a user plugging a computer which they have root access on into the network, mounting a common NFS mount, "su"ing to somebody's UID and then deleting their files.

Easy. It's called "physical security", and consists (in this case) of the sysadmin and a 2x4, also known as "clue by four". Or in the case of a company, often "paper security" is used, where the above-mentioned scenario is prevented by your boss, a HR person, a piece of paper and the word "fired".

Joking aside, newer versions of NFS do have real user authentication, and from NFSv4 they are mandatory (can't be turned off).

NFS security (1)

kangasloth (114799) | more than 8 years ago | (#14557026)

There are two parts to the answer to that. Traditional NFS access control is entirely host based. You can map root on the remote computer to an unprivileged user or map an entire host to a single user, but that's about it. NFS was designed in an era where all of a network's computers were managed by the sysadmins, and you could reasonably trust the computers on your local net. That trust is now a liability for protocols like NFS and NIS.

The extended answer is that the underlying rpc protocol has long supported more sophisticated access control. AFAICT, the only one which is currently usable is RPCSEC_GSS, the kerberos security flavor. Sun solaris has had this for years, but it has only recently become usable with linux (and there are still some gotchas). The new NFS protocol in development, NFSv4, mandates this and two others: SPKM-3 and LIPKEY. Both are SSL/TLS based. SPKM-3 uses certificates for user authentication, LIPKEY uses passwords. All of these schemes require the users sitting at the remote keyboard fork over his authentication info and cache credentials of some sort, so if that host is compromised, so may be his account. But that's unavoidable. Quite different from leaving your department fileserver wide open.

In theory, there's nothing to stop you from running an Active Directory server and adding a fileserver with samba-3 for the windows clients and nfs for the *nix clients, both using Active Directory's kerberos implementation for authentication. Being able to replace the AD server with samba-4 just sweetens the deal.

NFS and Samba (2, Interesting)

DrYak (748999) | more than 8 years ago | (#14556561)

You know, the big problem is, that the PHB [wikipedia.org] s that are sitting at the head of big corps around have never heard of NFS. They've only seen the niiiiiice Shiiiiiinny PowerPoint presentation in Microsoft booths in big expos. And then, they have made their company to pay a lot for an over-priced non-standart Microsoft LDAP/Kerberos/SMB bastard (a.k.a. Active Domain) and are now knee deep into a locked-in solution from which there's no other out except paying an even higher price for the next even worse microsoft product.

This is the crowd that is targeted by Samba 4 :
- those who are SMB/CIFS dependant beyond repair, but need an alternate and opensource solution to Microsoft.

Of course, for the other guys out there, who can see differences between a real OS and a nice promises in a PowerPoint, there are other protocols to start with (like NFS).

Re:NFS and Samba (1)

TheRaven64 (641858) | more than 8 years ago | (#14556933)

Securing NFS is incredibly difficult. By default, NFS uses host-based authentication. The only way of making this secure is to:
  1. Only allow NFS access from a VPN.
  2. Drop all packets from VPN IPs that do not come from the VPN.
  3. Set up an authenticating VPN server.
Doing this in a cross-platform way is a significant amount more effort than configuring Samba. Newer versions of NFS support things like Secure RPC and Kerberos authentication, but setting these up is still more effort than Samba (and good luck finding two platforms with compatible NFS implementations that support these things).

There is a reason that BOFHs believe NFS stands for 'Nightmare FileSystem' or 'Not F*ing Secure.'

Re:What is this samba you speak of? (1)

Nimey (114278) | more than 8 years ago | (#14557154)

Pfft. sshfs [sourceforge.net] is even simpler and more reliable, not to mention far, far more secure.

My cat lost his password (4, Funny)

digitaldc (879047) | more than 8 years ago | (#14556377)

'It may eat your cat,' says the Samba team in a statement, 'but is far more likely to choose to munch on your password database.'

Wow, it only took 25 days for Samba to break its New Year's resolution to eat less and lose weight.

Could be worse. (1)

Caspian (99221) | more than 8 years ago | (#14556571)

"Share and enjoy
Share and enjoy
Journey through life with your plastic boy
Or girl by your side
Let your pal be your guide
And when it breaks down or starts to annoy
Or grinds when it moves and gives you no joy
Cos it's eaten your hat
Or had sex with your cat
Bled oil on your floor
Or ripped off your door
You get to the point you can't stand any more
Bring it to us, we won't give a fig
We'll tell you, 'Go stick your head in a pig'."

NZ??? (2, Funny)

oztiks (921504) | more than 8 years ago | (#14556382)

Linux.conf.au conference in New Zealand

What the ... HAS THE WORLD GONE MAD!

Since when did anything .au become New Zealands responsibility? Usually its the other way around! I.e blaming the existance of Russle Crow on Australians. This wasnt our fault HE WAS BORN IN NZ! Now they NZ is stealing our conferences. I for one find this an outrage!

Re:NZ??? (1)

laptop006 (37721) | more than 8 years ago | (#14556404)

well then why didn't you bid for it in your home city, I'm one of the people doing so for Melbourne in 2008, if you haven't put the effort in then stop bitching. The truth is that the NZ people were the only ones who put a bid in for 2006.

(I write this lying in bed in my room for the week at LCA)

Re:NZ??? (0)

Anonymous Coward | more than 8 years ago | (#14556462)

LCA?? Lesbian Chefs Association .. I was never aware that they dealt in the tourism industry

Re:NZ??? (0)

Anonymous Coward | more than 8 years ago | (#14557027)

I hear they make a great blancmange.
(go read cantebury tales)

Re:NZ??? (0)

Anonymous Coward | more than 8 years ago | (#14556886)

They only wanted the conference so they could say 'In two thousund and sex, you can bring you hooded sweatshirts over here and have a bear with us...bro'

And in other news (0, Troll)

wetfeetl33t (935949) | more than 8 years ago | (#14556465)

And in other news...
Steve Ballmer was seen throwing chairs through his office's fourth floor windows in an angry rage.

Re:And in other news (0, Troll)

Capt James McCarthy (860294) | more than 8 years ago | (#14556511)

That's because he found more hair on his pillow.

Re:And in other news (1)

markiv34 (889642) | more than 8 years ago | (#14556577)

In that case he should be happy, atleast he has some left. One need to have hair to have a hair loss. Why is it such a bad news for the window world interoperablity between win and the linux world is no way threating to microsoft might actually be benefiting to the windows world.

Samba. (0)

poeidon1 (767457) | more than 8 years ago | (#14556550)

So now my linux machines do not have to do Samba with with windows. They will get a native partner yuppie :)

But as an Active Directory replacement? (4, Insightful)

Money for Nothin' (754763) | more than 8 years ago | (#14556583)

Can it do authorization of group access to a given application? How about publishing network resources (printers, workstations, etc.)? Can Samba 4 replicate its data between multiple sites? Is Samba 4's AD functionality even built off any sort of LDAP technology to begin with (probably OpenLDAP, if anything)?

For all MSFT's faults (and there are many, as /. routinely points out), AD *is* a decent NOS directory...

Re:But as an Active Directory replacement? (4, Interesting)

gentimjs (930934) | more than 8 years ago | (#14556640)

Yes, active directory is decent - if you only ever want windows clients. I confess that Ive got a samba3 server (Gentooooooo) as "full" member of our W2K ActiveDirectory - and even got the permissions synced up enough so that users can right-click files and play with permissions through the gui on the doze client. HOWEVER this setup took weeks of tweakage, involved a dozen or so actual software packages, and required violating some published microsoft specs on how AD (supposedly...) works. If samba4 gives me this without the BS, I'm happy. If samba4 lets me replace my domain controller and have the existing doze infrastructure not notice, I'm even more happy.

Re:But as an Active Directory replacement? (1)

robgamble (925419) | more than 8 years ago | (#14557003)

I'm so glad you owned up to that. I thought I was just missing the boat when I had a hard time getting Samba to bend to my will.

Sometimes even when your software works just fine, you may not realize what you are asking it to do.

Re:But as an Active Directory replacement? (1)

C_Kode (102755) | more than 8 years ago | (#14557403)

I'm happy to hear you got all of these working, but this is exactly why I do not replace my Windows Domain/File servers with Samba. I've got enough to deal with now. I do not have the times to dedicate. I've been keeping a eye on the status of Samba and I have used Samba (Samba 2) before, but until I can get easy integration; It's just not a choice.

I have a request though, Publish your work. Let others know how you did it. That information can lead to strides forward for Samba and those that wish to implement it.

Re:But as an Active Directory replacement? (0)

Anonymous Coward | more than 8 years ago | (#14557038)

Samba 4's AD functionality even built off any sort of LDAP technology to begin with (probably OpenLDAP, if anything)?

RTFA, that it is clearly stated.

All of your questions can be answered with very little reasearch but considering you will not even RTFA, why should anyone waste their time gathering information for you?

How you are initially modded as insightful is beyond me.

Which version of Active Directory? (5, Interesting)

j-cloth (862412) | more than 8 years ago | (#14556697)

This all sounds great, but will it work when(if) Vista comes out? Previously, I had samba setups running beautifully on Win2K networks. Then 2003 came out and it messed it all up. Eventually Samba (and supporting docs) caught up and 2003 now works reasonably well. So will Samba 4 come out with great support for 2003 then break as soon as Vista is released?

Lets be clear - (3, Informative)

gentimjs (930934) | more than 8 years ago | (#14556785)

Lets be clear on this point -
When vista comes out, samba will not break.
MS will simply have changed the standard/protocol/whatever in some way that thier own prior implementations will be tolerant of but Samba will not. Samba will not be busted, MS' own implementation of thier own technology (or other peoples tech, kerberos for example) is what will be busted.

Re:Lets be clear - (2, Insightful)

grasshoppa (657393) | more than 8 years ago | (#14556989)

MS will simply have changed the standard/protocol/whatever in some way that thier own prior implementations will be tolerant of but Samba will not. Samba will not be busted, MS' own implementation of thier own technology (or other peoples tech, kerberos for example) is what will be busted.

And, practically, does this make a difference? Can I look my boss in the eye and tell him that the mail server doesn't know who it's users are, but it's ok because it's MS's fault?

Re:Lets be clear - (2)

gentimjs (930934) | more than 8 years ago | (#14557066)

No, you can look your boss in the eye and tell him/her/it not to buy vista....
Or if you are feeling brave, you can suggest they actually plan for these kinds of "gotchas" before they happen...

Re:Which version of Active Directory? (-1, Troll)

Anonymous Coward | more than 8 years ago | (#14556916)

Isn't Vista a desktop OS?

so, no.

Re:Which version of Active Directory? (2, Interesting)

Anonymous Coward | more than 8 years ago | (#14556988)

The weblog [livejournal.com] linked from the article explains that Windows Vista will be using a new protocol, SMB2. Apparently the Samba team have already reverse engineered this and its in the technology preview! Impressive if you ask me.

Will configuration be simplified ? (1)

dom1234 (695331) | more than 8 years ago | (#14557132)

Will configuration be simplified ? Will it be more easy ?
I haver never understood thoses WINSserver/NetBIOS/User-Ressource-logins/sharing/r elationsWithIP/etc. mess at all. I have once or twice made it up to access some Win98 or Win95 files on a connected computer, but I it was with tries and errors, not knowing what was that last change that made it work finally.

Maybe it's I who has a problem, maybe it's Windows way of doing a network (why not plain old FTP ?), or maybe it's Samba that is complicated. Even if it's Windows or me, maybe there could be some way to structure Samba's configuration files so that it is becomes easier.

Are there plans for this for version 4 ?

Samba 3 Almost but not quite Active Directory,. (2, Informative)

Zombie Ryushu (803103) | more than 8 years ago | (#14557225)

On my home network, I have been using Samba as an internal network file system for Linux to Linux networking. I use LDAP as my Database backend, Kerberos as my means of authentication too Samba.

You see I discovered something about Windows and SMB. Windows Cached its passwords. The passwords were replayed across the network whenever a new socket was opened. Konqueror would not replicate this behavior unless forced to by the KDE Control center. I have a big long thing that describes the whole thing.

It is not totally perfect but I want you to tell me if you think that
this constitutes Active Directory, or at least something close.
Eitherway, This is a major accomplishment for me, and I wanted some
suggestions or potential improvements because I know this isn't perfect
but it is a noticable advancement.

Abstract

The general idea is that we have a single unifying database system
(LDAP) a single protocol for Sign-On (Kerberos) Name resolution (Bind
DNS) And a network File system (CIFS by care of Samba.)

Basically, Kerberos now acts as a single sign-on (SSO) facility for my
home network.

When you log in Linux Pluggable Authentication Modules (PAM) verify the
account's credibility via LDAP, and request a ticket from the Kerberos
Key Distribution Center. based on the Principal (Username and Password)
and Policies in the Kerberos Realm.

These are DNS Service records thaat help clients find their KDC without the need for client side configuration files. This is how clients detect servers without Broadcast discovery protocols like Netbios Message Block,. The reason this is important is because it elimanates the "replay" attack threat from the fact that Windows likes to Cache its passwords in SAM files (PWL Files in the 9x Series). Even without the User's knowlege.

Some things I want to draw attention to.

First, this is a Windows 2000 Style Port 445 CIFS (SMBX) connection between two Linux machines. NOT a port 139 NT4 Netbios Session (SMB) connection.

The second thing I want you to notice is the fact that both servers are doing SPENGO, also known as "Sign and Seal" In Windows 2003 Server.

Finally that it aquaired the valid Kerberos Principal and ticket, and did a valid Kerberos setup.

Sorry if I sound incoherent. I'm tired.
Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...