Editing Punjab samba architectural change


[[category:Punjab's IFMS-IWDMS Project]]

 
== Samba Cluster for Punjab's IFMS-IWDMS project ==

 Abhinav Sharma
 Tetra Information Services











==Introduction==


 The client wanted a Domain Controller, with a centralized authentication mechanism. To ensure this,
 Samba 3.5 was installed with 389-Directory server at the backend.

 This document has been divided into two parts, one detailing the installation of the Samba ;
 and the other showing the steps taken to integrate it with the ldap server,
 389-DS and configuring it as a Primary Domain Controller (PDC).



==Prerequisites:==

 1) Installation of RHEL 6.3
 2) yum must be configured to ensure Samba and other dependencies can be downloaded
 3) 389-DS must already be setup prior to this installation


==Servers==
 Two servers have been set up as follows:
 pbifmsntp1.pbifmsiwdms.pjb - 192.168.10.81
 pbifmsntp2.pbifmsiwdms.pjb - 192.168.10.82


 Active node: pbifmsntp1.pbifmsiwdms.pjb  
 Standby node: pbifmsntp2.pbifmsiwdms.pjb
 Mounted HDD: /dev/mapper/csmb_vg-csmb_lv ;


==Required Packages== 

 • samba 
 • samba-common 
 • samba-winbind-clients




==Configuration Of LAM:==

 vim /var/lib/ldap-account-manager/config/admin.conf

 # LDAP Account Manager configuration
 #
 # Please do not modify this file manually. The configuration can be done completely by the LAM GUI.
 #
 ###################################################################################################

 # server address (e.g. ldap://localhost:389 or ldaps://localhost:636)
 ServerURL: ldap://192.168.10.98:389

 # list of users who are allowed to use LDAP Account Manager
 # names have to be seperated by semicolons
 # e.g. admins: cn=admin,dc=yourdomain,dc=org;cn=root,dc=yourdomain,dc=org
 Admins: cn=Directory manager

 # password to change these preferences via webfrontend (default: lam)
 Passwd: {SSHA}cjKUoXZejBFB1BWzv7htxcVfKeg= P/mJQQ==

 # suffix of tree view
 # e.g. dc=yourdomain,dc=org
 treesuffix: dc=pbifmsiwdms,dc=pjb

 # default language (a line from config/language)
 defaultLanguage: en_GB.utf8:UTF-8:English (Great Britain)

 # Path to external Script
 scriptPath:

 # Server of external Script
 scriptServer:

 # Access rights for home directories
 scriptRights: 750

 # Number of minutes LAM caches LDAP searches.
 cachetimeout: 5

 # LDAP search limit.
 searchLimit: 0

 # Module settings

 modules: posixAccount_minUID: 10000
 modules: posixAccount_maxUID: 30000
 modules: posixAccount_minMachine: 50000
 modules: posixAccount_maxMachine: 60000
 modules: posixGroup_minGID: 10000
 modules: posixGroup_maxGID: 20000
 modules: posixGroup_pwdHash: SSHA
 modules: posixAccount_pwdHash: SSHA 

 # List of active account types.
 activeTypes: user,group,host,smbDomain


 types: suffix_user: ou=People,dc=pbifmsiwdms,dc=pjb
 types: attr_user: #uid;#givenName;#sn;#uidNumber;#gidNumber
 types: modules_user: inetOrgPerson,posixAccount,shadowAccount,sambaSamAccount

 types: suffix_group: ou=Groups,dc=pbifmsiwdms,dc=pjb
 types: attr_group: #cn;#gidNumber;#memberUID;#description
 types: modules_group: posixGroup,sambaGroupMapping

 types: suffix_host: ou=computers,dc=pbifmsiwdms,dc=pjb
 types: attr_host: #cn;#description;#uidNumber;#gidNumber
 types: modules_host: account,posixAccount,sambaSamAccount

 types: suffix_smbDomain: dc=pbifmsiwdms,dc=pjb
 types: attr_smbDomain: sambaDomainName:Domain name;sambaSID:Domain SID
 types: modules_smbDomain: sambaDomain

 # Password mail subject
 lamProMailSubject: Your password was reset

 # Password mail text
 lamProMailText: Dear @@givenName@@ @@sn@@,+::++::+your password was reset to:
 @@newPassword@@+::++::++::+Best regards+::++::+deskside  support+::+



 # enable TLS encryption
 useTLS: no


 # Access level for this profile.
 accessLevel: 100

 # Login method.
 loginMethod: list


 # Search suffix for LAM login.
 loginSearchSuffix: dc=yourdomain,dc=org


 # Search filter for LAM login.
 loginSearchFilter: uid=%USER%


 # Bind DN for login search.
 loginSearchDN:


 # Bind password for login search.
 loginSearchPassword: asd1234f


 # HTTP authentication for LAM login.
 httpAuthentication: false


 # Password mail from
 lamProMailFrom:


 # Password mail reply-to
 lamProMailReplyTo:


# Password mail is HTML
lamProMailIsHTML: false
modules: sambaSamAccount_timeZone: 0
modules: sambaSamAccount_lmHash: yes
modules: sambaSamAccount_hideHomeDrive: false
modules: sambaSamAccount_hideHomePath: false
modules: sambaSamAccount_hideProfilePath: false
modules: sambaSamAccount_hideLogonScript: false
modules: sambaSamAccount_hideWorkstations: false
modules: sambaSamAccount_hideLogonHours: false
modules: sambaSamAccount_hideTerminalServer: false
modules: posixAccount_primaryGroupAsSecondary: false
modules: inetOrgPerson_hideDescription: false
modules: inetOrgPerson_hideStreet: false
modules: inetOrgPerson_hidePostOfficeBox: false
modules: inetOrgPerson_hidePostalCode: false
modules: inetOrgPerson_hideLocation: false
modules: inetOrgPerson_hideState: false
modules: inetOrgPerson_hidePostalAddress: false
modules: inetOrgPerson_hideRegisteredAddress: false
modules: inetOrgPerson_hideOfficeName: false
modules: inetOrgPerson_hideRoomNumber: false
modules: inetOrgPerson_hideTelephoneNumber: false
modules: inetOrgPerson_hideHomeTelephoneNumber: false
modules: inetOrgPerson_hideMobileNumber: false
modules: inetOrgPerson_hideFaxNumber: false
modules: inetOrgPerson_hideEMailAddress: false
modules: inetOrgPerson_hideJobTitle: false
modules: inetOrgPerson_hideCarLicense: false
modules: inetOrgPerson_hideEmployeeType: false
modules: inetOrgPerson_hideBusinessCategory: false
modules: inetOrgPerson_hideDepartments: false
modules: inetOrgPerson_hideManager: false
modules: inetOrgPerson_hideO: false
modules: inetOrgPerson_hideEmployeeNumber: false
modules: inetOrgPerson_hideInitials: false
modules: inetOrgPerson_hideLabeledURI: false
tools: tool_hide_toolPDFEditor: false
tools: tool_hide_toolProfileEditor: false
tools: tool_hide_toolFileUpload: false
tools: tool_hide_toolSchemaBrowser: false
tools: tool_hide_toolServerInformation: false
tools: tool_hide_toolOUEditor: false
tools: tool_hide_toolTests: false                                                                                                                                                                                                   
==PAM Configuration== 

 Chack if nss_ldap is installed with: 

 # rpm -qa|grep -i nss-ldap 

 otherwise: 

 # yum install nss-pam-ldapd

 On both the samba nodes, run this:

 authconfig --enableldap --enableldapauth --disablenis \
 --enablecache –ldapserver=ldap1.pbifmsiwdms.pjb\
 --ldapbasedn=dc=pbifmsiwdms,dc=pjb --updateall 

    Then ensure ldap.conf has the following settings: 
 URI ldap://ldap1.pbifmsiwdms.pjb/ ldap://ldap2.pbifmsiwdms.pjb/ 
 TLS_CACERTDIR /etc/openldap/cacerts 
 TLS_REQCERT allow 
 TLS_CACERT /etc/openldap/cacerts/cacert.asc 
 BASE dc=pbifmsiwdms,dc=pjb 
 HOST pbifmsntp1.pbifmsiwdms.pjb 
 binddn "cn=Directory manager" 
 bindpw asd1234f 
 rootbinddn "cn=Directory manager" 
 port 389 
 bind_policy soft 
 nss_reconnect_tries 2 
 nss_base_passwd         ou=People,dc=pbifmsiwdms,dc=pjb?one 
 nss_base_passwd         ou=Computers,dc=pbifmsiwdms,dc=pjb?one 
 nss_base_shadow         ou=People,dc=pbifmsiwdms,dc=pjb?one 
 nss_base_group          ou=Groups,dc=pbifmsiwdms,dc=pjb?one 

 Without configuring ldap.conf, samba will not search posix accounts into ldap. Also, ensure that DNS has been setup.
 Architecture Diagram







==Samba Configuration:==

[global]
workgroup = PUNJABGOVT
netbios name= PUNJABGOVT1
security = user
passdb backend = ldapsam:ldap://ldap1.pbifmsiwdms.pjb/
hosts allow = 127.0.0.1 192.168.10.0/24 192.168.20.0/24 192.168.70.0/24 10.10.20.0/24 10.10.22.0/24 172.22.0.0/16
smb ports = 139
ldap admin dn = cn=Directory Manager
ldap suffix = dc=pbifmsiwdms,dc=pjb
ldap user suffix = ou=People
ldap machine suffix = ou=Computers
ldap group suffix = ou=Groups
lanman auth = yes
client lanman auth = yes
log file = /var/log/samba/%m.log
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
#obey pam restrictions = no
ldap passwd sync = yes
os level = 65
domain logons = yes
domain master = yes
local master = yes
preferred master = yes
ldap ssl= off
wins support = yes
wins proxy = yes
logon path = \\%L\profiles\%U
logon home = \\%L\%U

logon drive = H:
map to guest = bad user
logon script = logon.cmd
template shell = /bin/false
winbind use default domain = no
map to guest = bad user
map untrusted to domain = Yes
enable privileges = yes
lm announce = yes
pam password change = yes
passwd program = /usr/sbin/smbldap-passwd  %u

log level = 3
max log size = 1000
syslog only = no
syslog = 3

name resolve order = wins lmhosts hosts bcast
username map = /etc/samba/smbusers
add user script = /usr/sbin/smbldap-useradd -a %u
add machine script = /usr/sbin/smbldap-useradd -w %u
add group script = /usr/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/sbin/smbldap-groupdel "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'
delete user from group script = /usr/sbin/smbldap-groupmod -x '%u' '%g'
admin users = root
winbind enum groups = No
winbind trusted domains only = yes


[netlogon]
path = /mnt/gfs2/samba/netlogon
read only = yes
browsable = no
guest ok = yes


[profiles]
path = /mnt/gfs2/samba/profiles
read only = no
create mask = 0600
directory mask = 0700

#[profiles.V2]
#copy = profiles
#browseable = no

[homes]
browsable = no
writable = yes
path = /mnt/gfs2/share/%u

[csmb]
comment = Samba
public = yes
path = /mnt/gfs2/share
writeable = yes
ea support = yes

[nitrobit]
path = /mnt/gfs2/samba/nitrobit
read only = no
public = yes
browsable = yes
writable = yes
guest ok = yes







 Create appropriate directories/permissions for the Samba shares defined in your configuration : 	

 # mkdir -p /mnt/gfs2/samba 
 # mkdir /mnt/gfs2/samba/{netlogon,profiles} 
 # chown root:root -R /mnt/gfs2/samba 
 # chmod 0755 /mnt/gfs2/samba/netlogon 
 # chmod 1755 /mnt/gfs2/samba/profiles 
 # mkdir -p /mnt/gfs2/nitrobit




 Create a password for the ldap admin dn (the Directory Manager's Password) in Samba's secret file: 

 # smbpasswd -w <ldap-admin-password> 
 Setting stored passnword for "cn=Directory Manager" in secrets.tdb 

 net getlocalsid 
 SID for domain PUNJABGOVT is: S-1-5-21-4070117540-217532476-2757550252 



 If sid is not coming then you can Set manually by
 # Net setlocalsid  S-1-5-21-4070117540-217532476-2757550252

 Then Ckeck Groups of ldpa server is coming or not by 

 # net groupmap list
 PUNJABGOVT\Domain Users (S-1-5-21-4070117540-217532476-2757550252-513) -> Domain Users
 Domain Guests (S-1-5-21-4070117540-217532476-2757550252-514) -> Domain Guests
 Domain Computers (S-1-5-21-4070117540-217532476-2757550252-515) -> Domain Computers
 Administrators (S-1-5-32-544) -> Administrators
 Account Operators (S-1-5-32-548) -> Account Operators
 Print Operators (S-1-5-32-550) -> Print Operators
 Backup Operators (S-1-5-32-551) -> Backup Operators
 Replicators (S-1-5-32-552) -> Replicators
 Power Users (S-1-5-21-4070117540-217532476-2757550252-2912) -> Power Users
 PUNJABGOVT\Domain Admins (S-1-5-21-4070117540-217532476-2757550252-512) -> Domain Admins
 PUNJABGOVT\TCSDC (S-1-5-21-4070117540-217532476-2757550252-39001) -> TCSDC
 PUNJAB-USERS (S-1-5-21-4070117540-217532476-2757550252-39003) -> PUNJAB-USERS
 Datacenter Administrator (S-1-5-21-4070117540-217532476-2757550252-39005) -> data_admin



==Samba troubleshooting==

 If the client computers get the error that they cannot contact the Domain Controller specified,
  then check if nmb is running. If not, start  it.
 # service nmb start

 To check if an account can connect:
 # smbclient -L samba.pbifmsiwdms.pjb -U <username>

 To check if a user is read from the ldap server:
 # getent passwd <username>
 For example: 
 # getent passwd admin 
 admin:*:11071:5122:System User:/home/admin:/bin/bash

 This will show the user's POSIX details, as stored on the 389-DS server.

 It can be similarly used for groups, as follows:
 # getent group 'Domain Admins' 
 Domain Admins:*:5122:admin 


 'net' commands:

 To see the group mappings:
 # net groupmap list

 To add a group:
 # net groupmap add rid=513 \ 
 ntgroup='PUNJABGOVT\Domain Users' \
 unixgroup='Domain Users'

 To see a group's members:
 # net rpc group members "Domain Admins”

 To see a members's groups:
 # net rpc user info admin

 To get the SID:
 # net getdomainsid

     If Samba root/administrator users are blocked
   # pdbedit –c=’[]’ –-user=root
   # pdbedit –c=’[U]’ –-user=root

==Test Join==

 # Net rpc testjoin
 To join server in domain by admin user
 # net join –U admin







==Manual Swich Over:==  

 We have Done the manual Swich Over instead of Cluster Because any updation and upgradation 
 of packages and operation System effect Cluster  directly or indirectly. Due to which whole architecture
 get disturbe.  So after Analysis and  discussion We proceed with Manual swich over.


 1.	Node1: 
 # /etc/init.d/network restart
 #/etc/init.d/smb stop
 #/etc/init.d/nmb stop



 Node2:

 # ifconfig eth0:0 192.168.10.93 netmask 255.255.255.0
 # /etc/init.d/smb start;
 #/etc/init.d/nmb start