Editing Samba for DR (Ahmedabad)- Punjab's IFMS-IWDMS Project

[[category:Punjab's IFMS-IWDMS Project]]

== Samba for DR (Ahmedabad)- Punjab's IFMS-IWDMS Project ==
Navdeep Mathur


= Introduction =
The client wanted a Mirror copy of Slave Domain Controller, with a centralized authentication mechanism. To ensure this, Samba 3.5 was installed with 389-Directory server at the backend.


This document has been divided into two parts, one detailing the installation of the Samba; and the other showing the steps taken to integrate it with the ldap server, 389-DS and configuring it as a Primary Domain Controller (PDC).

== Prerequisites ==
1) yum must be configured to ensure Samba and other dependencies can be downloaded


 <nowiki># yum install samba*</nowiki>


2) Setup ssh logins via auth-keys. (Password-less login). While not necessary, this makes things work MUCH faster between all the servers.


3) 389-DS must already be setup prior to this installation


== Servers ==
Two servers have been set up as follows:

 pbdrntp.pbifmsiwdms.pjb - 192.168.10.81


Ony one server is connected to a SAN, and the Samba shares as well as th stored here. The cluster used is Red Hat Cluster Suite (RHCS).


= Integration of Samba with 389-Directory Server =

== Requirements ==
• openldap-servers (contains migration utilities used in this document)

• 389-DS (the directory server should already be installed)

• samba, samba-client, samba-common (samba server, also provides schema needed for storing samba information)

• schema to ldif migration script (can be downloaded from here:

[http://directory.fedoraproject.org/download/ol-schema-migrate.pl http://directory.fedoraproject.org/download/ol-schema-migrate.pl])


First off we need to provide 389-DS with a samba schema that it understands. Now lets break down how 389-DS implements extending schemas :


• All schema files are in ldif format and loaded during server start .


• All schema's are located in /etc/dirsrv/slapd-pbdrldap/schema.


• Filenames are sequential and loaded in order and 99user.ldif is always the last schema to be loaded.


For this document we are going to name our schema file 61samba.ldif. As stated above we need to provide 389-DS with a schema it understands which involves converting the provided /usr/share/doc/samba/LDAP/samba.schema to ldif format. Luckily, there is a utility provided 3rd party that will assist in doing this which can be found at [http://directory.fedoraproject.org/download/ol-schema-migrate.pl http://directory.fedoraproject.org/download/ol-schema-migrate.pl]


We do this on the 389-DS server.


Use of this script is straight forward :


 <nowiki># perl ol-schema-migrate.pl -b \</nowiki>
 /usr/share/doc/samba-*/LDAP/samba.schema \
 <nowiki>> /etc/dirsrv/slapd-<server>/schema/61samba.ldif</nowiki>


Once the ldif is in place restart the slapd service :


 <nowiki># service dirsrv restart</nowiki>


== PAM Configuration ==
Chack if nss_ldap is installed with:


 <nowiki># rpm -qa|grep -i nss-ldap</nowiki>


otherwise:


 <nowiki># yum install nss-pam-ldapd</nowiki>


On both the samba nodes, run this:


 authconfig --enableldap --enableldapauth --disablenis \
 --enablecache --ldapserver=pbdrldap.pbifmsiwdms.pjb\
 --ldapbasedn=dc=pbifmsiwdms,dc=pjb --updateall


Then ensure ldap.conf has the following settings:

 URI ldap://pbdrldap.pbifmsiwdms.pjb/ 
 BASE dc=pbifmsiwdms,dc=pjb
 HOST pbdrntp.pbifmsiwdms.pjb
 binddn "cn=Directory manager"
 bindpw asd1234f
 rootbinddn "cn=Directory manager"
 port 389
 bind_policy soft
 nss_reconnect_tries 2
 nss_base_passwd ou=People,dc=pbifmsiwdms,dc=pjb?one
 nss_base_passwd ou=Computers,dc=pbifmsiwdms,dc=pjb?one
 nss_base_shadow ou=People,dc=pbifmsiwdms,dc=pjb?one
 nss_base_group ou=Groups,dc=pbifmsiwdms,dc=pjb?one

Without configuring ldap.conf, samba will not search posix accounts into ldap. Also, ensure that DNS has been setup.


== Samba Setup ==


Change /etc/nsswitch.conf to have the following:


 passwd: files ldap sss
 shadow: files ldap sss
 group: files ldap sss


Copy /etc/samba/smb.conf fom Chandigarh DC to Ahmedabad Dr as it is and changes are below :


# Add “hosts allow” entry for DR Network 172.22.0.0/24

 <nowiki>[global]</nowiki>
 workgroup = PUNJABGOVT
 netbios name = PUNJABGOVT1
 hosts allow = 127.0.0.1 192.168.10.0/24 192.168.20.0/24 192.168.70.0/24 10.10.20.0/24 10.10.22.0/24 172.22.0.0/16
 security = user
 map untrusted to domain = Yes
 passdb backend = ldapsam:"ldap://pbdrldap.pbifmsiwdms.pjb"
 ldap admin dn = cn=Directory manager
 ldap suffix = dc=pbifmsiwdms,dc=pjb
 ldap user suffix = ou=People
 ldap machine suffix = ou=Computers
 ldap group suffix = ou=Groups
 ldap ssl = off
 ldap passwd sync = yes
 obey pam restrictions = no
 passwd program = /usr/local/sbin/smbldap-passwd %u
 passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n *password\supdated\ssuccessfully* .
 log file = /var/log/samba/%m.log
 log level = 3
 max log size = 1000
 syslog only = no
 socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
 os level = 65
 domain logons = yes
 domain master = yes
 local master = yes
 preferred master = yes
 wins proxy = yes
 wins support = yes
 logon path = \\%L\profiles\%U
 logon home = \\%L\%U
 logon drive = H:
 template shell = /bin/false
 name resolve order = wins lmhosts hosts bcast
 encrypt passwords = yes
 logon script = logon.cmd
 add user script = /usr/sbin/smbldap-useradd -a %u
 add machine script = /usr/sbin/smbldap-useradd -w %u
 delete user script = /usr/sbin/smbldap-userdel '%u'
 delete user from group script = /usr/sbin/smbldap-groupmod -x '%u' '%g'
 set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'
 lm announce = yes
 pam password change = yes
 enable privileges = yes
 <nowiki>;server string = PunjabGovt</nowiki>
 dns proxy = no
 winbind enum groups = No
 winbind trusted domains only = yes
 winbind use default domain = no
 map untrusted to domain = Yes
 map to guest = bad user
 username map = /etc/samba/smbusers
 add group script = /usr/sbin/smbldap-groupadd -p "%g"
 delete group script = /usr/sbin/smbldap-groupdel "%g"
 add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
 admin users = root
 <nowiki>[netlogon]</nowiki>
 path = /mnt/gfs2/samba/netlogon
 read only = yes
 browsable = no
 guest ok = yes
 <nowiki>[profiles]</nowiki>
 path = /mnt/gfs2/samba/profiles
 read only = no
 create mask = 0600
 directory mask = 0700
 <nowiki>[profiles.V2]</nowiki>
 copy = profiles
 browseable = no
 <nowiki>[homes]</nowiki>
 browsable = no
 writable = yes
 path = /mnt/gfs2/share/%u
 <nowiki>[nitrobit]</nowiki>
 path = /mnt/gfs2/samba/nitrobit
 read only = no
 public = yes
 browsable = yes
 writable = yes
 guest ok =yes


Copy /mnt/gfs2 as it is from Chandigarh DC to DR


Create a password for the ldap admin dn (the Directory Manager's Password) in Samba's secret file:


 <nowiki># smbpasswd -w <ldap-admin-password></nowiki>

Setting stored password for "cn=Directory Manager" in secrets.tdb


== Populating 389-DS with PDC Entry ==
At this point you should have a Samba PDC and a properly configured 389-DS ready to take the appropriate Samba entries. Now we are going to check entries of samba entries on LDAP.


 <nowiki>#ldapsearch –x –D”cn=”Directory Manager” –w asd1234f | grep sambaDomainName</nowiki>
 <nowiki>#smbldap-usershow admin</nowiki>
 <nowiki>#net rpc groupmap list</nowiki>


LDAP already have all the samba entries and not required to create because LDAP is integrated here in smb.conf


 passdb backend = ldapsam:"ldap://pbdrldap.pbifmsiwdms.pjb"
 ldap admin dn = cn=Directory manager
 ldap suffix = dc=pbifmsiwdms,dc=pjb
 ldap user suffix = ou=People
 ldap machine suffix = ou=Computers
 ldap group suffix = ou=Groups


== PDC across subnets ==

Windows machines find the Samba server via NetBios. With the default configuration, this takes place only in the subnet the server is in. To enable the PDC across subnets, we need to configure Samba as a WINS (Windows Internet Name Service) Server.

To ensure this, we enter the following lines in smb.conf:


 domain master = yes
 preferred master = yes
 local master = yes
 wins support = yes
 wins proxy = yes
 os level = 65


== Samba's smb.conf ==


 <nowiki>[global]</nowiki>
 workgroup = PUNJABGOVT
 netbios name = PUNJABGOVT1
 hosts allow = 127.0.0.1 192.168.10.0/24 192.168.20.0/24 192.168.70.0/24 10.10.20.0/24 10.10.22.0/24 172.22.0.0/16
 security = user
 map untrusted to domain = Yes
  passdb backend = ldapsam:"ldap://pbdrldap.pbifmsiwdms.pjb"
 ldap admin dn = cn=Directory manager
 ldap suffix = dc=pbifmsiwdms,dc=pjb
 ldap user suffix = ou=People
 ldap machine suffix = ou=Computers
 ldap group suffix = ou=Groups
 ldap ssl = off
 ldap passwd sync = yes
 obey pam restrictions = no
 passwd program = /usr/local/sbin/smbldap-passwd %u
 passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n *password\supdated\ssuccessfully* .
 log file = /var/log/samba/%m.log
 log level = 3
 max log size = 1000
 syslog only = no
 socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
 os level = 65
 domain logons = yes
 domain master = yes
 local master = yes
 preferred master = yes
 wins proxy = yes
 wins support = yes
 logon path = \\%L\profiles\%U
 logon home = \\%L\%U
 logon drive = H:
 template shell = /bin/false
 name resolve order = wins lmhosts hosts bcast
 encrypt passwords = yes
 logon script = logon.cmd
 add user script = /usr/sbin/smbldap-useradd -a %u
 add machine script = /usr/sbin/smbldap-useradd -w %u
 delete user script = /usr/sbin/smbldap-userdel '%u'
 delete user from group script = /usr/sbin/smbldap-groupmod -x '%u' '%g'
 set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'
 lm announce = yes
 pam password change = yes
 enable privileges = yes
 <nowiki>;server string = PunjabGovt</nowiki>
 dns proxy = no
 winbind enum groups = No
 winbind trusted domains only = yes
 winbind use default domain = no
 map untrusted to domain = Yes
 map to guest = bad user
 username map = /etc/samba/smbusers
 add group script = /usr/sbin/smbldap-groupadd -p "%g"
 delete group script = /usr/sbin/smbldap-groupdel "%g"
 add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
 admin users = root
 <nowiki>[netlogon]</nowiki>
 path = /mnt/gfs2/samba/netlogon
 read only = yes
 browsable = no
 guest ok = yes
 <nowiki>[profiles]</nowiki>
 path = /mnt/gfs2/samba/profiles
 read only = no
 create mask = 0600
 directory mask = 0700
 <nowiki>[profiles.V2]</nowiki>
 copy = profiles
 browseable = no
 <nowiki>[homes]</nowiki>
 browsable = no
 writable = yes
 path = /mnt/gfs2/share/%u
 <nowiki>[nitrobit]</nowiki>
 path = /mnt/gfs2/samba/nitrobit
 read only = no
 public = yes
 browsable = yes
 writable = yes
 guest ok =yes


Nitrobit has been configured to use this following directory:

 /mnt/gfs2/samba/nitrobit


Finally start the Samba service:


 <nowiki># service smb start; chkconfig smb on</nowiki>
 <nowiki># service nmb start; chkconfig nmb on</nowiki>


== Samba troubleshooting ==

If the client computers get the error that they cannot contact the Domain Controller specified, then check if nmb is running. If not, start it.

 <nowiki># service nmb start</nowiki>


To check if an account can connect:

 <nowiki># smbclient -L samba.pbifmsiwdms.pjb -U <username></nowiki>


To check if a user is read from the ldap server:

 <nowiki># getent passwd <username></nowiki>

For example:

 <nowiki># getent passwd admin</nowiki>

admin:*:11071:5122:System User:/home/admin:/bin/bash


This will show the user's POSIX details, as stored on the 389-DS server.


It can be similarly used for groups, as follows:

 <nowiki># getent group 'Domain Admins'</nowiki>

Domain Admins:*:5122:admin


To see the group mappings:

 <nowiki># net groupmap list</nowiki>


To add a group:

 <nowiki># net groupmap add rid=513 \</nowiki>

ntgroup='PUNJABGOVT\Domain Users' \

unixgroup='Domain Users'


To see a group's members:
 
 <nowiki># net rpc group members "Domain Admins”</nowiki>


To see a members's groups:

 <nowiki># net rpc user info admin</nowiki>


To get the SID:

 <nowiki># net getdomainsid</nowiki>