Editing SAMBA CLUSTER PUNJAB GOVT IFMS-IWDMS PROJECT (section)

= Integration of Samba with 389-Directory Server =
== Requirements  ==
• openldap-servers (contains migration utilities used in this document) 

• 389-DS (the directory server should already be installed) 

• samba, samba-client, samba-common (samba server, also provides schema needed for storing samba information) 

• schema to ldif migration script (can be downloaded from here:

[http://directory.fedoraproject.org/download/ol-schema-migrate.pl http://directory.fedoraproject.org/download/ol-schema-migrate.pl])


First off we need to provide 389-DS with a samba schema that it understands. Now lets break down how 389-DS implements extending schemas : 


• All schema files are in ldif format and loaded during server start .


• <nowiki>All schema's are located in /opt/389-DS/slapd-<server>/config/schema, where <server> is 'ldap1' or 'ldap2', as the case may be.</nowiki>


• Filenames are sequential and loaded in order and 99user.ldif is always the last schema to be loaded. 


For this document we are going to name our schema file 61samba.ldif. As stated above we need to provide 389-DS with a schema it understands which involves converting the provided /usr/share/doc/samba/LDAP/samba.schema to ldif format. Luckily, there is a utility provided 3rd party that will assist in doing this which can be found at [http://directory.fedoraproject.org/download/ol-schema-migrate.pl http://directory.fedoraproject.org/download/ol-schema-migrate.pl]


We do this on the 389-DS server. 


Use of this script is straight forward : 


<nowiki># perl ol-schema-migrate.pl -b \</nowiki>

/usr/share/doc/samba-*/LDAP/samba.schema \

<nowiki>> /etc/dirsrv/slapd-<server>/schema/61samba.ldif </nowiki>


Once the ldif is in place restart the slapd service : 


<nowiki># service dirsrv restart </nowiki>


== PAM Configuration  ==
Chack if nss_ldap is installed with: 


<nowiki># rpm -qa|grep -i nss-ldap </nowiki>


otherwise: 


<nowiki># yum install nss-pam-ldapd</nowiki>


On both the samba nodes, run this:


authconfig --enableldap --enableldapauth --disablenis \

--enablecache –ldapserver=ldap1.pbifmsiwdms.pjb\

--ldapbasedn=dc=pbifmsiwdms,dc=pjb --updateall 


Rsync the 'cacert.asc' from the ldap server to the samba server.

<nowiki># rsync -Pa ldap1:/etc/dirsrv/slapd-ldap1/cacert.asc \ /etc/openldap/cacerts/cacert.asc</nowiki>


Add the cacert.asc file of the second master below this entry.


Then ensure ldap.conf has the following settings: 

URI ldap://ldap1.pbifmsiwdms.pjb/ ldap://ldap2.pbifmsiwdms.pjb/ 

TLS_CACERTDIR /etc/openldap/cacerts 

TLS_REQCERT allow 

TLS_CACERT /etc/openldap/cacerts/cacert.asc 

BASE dc=pbifmsiwdms,dc=pjb 

HOST pbifmsntp1.pbifmsiwdms.pjb 

binddn "cn=Directory manager" 

bindpw asd1234f 

rootbinddn "cn=Directory manager" 

port 389 

bind_policy soft 

nss_reconnect_tries 2 

nss_base_passwd ou=People,dc=pbifmsiwdms,dc=pjb?one 

nss_base_passwd ou=Computers,dc=pbifmsiwdms,dc=pjb?one 

nss_base_shadow ou=People,dc=pbifmsiwdms,dc=pjb?one 

nss_base_group ou=Groups,dc=pbifmsiwdms,dc=pjb?one 


Without configuring ldap.conf, samba will not search posix accounts into ldap. Also, ensure that DNS has been setup.


== Samba Setup  ==
Change /etc/nsswitch.conf to have the following: 


passwd: files ldap sss 

shadow: files ldap sss 

group: files ldap sss 


<nowiki>Modify /etc/samba/smb.conf to have the following values (remember that 'PUNJABGOVT' string length < 14) </nowiki>


<nowiki>[global] </nowiki>

workgroup = PUNJABGOVT 

netbios name = PUNJABGOVT1 

hosts allow = 127.0.0.1 192.168.10.0/24 192.168.20.0/24 192.168.70.0/24 

security = user 

passdb backend = ldapsam:"ldap://ldap1.pbifmsiwdms.pjb ldap://ldap2.pbifmsiwdms.pjb" 

ldap admin dn = cn=Directory manager 

ldap suffix = dc=pbifmsiwdms,dc=pjb 

ldap user suffix = ou=People 

ldap machine suffix = ou=Computers 

ldap group suffix = ou=Groups 

ldap passwd sync = yes 

obey pam restrictions = no 

passwd program = /usr/bin/passwd %u 

passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n *password\supdated\ssuccessfully* . 

log file = /var/log/samba/%m.log 

log level = 3 

max log size = 1000 

syslog only = no 

socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 

os level = 65 

domain logons = yes 

domain master = yes 

local master = yes 

preferred master = yes 

wins proxy = yes 

wins support = yes 

logon home = \\%L\%U 

logon path = \\%L\%U\profile 

logon drive = H: 

template shell = /bin/false 

name resolve order = wins lmhosts hosts bcast 

encrypt passwords = yes 

logon script = logon.cmd 

add user script = /usr/sbin/adduser %u 

add machine script = /usr/sbin/smbldap-useradd -W %u 

lm announce = yes 

pam password change = yes 

enable privileges = yes 

<nowiki>;server string = PunjabGovt </nowiki>

dns proxy = no 

winbind enum groups = No 

winbind trusted domains only = yes 

winbind use default domain = no 

map untrusted to domain = Yes 

map to guest = bad user 

username map = /etc/samba/smbusers 

clustering = yes 

client lanman auth = Yes 

add group script = /usr/sbin/smbldap-groupadd -p "%g" 

delete group script = /usr/sbin/smbldap-groupdel "%g" 

add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g" 

admin users = root 


<nowiki>[netlogon] </nowiki>

path = /mnt/gfs2/samba/netlogon 

read only = yes 

browsable = no 

guest ok = yes 


<nowiki>[profiles] </nowiki>

path = /mnt/gfs2/samba/profiles 

read only = no 

create mask = 0600 

directory mask = 0700 


<nowiki>[homes] </nowiki>

browsable = no 

writable = yes 

path = /mnt/gfs2/share/%u 


<nowiki>[nitrobit] </nowiki>

path = /mnt/gfs2/samba/nitrobit 

read only = no 

public = yes 

browsable = yes 

writable = yes 

guest ok = yes 


<nowiki>[csmb] </nowiki>

comment = Clustered Samba 

public = yes 

path = /mnt/gfs2/share 

writeable = yes 

ea support = yes 


Create appropriate directories/permissions for the Samba shares defined in your configuration : 


<nowiki># mkdir -p /mnt/gfs2/samba </nowiki>

<nowiki># mkdir /mnt/gfs2/samba/{netlogon,profiles} </nowiki>

<nowiki># chown root:root -R /mnt/gfs2/samba </nowiki>

<nowiki># chmod 0755 /mnt/gfs2/samba/netlogon </nowiki>

<nowiki># chmod 1755 /mnt/gfs2/samba/profiles </nowiki>


Create a password for the ldap admin dn (the Directory Manager's Password) in Samba's secret file: 


<nowiki># smbpasswd -w <ldap-admin-password> </nowiki>

Setting stored password for "cn=Directory Manager" in secrets.tdb 


== Populating 389-DS with PDC Entry  ==
At this point you should have a Samba PDC and a properly configured 389-DS ready to take the appropriate Samba entries. Now we are going to provide an entry into 389-DS for your PDC. 


First get the Samba SID for your PDC. Note that the samba should not be running to get local SID. To do this, we first shutdown ctdb, then get the SID: 


<nowiki># service ctdb stop</nowiki>

<nowiki># net getlocalsid </nowiki>

SID for domain PUNJABGOVT is: S-1-5-21-4070117540-217532476-2757550252 


Next create your Samba Domain ldif(/tmp/sambaDomainName.ldif) for entry: 


<nowiki>dn: sambaDomainName=<PUNJABGOVT>,dc=pbifmsiwdms,dc=pjb </nowiki>

objectclass: sambaDomain 

objectclass: sambaUnixIdPool 

objectclass: top 

<nowiki>sambaDomainName: <PUNJABGOVT> </nowiki>

sambaSID: S-1-5-21-4070117540-217532476-2757550252 

uidNumber: 550 

gidNumber: 550 


Populate your 389-DS with the above entry. This can be run on only one server, as it will be replicated to the other.


'''NOTE''': There is an error in ldap2ldif. Open 'ldif2ldap' script, change 'PATH=:$prefix' to 'PATH=$PATH:$prefix:' . Also change 'ldapmodify' to include '-h localhost'


<nowiki># /usr/lib64/dirsrv/slapd-ldap1/ldif2ldap "cn=Directory manager" password /tmp/sambaDomainName.ldif </nowiki>


== Migrating Samba groups and populating 389-DS with Samba Users ==
This is where the openldap migration scripts are going to come in handy. Run these on any one of the Samba servers:


First install the scripts- 

<nowiki># yum install migrationtools </nowiki>


Lets modify the file /usr/share/openldap/migration/migrate_common.ph to apply our default domain and base. 


Search for the following OrganizationalUnit : 


$NAMINGCONTEXT{'group'} <nowiki>= "ou=Group"; </nowiki>


Default install of 389-DS will require this to be 'Groups', please change as follows : 


$NAMINGCONTEXT{'group'} <nowiki>= "ou=Groups"; </nowiki>


The rest can be modified as seen below : 


<nowiki># Default DNS domain </nowiki>

$DEFAULT_MAIL_DOMAIN = "pbifmsiwdms.pjb"; 


<nowiki># Default base </nowiki>

$DEFAULT_BASE = "dc=pbifmsiwdms,dc=pjb"; 


<nowiki># turn this on to support more general object clases </nowiki>

<nowiki># such as person.</nowiki>

$EXTENDED_SCHEMA = 1; 


Once complete we are now going to create our Samba Domain Groups. Open up a new file /tmp/sambaGroups and add the following : 


Domain Admins:x:5122: 

Domain Users:x:11503: 

Domain Guests:x:11504: 

Domain Computers:x:11505: 


Note: These are your UNIX groups, created in LDAP! They must exist on the Directory Server group list first! (if you do not have PAM setup) 


Next convert /tmp/sambaGroups into an ldif to be imported into 389-DS : 


<nowiki># /usr/share/openldap/migration/migrate_group.pl \</nowiki>

/tmp/sambaGroups > /tmp/sambaGroups.ldif 

<nowiki># cat /tmp/sambaGroups.ldif </nowiki>


dn: cn=Domain Admins,ou=Groups,dc=pbifmsiwdms,dc=pjb 

objectClass: posixGroup 

objectClass: top 

cn: Domain Admins 

userPassword: {crypt}x 

gidNumber: 5122 


dn: cn=Domain Users,ou=Groups,dc=pbifmsiwdms,dc=pjb 

objectClass: posixGroup 

objectClass: top 

cn: Domain Users 

userPassword: {crypt}x 

gidNumber: 11503 


dn: cn=Domain Guests,ou=Groups,dc=pbifmsiwdms,dc=pjb 

objectClass: posixGroup 

objectClass: top 

cn: Domain Guests 

userPassword: {crypt}x 

gidNumber: 11504 


dn: cn=Domain Computers,ou=Groups,dc=pbifmsiwdms,dc=pjb 

objectClass: posixGroup 

objectClass: top 

cn: Domain Computers 

userPassword: {crypt}x 

gidNumber: 11505 


Now rsync the sambaGroups file to one of the 389-DS servers and import /tmp/sambaGroups.ldif into 389-DS : 


<nowiki># /usr/lib64/dirsrv/slapd-<server>/ldif2ldap "cn=Directory manager" password /tmp/sambaGroups.ldif </nowiki>


Map the Samba groups to the Linux groups (Run on the Samba server): 


<nowiki># net groupmap add rid=512 ntgroup='Domain Admins' </nowiki>\

unixgroup='Domain Admins' 

<nowiki># net groupmap add rid=513 ntgroup='Domain Users' \</nowiki>

unixgroup='Domain Users' 

<nowiki># net groupmap add rid=514 ntgroup='Domain Guests' \</nowiki>

unixgroup='Domain Guests' 

<nowiki># net groupmap add rid=515 ntgroup='Domain Computers'\</nowiki>

unixgroup='Domain Computers' 


Verify : 


<nowiki># net groupmap list </nowiki>


Lets create a Samba Administrator account with an RID of 500. Create a file /tmp/sambaAdmin with the following : 


Administrator:x:0:0:Samba Admin:/root:/bin/bash 


Migrate /tmp/sambaAdmin to the formatted ldif and import into 389-DS : 


<nowiki># /usr/share/openldap/migration/migrate_passwd.pl /tmp/sambaAdmin > /tmp/sambaAdmin.ldif </nowiki>

<nowiki># /usr/lib64/dirsrv/slapd-<server>/ldif2ldap "cn=Directory manager" password /tmp/sambaAdmin.ldif </nowiki>


Create a Samba Administrator account and modify the account to use the correct Samba SID : 


<nowiki># smbpasswd -a Administrator</nowiki>

<nowiki># pdbedit -U $( net getlocalsid | \</nowiki>

sed 's/SID for domain PUNJABGOVT is: //' )-500 -u Administrator -r 


== PDC across subnets ==
Windows machines find the Samba server via NetBios. With the default configuration, this takes place only in the subnet the server is in. To enable the PDC across subnets, we need to configure Samba as a WINS (Windows Internet Name Service) Server.

To ensure this, we enter the following lines in smb.conf:


domain master = yes

preferred master = yes 

local master = yes

wins support = yes

wins proxy = yes

os level = 65


== Samba's smb.conf ==
Including all the relevant settings, our final smb.conf will look as follows. The cluster has been configured with 'clustering=yes'.


Nitrobit has been configured to use this following directory:

/mnt/gfs2/samba/nitrobit 


<nowiki>[global] </nowiki>

workgroup = PUNJABGOVT 

netbios name = PUNJABGOVT1 

hosts allow = 127.0.0.1 192.168.10.0/24 192.168.20.0/24 192.168.70.0/24 

security = user 

passdb backend = ldapsam:"ldap://ldap1.pbifmsiwdms.pjb ldap://ldap2.pbifmsiwdms.pjb" 

ldap admin dn = cn=Directory manager 

ldap suffix = dc=pbifmsiwdms,dc=pjb 

ldap user suffix = ou=People 

ldap machine suffix = ou=Computers 

ldap group suffix = ou=Groups 

ldap passwd sync = yes 

obey pam restrictions = no 

passwd program = /usr/bin/passwd %u 

passwd chat = *Enter\snew\sUNIX\spassword:* %n\n <nowiki>*Retype\snew\sUNIX\spassword:* %n\n *password\supdated\ssuccessfully* . </nowiki>

log file = /var/log/samba/%m.log 

log level = 3 

max log size = 1000 

syslog only = no 

socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 

os level = 65 

domain logons = yes 

domain master = yes 

local master = yes 

preferred master = yes 

wins proxy = yes 

wins support = yes 

logon home = \\%L\%U 

logon path = \\%L\%U\profile 

logon drive = H: 

template shell = /bin/false 

name resolve order = wins lmhosts hosts bcast 

encrypt passwords = yes 

logon script = logon.cmd 

add user script = /usr/sbin/adduser %u 

add machine script = /usr/sbin/smbldap-useradd -W %u 

lm announce = yes 

pam password change = yes 

enable privileges = yes 

<nowiki>;server string = PunjabGovt </nowiki>

dns proxy = no 

winbind enum groups = No 

winbind trusted domains only = yes 

winbind use default domain = no 

map untrusted to domain = Yes 

map to guest = bad user 

username map = /etc/samba/smbusers 

clustering = yes 

client lanman auth = Yes 

add group script = /usr/sbin/smbldap-groupadd -p "%g" 

delete group script = /usr/sbin/smbldap-groupdel "%g" 

add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g" 

admin users = root 


<nowiki>[netlogon] </nowiki>

path = /mnt/gfs2/samba/netlogon 

read only = yes 

browsable = no 

guest ok = yes 


<nowiki>[profiles] </nowiki>

path = /mnt/gfs2/samba/profiles 

read only = no 

create mask = 0600 

directory mask = 0700 


<nowiki>[homes] </nowiki>

browsable = no 

writable = yes 

path = /mnt/gfs2/share/%u 


<nowiki>[nitrobit] </nowiki>

path = /mnt/gfs2/samba/nitrobit 

read only = no 

public = yes 

browsable = yes 

writable = yes 

guest ok = yes 


<nowiki>[csmb] </nowiki>

comment = Clustered Samba 

public = yes 

path = /mnt/gfs2/share 

writeable = yes 

ea support = yes 


Finally start the Samba service: 


<nowiki># service ctdb start; chkconfig ctdb on</nowiki>