Apache2 + AuthenNTLM +groups help needed

[ChrisH]

I have GLPI working on one of my Ubuntu servers with full NTLM. I want to make it so it only accepts one user group though.

 

My current apache config is

 

PerlAuthenHandler Apache2::AuthenNTLM
AuthType ntlm,basic
AuthName GLPI
require valid-user
PerlAddVar ntdomain "DOMAIN DC1 DC2"
PerlSetVar defaultdomain DOMAIN
PerlSetVar splitdomainprefix 1
PerlSetVar ntlmdebug 2
PerlSetVar ntlmauthoritative off
PerlsetVar basicauth off

 

Currently this authenticates everyone.

I am not sure if what I want is possible with this method as I have tried alsorts of directive lines for groups.

 

Any ideas?

 

tia

 

Chris

[ChrisH]

Ok if nobody knows the answer to this then how about me using a .htaccess to filter by group ? Is this possible? I can do the winbinf bit etc, it would just be the htaccess I would need some guidance on.

[Geoff]

require group admin

 

?

[ChrisH]

require group admin

 

?

 

Is that a solution to my original query or the .htaccess? I have tried that with my original solution and it doesnt seem to work. I couldnt find any examples of it being used with groups either.

I am willing to try another apache module as well if you can recommend one which will give me ntlm and allow me to use a require group directive.

 

Rofl top google hit is this thread!

[Geoff]

That was assuming you were going down the winbind route. Anyway, If you want straight NTLM...

 

AuthName "NTLM Authentication"
NTLMAuth on
NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp" --require-membership-of="YOUR_DOMAIN+administrators"
NTLMBasicAuthoritative on
AuthType NTLM
NTLMBasicAuth on
NTLMBasicAuthoritative on
require valid-user

[ChrisH]

Thanks I will give that a go. Any quirks I should know about? Hmm what about the squid reference?

[Geoff]

It's just the way ntlm auth talks to the client app.

[ChrisH]

What module needs to be enabled for this to work then as its moaning NTLMAuth is an invalid command.

[Geoff]

mod_ntlm

[ChrisH]

Ok this has turned out to be more of a pain than I realised. I assume you are compiling you own as there are no packages? I cannot get it to compile on mine no matter what I try. I found a compiled one on the ubuntu forums but it says its for a different verion of apache grrr. Everything else is ready I just need to get a working mod_ntlm.so.

[Geoff]

correct. I compiled my own.

[ChrisH]

Then you must have been using voodoo because eveytime I fix one error on the compiling it finds another. any chance you can attach yours?

[Geoff]

here you go

mod_ntlm.zip

[ChrisH]

wrong elfclass64.... Is your server 64 bit?

[Geoff]

correct.

[ChrisH]

Mine is a 32bit server. Thwarted at every turn! It's a conspiracy I tell you!

Why are there no official packages for this? Is it something to do with M$ proprietry rubbish or something?

Anyone else got a this file for 32 bit compiled for a recent version of Ubuntu?

[ChrisH]

Ok making some progress. I got it compiled with these files and instructions:

 

Personal Bytes mod_ntlm2 on Apache 2.2.x

 

Looking at the code block you gave me Geoff I have come to the conclusion you are using using mod_ntlm_winbind as only this has some of the directives you have listed.

[Geoff]

perhaps. I have that module installed too..

[ChrisH]

You will be because mod_ntlm doesnt seem to do groups unless you use some very basic static list. Of course the search is broken on the samba site due to their search host going down and all the google links I tried send me to an old link that doesnt work! That about sums up my day :\

 

Thanks for all the help I am sure once the samba site is fully operational I can use the method you described earlier.

[Geoff]

You might also want to look at mod_auth_sspi while you're waiting.

 

Apache module mod_auth_sspi

[ChrisH]

I thought that was for Apache on Windows server?

[ChrisH]

Ok I have done this finally. The samba site search is still down but I found a reference from another website.

So this does not end up being one of the hundred incomplete topics I have read on this topic I shall complete shall tell you what I have done and it can be wikified later.

 

OS: Ubuntu 8.10

Apache 2.2.9

 

This assumes you have Samba and winbind already setup so you get use the following commands to get users and groups:

 

wbinfo -u
wbinfo -g

 

Use a "+" as your winbind seperator in your smb.conf as I could not get it to work with "\"

 

I wanted NTLM authentication on Apache but I wanted to restrict the website to a certain group eg teachers. mod_ntlm will not do anything with groups. mod_ntlm_winbind will do as I want.

 

Get it here:

 

Index of /ftp/unpacked/lorikeet/mod_auth_ntlm_winbind

 

You will need some complier tools and some apache dev tools so

apt-get install build-essentials apache2-mpm-prefork-dev

 

You may also need the package autoconf

 

In the directory with mod_ntlm_winbind.c

./configure
apxs2 -DAPACHE2 -c -i mod_ntlm_winbind.c

 

Once this is done it actually gives the module the name of

 

mod_auth_ntlm_winbind

 

You then need to create a configuration file to load the mod in the apache mod dir.

 

nano /etc/apache2/mods-enabled/mod_auth_ntlm_winbind.load

 

Then add the entry

 

LoadModule auth_ntlm_winbind_module /usr/lib/apache2/modules/mod_auth_ntlm_winbind.so

 

The directive for the web directory is:

 

 

AuthName "NTLM Authentication"
NTLMAuth on
NTLMAuthHelper "/usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp --require-membership-of=YOUR_DOMAIN+usergroup"
NTLMBasicAuthoritative on
AuthType NTLM
NTLMBasicAuth on
NTLMBasicAuthoritative on
require valid-user

 

Restart samba, winbind and apache2 or reboot if you are lazy.

 

If you are getting 500 internal server errors then you need to change permission of the following file.

 

chmod 750 /var/run/samba/winbindd_privileged 

 

Add apache user (www-data) to the group winbindd_priv

 

usermod -G winbindd_priv www-data 

 

and restart winbind.

 

That should get you going

[upbimstuts83]

Hi ChrisH

Can you please guide me throw the instalation of the Apache2::AuthenNTLM. I followed the documentation from here but with no luck

Any help or idea would be much appreciated.

Thank you.