Wednesday, December 16, 2015

Centrify DirectControl for UNIX/Linux/Mac and servicePrincipalNames

Background
IT Ops often ask themselves about servicePrincipalNames in the context of Kerberos and ActiveDirectory.  When a system is Centrified, part of the process is to populate some of these entries to facilitate certain services to "just work";  SPNs play a part on that equation;  however there may be conflicts as well;  many organizations use Centrify software to simplify and secure Hadoop implementations at the OS-layer;  there may be conflicts with other Kerberos-enabled apps as well.  This quick article consolidates the questions that we commonly get as it relates to SPNs and Centrify DirectControl.

What is a Kerberos SPN?
ServicePrincipalName is the name by which a Kerberos client identifies an instance of a service.  The simple format entry in Active Directory looks like this:  service/realm:PORT.  E.g. HTTP/host.example.com

What does this have to do with Centrify?
Centrify uses Kerberos for authentication against Active Directory.  When you join a UNIX, Linux or Mac system into Active Directory using Centrify, there are a set of ServicePrincipalNames defined for the system by default.  Some of these are (varies between platforms). 

afpserver:  for an Apple file server
cifs: for a Samba file server
ftp: for a Kerberos-enabled ftp server
host: for host services like SSHD
http: for Web Servers that use SPNEGO
ipp: for web-based printing
nfs: for Kerberos-enabled NFS

How commonly used are this servicePrincipalNames?
In an Active Directory environment, because it uses Kerberos as the authentication protocol, you interact with Kerberos-enabled services all the time.  As an example, right now, you can connect to a Centrified system using ssh.  When you do, you are getting a service ticket for the HOST service for that system.  You can verify this with the klist command on Windows or in UNIX.    For example:  Diana (dwirth) connects to two centrified systems using PuTTY (engcen6 and linux2); then she opens PowerShell and verifies that she has a service ticket.
Windows PowerShell
Copyright (C) 2014 Microsoft Corporation. All rights reserved.

PS C:\Users\dwirth> klist | sls host

    Server: host/engcen6.centrify.vms @ CENTRIFY.VMS
    Server: host/linux2.centrify.vms @ CENTRIFY.VMS

When does the service registration happen, when I install your CentrifyDC package?
No.  Remember that installing our packages only will place our binaries in your system.  These changes happen when you run the adjoin command OR on the AD side, when you use the "Prepare UNIX computer" option in Centrify Access Manager or when you use the New-CdmManagedComputer PowerShell commandlet.
Access Manager - Precreate SPNs.png
You have a chance to add/remove or modify SPNs during the Pre-Create stage.

Why do you do this?
To make sure that certain common services that rely on Kerberos just work out of the box.

Can I control the behavior of the default SPNs?
Yes.  The adclient.krb5.service.principals parameter takes care of what SPNs are set up in the computer’s AD object and its corresponding system keytab entries. All you need to do is enable the parameter, PRIOR to running adjoin to join AD and only the entries defined will be created by default.  From the Centrify UNIX configuration guide:

"adclient.krb5.service.principals

This configuration parameter specifies additional service principals 
for entries in the Kerberos key table. The key table is populated by 
default with the service principals host, http, cifs, and nfs.
This parameter's value must be one or more principal service names, 
separated by a space or by a comma. For example:

adclient.krb5.service.principals: http ftp cifs nfs

If this parameter is not defined in the configuration file, no 
additional principal names are added to the Kerberos key table."

You can also leverage the Precrate option in Access Manager or the New-CdmManagedComputer PowerShell commandlet.

How can I see the existing registered SPNs for a Centrified system?
On UNIX/Linux/Mac CLI:   Use the “adinfo –C” command from the CLI. 
  1. Make sure you have a current Kerberos ticket. If you get a "cannot bind" error, just kinit and reauthenticate against AD.
$ adinfo -C
Computer Account Diagnostics
  Joined as: engcen6
  Trusted for Delegation: true
  Use DES Key Only: false
  Run adinfo as root to examine local key info
  Key Version: 11   (local key version unavailable)
  Service Principal Names: myservice/engcen6
                           myservice/engcen6.centrify.vms
                           nfs/engcen6.centrify.vms
                           nfs/engcen6
                           ipp/engcen6.centrify.vms
                           ipp/engcen6
                           http/engcen6.centrify.vms
                           http/engcen6
                           host/engcen6.centrify.vms
                           host/engcen6
                           ftp/engcen6.centrify.vms
                           ftp/engcen6
                           cifs/engcen6.centrify.vms
                           cifs/engcen6
                           afpserver/engcen6.centrify.vms
                           afpserver/engcen6

Supported Encryption Type(s): RC4-HMAC
                              AES128-CTS-HMAC-SHA1-96
                              AES256-CTS-HMAC-SHA1-96

Operating System Version: 6.1:6.5 (Final)
From Windows using the CLI:  Use the “setspn.exe –L <hostname>”

Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.

C:\>setspn -L engcen6
Registered ServicePrincipalNames for CN=engcen6,OU=Servers,OU=centrifyse,DC=cent
rify,DC=vms:
        myservice/engcen6
        myservice/engcen6.centrify.vms
        nfs/engcen6.centrify.vms
        nfs/engcen6
        ipp/engcen6.centrify.vms
        ipp/engcen6
        http/engcen6.centrify.vms
        http/engcen6
        host/engcen6.centrify.vms
        host/engcen6
        ftp/engcen6.centrify.vms
        ftp/engcen6
        cifs/engcen6.centrify.vms
        cifs/engcen6
        afpserver/engcen6.centrify.vms
        afpserver/engcen6
From Windows Using Active Directory Users and Computers

  1. Make sure that the Advanced Features check is set in the View menu.
  2. Find the computer object > right click > Properties > Attribute Editor
  3. In the Attribute Editor, find the servicePrincipalName field.
    ADUC - SPNs.png

What if I need to change the SPNs for an existing system?
There are several ways to do it.  The easiest way to do it is using adkeytab; however if you want this to happen automatically during join, you have to modify the configuration file.
You can also use adleave/adjoin, however this has the drawback that the agent will be disabled temporarily.

Using adkeytab 
To add an SPN to the computer
Example:  adding the oracle service to the shortname engcen6 – notice that you need to be root or elevate to change the system keytab, plus you'll need an AD user that can modify the computer object in AD.
  1. Run “dzdo adkeytab --addspn --principal [principal in correct format] --user [ad-user-that-can-modify-computer-object] --verbose”
    $ dzdo adkeytab --addspn --principal oracle/engcen6 --user dwirth --verbose
    Active Directory Password:
    ADKeyTab version: CentrifyDC 5.2.0-218
    Options
    -------
    use machine ccache: no
    domain: centrify.vms
    server: null
    user: dwirth
    container: null
    account: null
    trust: no
    des: no
    dwirth@CENTRIFY.VMS's password:
    Attempting bind to centrify.vms site:Demo-Network server:dc.centrify.vms: ccache:MEMORY:0x5666c0
    Bind successful to server dc.centrify.vms
    Searching for AD Object: filter = (samAccountName=engcen6$), root = DC=centrify,DC=vms
    AD Object found: CN=engcen6,OU=Servers,OU=centrifyse,DC=centrify,DC=vms
    Key Version = 11
    Success: Add SPNs: Default Key Tab
    
  2. Verify the new SPN with “adinfo –C”
    $ adinfo -C | grep oracle
      Service Principal Names: oracle/engcen6
    
  3. Optional:  List the contents of the system keytab
    dzdo /usr/share/centrifydc/kerberos/bin/klist -kt /etc/krb5.keytab | grep oracle
      11 12/16/15 07:27:47 oracle/engcen6@CENTRIFY.VMS
    [output truncated]
    
    The KVNO goes up, and the new entry is present.
To remove an SPN from the computer (example:  removing the entry I added above to the same system)
  1. Run “dzdo adkeytab --delspn --principal oracle/engcen6 --user [ad-user-that-can-modify-computer-object] --verbose”
    $ dzdo adkeytab --delspn --principal oracle/engcen6 --user dwirth --verbose
    ADKeyTab version: CentrifyDC 5.2.0-218
    Options
    -------
    use machine ccache: no
    domain: centrify.vms
    server: null
    user: dwirth
    container: null
    account: null
    trust: no
    des: no
    dwirth@CENTRIFY.VMS's password:
    Attempting bind to centrify.vms site:Demo-Network server:dc.centrify.vms: ccache:MEMORY:0x5666c0
    Bind successful to server dc.centrify.vms
    Searching for AD Object: filter = (samAccountName=engcen6$), root = DC=centrify,DC=vms
    AD Object found: CN=engcen6,OU=Servers,OU=centrifyse,DC=centrify,DC=vms
    Key Version = 11
    Deleting SPN oracle/engcen6
    Keeping SPN myservice/engcen6
    Keeping SPN myservice/engcen6.centrify.vms
    Keeping SPN nfs/engcen6.centrify.vms
    Keeping SPN nfs/engcen6
    Keeping SPN ipp/engcen6.centrify.vms
    Keeping SPN ipp/engcen6
    Keeping SPN http/engcen6.centrify.vms
    Keeping SPN http/engcen6
    Keeping SPN host/engcen6.centrify.vms
    Keeping SPN host/engcen6
    Keeping SPN ftp/engcen6.centrify.vms
    Keeping SPN ftp/engcen6
    Keeping SPN cifs/engcen6.centrify.vms
    Keeping SPN cifs/engcen6
    Keeping SPN afpserver/engcen6.centrify.vms
    Keeping SPN afpserver/engcen6
    Removing SPNs from ADObject engcen6
    Removing spns and from config file for engcen6
    Removing SPNS from Keytab for engcen6
    Success: Del SPNs: Default Key Tab
    
  2. Verify the new deleted SPN with “adinfo –C”
    $ adinfo -C | grep oracle
    $
    
    No results imply that there's no entry.

Using adleave/adjoin 
  1. Edit the /etc/centrifydc/centrifydc.conf file and use the krb5.service.principals parameter to reflect the desired SPNs and save the file
  2. Note the Zone and Computer Roles the system belongs to  (using access manager, UNIX CLI or ADUC)
  3. Leave AD by running “dzdo adleave –r –u [AD-user-that-can-remove-the-computer-object]”
    this will leave the domain and remove the computer object;  if you rather do an offline leave, use the adleave -f command.
  4. Join AD by running the “[elevate] adjoin –z [zone] –c [container-in-ad] –u [ad-user-that-can-join]  [domain.name]” 
    if you have to join any computer roles, use the –computerrolrole parameter and list the computer roles.
  5. Verify that the newly-joined system has the SPNs you require by using adinfo -C

Do you know any instances of conflicts with these SPNs?
Yes.  Other Kerberos-enabled apps may rely on these SPNs.  Some notables:
  • Hadoop:  Applications like Cloudera Manager, Hortonworks Ambari or MapR Control System will create HTTP records for SNEGO-enabled services.  The best practice is to disable the http SPN using the krb5.service.principals parameter PRIOR to joining any systems that will participate in Hadoop clusters.
    For example, if I forgot to remove the http entry and I already joined my Hadoop node, all I need to do is run the "sudo adkeytab --delspn --principal http/shortname --principal http/fqdn --user myuser"  > this will remove all http SPNs.
  • Certain Java apps:   Some Kerberized java applications may have other conflicts.  Applications vary.
  • Mixed Kerberos Environments: In environments with mixed Kerberos environments (where AD and MIT Kerberos coexist) there may be conflicts, however if you follow the guidelines on Mixed Kerberos, there should be none given that the realms are different and the system keytabs & krb5.conf files are independent.

No comments:

Post a Comment