NTLMSSP authentication mechanism with Apache #264

v-kapuangan · 2022-04-07T09:36:33Z

v-kapuangan
Apr 7, 2022

Hello,

We would like to activate NTLMSSP authentication with Apache server and mod_auth_gssapi support, but we are not able to make it working. We keep on having HTTP 401 unauthorized error when trying to access to our protected application path.

Here is our configuration in Apache :

<Location "/compagnon">
    AuthType GSSAPI
    AuthName "DOMAIN.NET"
    GssapiCredStore keytab:/etc/httpd/conf.d/spn.keytab
    Require valid-user
    GssapiAllowedMech ntlmssp
    GssapiSSLonly On
    GssapiConnectionBound On
    GssapiSignalPersistentAuth On
    GssapiUseSessions On
    Session On
    SessionCookieName gssapi_session path=/;httponly;secure
    GssapiNameAttributes json
    GssapiAcceptorName HTTP@ms-suit-test-alr-wikit
    GssapiNegotiateOnce Off
    RequestHeader set kerberos-user-data "%{GSS_NAME_ATTRS_JSON}e"
    RequestHeader set X-Forwarded-User "%{REMOTE_USER}s"
    SetEnvIf Host "^(.*)$" THE_HOST=$1
    RequestHeader set X-Forwarded-Proto https
    RequestHeader set X-Forwarded-Host %{THE_HOST}e
    RequestHeader edit X-Forwarded-Host (.*) $1/compagnon
    ProxyPreserveHost Off
    ProxyAddHeaders Off
</Location>

The error message in Apache logs is :
[auth_gssapi:error] [pid 1370] [client 172.20.193.130:52046] INTERNAL ERROR List of desired mechs is missing or empty, can't proceed!

It seems that Apache does not recognize ntlmssp. Do we miss something here ? Is there any other modules we should install ?

Please note that if we replace ntlmssp with krb5 as authentication mechanism, all is working fine.

We are using the latest mod_auth_gssapi 1.6.3 and krb5-libs-1.15.1.

Many thanks in advance for your help.

KR,
Victorianus

Answered by michael-dev

Dec 6, 2022

For me, the issue was that www-data was not im winbindd_priv

View full answer

simo5 · 2022-04-07T12:55:16Z

simo5
Apr 7, 2022
Maintainer

In order to offer gssntlmssp you need to have the gssntlmssp package installed.

4 replies

v-kapuangan Apr 7, 2022
Author

Thanks simo5.
We just compiled and installed the gss-ntlmssp module (see extract below).

[root@ms-suit-test-alr-wikit gss-ntlmssp]# make install
Making install in man
make[1] : on entre dans le répertoire « /home/admin/gss-ntlmssp/man »
make[2] : on entre dans le répertoire « /home/admin/gss-ntlmssp/man »
make[2]: Rien à faire pour « install-exec-am ».
 /bin/mkdir -p '/usr/local/share/man/man8'
 /bin/install -c -m 644 gssntlmssp.8 '/usr/local/share/man/man8'
make[2] : on quitte le répertoire « /home/admin/gss-ntlmssp/man »
make[1] : on quitte le répertoire « /home/admin/gss-ntlmssp/man »
Making install in po
make[1] : on entre dans le répertoire « /home/admin/gss-ntlmssp/po »
make[2] : on entre dans le répertoire « /home/admin/gss-ntlmssp/po »
make[2]: Rien à faire pour « install-exec-am ».
make  install-data-hook
make[3] : on entre dans le répertoire « /home/admin/gss-ntlmssp/po »
linguas="en_GB ko"; \
for l in $linguas; do \
  dir="/usr/local/share/locale/$l/LC_MESSAGES"; \
  /bin/mkdir -p $dir; \
  echo Installing $l.mo to $dir/gssntlmssp.mo ; \
  /bin/install -c -m 644 $l.mo $dir/gssntlmssp.mo; \
done
Installing en_GB.mo to /usr/local/share/locale/en_GB/LC_MESSAGES/gssntlmssp.mo
Installing ko.mo to /usr/local/share/locale/ko/LC_MESSAGES/gssntlmssp.mo
make[3] : on quitte le répertoire « /home/admin/gss-ntlmssp/po »
make[2] : on quitte le répertoire « /home/admin/gss-ntlmssp/po »
make[1] : on quitte le répertoire « /home/admin/gss-ntlmssp/po »
make[1] : on entre dans le répertoire « /home/admin/gss-ntlmssp »
make[2] : on entre dans le répertoire « /home/admin/gss-ntlmssp »
make[2]: Rien à faire pour « install-exec-am ».
 /bin/mkdir -p '/usr/local/include/gssapi'
 /bin/install -c -m 644 src/gssapi_ntlmssp.h '/usr/local/include/gssapi'
 /bin/mkdir -p '/usr/local/lib/gssntlmssp'
 /bin/sh ./libtool   --mode=install /bin/install -c   gssntlmssp.la '/usr/local/lib/gssntlmssp'
libtool: install: /bin/install -c .libs/gssntlmssp.so /usr/local/lib/gssntlmssp/gssntlmssp.so
libtool: install: /bin/install -c .libs/gssntlmssp.lai /usr/local/lib/gssntlmssp/gssntlmssp.la
libtool: finish: PATH="/sbin:/bin:/usr/sbin:/usr/bin:/sbin" ldconfig -n /usr/local/lib/gssntlmssp
----------------------------------------------------------------------
Libraries have been installed in:
   /usr/local/lib/gssntlmssp

If you ever happen to want to link against installed libraries
in a given directory, LIBDIR, you must either use libtool, and
specify the full pathname of the library, or use the `-LLIBDIR'
flag during linking and do at least one of the following:
   - add LIBDIR to the `LD_LIBRARY_PATH' environment variable
     during execution
   - add LIBDIR to the `LD_RUN_PATH' environment variable
     during linking
   - use the `-Wl,-rpath -Wl,LIBDIR' linker flag
   - have your system administrator add LIBDIR to `/etc/ld.so.conf'

See any operating system documentation about shared libraries for
more information, such as the ld(1) and ld.so(8) manual pages.
----------------------------------------------------------------------
make[2] : on quitte le répertoire « /home/admin/gss-ntlmssp »
make[1] : on quitte le répertoire « /home/admin/gss-ntlmssp »

The libraries have been installed in:
/usr/local/lib/gssntlmssp

But we do not know how we link these libraries with our Apache server. Could you please guide us ?

As per current situation, we still get the same error message on Apache log even after restarted it.
INTERNAL ERROR List of desired mechs is missing or empty, can't proceed!

Thanks again.
Victorianus

simo5 Apr 7, 2022
Maintainer

https://github.com/gssapi/gss-ntlmssp/blob/80520459a6ce850042fa2fc38793b6e65f20a3d9/TESTING.txt#L18

v-kapuangan Apr 12, 2022
Author

Hi simo5,

Thanks for your reply.

We follow up the examples to test the NTLM authentication using Apache2. First, we copy the content of the file examples/mech.ntlmssp into /etc/gss/mech.d. No problem on this.

However, we do not know where we should configure the environment variable NTLM_USER_FILE. We put this variable into /etc/environment so that it applies to all users, but it seems the variable is not read by the mod_auth_gssapi module.

KLEE:svc-user:passw0rd

The error message on Apache logs :

[Tue Apr 12 09:36:16.052404 2022] [authz_core:debug] [pid 109134] mod_authz_core.c(820): [client 172.20.195.44:54838] AH01626: authorization result of Require valid-user : denied (no authenticated user yet)
[Tue Apr 12 09:36:16.052409 2022] [authz_core:debug] [pid 109134] mod_authz_core.c(820): [client 172.20.195.44:54838] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)

Our mod_auth_gssapi configuration :

<Location "/compagnon">
    AuthType GSSAPI
    AuthName "KLEE"
    Require valid-user
    GssapiAllowedMech ntlmssp
    GssapiSSLonly On
    GssapiConnectionBound On
    GssapiSignalPersistentAuth On
    GssapiUseSessions On
    Session On
    SessionCookieName gssapi_session path=/;httponly;secure
    GssapiNameAttributes json
    GssapiAcceptorName HTTP@ms-suit-test-alr-wikit
    GssapiNegotiateOnce Off
    RequestHeader set kerberos-user-data "%{GSS_NAME_ATTRS_JSON}e"
    RequestHeader set X-Forwarded-User "%{REMOTE_USER}s"
    SetEnvIf Host "^(.*)$" THE_HOST=$1
    RequestHeader set X-Forwarded-Proto https
    RequestHeader set X-Forwarded-Host %{THE_HOST}e
    RequestHeader edit X-Forwarded-Host (.*) $1/compagnon
    ProxyPreserveHost Off
    ProxyAddHeaders Off
</Location>

Thanks again for your help.

KR,
Victorianus

simo5 Apr 14, 2022
Maintainer

NTLM_USER_FILE should be set in the init script as environment variable as /etc/environments is generally ignored by init scripts, those are for users not for system services.
If you are using systemd read https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Environment

simo5 · 2022-04-07T12:56:43Z

simo5
Apr 7, 2022
Maintainer

If you are offering exclusively gssntlmssp you also have no need for a keytab, but you will either need a system joined via winbindd to an AD domain, or you will need to provide a password file that gssntlmssp can use to check user's passwords against.

0 replies

OlivierSalasc · 2022-04-12T18:14:24Z

OlivierSalasc
Apr 12, 2022

Hi,i'm working with v-kapuangan on this subject.

To make things clear, ve have 2 differents use case to authenticate our users depending on their workstation configuration.

-The first one is when the user on his windows machine is logged on the same AD than our Apache Server configured with apache_mod_gssapi and a keytab. The protocol used is Kerberos in this case.
-The second is when the user on his windows machine is logged on a different AD. We think NTLM should be used as a fallback, because the user can't generate Kerberos ticket for the Active Directory.

The first user case works perfectly. We have configured the krb5 mech and setup the GssapiCredStore with a keytab.

The second user case is not working : despite having compiled apache_mod_gssapi with gss-ntlmssp, created a directory /etc/gss/mech, and having configured the
ntlmssp mech (GssapiAllowedMech).

On the web browser, we first have a prompt for login that we fulfill with OUR_DOMAIN\username and the corresponding password.

With Wireshark, we have the NTLMSSP_NEGOCIATE.
And then a NTLMSSP_CHALLENGE is sent by the server.

But the browser doesn't respond to the challenge (ERR_INVALID_RESPONSE in the browser).

We don't understand how the gss-ntlmssp should be plugged with our Active Directory. Can it use the keytab we have configured for our Kerberos use case ?
Should we install winbind as you suggested us in your previous reply?
If yes, how do we configure winbind ?

For exemple, In the challenge, we see a lot of target properties :
target name : <DNS_OF_THE_APACHE_SERVER>
Netbios Domain Name : WORKSTATION

When we look onto another Website that successfully use an NTLM sequence (on a IIS Server but on the same AD), we have

target_name <OUR_DOMAIN>
Netbios Domain Name : <OUR_DOMAIN>

We think that can explain why the browser doesn't complete the challenge.

How can we configure these properties so that they use our AD configuration?

1 reply

simo5 Apr 14, 2022
Maintainer

The simplest way is to look up instructions on how to join a windows domain, but if your case is about supporting fallback for a foreign domain this would probably not help you, unless you join that other domain.

The server name can be set with GssapiAcceptorName, however this will also affect the kerberos authentication, I do not recommend it, it shouldn't be needed anyway.

For the netbios names you can set these os environment variables:
NETBIOS_COMPUTER_NAME
NETBIOS_DOMAIN_NAME

HTH

michael-dev · 2022-12-06T10:21:21Z

michael-dev
Dec 6, 2022

For me, the issue was that www-data was not im winbindd_priv

1 reply

simo5 Dec 6, 2022
Maintainer

I see, in this case I suggest looking at using gss-proxy for privilege separation, because giving access to winbindd_priv means giving apache the ability to authenticate to the system as any user (if winbind is also used to provide system level authentication).

michael-dev · 2022-12-07T11:49:20Z

michael-dev
Dec 7, 2022

Thanks for pointing that out. Sadly, ntlmssp is not currently supported by gssproxy: https://github.com/gssapi/gssproxy/blob/c6847f012b326a7e27dbe79d8df0faafdeb2dbef/src/gp_creds.c

1 reply

iconeb Apr 18, 2023

May I ask you how you configured library to connect to winbindd? Which env vars did you specify?
Thanks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

NTLMSSP authentication mechanism with Apache #264

{{title}}

Replies: 5 comments 7 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

NTLMSSP authentication mechanism with Apache #264

v-kapuangan Apr 7, 2022

Replies: 5 comments · 7 replies

simo5 Apr 7, 2022 Maintainer

v-kapuangan Apr 7, 2022 Author

simo5 Apr 7, 2022 Maintainer

v-kapuangan Apr 12, 2022 Author

simo5 Apr 14, 2022 Maintainer

simo5 Apr 7, 2022 Maintainer

OlivierSalasc Apr 12, 2022

simo5 Apr 14, 2022 Maintainer

michael-dev Dec 6, 2022

simo5 Dec 6, 2022 Maintainer

michael-dev Dec 7, 2022

iconeb Apr 18, 2023

v-kapuangan
Apr 7, 2022

Replies: 5 comments 7 replies

simo5
Apr 7, 2022
Maintainer

v-kapuangan Apr 7, 2022
Author

simo5 Apr 7, 2022
Maintainer

v-kapuangan Apr 12, 2022
Author

simo5 Apr 14, 2022
Maintainer

simo5
Apr 7, 2022
Maintainer

OlivierSalasc
Apr 12, 2022

simo5 Apr 14, 2022
Maintainer

michael-dev
Dec 6, 2022

simo5 Dec 6, 2022
Maintainer

michael-dev
Dec 7, 2022