1

I'm switching some servers over to Debian 8 and using realmd for Active Directory (LDAP/Kerberos) authentication. This has been working great and allows Domain Users to login to my server, etc.

However, how would I run an unattended process (i.e. media server like Plex, or download client like transmission) using the credentials of a domain user? Both of those applications access network file shares so they need to be authenticated but they are also unattended/background processes.

  • Hmm, tricky, for Kerberos-using services like the Andrew File System (AFS), one usually ends up with things like a custom crond and alternate identities or kluging around with kinit and renewed tickets somehow. – thrig Aug 14 '15 at 16:18
0

As thrig intoned, the way to authenticate accounts to perform "background tasks" is effectively:

  1. Export a keytab for the account (best to use samba "net" commands rather than native windows ones for linux hosts)
  2. Save the keytab to each host
  3. a) Using kinit, source the keytab at service/command launch and renew it periodically in cron b) use gss-proxy to authenticate the service when needed

gss-proxy is (relatively) new and on my list of things to try.

Let us know how you go.

  • Thanks! Can you explain a little bit about gss-proxy and how it would work? My goal seems simple, but I suppose it's complicated. I want one Linux host running multiple applications (i.e. Plex, Nzbget) and each of them to connect to SMB/CIFS/NFS shares using different credentials. If I used Windows, I believe I could just create a Service and select a domain user to run under and it would be done... – SofaKng Aug 17 '15 at 19:55
  • Unfortunately i haven't yet had time to try it. Kerberos in linux is nowhere near as transparent as Windows, and has had little progress in terms of "ease of use" outside of freeipa/gssproxy/sssd. The two guides I've bookmarked are danwalsh.livejournal.com/65467.html and fedorahosted.org/gss-proxy/wiki/NFS . – Andy Aug 18 '15 at 10:23
  • Effectively gss-proxy should be able to retrieve auth tokens on behalf of your application. You still need the keytab(s) saved on your host, and you need to configure gss-proxy to request & renew tokens on behalf of your service account – Andy Aug 18 '15 at 10:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.