Unix/Linux account synchronization with Windows


Author: Walter Marchuk

Synchronizing accounts between these 2 platforms has always been difficult because of incompatibilities. One major incompatibilty is the password encryption storage. Through the use of SSH and perl synchronizing these 2 platforms is now possible.

The process is, when you create an account on unix, at the same time the account creation process will connect through SSH to the Windows Domain Controller and create an account there. It will also record all the account information in a database(LDAP/file). Windows stores its password in a one way hash, here how one looks like: 066DDFD4EF0E9CD7C256FE77191EF43CFDA95FBECA288D44AAD3B435B51404EE, which translates to "hello". During the the account creation your unix will create this hash, store it and pass it to windows.

Then on an hourly basis your windows machine will run a sync process that will connect back to your unix database and retrieve account information. It will then compare and sync the unix information to its own. NT password hashes on unix are created by mkntpwd, this program is based on l0phtcrack. Windows does not provide any function to retrieve hash passwords, only a password compare function for authentication. So on windows we use a program called copypwd, also based on a program related to l0phtcrack, it allows you to dump windows hash passwords to file and and modify windows hash passwords.

Here is the installation process. First you need to install openssh for Windows from http://www.networksimplicity.com/openssh/. Once installed, setup key authentication to allow your unix machine to log into your windows machine. Install perl from www.activestate.com. Install Win32::AdminMisc, Win32::NetAdmin, Net::LDAP, MIME::Base64 modules by using "ppm install modulename". Make sure you have MIME::Base64 module installed on the unix side. Download unixacct.tar.gz. In it there are two directories, the unix directory goes on a unix host and windows directory goes to the windows host.

The unix directory provides a perl module that you would put in your account creation program. The perl module authenticates through a key, the SSH scalar points to sshkey location. It uses MIME::Base64 to interact with the windows program.

Put the windows directory in c:\winnt\unixacct. The windows directory provides a standalone perl program. This is the program that the unix perl module interaccts with, it has 2 modes, either to make changes or to sync with the unix side. Another think to mention is that the windows side stores all its accounts and machine accounts in one database file. Because of this you cannot have a same group and username, computer accounts end with a dollar sign. The program will create unix group accounts with a suffix of -group to differentiate between groups and users. The sync process is where you may need to work on unless you have LDAP. You may need to figure out how to allow your windows machine to connect back to your unix host, you can setup an NIS perl module and tie that in, store your account information in an SQL database, setup so that your windows machine can ssh passwordless back to your unix box, or just setup LDAP.