Punjab samba architectural change

Samba Cluster for Punjab's IFMS-IWDMS project

Abhinav Sharma
Tetra Information Services

Introduction

The client wanted a Domain Controller, with a centralized authentication mechanism. To ensure this,
Samba 3.5 was installed with 389-Directory server at the backend.

This document has been divided into two parts, one detailing the installation of the Samba ;
and the other showing the steps taken to integrate it with the ldap server,
389-DS and configuring it as a Primary Domain Controller (PDC).

Prerequisites:

1) Installation of RHEL 6.3
2) yum must be configured to ensure Samba and other dependencies can be downloaded
3) 389-DS must already be setup prior to this installation

Servers

Two servers have been set up as follows:
pbifmsntp1.pbifmsiwdms.pjb - 192.168.10.81
pbifmsntp2.pbifmsiwdms.pjb - 192.168.10.82

Active node: pbifmsntp1.pbifmsiwdms.pjb  
Standby node: pbifmsntp2.pbifmsiwdms.pjb
Mounted HDD: /dev/mapper/csmb_vg-csmb_lv ;

Required Packages

• samba 
• samba-common 
• samba-winbind-clients

Configuration Of LAM:

vim /var/lib/ldap-account-manager/config/admin.conf

# LDAP Account Manager configuration
#
# Please do not modify this file manually. The configuration can be done completely by the LAM GUI.
#
###################################################################################################

# server address (e.g. ldap://localhost:389 or ldaps://localhost:636)
ServerURL: ldap://192.168.10.98:389

# list of users who are allowed to use LDAP Account Manager
# names have to be seperated by semicolons
# e.g. admins: cn=admin,dc=yourdomain,dc=org;cn=root,dc=yourdomain,dc=org
Admins: cn=Directory manager

# password to change these preferences via webfrontend (default: lam)
Passwd: {SSHA}cjKUoXZejBFB1BWzv7htxcVfKeg= P/mJQQ==

# suffix of tree view
# e.g. dc=yourdomain,dc=org
treesuffix: dc=pbifmsiwdms,dc=pjb

# default language (a line from config/language)
defaultLanguage: en_GB.utf8:UTF-8:English (Great Britain)

# Path to external Script
scriptPath:

# Server of external Script
scriptServer:

# Access rights for home directories
scriptRights: 750

# Number of minutes LAM caches LDAP searches.
cachetimeout: 5

# LDAP search limit.
searchLimit: 0

# Module settings

modules: posixAccount_minUID: 10000
modules: posixAccount_maxUID: 30000
modules: posixAccount_minMachine: 50000
modules: posixAccount_maxMachine: 60000
modules: posixGroup_minGID: 10000
modules: posixGroup_maxGID: 20000
modules: posixGroup_pwdHash: SSHA
modules: posixAccount_pwdHash: SSHA 

# List of active account types.
activeTypes: user,group,host,smbDomain

types: suffix_user: ou=People,dc=pbifmsiwdms,dc=pjb
types: attr_user: #uid;#givenName;#sn;#uidNumber;#gidNumber
types: modules_user: inetOrgPerson,posixAccount,shadowAccount,sambaSamAccount

types: suffix_group: ou=Groups,dc=pbifmsiwdms,dc=pjb
types: attr_group: #cn;#gidNumber;#memberUID;#description
types: modules_group: posixGroup,sambaGroupMapping

types: suffix_host: ou=computers,dc=pbifmsiwdms,dc=pjb
types: attr_host: #cn;#description;#uidNumber;#gidNumber
types: modules_host: account,posixAccount,sambaSamAccount

types: suffix_smbDomain: dc=pbifmsiwdms,dc=pjb
types: attr_smbDomain: sambaDomainName:Domain name;sambaSID:Domain SID
types: modules_smbDomain: sambaDomain

# Password mail subject
lamProMailSubject: Your password was reset

# Password mail text
lamProMailText: Dear @@givenName@@ @@sn@@,+::++::+your password was reset to:
@@newPassword@@+::++::++::+Best regards+::++::+deskside  support+::+

# enable TLS encryption
useTLS: no

# Access level for this profile.
accessLevel: 100

# Login method.
loginMethod: list

# Search suffix for LAM login.
loginSearchSuffix: dc=yourdomain,dc=org

# Search filter for LAM login.
loginSearchFilter: uid=%USER%

# Bind DN for login search.
loginSearchDN:

# Bind password for login search.
loginSearchPassword: asd1234f

# HTTP authentication for LAM login.
httpAuthentication: false

# Password mail from
lamProMailFrom:

# Password mail reply-to
lamProMailReplyTo:

1. Password mail is HTML

lamProMailIsHTML: false modules: sambaSamAccount_timeZone: 0 modules: sambaSamAccount_lmHash: yes modules: sambaSamAccount_hideHomeDrive: false modules: sambaSamAccount_hideHomePath: false modules: sambaSamAccount_hideProfilePath: false modules: sambaSamAccount_hideLogonScript: false modules: sambaSamAccount_hideWorkstations: false modules: sambaSamAccount_hideLogonHours: false modules: sambaSamAccount_hideTerminalServer: false modules: posixAccount_primaryGroupAsSecondary: false modules: inetOrgPerson_hideDescription: false modules: inetOrgPerson_hideStreet: false modules: inetOrgPerson_hidePostOfficeBox: false modules: inetOrgPerson_hidePostalCode: false modules: inetOrgPerson_hideLocation: false modules: inetOrgPerson_hideState: false modules: inetOrgPerson_hidePostalAddress: false modules: inetOrgPerson_hideRegisteredAddress: false modules: inetOrgPerson_hideOfficeName: false modules: inetOrgPerson_hideRoomNumber: false modules: inetOrgPerson_hideTelephoneNumber: false modules: inetOrgPerson_hideHomeTelephoneNumber: false modules: inetOrgPerson_hideMobileNumber: false modules: inetOrgPerson_hideFaxNumber: false modules: inetOrgPerson_hideEMailAddress: false modules: inetOrgPerson_hideJobTitle: false modules: inetOrgPerson_hideCarLicense: false modules: inetOrgPerson_hideEmployeeType: false modules: inetOrgPerson_hideBusinessCategory: false modules: inetOrgPerson_hideDepartments: false modules: inetOrgPerson_hideManager: false modules: inetOrgPerson_hideO: false modules: inetOrgPerson_hideEmployeeNumber: false modules: inetOrgPerson_hideInitials: false modules: inetOrgPerson_hideLabeledURI: false tools: tool_hide_toolPDFEditor: false tools: tool_hide_toolProfileEditor: false tools: tool_hide_toolFileUpload: false tools: tool_hide_toolSchemaBrowser: false tools: tool_hide_toolServerInformation: false tools: tool_hide_toolOUEditor: false tools: tool_hide_toolTests: false

PAM Configuration

Chack if nss_ldap is installed with: 

# rpm -qa|grep -i nss-ldap 

otherwise: 

# yum install nss-pam-ldapd

On both the samba nodes, run this:

authconfig --enableldap --enableldapauth --disablenis \
--enablecache –ldapserver=ldap1.pbifmsiwdms.pjb\
--ldapbasedn=dc=pbifmsiwdms,dc=pjb --updateall 

   Then ensure ldap.conf has the following settings: 
URI ldap://ldap1.pbifmsiwdms.pjb/ ldap://ldap2.pbifmsiwdms.pjb/ 
TLS_CACERTDIR /etc/openldap/cacerts 
TLS_REQCERT allow 
TLS_CACERT /etc/openldap/cacerts/cacert.asc 
BASE dc=pbifmsiwdms,dc=pjb 
HOST pbifmsntp1.pbifmsiwdms.pjb 
binddn "cn=Directory manager" 
bindpw asd1234f 
rootbinddn "cn=Directory manager" 
port 389 
bind_policy soft 
nss_reconnect_tries 2 
nss_base_passwd         ou=People,dc=pbifmsiwdms,dc=pjb?one 
nss_base_passwd         ou=Computers,dc=pbifmsiwdms,dc=pjb?one 
nss_base_shadow         ou=People,dc=pbifmsiwdms,dc=pjb?one 
nss_base_group          ou=Groups,dc=pbifmsiwdms,dc=pjb?one 

Without configuring ldap.conf, samba will not search posix accounts into ldap. Also, ensure that DNS has been setup.
Architecture Diagram

Samba Configuration:

[global] workgroup = PUNJABGOVT netbios name= PUNJABGOVT1 security = user passdb backend = ldapsam:ldap://ldap1.pbifmsiwdms.pjb/ hosts allow = 127.0.0.1 192.168.10.0/24 192.168.20.0/24 192.168.70.0/24 10.10.20.0/24 10.10.22.0/24 172.22.0.0/16 smb ports = 139 ldap admin dn = cn=Directory Manager ldap suffix = dc=pbifmsiwdms,dc=pjb ldap user suffix = ou=People ldap machine suffix = ou=Computers ldap group suffix = ou=Groups lanman auth = yes client lanman auth = yes log file = /var/log/samba/%m.log socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192

1. obey pam restrictions = no

ldap passwd sync = yes os level = 65 domain logons = yes domain master = yes local master = yes preferred master = yes ldap ssl= off wins support = yes wins proxy = yes logon path = \\%L\profiles\%U logon home = \\%L\%U

logon drive = H: map to guest = bad user logon script = logon.cmd template shell = /bin/false winbind use default domain = no map to guest = bad user map untrusted to domain = Yes enable privileges = yes lm announce = yes pam password change = yes passwd program = /usr/sbin/smbldap-passwd %u

log level = 3 max log size = 1000 syslog only = no syslog = 3

name resolve order = wins lmhosts hosts bcast username map = /etc/samba/smbusers add user script = /usr/sbin/smbldap-useradd -a %u add machine script = /usr/sbin/smbldap-useradd -w %u add group script = /usr/sbin/smbldap-groupadd -p "%g" delete group script = /usr/sbin/smbldap-groupdel "%g" add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g" set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u' delete user from group script = /usr/sbin/smbldap-groupmod -x '%u' '%g' admin users = root winbind enum groups = No winbind trusted domains only = yes

[netlogon] path = /mnt/gfs2/samba/netlogon read only = yes browsable = no guest ok = yes

[profiles] path = /mnt/gfs2/samba/profiles read only = no create mask = 0600 directory mask = 0700

1. [profiles.V2]
2. copy = profiles
3. browseable = no

[homes] browsable = no writable = yes path = /mnt/gfs2/share/%u

[csmb] comment = Samba public = yes path = /mnt/gfs2/share writeable = yes ea support = yes

[nitrobit] path = /mnt/gfs2/samba/nitrobit read only = no public = yes browsable = yes writable = yes guest ok = yes

Create appropriate directories/permissions for the Samba shares defined in your configuration : 	

# mkdir -p /mnt/gfs2/samba 
# mkdir /mnt/gfs2/samba/{netlogon,profiles} 
# chown root:root -R /mnt/gfs2/samba 
# chmod 0755 /mnt/gfs2/samba/netlogon 
# chmod 1755 /mnt/gfs2/samba/profiles 
# mkdir -p /mnt/gfs2/nitrobit

Create a password for the ldap admin dn (the Directory Manager's Password) in Samba's secret file: 

# smbpasswd -w <ldap-admin-password> 
Setting stored passnword for "cn=Directory Manager" in secrets.tdb 

net getlocalsid 
SID for domain PUNJABGOVT is: S-1-5-21-4070117540-217532476-2757550252 

If sid is not coming then you can Set manually by
# Net setlocalsid  S-1-5-21-4070117540-217532476-2757550252

Then Ckeck Groups of ldpa server is coming or not by 

# net groupmap list
PUNJABGOVT\Domain Users (S-1-5-21-4070117540-217532476-2757550252-513) -> Domain Users
Domain Guests (S-1-5-21-4070117540-217532476-2757550252-514) -> Domain Guests
Domain Computers (S-1-5-21-4070117540-217532476-2757550252-515) -> Domain Computers
Administrators (S-1-5-32-544) -> Administrators
Account Operators (S-1-5-32-548) -> Account Operators
Print Operators (S-1-5-32-550) -> Print Operators
Backup Operators (S-1-5-32-551) -> Backup Operators
Replicators (S-1-5-32-552) -> Replicators
Power Users (S-1-5-21-4070117540-217532476-2757550252-2912) -> Power Users
PUNJABGOVT\Domain Admins (S-1-5-21-4070117540-217532476-2757550252-512) -> Domain Admins
PUNJABGOVT\TCSDC (S-1-5-21-4070117540-217532476-2757550252-39001) -> TCSDC
PUNJAB-USERS (S-1-5-21-4070117540-217532476-2757550252-39003) -> PUNJAB-USERS
Datacenter Administrator (S-1-5-21-4070117540-217532476-2757550252-39005) -> data_admin

Samba troubleshooting

If the client computers get the error that they cannot contact the Domain Controller specified,
 then check if nmb is running. If not, start  it.
# service nmb start

To check if an account can connect:
# smbclient -L samba.pbifmsiwdms.pjb -U <username>

To check if a user is read from the ldap server:
# getent passwd <username>
For example: 
# getent passwd admin 
admin:*:11071:5122:System User:/home/admin:/bin/bash

This will show the user's POSIX details, as stored on the 389-DS server.

It can be similarly used for groups, as follows:
# getent group 'Domain Admins' 
Domain Admins:*:5122:admin 

'net' commands:

To see the group mappings:
# net groupmap list

To add a group:
# net groupmap add rid=513 \ 
ntgroup='PUNJABGOVT\Domain Users' \
unixgroup='Domain Users'

To see a group's members:
# net rpc group members "Domain Admins”

To see a members's groups:
# net rpc user info admin

To get the SID:
# net getdomainsid

    If Samba root/administrator users are blocked
  # pdbedit –c=’[]’ –-user=root
  # pdbedit –c=’[U]’ –-user=root

Test Join

# Net rpc testjoin
To join server in domain by admin user
# net join –U admin

Manual Swich Over:

We have Done the manual Swich Over instead of Cluster Because any updation and upgradation 
of packages and operation System effect Cluster  directly or indirectly. Due to which whole architecture
get disturbe.  So after Analysis and  discussion We proceed with Manual swich over.

1.	Node1: 
# /etc/init.d/network restart
#/etc/init.d/smb stop
#/etc/init.d/nmb stop

Node2:

# ifconfig eth0:0 192.168.10.93 netmask 255.255.255.0
# /etc/init.d/smb start;
#/etc/init.d/nmb start