82 lines
3.7 KiB
Plaintext
82 lines
3.7 KiB
Plaintext
//
|
|
// JAAS config file for GhidraServer when operating in -a4 mode.
|
|
// Only the one section that you wish to enable should be called "auth".
|
|
// All other sections will be ignored.
|
|
|
|
|
|
|
|
|
|
//**********************************************************************************
|
|
// Active Directory via LDAP
|
|
//**********************************************************************************
|
|
// The special string "{USERNAME}" in the authIdentity and userFilter parameters is replaced with the Ghidra user's name
|
|
// at runtime by the LdapLoginModule, and should not be modified.
|
|
//
|
|
// The ldap DNS hostname for your Active Directory server needs to be fixed-up in the userProvider parameter,
|
|
// and the domain name portion of your user's identity (ie. user@domain.tld) needs to be fixed up in the
|
|
// authIdentity parameter, possibly the port number also (3269).
|
|
//
|
|
// In this mode, GhidraServer will bind to the LDAP server using the Ghidra user's name and password. It will
|
|
// then query for that same user (sAMAccountName={USERNAME}) to confirm that user's DN.
|
|
//
|
|
// See https://docs.oracle.com/javase/8/docs/jre/api/security/jaas/spec/com/sun/security/auth/module/LdapLoginModule.html
|
|
// for more information about the LdapLoginModule and its configuration.
|
|
//
|
|
// Do not use a plain "ldap" URI to connect to your LDAP server unless you want your user's
|
|
// credentials to be visible as plaintext network traffic.
|
|
//
|
|
example_ad_ldap_auth {
|
|
com.sun.security.auth.module.LdapLoginModule REQUIRED
|
|
userProvider="ldaps://<your_active_directory_ldap_server_hostname>:3269"
|
|
authIdentity="{USERNAME}@<your_active_directory_domain_name.tld>"
|
|
userFilter="(sAMAccountName={USERNAME})"
|
|
debug=true;
|
|
};
|
|
|
|
|
|
//**********************************************************************************
|
|
// JPAM
|
|
//**********************************************************************************
|
|
// JPAM is not included in the Ghidra distro. See http://jpam.sourceforge.net/.
|
|
//
|
|
// Additionally:
|
|
// The libjpam.so native library needs to be copied to your Ghidra/Features/GhidraServer/os/linux64 directory.
|
|
// The JPAM-x.y.jar java library needs to be copied to your Ghidra/Features/GhidraServer/lib directory,
|
|
// and the following entries need to be added to your server/server.conf file:
|
|
// wrapper.java.classpath.PAM=${ghidra_home}/Ghidra/Features/GhidraServer/lib/JPam-x.y.jar
|
|
// wrapper.java.classpath.PAM2=${ghidra_home}/Ghidra/Features/GhidraServer/data/yajsw-stable-12.12/lib/core/commons/commons-logging-1.1.jar
|
|
//
|
|
// NOTE: you may need to run GhidraServer as root when using PAM authentication, depending on your configuration.
|
|
//
|
|
example_jpam_auth {
|
|
net.sf.jpam.jaas.JpamLoginModule REQUIRED
|
|
// The serviceName parameter controls which PAM service Ghidra will try to authenticate against.
|
|
// This typically corresponds to a file called /etc/pam.d/<serviceName>
|
|
serviceName="system-auth"
|
|
;
|
|
};
|
|
|
|
|
|
//**********************************************************************************
|
|
// External program (ie. mod_authnz_external)
|
|
//**********************************************************************************
|
|
// Launches an external program to perform authentication.
|
|
//
|
|
// You may need to adjust the PROGRAM="" to include the full path to the example script
|
|
example_external_auth {
|
|
ghidra.server.security.loginmodule.ExternalProgramLoginModule REQUIRED
|
|
|
|
// Path to the external program. An absolute path is preferable.
|
|
PROGRAM="server/jaas_external_program.example.sh"
|
|
|
|
// Time to wait for external program to finish before killing it, in milliseconds.
|
|
TIMEOUT="1000"
|
|
|
|
// Any arguments that the external program needs. Do not include sensitive values as an
|
|
// argument because they can be seen by other users on the system.
|
|
ARG_00="arg1" ARG_01="test arg2"
|
|
;
|
|
};
|
|
|
|
|