Introduction

Looking at a Linux filesystem, checking if a certain file or directory is accessible for reading, writing or executing by certain users or groups poses interesting challenges.

Let the basic and seemingly simple question be: „Given a user X and a file Y, can it be determined if X has access to Y, and if yes, how can it be determined?“ A simple answer was: „Let X try to access Y, and if it does not work, X does not have that kind of access.“ However, this may not be feasible: The users, files and directories in question may not exist yet. More generally, access by users to files and directories should be predictable; appropriate access restrictions should be placed in advance, not after exposing possibly sensitive information. Also, certain types of access, such as deleting a file or directory, can not be simulated in a safe manner.

Moreover, a test procedure that just involves „trying to access the file“ may be incomplete: Just because the way the test procedure has attempted access did not succeed, that does not mean that there is no procedure at all by which the user in question can access the file.

This article investigates Linux filesystems that implement the semantics of „classic UNIX permissions“ in an effort to find more exhaustive methods of determining access.

• The following procedure is available starting with SAMBA version 4.9.
• The procedure can be performed on a host that is unrelated to the domain, but one domain controller must be reachable, must be used as a nameserver at the time of the backup and have open ports for DNS (53/tcp and /udp) SSH (22/tcp), LDAP (389/tcp), Kerberos (88/tcp and udp) and SMB (445/tcp).

1. On the machine that will be used to perform the backup, if not already present, install SAMBA.

apt -y install samba

2. Get the current smb.conf from the DC you want to query:

scp dc01.ad.example.com:/etc/samba/smb.conf ./smb.conf.dc01

3. Create a backup output directory:

mkdir samba-domain-backup

4. Ensure that /etc/resolv.conf contains the IP address of dc01 as the nameserver.

5. Perform the backup:

samba-tool domain backup online \
    --server=dc01.ad.example.com \
    --configfile=smb.conf.dc01 \
    --realm=AD.EXAMPLE.COM \
    --username=administrator@AD.EXAMPLE.COM \
    --targetdir=samba-domain-backup

Using computer object precreation you can enable machines to join an Active Directory domain with knowledge of just one dedicated one-time-password. Combined with delegation you can offload management of computer objects to an otherwise unprivileged AD user.

Weiterlesen … »