Editing GSTN - Additional Domain Controller (ADC ) Implementation Document

[[category:GSTN]]



'''Setup additional Samba Domain Controller installation document.'''

1. Configure yum repository for Packages installation.


Edit '''/etc/yum.repos.d/local.repo '''

<div style="margin-left:0cm;margin-right:0cm;">''<nowiki>#</nowiki> vi /etc/yum.repos.d/local.repo''' '''''</div>


[[Image:Image-GSTNADC1.png]]

Make below entries. Save file and exit.


''[local]''

''name=local''

''baseurl=file:///mnt''

''gpgcheck=0''

''enabled=1''

[[Image:Image-GSTNADC2.png]]
















2. Set hostname.


''<nowiki># hostnamectl set-hostname gd9104.gstn.local</nowiki>''


[[Image:Image-GSTNADC3.png]]


3. Assign the Ipv4 address.

''<nowiki># nmcli connection modify eth0 ipv4.addresses 172.18.101.15/24 ipv4.method manual ipv4.gateway 172.18.101.1 connection.autoconnect yes ipv4.dns 172.18.101.15</nowiki>''






[[Image:Image-GSTNADC4.png]]








4. Assign the Ipv6 address and restart the network services.

''<nowiki># nmcli connection modify eth0 ipv6.addresses 2404:a800:1000:d:7800::f/69 ipv6.method manual ipv6.gateway 2404:a800:1000:d:7800::1 connection.autoconnect yes ipv6.dns 2404:a800:1000:d:7800::f</nowiki>''


''<nowiki># systemctl restart network.service</nowiki>''


[[Image:Image-GSTNADC5.png]]


5. Edit '''/etc/hosts '''file.

''<nowiki># vi /etc/hosts</nowiki>''


[[Image:Image-GSTNADC6.png]]








6. Make below entries in '''/etc/hosts''' file and reboot the server.


''172.18.101.15gd9104.gstn.localgd9104''

''2404:a800:1000:d:7800::fgd9104.gstn.localgd9104''


[[Image:Image-GSTNADC7.png]]

7. After rebooting server logged in as root user and Install Dependencies for samba .


''<nowiki># yum install perl gcc attr libacl-devel libblkid-devel gnutls-devel readline-devel python-devel gdb pkgconfig krb5-workstation zlib-devel setroubleshoot-server libaio-devel setroubleshoot-plugins policycoreutils-python libsemanage-python perl-ExtUtils-MakeMaker perl-Parse-Yapp perl-Test-Base popt-devel libxml2-devel libattr-devel keyutils-libs-devel cups-devel bind-utils libxslt docbook-style-xsl openldap-devel autoconf python-crypto pam-devel</nowiki>''


[[Image:Image-GSTNADC8.png]]






8. Download '''samba''' tar file from [https://www.samba.org/ https://www.samba.org/] '''and extract it.


''<nowiki># tar xvzf samba-4.4.4.tar.gz</nowiki>''


[[Image:Image-GSTNADC9.png]]

9. Enter in samba-4.4.4 directory and run configure command.


''<nowiki># cd samba-4.4.4/</nowiki>''

''<nowiki># ./configure</nowiki>''


[[Image:Image-GSTNADC10.png]]












Configure done successfully.


[[Image:Image-GSTNADC11.png]]


10. Run '''make''' command.


''<nowiki># make</nowiki>''


[[Image:Image-GSTNADC12.png]]














Make command finished successfully.


[[Image:Image-GSTNADC13.png]]

11. Run '''make install '''command.


''<nowiki># make install</nowiki>''


[[Image:Image-GSTNADC14.png]]


















Make install command completed successfully.


[[Image:Image-GSTNADC15.png]]




12. Create a file /etc/rc.d/init.d/samba4


''<nowiki># vi /etc/rc.d/init.d/samba4</nowiki>''


[[Image:Image-GSTNADC16.png]]












13. Paste the below content in '''/etc/rc.d/init.d/samba4''' file'' ''and save and exit.


<nowiki>#! /bin/bash</nowiki>


<nowiki>#</nowiki>


<nowiki># samba4 Bring up/down samba4 service</nowiki>


<nowiki>#</nowiki>


<nowiki># chkconfig: - 90 10</nowiki>


<nowiki># description: Activates/Deactivates all samba4 interfaces configured to \</nowiki>


<nowiki># start at boot time.</nowiki>


<nowiki>#</nowiki>


<nowiki>### BEGIN INIT INFO</nowiki>


<nowiki># Provides:</nowiki>


<nowiki># Should-Start:</nowiki>


<nowiki># Short-Description: Bring up/down samba4</nowiki>


<nowiki># Description: Bring up/down samba4</nowiki>


<nowiki>### END INIT INFO</nowiki>


<nowiki># Source function library.</nowiki>


. /etc/init.d/functions


if [ -f /etc/sysconfig/samba4 ]; then


. /etc/sysconfig/samba4


fi


CWD=$(pwd)


prog="samba4"


start() {


<nowiki># Attach irda device</nowiki>


echo -n $"Starting $prog: "


/usr/local/samba/sbin/samba


sleep 2


if ps ax | grep -v "grep" | grep -q /samba/sbin/samba ; then success $"samba4 startup"; else failure $"samba4 startup"; fi


echo


}


stop() {


<nowiki># Stop service.</nowiki>


echo -n $"Shutting down $prog: "


killall samba


sleep 2


if ps ax | grep -v "grep" | grep -q /samba/sbin/samba ; then failure $"samba4 shutdown"; else success $"samba4 shutdown"; fi


echo


}


status() {


/usr/local/samba/sbin/samba --show-build


}






<nowiki># See how we were called.</nowiki>


case "$1" in


start)


start


<nowiki>;;</nowiki>


stop)


stop


<nowiki>;;</nowiki>


status)


status irattach


<nowiki>;;</nowiki>


restart|reload)


stop


start


<nowiki>;;</nowiki>


<nowiki>*)</nowiki>


echo $"Usage: $0 {start|stop|restart|status}"


exit 1


esac






exit 0










[[Image:Image-GSTNADC17.png]]














14. Set the permissions on samba4 file and export path.


''<nowiki># chmod 755 /etc/rc.d/init.d/samba4</nowiki>''

''<nowiki># chmod +x /etc/rc.d/init.d/samba4</nowiki>''

''<nowiki># ln -s /etc/rc.d/init.d/samba4 /etc/rc3.d/S80samba4</nowiki>''

''<nowiki># chkconfig --add samba4</nowiki>''

''<nowiki># chkconfig samba4 on</nowiki>''

''<nowiki># export PATH=/usr/local/samba/bin/:/usr/local/samba/sbin/:$PATH</nowiki>''


[[Image:Image-GSTNADC18.png]]

15. Edit in '''/etc/krb5.conf '''file.


''<nowiki># vi /etc/krb5.conf</nowiki>''


[[Image:Image-GSTNADC19.png]]








16. Make below entries in '''/etc/krb5.conf '''file.


''[libdefaults]''

''default_realm = GSTN.LOCAL''

''dns_lookup_realm = false''

''dns_lookup_kdc = true''


[[Image:Image-GSTNADC20.png]]




17. Edit in '''/etc/resolv.conf''' file.


[[Image:Image-GSTNADC21.png]]








18. Make below entries and save file.


''search gstn.local''

''nameserver 172.18.101.14''

''nameserver 172.18.101.15''

''nameserver 2404:a800:1000:d:7800::f''


[[Image:Image-GSTNADC22.png]]


19. Verify a correct name resolution by running below command. We should get output like in screen shot.


''<nowiki># host -t A gd9103.gstn.local</nowiki>''


[[Image:Image-GSTNADC23.png]]






20. Run "kinit" to obtain a Kerberos ticket, and to verify that you had received a Kerberos ticket, run: "klist -e" :


''<nowiki># kinit administrator</nowiki>''

''<nowiki># </nowiki>klist -e''


[[Image:Image-GSTNADC24.png]]


21. Run below command to join the existing domain as a Domain Controller.


''<nowiki># /usr/local/samba/bin/samba-tool domain join gstn.local DC -Uadministrator --realm=GSTN.LOCAL --dns-backend=BIND9_DLZ</nowiki>''




[[Image:Image-GSTNADC25.png]]








22. We will receive output like below in screen shot after successfull joining.


[[Image:Image-GSTNADC26.png]]

23. Fix keytab permissions.

Fix permissions on the "dns.keytab" file, to allow BIND to read this file. Run below commands.


''<nowiki># chmod 640 /usr/local/samba/private/dns.keytab</nowiki>''

''<nowiki># chgrp named /usr/local/samba/private/dns.keytab</nowiki>''

''<nowiki># chown named:named /usr/local/samba/private/named.conf</nowiki>''


[[Image:Image-GSTNADC27.png]]












24. Now edit '''/etc/named.conf''' file.


''<nowiki># vi /etc/named.conf </nowiki>''


[[Image:Image-GSTNADC28.png]]

25. Make below entries.


''tkey-gssapi-keytab "/usr/local/samba/private/dns.keytab";''

''listen-on port 53 { 127.0.0.1; any; };''

''listen-on-v6 port 53 { ::1; any; };''

''allow-query { localhost; any; };''


[[Image:Image-GSTNADC29.png]]










And also add below line at the end of the '''/etc/named.conf''' file. Save and exit.


''include "/usr/local/samba/private/named.conf";''


[[Image:Image-GSTNADC30.png]]


26. Resolve the A record of the new joined Domain Controller.


[[Image:Image-GSTNADC31.png]]


If the record could not be resolved to its IP, you will receive the following output instead:


'''''Host gd9104.gstn.local. not found: 3(NXDOMAIN)'''''


In this case we have to add record manually to the AD DNS zone on PDC. For Ipv4 run below command.


''<nowiki># /usr/local/samba/bin/samba-tool dns add gd9103 gstn.local gd9104 A 172.18.101.15 -Uadministrator</nowiki>''

''Password for [GSTN\administrator]:''

''<nowiki>*********</nowiki>''

''Record added successfully''




For Ipv6 run below command.


''<nowiki># /usr/local/samba/bin/samba-tool dns add gd9103 gstn.local gd9104 AAAA 2404:a800:1000:d:7800::f -Uadministrator</nowiki>''

''Password for [GSTN\administrator]:''

''<nowiki>*********</nowiki>''

''Record added successfully''


















27. Start samba service.

''<nowiki># systemctl start samba4.service</nowiki>''

''<nowiki># chkconfig --add samba4</nowiki>''

''<nowiki># chkconfig samba4 on</nowiki>''


[[Image:Image-GSTNADC32.png]]




28. Check status of samba services.


''<nowiki># systemctl status samba4.service</nowiki>''

[[Image:Image-GSTNADC33.png]]
















29. Directory Replication.


A few minutes after we have started Samba, connections with other DCs will be established automatically. 

Run below command to check the replication.


''<nowiki># /usr/local/samba/bin/samba-tool drs showrepl</nowiki>''


[[Image:Image-GSTNADC34.png]]


30. If replication is working, Start named services.


''<nowiki># systemctl start named.service</nowiki>''

''<nowiki># systemctl enable named.service</nowiki>''

''<nowiki># systemctl status named.service</nowiki>''


[[Image:Image-GSTNADC35.png]]




31. Best practice: DNS configuration on DCs 


A best practice for DNS configuration on DCs is, that you don't define the IP of the local DNS as the first nameserver.


<u>'''/etc/resolv.conf''' on gd9103.gstn.local:</u>


''<nowiki># Generated by NetworkManager</nowiki>''

''search gstn.local''

''nameserver 172.18.101.15''

''nameserver 172.18.101.14''

''nameserver 2404:a800:1000:d:7800::e''




<u>'''/etc/resolv.conf '''on gd9104.gstn.local:</u>

''<nowiki># Generated by NetworkManager</nowiki>''

''search gstn.local''

''nameserver 172.18.101.14''

''nameserver 172.18.101.15''

''nameserver 2404:a800:1000:d:7800::f''






32. SYSVOL replication.


Samba AD currently doesn't provide support for SysVol replication. To achive this important feature in a Multi-DC environment, until it's implemented, workarounds are necessary to keep it in sync. This HowTo provides a basic workaround solution based on rsync.

This tool is unidirectional, this means files can only be transferred in one direction. That's why for rsync-based SysVol replication, you have to choose one DC on which you do all modifications like GPO edits, logon script changes, etc. A good choice for this "master" host is the one that contains the FSMO roles. All other DC's retrieve the changes from this host, this is because modifications on them are overwritten when syncing. 




1. Setup SysVol replication:


a. Install rsync on the pdc by runing below command.

''<nowiki># yum install rsync</nowiki>''


[[Image:Image-GSTNADC36.png]]














































b. Open '''/etc/rsyncd.conf '''file and make below entries.


''[SysVol]''


''path = /usr/local/samba/var/locks/sysvol/''


''comment = Samba Sysvol Share''


''uid = root''


''gid = root''


''read only = yes''


''auth users = sysvol-replication''


''secrets file = /usr/local/samba/etc/rsyncd.secret''






[[Image:Image-GSTNADC37.png]]


c. Create a file '''/usr/local/samba/etc/rsyncd.secret'''.


<nowiki># vi /usr/local/samba/etc/rsyncd.secret</nowiki>




[[Image:Image-GSTNADC38.png]]

d. Make below entry in '''rsyncd.secret''' file.


''sysvol-replication:Pa$$w0rD''


and set 600 permission on this file.

<nowiki># chmod 600 /usr/local/samba/etc/rsyncd.secret</nowiki>














[[Image:Image-GSTNADC39.png]]




e. Restart rsyncd services.

''<nowiki># systemctl restart rsyncd.service</nowiki>''


[[Image:Image-GSTNADC40.png]]


2. Setup on secondary Domain Controller 


a. Install rsync on the adc by runing below command.


''<nowiki># yum install rsync</nowiki>''


[[Image:Image-GSTNADC41.png]]

b. Create a password file /usr/local/samba/etc/rsync-sysvol.secret. 

''<nowiki># vi /usr/local/samba/etc/rsync-sysvol.secret</nowiki>''


[[Image:Image-GSTNADC42.png]]
















c. Fill it with the password you set on the PDC for the sysvol-replication rsync account.

''Pa$$w0rD''


[[Image:Image-GSTNADC43.png]]


d. Set 600 permission on this file and restart rsync service.

<nowiki># chmod 600 /usr/local/samba/etc/rsyncd.secret</nowiki>

<nowiki># systemctl restart rsyncd.service</nowiki>


[[Image:Image-GSTNADC44.png]]

e. For replicating the SysVol folder, run the following command (--dry-run means that no modifications are actually made):


''<nowiki># /usr/bin/rsync --dry-run -XAavz --delete-after --password-file=/usr/local/samba/etc/rsync-sysvol.secret rsync://sysvol-replication@172.18.101.14/SysVol/ /usr/local/samba/var/locks/sysvol/</nowiki>''


[[Image:Image-GSTNADC45.png]]


f. If everything looks sane, run the command without the --dry-run option and let rsync do the replication.

To automate synchronisation, run the command via cron.


''<nowiki># */2 * * * * /usr/bin/rsync -XAavz --delete-after --password-file=/usr/local/samba/etc/rsync-sysvol.secret rsync://sysvol-replication@172.18.101.14/SysVol/ /usr/local/samba/var/locks/sysvol/</nowiki>''


[[Image:Image-GSTNADC46.png]]