From fff5f75de47bad3223ef0331ef97c98b9f7eb829 Mon Sep 17 00:00:00 2001 From: Brian (bex) Exelbierd Date: Sep 24 2017 15:00:21 +0000 Subject: [PATCH 1/3] Branching for F27 --- diff --git a/en-US/entities.adoc b/en-US/entities.adoc index 67173b2..fb9b41f 100644 --- a/en-US/entities.adoc +++ b/en-US/entities.adoc @@ -4,8 +4,8 @@ :COMMONBUGS_URL: http://fedoraproject.org/wiki/Common_F26_bugs :HOLDER: Fedora Project Contributors :KERNEL: 4.8 -:NEXTVER: 27 +:NEXTVER: 28 :PREVVER: 26 :PRODUCT: Fedora Documentation -:PRODVER: Rawhide +:PRODVER: 27 :YEAR: 2017 From e5185a340b4cf13cbe102c68e33aec49073814b7 Mon Sep 17 00:00:00 2001 From: Brian (bex) Exelbierd Date: Oct 16 2017 06:07:51 +0000 Subject: [PATCH 2/3] Branching for F27 - adding _distro_map.yml --- diff --git a/_distro_map.yml b/_distro_map.yml index 402869d..ea9eea9 100644 --- a/_distro_map.yml +++ b/_distro_map.yml @@ -12,3 +12,6 @@ fedora: f26: name: 26 dir: f26 + f27: + name: 27 + dir: f27 From 9cce68602fed417784c304ddc8dcf81e6bd37a06 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Oct 16 2017 06:07:51 +0000 Subject: [PATCH 3/3] Add section about changes in domain controllers (FreeIPA and Samba) --- diff --git a/_topic_map.yml b/_topic_map.yml index 165ff54..3b4e9dd 100644 --- a/_topic_map.yml +++ b/_topic_map.yml @@ -50,6 +50,8 @@ Topics: File: Security - Name: Mail Servers File: Mail_Servers + - Name: Domain Controllers + File: Domain_Controllers - Name: X.Org File: Xorg - Name: Changes in Fedora for Desktop Users diff --git a/en-US/sysadmin/Domain_Controllers.adoc b/en-US/sysadmin/Domain_Controllers.adoc new file mode 100644 index 0000000..0743a0b --- /dev/null +++ b/en-US/sysadmin/Domain_Controllers.adoc @@ -0,0 +1,51 @@ + +include::en-US/entities.adoc[] + +[[sect-domain-controllers]] +== Domain Controllers + +[[sect-domain-controllers-samba-changes]] +=== Samba changes + +Samba project completed conversion of Samba AD DC to support MIT Kerberos. Fedora 27 is the first Fedora version to include Samba AD domain controller functionality. + +The Samba AD process will take care of starting the MIT KDC and it will load a KDB (Kerberos Database) driver to access the Samba AD database. When +provisioning an AD DC using 'samba-tool' it will take care of creating a correct kdc.conf file for the MIT KDC. + +For further details, see: link:++https://wiki.samba.org/index.php/Running_a_Samba_AD_DC_with_MIT_Kerberos_KDC++[upstream's documentation]. + +Important changes to note: + +* Two different deployment modes are now supported for Samba domain controller: + - Traditional domain controller (NT-style domain controller) + - Active Directory domain controller (new mode). +* Samba upgraded to version 4.7. +* The default for `client max protocol` has changed to `SMB3_11`, which means that `smbclient` (and related commands) will work against servers without SMB1 support. It is possible to use the `m/--max-protocol` option to overwrite the `client max protocol` option temporarily. +* Encryption support in `smbclient` (option `-e/--encrypt`) works with SMB3 servers as well (Windows Server 2012 or later, Samba 4.0.0 or later). +* The change to `SMB3_11` as default also means `smbclient` no longer negotiates `SMB1` unix extensions by default, when talking to a Samba server with `unix extensions = yes`. As a result, some commands are not available, e.g. `posix_encrypt`, `posix_open`, `posix_mkdir`, `posix_rmdir`, `posix_unlink`, `posix_whoami`, `getfacl` and `symlink`. Using `-mNT1` reenables them, if the server supports SMB1. +* `smbclient` learned a new command 'deltree' that is able to do a recursive deletion of a directory tree. +* The dynamic port range for RPC services has been changed from the old default value `1024-1300` to `49152-65535`. This port range is not only used by a Samba AD DC, but also applies to all other server roles including NT4-style domain controllers. The new value has been defined by Microsoft in Windows Server 2008 and newer versions. To make it easier for Administrators to control those port ranges we use the same default and make it configurable with the option: `rpc server dynamic port range`. The `rpc server port` option sets the first available port from the new `rpc server dynamic port range` option. The option `rpc server port` only applies to Samba provisioned as an AD DC. + +Samba AD DC with MIT Kerberos does not have all the features of Heimdal Kerberos build. Missing features, compared to a Heimdal Kerberos build, are: + +* PKINIT support +* S4U2SELF/S4U2PROXY support +* Read-only domain controller support (RODC). This functionality is not fully working with Heimdal Kerberos build either. + + +[[sect-domain-controllers-freeipa-changes]] +=== FreeIPA changes + +FreeIPA has been upgraded to version 4.6. This is a major FreeIPA release which supports Python 3. + +Major changes compared to FreeIPA 4.4 which was shipped in Fedora 26: + +* FreeIPA is using Python 3 now +* Security defaults are in line with the rest of Fedora. In particular, newly issued certificates default to SHA-256. +* Smartcard support was added to FreeIPA and SSSD. New `ipa-advise` recipes are available to configure FreeIPA-enrolled clients and servers to support smartcard authentication. +* FreeIPA web UI can now be accessed using smartcard authentication. This feature is not enabled by default. +* Kerberos PKINIT is enabled by default on new installations with an integrated Certificate Authority. This allows to use smartcards to login to FreeIPA-enrolled hosts and obtain Kerberos tickets. +* Kerberos authentication indicator `pkinit` is automatically issued when Kerberos PKINIT pre-authentication succeeds. As result, elevated security requirements can be assigned to Kerberos services that require to only smartcard (`pkinit`), multi-factor (`otp`), or RADIUS (`radius`) authentication to succeed prior accessing them. +* Users from trusted Active Directory domains can now login to FreeIPA web UI and perform self-service operations. +* FreeIPA can now be installed in an environment subject to FIPS 140-2 requirements. +