Autenticação de usuários do Active Directory no CUPS [RESOLVIDO]

patrickpcs
(usa Nenhuma)

Enviado em 06/09/2017 - 18:05h

Ambiente: Domínio totalmente Windows 2012r2 com algumas estações Linux ingressadas no AD usando winbind Kerberos samba e Pam.

Não estou conseguindo fazer o PAM autenticar o trabalho de impressão automaticamente no cups. O cups de certa forma reconhece os usuários e grupos do Active Directory pois mudei o grupo administrativo no cups-file.conf de lpadmin para usuários do domínio e qualquer usuário do domínio está conseguindo acrescentar impressoras pela interface web do cups agora. Log do cups reconhecendo usuários do domínio pelo pam

Set 06 18:51:05 timc-patrick5 systemd[1]: Started CUPS Scheduler.

Set 06 18:55:26 timc-patrick5 cupsd[2319]: pam_krb5(cups:auth): authentication failure; logname=asdasd uid=0 euid=0 tty=cups ruser= rhost=localhost

Set 06 18:55:26 timc-patrick5 cupsd[2319]: pam_unix(cups:auth): check pass; user unknown

Set 06 18:55:26 timc-patrick5 cupsd[2319]: pam_unix(cups:auth): authentication failure; logname= uid=0 euid=0 tty=cups ruser= rhost=localhost

Set 06 18:55:46 timc-patrick5 cupsd[2319]: pam_krb5(cups:auth): user patrickpcs authenticated as patrickpcs@DOMAIN.INTRANET

 

pam.d

root@timc-patrick5:/etc/pam.d# egrep -v "^#" common-*

common-account:account	[success=2 new_authtok_reqd=done default=ignore]	pam_winbind.so

common-account:account	[success=1 new_authtok_reqd=done default=ignore]	pam_unix.so

common-account:account	requisite						pam_deny.so

common-account:account	required						pam_permit.so

common-account:account	required						pam_krb5.so minimum_uid=1000

common-auth:

common-auth:auth	[success=3 default=ignore]	pam_krb5.so minimum_uid=1000

common-auth:auth	[success=2 default=ignore]	pam_unix.so nullok_secure try_first_pass

common-auth:auth	[success=1 default=ignore]	pam_winbind.so krb5_auth krb5_ccache_type=FILE cached_login try_first_pass

common-auth:auth	requisite			pam_deny.so

common-auth:auth	required			pam_permit.so

common-auth:auth	optional	pam_mount.so 

common-password:

common-password:

common-password:

common-password:password	[success=3 default=ignore]	pam_krb5.so minimum_uid=1000

common-password:password	[success=2 default=ignore]	pam_unix.so obscure use_authtok try_first_pass sha512

common-password:password	[success=1 default=ignore]	pam_winbind.so use_authtok try_first_pass

common-password:password	requisite			pam_deny.so

common-password:password	required			pam_permit.so

common-password:password	optional	pam_gnome_keyring.so 

common-session:session [default=1]		pam_permit.so

common-session:session requisite			pam_deny.so

common-session:session required			pam_permit.so

common-session:session optional			pam_umask.so

common-session:session optional			pam_krb5.so minimum_uid=1000

common-session:session required			pam_unix.so

common-session:session required			pam_mkhomedir.so umask=0077 skel=/etc/skel

common-session:session optional			pam_winbind.so

common-session:session optional			pam_mount.so

common-session:session optional			pam_systemd.so

common-session-noninteractive:

common-session-noninteractive:session	[default=1]			pam_permit.so

common-session-noninteractive:session	requisite			pam_deny.so

common-session-noninteractive:session	required			pam_permit.so

common-session-noninteractive:session optional			pam_umask.so

common-session-noninteractive:session	optional			pam_krb5.so minimum_uid=1000

common-session-noninteractive:session	required	pam_unix.so 

common-session-noninteractive:session	optional			pam_winbind.so 

 

cups

root@timc-patrick5:/etc/pam.d# cat cups

@include common-auth

@include common-account

@include common-session

 

root@timc-patrick5:/etc/cups# egrep -v "^#" cups-files.conf 

SystemGroup "usuários do domínio"

AccessLog /var/log/cups/access_log

ErrorLog /var/log/cups/error_log

PageLog /var/log/cups/page_log

 

winbind/samba

root@timc-patrick5:/etc/samba# egrep -v "^#" smb.conf

[global]

security = ads

realm = DOMAIN.INTRANET

workgroup = DOMAIN

idmap uid = 10000-15000

idmap gid = 10000-15000

winbind enum users = yes

winbind enum groups = yes

template homedir = /home/%U-%D

template shell = /bin/bash

client use spnego = yes

client NTLMv2 auth = yes

winbind use default domain = yes

restrict anonymous = 2

winbind refresh tickets = yes

winbind expand groups = 1

client plaintext auth = no

 

kerberos

root@timc-patrick5:/etc# egrep -v "^#" krb5.conf

[libdefaults]

default_realm = DOMAIN.INTRANET



[realms]

DOMAIN.INTRANET  =  {

kdc  =  dc1.domain.intranet

kdc  =  dc2.domain.intranet

kdc  =  dc3.domain.intranet

kdc  =  dc4.domain.intranet

default_domain  =  DOMAIN.INTRANET

admin_server  =  dc1.domain.intranet

}



[domain_realm]

.domain.intranet = DOMAIN.INTRANET

 

Entretanto na hora de imprimir, o trabalho fica retido na fila de impressão aguardando autenticação. Alguém tem ideia?

patrickpcs
(usa Nenhuma)

Enviado em 10/09/2017 - 19:59h

Falta pouco pra uma década de bug.
https://bugs.launchpad.net/ubuntu/+source/cups/+bug/788167
Já vem sendo mencionado a um bom tempo esse problema.
https://github.com/apple/cups/issues/3847
Pelo que parece foi corrigido pela equipe de desenvolviment do cups, mas pelo menos no ubuntu e debian não é o que parece.
A equipe do Debian simplesmente fechou o bug-report sem reparar alegando que o desenvolvedor já sabe do bug.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=711341


Solução alternativa.
https://ubuntuforums.org/showthread.php?t=2176738
Agradecimento:
Peter_Watkins
Created by Sam Mousa - July 2009
Based on code by A. Martins-Melo.
2010/03/03: Updated by Andre Dill
O script dos caras funciona, só acrescentar aspas duplas do parâmetro posicional 3 do comando. Alguns nomes de trabalho de impressão contem espaços e o comando não é bem executado sem as aspas pois muda os parâmetros posicionais.

strPrintCommand="smbspool smb://$strServer/$strPrinter $1 $2 $3 $4 \"$5\" $strTmpFile"

strPrintCommand="smbspool smb://$strServer/$strPrinter $1 $2 \"$3\" $4 \"$5\" $strTmpFile"

 

Nada se cria...tudo se copia e modifica de leve ;)



Vou deixar uma cópia salva aqui, pois o link para a primeira fonte que o cara postou nem funciona mais. Vai que o ubuntuforuns é apagado. Não podemos perder essa preciosidade.

#!/bin/sh

# To be put in the /usr/lib/cups/backend/

# Allow Samba kerberized printing on Ubuntu.



# Created by Sam Mousa - July 2009

# Based on code by A. Martins-Melo.

# 2010/03/03: Updated by Andre Dill



# Debuging

booDebug=1

strDebugFile="/tmp/printlog"

if [ $booDebug -eq 0 ]; then

output=/dev/null

else

output=$strDebugFile

fi



# check arguments recieved

if [ $# -eq 0 ]; then

echo 'network ksmb "Unknown" "Windows Printer via SAMBA with Kerberos support"'

exit 0

elif [ $# -lt 4 ]; then

echo "Usage: $0 job-id user title copies options [file]\n"

exit 1

elif [ $# -gt 6 ]; then

echo "Usage: $0 job-id user title copies options [file]\n"

exit 1

fi



# Username

strUserName=$2



# Extract Windows printer name and server

strPrinter=`echo $DEVICE_URI | sed 's,k*smb://,,g'`

strServer=`echo $strPrinter | sed 's,/.*$,,g'`

strPrinter=`echo $strPrinter | sed 's,.*/,,g'`

# fix a space in printer name

strPrinter=`echo $strPrinter | sed 's,%20,\\\ ,g'`



# Set environment variable to ticket cache of user.

strTicketName=/tmp/krb5cc_`id -u "$strUserName"`

KRB5CCNAME=`ls $strTicketName*`



# Debugging:

if [ $booDebug -eq 1 ]; then

echo "Printer: $strPrinter" >> $output

echo "Server: $strServer" >> $output

echo "Ticket cache: $KRB5CCNAME" >> $output

fi



# Export it so smbclient uses it.

export KRB5CCNAME



# data file

strTmpFile=/tmp/print.$$



if [ $# -eq 5 ]; then

# There are 5 arguments input will follow on stdin.

echo "Five arguments received. Tempfile created at $strTmpFile." >> $output

cat - > $strTmpFile



else

# There are 6 arguments, the 6th is the filename.

echo "Six arguments received." >> $output

if [ -f $6 ]; then

cp $6 $strTmpFile

fi

fi



# print the file

chown $strUserName $strTmpFile

#strPrintCommand="smbclient //$strServer/$strPrinter -k yes -E -c \"print $strTmpFile\""

#strPrintCommand="smbspool smb://$strServer/$strPrinter $1 $2 $3 $4 \"$5\" $strTmpFile"

#Patrick's tweak - Some print jobs names have spaces.

strPrintCommand="smbspool smb://$strServer/$strPrinter $1 $2 \"$3\" $4 \"$5\" $strTmpFile"

echo "Print command used is: $strPrintCommand" >> $output

`su -c "$strPrintCommand" $strUserName`

intReturn=$?

echo "Return code from smbclient: $intReturn" >> $output



# clean up

if [ -f $strTmpFile ]; then

rm $strTmpFile

fi

unset KRB5CCNAME



# How do we exit?

if [ $intReturn -eq 0 ]; then

# If smbclient finished successfully return 0.

echo "Exiting with exit code 0." >> $output

exit 0

else

# In all other cases return error code 1 which means Failed -- Note: this is not the same as returning $intReturn!

echo "Exiting with exit code 1." >> $output

echo "Note: If smbclient reports permission errors on the ticket cache" >> $output

echo " check the permissions on this file to make sure it is run " >> $output

echo " as root." >> $output

echo "Dumping environment." >> $output

env >> $output

exit 1

fi



# END

 

Basta renomear o backend do smb do cups em /usr/lib/cups/backend/smb para qualquer outra coisa só pra salvar caso queira reverter. Depois coloque o script acima no lugar e com a permissão de acesso apenas ao root, pode ser um chmod 0700. O script tem que ser executado como root a todo custo pois ele ira se passar por outro usuário e declarar a variável com o caminho para o cache do kerberos para enviar a impressão.

Todo o problema se dá por causa do CUPS que não está declarando a variável da forma correta e tentando enviar a impressão como usuário root.

A solução funciona independentemente de se estar usando a integração com Winbind ou SSSD.