Abhinav at 10:45, 19 February 2014

2014-02-19T10:45:11Z

← Older revision	Revision as of 10:45, 19 February 2014
Line 1:	Line 1:

		[[category:Punjab's IFMS-IWDMS Project]]

Abhinav: Created page with " == Samba Cluster for Punjab's IFMS-IWDMS project == Abhinav Sharma Tetra Information Services ==Introduction== The client wanted a Domain Controller, wit..."

2014-02-19T10:44:11Z

Created page with " == Samba Cluster for Punjab's IFMS-IWDMS project == Abhinav Sharma Tetra Information Services ==Introduction== The client wanted a Domain Controller, wit..."

New page

== Samba Cluster for Punjab's IFMS-IWDMS project ==

Abhinav Sharma
Tetra Information Services

==Introduction==

The client wanted a Domain Controller, with a centralized authentication mechanism. To ensure this,
Samba 3.5 was installed with 389-Directory server at the backend.

This document has been divided into two parts, one detailing the installation of the Samba ;
and the other showing the steps taken to integrate it with the ldap server,
389-DS and configuring it as a Primary Domain Controller (PDC).

==Prerequisites:==

1) Installation of RHEL 6.3
2) yum must be configured to ensure Samba and other dependencies can be downloaded
3) 389-DS must already be setup prior to this installation

==Servers==
Two servers have been set up as follows:
pbifmsntp1.pbifmsiwdms.pjb - 192.168.10.81
pbifmsntp2.pbifmsiwdms.pjb - 192.168.10.82

Active node: pbifmsntp1.pbifmsiwdms.pjb
Standby node: pbifmsntp2.pbifmsiwdms.pjb
Mounted HDD: /dev/mapper/csmb_vg-csmb_lv ;

==Required Packages==

• samba
• samba-common
• samba-winbind-clients

==Configuration Of LAM:==

vim /var/lib/ldap-account-manager/config/admin.conf

# LDAP Account Manager configuration
#
# Please do not modify this file manually. The configuration can be done completely by the LAM GUI.
#
###################################################################################################

# server address (e.g. ldap://localhost:389 or ldaps://localhost:636)
ServerURL: ldap://192.168.10.98:389

# list of users who are allowed to use LDAP Account Manager
# names have to be seperated by semicolons
# e.g. admins: cn=admin,dc=yourdomain,dc=org;cn=root,dc=yourdomain,dc=org
Admins: cn=Directory manager

# password to change these preferences via webfrontend (default: lam)
Passwd: {SSHA}cjKUoXZejBFB1BWzv7htxcVfKeg= P/mJQQ==

# suffix of tree view
# e.g. dc=yourdomain,dc=org
treesuffix: dc=pbifmsiwdms,dc=pjb

# default language (a line from config/language)
defaultLanguage: en_GB.utf8:UTF-8:English (Great Britain)

# Path to external Script
scriptPath:

# Server of external Script
scriptServer:

# Access rights for home directories
scriptRights: 750

# Number of minutes LAM caches LDAP searches.
cachetimeout: 5

# LDAP search limit.
searchLimit: 0

# Module settings

modules: posixAccount_minUID: 10000
modules: posixAccount_maxUID: 30000
modules: posixAccount_minMachine: 50000
modules: posixAccount_maxMachine: 60000
modules: posixGroup_minGID: 10000
modules: posixGroup_maxGID: 20000
modules: posixGroup_pwdHash: SSHA
modules: posixAccount_pwdHash: SSHA

# List of active account types.
activeTypes: user,group,host,smbDomain

types: suffix_user: ou=People,dc=pbifmsiwdms,dc=pjb
types: attr_user: #uid;#givenName;#sn;#uidNumber;#gidNumber
types: modules_user: inetOrgPerson,posixAccount,shadowAccount,sambaSamAccount

types: suffix_group: ou=Groups,dc=pbifmsiwdms,dc=pjb
types: attr_group: #cn;#gidNumber;#memberUID;#description
types: modules_group: posixGroup,sambaGroupMapping

types: suffix_host: ou=computers,dc=pbifmsiwdms,dc=pjb
types: attr_host: #cn;#description;#uidNumber;#gidNumber
types: modules_host: account,posixAccount,sambaSamAccount

types: suffix_smbDomain: dc=pbifmsiwdms,dc=pjb
types: attr_smbDomain: sambaDomainName:Domain name;sambaSID:Domain SID
types: modules_smbDomain: sambaDomain

# Password mail subject
lamProMailSubject: Your password was reset

# Password mail text
lamProMailText: Dear @@givenName@@ @@sn@@,+::++::+your password was reset to:
@@newPassword@@+::++::++::+Best regards+::++::+deskside support+::+

# enable TLS encryption
useTLS: no

# Access level for this profile.
accessLevel: 100

# Login method.
loginMethod: list

# Search suffix for LAM login.
loginSearchSuffix: dc=yourdomain,dc=org

# Search filter for LAM login.
loginSearchFilter: uid=%USER%

# Bind DN for login search.
loginSearchDN:

# Bind password for login search.
loginSearchPassword: asd1234f

# HTTP authentication for LAM login.
httpAuthentication: false

# Password mail from
lamProMailFrom:

# Password mail reply-to
lamProMailReplyTo:

# Password mail is HTML
lamProMailIsHTML: false
modules: sambaSamAccount_timeZone: 0
modules: sambaSamAccount_lmHash: yes
modules: sambaSamAccount_hideHomeDrive: false
modules: sambaSamAccount_hideHomePath: false
modules: sambaSamAccount_hideProfilePath: false
modules: sambaSamAccount_hideLogonScript: false
modules: sambaSamAccount_hideWorkstations: false
modules: sambaSamAccount_hideLogonHours: false
modules: sambaSamAccount_hideTerminalServer: false
modules: posixAccount_primaryGroupAsSecondary: false
modules: inetOrgPerson_hideDescription: false
modules: inetOrgPerson_hideStreet: false
modules: inetOrgPerson_hidePostOfficeBox: false
modules: inetOrgPerson_hidePostalCode: false
modules: inetOrgPerson_hideLocation: false
modules: inetOrgPerson_hideState: false
modules: inetOrgPerson_hidePostalAddress: false
modules: inetOrgPerson_hideRegisteredAddress: false
modules: inetOrgPerson_hideOfficeName: false
modules: inetOrgPerson_hideRoomNumber: false
modules: inetOrgPerson_hideTelephoneNumber: false
modules: inetOrgPerson_hideHomeTelephoneNumber: false
modules: inetOrgPerson_hideMobileNumber: false
modules: inetOrgPerson_hideFaxNumber: false
modules: inetOrgPerson_hideEMailAddress: false
modules: inetOrgPerson_hideJobTitle: false
modules: inetOrgPerson_hideCarLicense: false
modules: inetOrgPerson_hideEmployeeType: false
modules: inetOrgPerson_hideBusinessCategory: false
modules: inetOrgPerson_hideDepartments: false
modules: inetOrgPerson_hideManager: false
modules: inetOrgPerson_hideO: false
modules: inetOrgPerson_hideEmployeeNumber: false
modules: inetOrgPerson_hideInitials: false
modules: inetOrgPerson_hideLabeledURI: false
tools: tool_hide_toolPDFEditor: false
tools: tool_hide_toolProfileEditor: false
tools: tool_hide_toolFileUpload: false
tools: tool_hide_toolSchemaBrowser: false
tools: tool_hide_toolServerInformation: false
tools: tool_hide_toolOUEditor: false
tools: tool_hide_toolTests: false
==PAM Configuration==

Chack if nss_ldap is installed with:

# rpm -qa|grep -i nss-ldap

otherwise:

# yum install nss-pam-ldapd

On both the samba nodes, run this:

authconfig --enableldap --enableldapauth --disablenis \
--enablecache –ldapserver=ldap1.pbifmsiwdms.pjb\
--ldapbasedn=dc=pbifmsiwdms,dc=pjb --updateall

Then ensure ldap.conf has the following settings:
URI ldap://ldap1.pbifmsiwdms.pjb/ ldap://ldap2.pbifmsiwdms.pjb/
TLS_CACERTDIR /etc/openldap/cacerts
TLS_REQCERT allow
TLS_CACERT /etc/openldap/cacerts/cacert.asc
BASE dc=pbifmsiwdms,dc=pjb
HOST pbifmsntp1.pbifmsiwdms.pjb
binddn "cn=Directory manager"
bindpw asd1234f
rootbinddn "cn=Directory manager"
port 389
bind_policy soft
nss_reconnect_tries 2
nss_base_passwd ou=People,dc=pbifmsiwdms,dc=pjb?one
nss_base_passwd ou=Computers,dc=pbifmsiwdms,dc=pjb?one
nss_base_shadow ou=People,dc=pbifmsiwdms,dc=pjb?one
nss_base_group ou=Groups,dc=pbifmsiwdms,dc=pjb?one

Without configuring ldap.conf, samba will not search posix accounts into ldap. Also, ensure that DNS has been setup.
Architecture Diagram

==Samba Configuration:==

[global]
workgroup = PUNJABGOVT
netbios name= PUNJABGOVT1
security = user
passdb backend = ldapsam:ldap://ldap1.pbifmsiwdms.pjb/
hosts allow = 127.0.0.1 192.168.10.0/24 192.168.20.0/24 192.168.70.0/24 10.10.20.0/24 10.10.22.0/24 172.22.0.0/16
smb ports = 139
ldap admin dn = cn=Directory Manager
ldap suffix = dc=pbifmsiwdms,dc=pjb
ldap user suffix = ou=People
ldap machine suffix = ou=Computers
ldap group suffix = ou=Groups
lanman auth = yes
client lanman auth = yes
log file = /var/log/samba/%m.log
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
#obey pam restrictions = no
ldap passwd sync = yes
os level = 65
domain logons = yes
domain master = yes
local master = yes
preferred master = yes
ldap ssl= off
wins support = yes
wins proxy = yes
logon path = \\%L\profiles\%U
logon home = \\%L\%U

logon drive = H:
map to guest = bad user
logon script = logon.cmd
template shell = /bin/false
winbind use default domain = no
map to guest = bad user
map untrusted to domain = Yes
enable privileges = yes
lm announce = yes
pam password change = yes
passwd program = /usr/sbin/smbldap-passwd %u

log level = 3
max log size = 1000
syslog only = no
syslog = 3

name resolve order = wins lmhosts hosts bcast
username map = /etc/samba/smbusers
add user script = /usr/sbin/smbldap-useradd -a %u
add machine script = /usr/sbin/smbldap-useradd -w %u
add group script = /usr/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/sbin/smbldap-groupdel "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'
delete user from group script = /usr/sbin/smbldap-groupmod -x '%u' '%g'
admin users = root
winbind enum groups = No
winbind trusted domains only = yes

[netlogon]
path = /mnt/gfs2/samba/netlogon
read only = yes
browsable = no
guest ok = yes

[profiles]
path = /mnt/gfs2/samba/profiles
read only = no
create mask = 0600
directory mask = 0700

#[profiles.V2]
#copy = profiles
#browseable = no

[homes]
browsable = no
writable = yes
path = /mnt/gfs2/share/%u

[csmb]
comment = Samba
public = yes
path = /mnt/gfs2/share
writeable = yes
ea support = yes

[nitrobit]
path = /mnt/gfs2/samba/nitrobit
read only = no
public = yes
browsable = yes
writable = yes
guest ok = yes

Create appropriate directories/permissions for the Samba shares defined in your configuration :

# mkdir -p /mnt/gfs2/samba
# mkdir /mnt/gfs2/samba/{netlogon,profiles}
# chown root:root -R /mnt/gfs2/samba
# chmod 0755 /mnt/gfs2/samba/netlogon
# chmod 1755 /mnt/gfs2/samba/profiles
# mkdir -p /mnt/gfs2/nitrobit

Create a password for the ldap admin dn (the Directory Manager's Password) in Samba's secret file:

# smbpasswd -w <ldap-admin-password>
Setting stored passnword for "cn=Directory Manager" in secrets.tdb

net getlocalsid
SID for domain PUNJABGOVT is: S-1-5-21-4070117540-217532476-2757550252

If sid is not coming then you can Set manually by
# Net setlocalsid S-1-5-21-4070117540-217532476-2757550252

Then Ckeck Groups of ldpa server is coming or not by

# net groupmap list
PUNJABGOVT\Domain Users (S-1-5-21-4070117540-217532476-2757550252-513) -> Domain Users
Domain Guests (S-1-5-21-4070117540-217532476-2757550252-514) -> Domain Guests
Domain Computers (S-1-5-21-4070117540-217532476-2757550252-515) -> Domain Computers
Administrators (S-1-5-32-544) -> Administrators
Account Operators (S-1-5-32-548) -> Account Operators
Print Operators (S-1-5-32-550) -> Print Operators
Backup Operators (S-1-5-32-551) -> Backup Operators
Replicators (S-1-5-32-552) -> Replicators
Power Users (S-1-5-21-4070117540-217532476-2757550252-2912) -> Power Users
PUNJABGOVT\Domain Admins (S-1-5-21-4070117540-217532476-2757550252-512) -> Domain Admins
PUNJABGOVT\TCSDC (S-1-5-21-4070117540-217532476-2757550252-39001) -> TCSDC
PUNJAB-USERS (S-1-5-21-4070117540-217532476-2757550252-39003) -> PUNJAB-USERS
Datacenter Administrator (S-1-5-21-4070117540-217532476-2757550252-39005) -> data_admin

==Samba troubleshooting==

If the client computers get the error that they cannot contact the Domain Controller specified,
then check if nmb is running. If not, start it.
# service nmb start

To check if an account can connect:
# smbclient -L samba.pbifmsiwdms.pjb -U <username>

To check if a user is read from the ldap server:
# getent passwd <username>
For example:
# getent passwd admin
admin:*:11071:5122:System User:/home/admin:/bin/bash

This will show the user's POSIX details, as stored on the 389-DS server.

It can be similarly used for groups, as follows:
# getent group 'Domain Admins'
Domain Admins:*:5122:admin

'net' commands:

To see the group mappings:
# net groupmap list

To add a group:
# net groupmap add rid=513 \
ntgroup='PUNJABGOVT\Domain Users' \
unixgroup='Domain Users'

To see a group's members:
# net rpc group members "Domain Admins”

To see a members's groups:
# net rpc user info admin

To get the SID:
# net getdomainsid

If Samba root/administrator users are blocked
# pdbedit –c=’[]’ –-user=root
# pdbedit –c=’[U]’ –-user=root

==Test Join==

# Net rpc testjoin
To join server in domain by admin user
# net join –U admin

==Manual Swich Over:==

We have Done the manual Swich Over instead of Cluster Because any updation and upgradation
of packages and operation System effect Cluster directly or indirectly. Due to which whole architecture
get disturbe. So after Analysis and discussion We proceed with Manual swich over.

1. Node1:
# /etc/init.d/network restart
#/etc/init.d/smb stop
#/etc/init.d/nmb stop

Node2:

# ifconfig eth0:0 192.168.10.93 netmask 255.255.255.0
# /etc/init.d/smb start;
#/etc/init.d/nmb start

Punjab samba architectural change - Revision history

Abhinav at 10:45, 19 February 2014

Abhinav: Created page with " == Samba Cluster for Punjab's IFMS-IWDMS project == Abhinav Sharma Tetra Information Services ==Introduction== The client wanted a Domain Controller, wit..."