Accessing SMB shares from FM server with Kerberos

filemaker_server_kerberos.md

A Linux / Ubuntu based FileMaker server sometimes needs to access data on a Windows file server. This is possible with the Windows NTLM username/password authentication. But NTLM is insecure and some companies do not tolerate it in their networks.

I would like to show how to access files on a Windows server using Kerberos ticket based authentication and autofs. To do this at home, you will need to know your way around the Linux command line and have access to your Windows domain controller.

Why can't we do this the old fashioned way?

Ever since that distant 2001, the weaknesses of the NTLM authentication protocol have been clearly exposed.

Our demo user

Domain: contoso.com

Username: demouser@contoso.com

Install the Ubuntu packages

apt-get install krb5-user keyutils kstart

Create the krb5.conf file

Create the file /etc/krb5.conf on the FileMaker server:

[libdefaults]
  default_realm = CONTOSO.COM
  dns_lookup_realm = true
  dns_lookup_kdc = true

[domain_realm]
  .contoso.com = CONTOSO.COM
  contoso.com = CONTOSO.COM

Set up a domain user

It makes sense to set up a special domain user for FileMaker Server access. The password of this user should not expire automatically.

Create a keytab for the domain user

Open an admin PowerShell on your windows Domain Controller.

ktpass /out demouser.keytab /princ demouser@CONTOSO.COM /mapuser CONTOSO\demouser /ptype KRB5_NT_PRINCIPAL /crypto AES256-SHA1 /mapop set /pass +rndPass

After setting up the user and creating the keytab, you will need to wait until this information has been distributed to all DCs in your domain.

Move the keytab to the FileMaker server

Move the keytab to /etc/security/demouser.keytab (or whatever name/location you choose) on the FileMaker Server. Change the owner to root, who should be the only user to be able to read this file.

sudo chown root:root /etc/security/demouser.keytab
sudo chmod 600 /etc/security/demouser.keytab

Obtain a Kerberos ticket

sudo k5start -v -U -f /etc/security/demouser.keytab

Kerberos initialization for demouser@ORTMANNTEAM.LOCAL
k5start: authenticating as demouser@ORTMANNTEAM.LOCAL
k5start: getting tickets for krbtgt/ORTMANNTEAM.LOCAL@ORTMANNTEAM.LOCAL

If you get an error like Client 'demouser@CONTOSO.COM' not found in Kerberos database, you need to wait until the username/password info has been distributed in your domain.

Parameters of k5start

-v                   Verbose
-f <keytab>          Use <keytab> for authentication rather than password
-U                   Use the first principal in the keytab as the client
					 principal

List active Kerberos tickets

klist lists all the active tickets on your FileMaker server. You should see a ticket for demouser@CONTOSO.COM. It will be written to the ticket cache indicated.

sudo klist

Ticket cache: FILE:/tmp/krb5cc_0
Default principal: demouser@CONTOSO.COM

Valid starting     Expires            Service principal
05/19/26 15:00:54  05/20/26 01:00:54  krbtgt/CONTOSO.COM@CONTOSO.COM

This ticket will expire after a few hours, so we need a way to make it permanent.

Set up a service to renew our ticket

Create the following file in /etc/systemd/system/kerberos-renew.service

[Unit]
Description=Maintain Kerberos ticket
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
# Check tickets every 10 minutes
ExecStart=/usr/bin/k5start -U -f /etc/security/demouser.keytab -k FILE:/tmp/krb5cc_0 -K 10 -l 10h
Restart=always
RestartSec=3

[Install]
WantedBy=multi-user.target

Reload systemd and make the service permanent

sudo systemctl daemon-reload
sudo systemctl enable kerberos-renew

Start the service

sudo systemctl start kerberos-renew

Check the service status

systemctl status kerberos-renew

Delete all kerberos tickets for testing

sudo kdestroy -A