Configuring Kerberos/AD Authentication For The SMB Server - Revision history

Tommygonk at 14:07, 2 November 2024

2024-11-02T14:07:29Z

Tommygonk: /* Configure Kerberos On The File Server */

2022-09-29T07:48:16Z

Configure Kerberos On The File Server

Tommygonk at 10:02, 20 April 2022

2022-04-20T10:02:44Z

Tommygonk at 10:17, 12 May 2020

2020-05-12T10:17:10Z

Tommygonk at 14:41, 11 June 2019

2019-06-11T14:41:09Z

Tommygonk at 13:01, 6 June 2019

2019-06-06T13:01:28Z

Tommygonk at 12:03, 6 June 2019

2019-06-06T12:03:16Z

Tommygonk at 12:02, 6 June 2019

2019-06-06T12:02:56Z

Tommygonk at 12:02, 6 June 2019

2019-06-06T12:02:00Z

Tommygonk at 11:53, 6 June 2019

2019-06-06T11:53:13Z

@@ Line 8: / Line 8: @@
 Create a user account on the AD server, fill in the user logon name eg. ''jfileserver'', disable the 'User must change password at next logon' option, and enable the 'Password never expires' option. Set a password for the new account.
-In the user account properties enable the 'Do not require Kerberos pre-authentication' option. If there are options for AES 128 bit and AES 256 bit encryption then enable both options.
+The user account can be configured with the 'Do not require Kerberos pre-authentication' option, or you can use pre-authentication. If pre-authentication is required you will need to specify the AD account password in the JFileServer ''<authenticator>'' configuration section using the ''<Password>...</Password>'' setting.
 [[File:KerberosADOptions.jpg|border]]

@@ Line 50: / Line 50: @@
   [libdefaults]
-  default realm = FILESYS.ORG
+  default_realm = FILESYS.ORG
   [realms]
-  FILESYS.ORG {
+  FILESYS.ORG = {
     kdc = adsrv.filesys.org
     admin_server = adsrv.filesys.org

← Older revision		Revision as of 10:02, 20 April 2022
Line 13:		Line 13:

	The file server host also requires a DNS entry with the AD server.		The file server host also requires a DNS entry with the AD server.
		+
		+	'''Note:''' If you are using an older Java VM that does not have the high strength encryption policy enabled then do not enable AES 256 bit encryption for the account. This may be earlier versions of Java 8 or pre Java 8 versions. If in doubt then do not enable AES 256 bit encryption. Only Windows 11 and the latest macOS clients support AES 256 encryption, and JFileServer does not currently support or negotiate AES 256, it will negotiate to use AES 128 only.

	== Generate The Keytab and Service Principal Name ==		== Generate The Keytab and Service Principal Name ==

@@ Line 8: / Line 8: @@
 Create a user account on the AD server, fill in the user logon name eg. ''jfileserver'', disable the 'User must change password at next logon' option, and enable the 'Password never expires' option. Set a password for the new account.
-In the user account properties enable the 'Do not require Kerberos pre-authentication' option.
+In the user account properties enable the 'Do not require Kerberos pre-authentication' option. If there are options for AES 128 bit and AES 256 bit encryption then enable both options.
 The file server host also requires a DNS entry with the AD server.
@@ Line 18: / Line 20: @@
    -pass <file-server-account-password>
    -mapuser <domain>\<file-server-account-name>
-   -crypto RC4-HMAC-NT
+   -crypto ALL
    -ptype KRB5_NT_PRINCIPAL
    -out <output-file-name>
    -kvno 0
 The generated key table will be used by the SMB server to authenticate the server so it will then be able to authenticate the client logons.
@@ Line 27: / Line 31: @@
 Copy the key table to the file server host system.
-Create the service principal name mapping, that clients will use to connect to the SMB file server service, using the ''setspn'' utility.
+Create the service principal name mapping, that clients will use to connect to the SMB file server service, using the ''setspn'' utility. Newer versions of the ''ktpass'' command will set the SPN when generating the key table.
   setspn cifs/<file-server-host-name> <file-server-account-name>
@@ Line 33: / Line 43: @@
 == Configure Kerberos On The File Server ==
-The Java authentication APIs require a Kerberos configuration file, this can either be in the default location such as ''/etc/krb5.conf'' on linux and macOS, ''C:\winnt\krb5.ini'' on Windows, or the location can be specified on the Java command line using the ''java.security.krb5.conf'' property.
+The Java authentication APIs require a Kerberos configuration file, this can either be in the default location such as ''/etc/krb5.conf'' on linux and macOS, ''C:\winnt\krb5.ini'' on Windows, the location can be specified on the Java command line using the ''java.security.krb5.conf'' property, or using the JFileServer configuration value <KerberosConfig> to specify the configuration file path and name.
 A sample Kerberos configuration file is shown below, the Kerberos realm is always specified in uppercase.
@@ Line 66: / Line 76: @@
 Note: Use spaces in the Java login configuration file, tab characters cause problems.
-To enable the Java login configuration the main Java security configuration file needs to be updated. This is usually located in the ''<JRE-folder>/lib/security/java.security'' file.
+To enable the Java login configuration use the JFileServer configuration value <LoginConfig> to specify the path to the login configuration file.
 Look for the example configuration line that starts with ''#java.login.config.url.1=...''. Uncomment the line, or add a new line, similar to the value shown:-
@@ Line 103: / Line 115: @@
 | Kerberos realm, always uppercase
 |-
-| <LoginEntry<...</LoginEntry>
+| <LoginEntry>...</LoginEntry>
 | Specifies the Java login configuration entry name if the default name of 'FileServerSMB' is not used
 |-
@@ Line 120: / Line 132: @@
 | <kerberosDebug/>
 | Enables the Java authentication API debug output. Equivalent of setting the Java system properties 'sun.security.jgss.debug' and 'sun.security.krb5.debug'
 |-
 |}

@@ Line 82: / Line 82: @@
       <authenticator type="enterprise">
         <!-- Kerberos/Active Directory Setup -->
         <Realm>FILESYS.ORG</Realm>
       </authenticator>
@@ Line 100: / Line 99: @@
 | <mode>...</mode>
 | Server mode, should always be 'USER'
 |-
 | <Realm>...</Realm>

← Older revision		Revision as of 12:03, 6 June 2019
Line 1:		Line 1:
−	By default the JFileServer SMB server uses NTLM authentication, for a more secure and single signon authentication you can configure the SMB server to use Kerberos logons.	+	By default the JFileServer SMB server uses NTLM authentication, for more secure and single signon authentication you can configure the SMB server to use Kerberos logons.

	This document details how to configure the JFileServer, and JFileServer Enterprise, SMB server to use Kerberos authentication using a Windows Active Directory (AD) server setup.		This document details how to configure the JFileServer, and JFileServer Enterprise, SMB server to use Kerberos authentication using a Windows Active Directory (AD) server setup.

@@ Line 98: / Line 98: @@
 | Force Simple Protected Negotiation to be used for the authentication, this will be selected automatically if Kerberos authentication is enabled. If only NTLM authentication is enabled the default is to use NTLMSSP in the authentication exchanges.
 |-
-| <mode>USER|SHARE</mode>
+| <mode>...</mode>
 | Server mode, should always be 'USER'
 |-

@@ Line 53: / Line 53: @@
 The Java login configuration is used by the file server application to logon the server application using Kerberos by using the details in the key table that was generated on the Windows AD server.
-The Java login configuration file can be stored in your user home folder or a system folder such as ''/etc''. Create a new file called ''jfileserver.login.conf''. A sample Java login configuration file is shown below :-
+The Java login configuration file can be stored in your user home folder or a system folder such as ''/etc''. Create a new file called ''jfileserver.login.conf''. The default Java login configuration section name is ''FileServerSMB''. A sample Java login configuration file is shown below :-
   FileServerSMB {
@@ Line 73: / Line 73: @@
 == Configure The JFileServer SMB Authentication ==
-In the JFileServer XML configuration file enable the SMB server Kerberos authentication via the <authenticator> configuration section within the <fileserver> <SMB> section of the configuration. A sample configuration section is shown below:-
+In the JFileServer XML configuration file enable the SMB server Kerberos authentication via the <authenticator> configuration section within the <fileserver> <SMB> section of the configuration. A minimal sample configuration section is shown below:-
   <fileserver>
@@ Line 81: / Line 81: @@
       <authenticator type="enterprise">
         <!-- Kerberos/Active Directory Setup -->
         <KDC>adsrv.filesys.org</KDC>