GSTN - Directory services DNS PRINT DHCP
- Directory Services, DNS, PRINT and DHCP
#
- Integrated Components
The following components will be used for building up the Integrated Environment.* BIND (Berkeley Internet Name Domain) is an implementation of the DNS protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including:
- Domain Name System server
- Domain Name System resolver library
- Tools for managing and verifying the proper operation of the DNS server
Some of the important features of BIND9 are DNS Security (DNSSEC, TSIG), IPv6, DNS Protocol Enhancements (IXFR, DDNS, DNS Notify, EDNS0), Views, Multiprocessor Support, Replications, Zone updates and an Improved Portability Architecture.
Below is the print screen of packages used to implement BIND:
* ISC (Internet Systems Consortium) DHCP is open source software that implements the Dynamic Host Configuration Protocol for connection to an IP network. It is production-grade software that offers a complete solution for implementing DHCP servers, relay agents, and clients for small local networks to large enterprises. ISC DHCP solution supports both IPv4 and IPv6, and is suitable for use in high-volume and high-reliability applications.
(Due to design change DHCP has been configured on different server in HA.)* Directory and policy - Samba 4.X is a milestone release that brings Active Directory functionality to the open source SMB/CIFS (Server Message Block/Common Internet File System) file and print server. Samba 4.X can serve as an Active Directory Domain Controller, provide DNS services, handle Kerberos-based authentication, and administer group policy. The Samba 4.X Domain Controller can even be managed using the native Windows Active Directory admin tools. Supports DC and ADC .
Command to check kerberos klist get host/%computername%
Below print screen for kerberose ticket for a windows10 client.
Windows Active Directory admin tool to manage users and computers.
Administer group policy using Group policy management tool.
Domain Controller management using the native Windows Active Directory admin tools:
DNS management tool.
- Common UNIX Printing System (CUPS). This printing system is a freely available, portable printing layer which has become the new standard for printing in most Linux distribution. CUPS manages print jobs and queues and provides network printing using the standard Internet Printing Protocol (IPP), while offering support for a very large range of printers, from dot-matrix to laser and many in between. CUPS also supports Post Script Printer Description (PPD) and auto-detection of network printers, and features a simple web-based configuration and administration tool.
CUPS web interface to manage printers.
Print jobs and queues management.
CUPS allows to create a new or modify an existing printer in such a way that there is a user-based access-control in place.
Print server High Availability.
We have configured Print server on HA. Cluster IPV4 is 172.18.101.33 and IPV6 is 2404:a800:1000:d:7800::21 for print server.
We have configured one cluster named as PRINTER having two nodes and one resource.
To manage cluster open web GUI link https://gdprinter.gstn.local:2224.
Cluster nodes:
Cluster Resource:
Checking cluster status from command line: Run “pcs status”
Start the cluster using pcs command. “–all” will start the cluster on all the configured nodes.
# pcs cluster start --all
Stopping cluster.
# pcs cluster stop all
#
- Server Sizing / Considerations
| ServerName | OS | Role | vRAM | vCPU | HDD [GB] | VLANID | IP4/IP6 Address | Subnet | Gateway |
| GD9103 | RHEL | DNS, Print , Directory #1 | 16 | 4 | OS-200 | 101 | 172.18.101.14/2404:a800:1000:d:7800::e | 255.255.255.0/69 | 172.18.101.1 |
| GD9104 | RHEL | DNS, Directory #2 | 16 | 4 | OS-200 | 101 | 172.18.101.15/2404:a800:1000:d:7800::f | 255.255.255.0/69 | 172.18.101.1 |
| GDPRINTER | RHEL | 16 | 4 | OS-200 | 101 | 172.18.101.33/2404:a800:1000:d:7800::21 | 255.255.255.0/69 | 172.18.101.1 | |
-
- DNS Structure at GSTN
As there will be Linux AD implemented via SAMBA4, DNS which is Bind9 will be additionally installed and integrated with SAMBA4 implementation. The DNS setup and records will be managed by DNS MMC Snap-In tool on windows as shown below.
Adding new records, Updating existing records, Deleting, Changing zone properties, Defining Zone Replication Scope, Reverse Lookup Zone, Dynamic Update etc will be created and deployed via Window's DNS MMC Snap-in tool from Windows Management Machine placed in management zone.
The DNS can also be managed via Linux CLI.
An Separate DNS zone for Servers at GSTN is created for having name based resolution for inter communications.
Bind9 with Master – Slave replication is designed for GSTN. The Slave will reside on ADC and replicated.
Both IPV4 and IPV6 as dual stack will be activated and populated.
We have created an additional zone named as gstn.org.in for mail server.
-
-
- Conditional Forwarding
-
A forwarder is a Domain Name System (DNS) server on a network that is used to forward DNS queries for external DNS names to DNS servers outside that network. You can also configure your server to forward queries according to specific domain names using conditional forwarders.
Bind9 supports forwarders and conditional forwarding .Conditional forwarders are not implemented yet on Samba integrated DNS management Snap-In . That means any conditional forwarders will be implemented via CLI.
-
-
- Round robin DNS
-
Round Robin DNS is a technique of load distribution, load balancing, or fault-tolerance provisioning multiple, redundant Internet Protocol service hosts, e.g., Web server, FTP servers, by managing the Domain Name System's (DNS) responses to address requests from client computers according to an appropriate statistical model.
Bind9 support Round robin (RR) for long . Both IPV4 and IPv6 is supported over round robin principle. The records are output as per rrset-order .rrset-order defines the order in which multiple records of the same type are returned. This works for any record type in which the records are similar not just A or AAAA RRs and covers results in the ANSWER SECTION and the ADDITIONAL SECTION. The default is cyclic (round-robin).#
- Template:Anchor DHCP Structure at GSTN (DHCP has been covered in different document )
DHCP will be configured on IPV4 and IPV6 both as dual stack. Dedicated 2 VMs are allocated for High Availability. Following are the details of suggested DHCP environment* Enablement of both dhcpd and dhcpv6d Services for ipv4 and ipv6 respectively
- Only Desktop / Laptop User based VLAN and IP Telephone Devices VLAN to be included in scoping of DHCP.
- Scope ID 176 to be configured for scope of IP Telephony devices.
- Switches will be activated as DHCP relay agent to forward the different VLAN Traffic for DHCP server.
- Both Ipv4 and Ipv6 scopes will be defined. Ipv6 will be preferred over ipv4.
- As there will be around 200 devices which might increase up to four hundred, the lease period suggested for 8 hours.
- High Availability is inbuilt feature of ISC DHCP. It will configured as primary and secondary server in active / passive mode or fail-over mode
- The Leases databases is file type and can be backup and restored.
- DHCP with dynamic DNS updates to ensure the tight integration of DNS with DHCP
- 13/14 VLANS would be present for different Type of User. Each VLAN would have a scope name and a particular VLAN type defined.
| S.No | VLAN ID | FW-MZ- VLAN NAME | Description | Network | Gateway | Mask | Host Start Range | IPV6 Network/Gateway | DHCP Range |
|---|---|---|---|---|---|---|---|---|---|
| 1 | 2 | GNDEL-VoIP | VOIP PHONE - "String Option 176" | 172.18.2.0/24 | 172.18.2.1 | [callto:255.255.255.0 255.255.255.0] | 172.18.16.11 to 172.18.16.254 | [callto:172.18.16.51%20-%20172.18 172.18.16.51 - 172.18.16.240] | |
| 2 | 3 | GSTN-VC | VIDEO-CONFERENCE | 172.18.3.0/27 | 172.18.3.1 | [callto:255.255.255.224 255.255.255.224] | 172.18.3.11 to 172.18.3.30 | NA | |
| 3 | 33 | GNDEL-SEC-SYSTEM | SECURITY SYSTEM | 172.18.3.32/27 | 172.18.3.33 | [callto:255.255.255.224 255.255.255.224] | [callto:172.18.3.%2036 172.18.3. 36 to 172.18.3.62] | 172.18.3.41 to 172.18.3.62 | |
| 4 | 4 | GNDEL-TPV | GSTN- TP VENDOR | 172.18.4.0/24 | 172.18.4.0 | [callto:255.255.255.0 255.255.255.0] | [callto:172.18.4.254 172.18.4.11 to 172.18.4.254] | [callto:172.18.4.240 172.18.4.51 to 172.18.4.240] | |
| 5 | 5 | GNDEL-USER | GSTN-USERs | 172.18.5.0/24 | 172.18.5.0 | [callto:255.255.255.0 255.255.255.0] | [callto:172.18.5.254 172.18.5.11 to 172.18.5.254] | ISP-GUA(Global Unique Adress) | [callto:172.18.5.240 172.18.5.51 to 172.18.5.240] |
| 6 | 6 | GNDEL-IT | GSTN-IT | 172.18.6.0/26 | 172.18.6.0 | [callto:255.255.255.192 255.255.255.192] | 172.18.6.11 to 172.18.6.62 | ISP-GUA(Global Unique Adress) | 172.18.6.21 to 172.18.6.62 |
| 7 | 7 | GNDEL-HR | GSTN-HR | 172.18.7.0/27 | 172.18.7.0 | [callto:255.255.255.224 255.255.255.224] | 172.18.7.11 to 172.18.7.30 | ISP-GUA(Global Unique Adress) | 172.18.7.11 to 172.18.7.30 |
| 8 | 8 | GNDEL-FINANCE | GSTN-FINANCE | 172.18.8.0/27 | 172.18.8.0 | [callto:255.255.255.224 255.255.255.224] | 172.18.8.11 to 172.18.8.30 | ISP-GUA(Global Unique Adress) | 172.18.8.11 to 172.18.8.30 |
| 9 | 9 | GENDEL-WIFI-AP | WIFI-MGMT-VLAN(CNTRLR+APS) | 172.18.9.0/26 | 172.18.9.0 | [callto:255.255.255.192 255.255.255.192] | 172.18.9.11 to 172.18.9.62 | ISP-GUA(Global Unique Adress) | NA |
| 10 | 10 | GNDEL-WIFI-DC | GSTN-DC GSTN-WIFI(AD-AUTH) | 172.18.10.0/24 | 172.18.10.0 | [callto:255.255.255.0 255.255.255.0] | 172.18.10.11 to 172.18.10.254 | ISP-GUA(Global Unique Adress) | 172.18.10.51 to 172.18.10.240 |
| 11 | 11 | GNDEL-WIFI(MAC-AUTH) | GSTN-INTERNET | 172.18.11.0/24 | 172.18.11.0 | [callto:255.255.255.0 255.255.255.0] | 172.18.11.11 to 172.18.11.254 | ISP-GUA(Global Unique Adress) | 172.18.11.51 to 172.18.11.240 |
| 12 | 12 | GNDEL-WIFI(GUEST USER) | GSTN-GUEST | 172.18.12.0/24 | 172.18.12.0 | [callto:255.255.255.0 255.255.255.0] | 172.18.12.11 to 172.18.12.254 | ISP-GUA(Global Unique Adress) | 172.18.12.51 to 172.18.12.240 |
IPv6 – IP Range will be provided/Shared by ISP.
DHCP HA Configuration:
The Servers:
How HA is working?
Primary DHCP server:
[root@gd9101 ~]# cat /etc/dhcp/dhcpd.conf
Secondary Server:
[root@gd9102 ~]# cat /etc/dhcp/dhcpd.conf
Primary Server:
vi /etc/dhcp/dhcpd6.conf
vi /etc/dhcp/dhcpd6.conf
-
- Active Directory via SAMBA4
Samba AD DC Features* LDAP
- Kerberos
- X.500 complaint
- Windows Domain Controller
- Centralized Identity Management Server
- Authentication
- Authorization
- SMB / SMB2 / CIFS
- Windows machines join AD natively
- Ipv4 and Ipv6 ready
- SSL over TCP as the Transporting Protocol ( https://wiki.samba.org/index.php/Configuring_LDAP_over_SSL_%28LDAPS%29_on_a_Samba_AD_DC )
- 7 FSMO roles
- PDC Emulator
- RID Master
- Schema Master
- Domain Naming Master
- Infrastructure Master
- Domain DNS Zone Master role
- Forest DNS Zone Master role
At GSTN , AD and ADC will be implemented#
-
- Forest and Domain design
-
Considering the Need of GSTN , there is no need to have Multi forest or Multi domain . There will be a single forest with a single domain as “GSTN.local” .
Environment will have one domain controller in a domain and additional domain controllers to the domain is added to improve the availability and reliability of network services. Adding additional domain controllers can help provide fault tolerance, balance the load of existing domain controllers, and provide additional infrastructure support to sites. More than one domain controller in a domain makes it possible for the domain to continue to function if a domain controller fails or must be disconnected. Multiple domain controllers can also improve performance by making it easier for clients to connect to a domain controller when logging on to the network.
Distribution of FSMO roles for Active Directory DC and Addition DC will be
Active Directory DC*
- PDC Emulator
- RID Master
- Schema Master
- Domain Naming Master
- Infrastructure Master
- Domain DNS Zone Master role
- Forest DNS Zone Master role
Below screen shot shows the 7 fsmo roles on PDC.
There is no FSMO roles on ADC.
In case of DC failure the ADC needs to be promoted as DC .#
-
- Time Synchronization
-
Time synchronization design and setup are very important for an Active Directory environment. This is because time synchronization issues lead to Kerberos authentication failures once the maximum tolerance for computer clock synchronization (By default is five (5) minutes) is exceeded.
We have 2 NTP servers running on RHEL for the time synchronization purpose . Active directory will update time or synchronize time from these NTP servers.
NTP configuration done on PDC as in below screen shot.
We have created NTP policy, all client computers will sync the time from AD only.
-
-
- AD Group Policies
-
Group Policy
The guiding principle for Group Policy design is OU design and IT administrative model and together they form the below benefits* To enable delegation of administration
- To scope the application of Group Policy Objects
While designing the group policy the required consideration from key stake holders and best practices are consulted.
Group Policy settings are passed from parent containers down to child containers. This means that a policy that is applied to a parent container applies to all the containers including users and computers that are below the parent containers in the Active directory tree hierarchy.
However if you specifically assign a group policy for a child container that contradicts the parent container policy, the child container’s policy overrides the parent group policy. If policies are not contradictory, both are implemented. Group Policies are processed in the following order:
- Local Group policy
- Site Group Policy
- Domain Group Policy
- Organizational unit Group Policy
We are selecting No Override option at GSTN so that child containers cannot override any policy setting set by higher level GPO. This option is not turned on by default and must be turned on in each GPO where it’s wanted.
In Addition with Default Domain and Domain Controller policy will apply set of CIS (Center for Internet Security) recommended policy for Active Directory like Account, Audit, Security, Interactive Login, Event Log Settings, Network Services, Network Access, User Account Control etc for GSTN.
Please Note the AD Based policies will only be Applicable for Windows based environments and its components. These policies will not be applicable any of Linux environment and its components.#
-
- Accounts Policy
-
Account policies control password restrictions and account lockouts and help protecting the system from unauthorized access. Account policies apply to all user accounts at the same time locally or domain-wide, depend on the scope where the policy is defined.
| Account Policy |
| Set 'Account lockout threshold' to '7 invalid logon attempt(s)' |
| Set 'Account lockout duration' to '10 or more minute(s)' |
| Set 'Reset account lockout counter after' to '10 minute(s)' |
| Set 'Minimum password length' to '8 or more character(s)' |
| Set 'Enforce password history' to '24 or more password(s) |
| Set 'Password must meet complexity requirements' to 'Enabled' |
| Set 'Store passwords using reversible encryption' to 'Disabled |
| Set 'Minimum password age' to '1 or more day(s)' |
| Set 'Maximum password age' to '30 or fewer days' |
Below screen shot is showing password policy which has been defined.
#
-
- Template:Anchor Audit Policy
-
Auditing enhancements in Active Directory support the needs of IT Admins of Windows environments who are responsible for implementing, maintaining, and monitoring the ongoing security of an organization's Windows related physical and information assets.
These settings can help administrators to get answers of following:
Who is accessing our assets?
What assets are they accessing?
When and where did they access them?
How did they obtain access?
Advanced Audit Policies
| Account Management |
| Audit Computer Account Management “Success” |
| Audit User Account Management “Success” |
| Logon/Logoff |
| Audit Account Lockout “Success” |
| Audit User / Device Claims “Success” |
| Audit logoff “Success” |
| Audit Logon “Success” |
| Audit Other Logon/Logoff Events “Success” |
| Policy Change |
| Audit Audit Policy Change “Success” |
| Audit Authentication Policy Change Success” |
Rsysnc based SysVol replication.
Samba AD currently doesn't provide support for SysVol replication. To achive this important feature in a Multi-DC environment, until it's implemented, workarounds are necessary to keep it in sync. This HowTo provides a basic workaround solution based on rsync.
This tool is unidirectional, this means files can only be transferred in one direction. That's why for rsync-based SysVol replication, you have to choose one DC on which you do all modifications like GPO edits, logon script changes, etc. A good choice for this "master" host is the one that contains the FSMO roles. All other DC's retrieve the changes from this host, this is because modifications on them are overwritten when syncing.
1. Setup SysVol replication:
a. Install rsync on the pdc by runing below command.
# yum install rsync
Open /etc/rsyncd.conf file and make below entries.
[SysVol]
path = /usr/local/samba/var/locks/sysvol/
comment = Samba Sysvol Share
uid = root
gid = root
read only = yes
auth users = sysvol-replication
secrets file = /usr/local/samba/etc/rsyncd.secret
Create a file /usr/local/samba/etc/rsyncd.secret.
# vi /usr/local/samba/etc/rsyncd.secret
Make below entry in rsyncd.secret file.
sysvol-replication:Pa$$w0rD
and set 600 permission on this file.
# chmod 600 /usr/local/samba/etc/rsyncd.secret
Restart rsyncd services.
# systemctl restart rsyncd.service
Setup on secondary Domain Controller
a. Install rsync on the adc by runing below command.
# yum install rsync
Create a password file /usr/local/samba/etc/rsync-sysvol.secret.
# vi /usr/local/samba/etc/rsync-sysvol.secret
Fill it with the password you set on the PDC for the sysvol-replication rsync account.
Pa$$w0rD
Set 600 permission on this file and restart rsync service.
# chmod 600 /usr/local/samba/etc/rsyncd.secret
# systemctl restart rsyncd.service
For replicating the SysVol folder, run the following command (--dry-run means that no modifications are actually made):
# /usr/bin/rsync --dry-run -XAavz --delete-after --password-file=/usr/local/samba/etc/rsync-sysvol.secret rsync://sysvol-replication@172.18.101.14/SysVol/ /usr/local/samba/var/locks/sysvol/
If everything looks sane, run the command without the --dry-run option and let rsync do the replication.
To automate synchronisation, run the command via cron.
# */2 * * * * /usr/bin/rsync -XAavz --delete-after --password-file=/usr/local/samba/etc/rsync-sysvol.secret rsync://sysvol-replication@172.18.101.14/SysVol/ /usr/local/samba/var/locks/sysvol/
Demote a Samba AD DC
Demote a working Domain Controller.
*
- Verify that the DC is not the last one remaining in the domain!
- Make sure this DC does not contain any FSMO role:
# /usr/local/samba/bin/samba-tool fsmo show
Transferring a FSMO Role
- Log on to the DC, that should be the new owner of the role you want to transfer.
- Transfer the role to the DC, by executing the following command:
# /usr/local/samba/bin/samba-tool fsmo transfer --role=all
Ensure that the role was transferred ('samba-tool fsmo show').
Demote the DC:
# /usr/local/samba/bin/samba-tool domain demote -Uadministrator
Demote a DC that isn't accessible any more
Verifying that nothing was left
The following steps are done on a Windows computer having RSAT installed.
Warning: The following are just cleanup steps, if something was left after a demote! It's not a replacement for the demote process itself! :
- Go to the container „Domain Controllers“ and verify that the demoted DC was removed. If not, remove the account manually. This would also cleanup metadata.
Seizing FSMO Roles
Difference of Transferring and Seizing FSMO Roles
Whenever it's possible, you should transfer FSMO roles and do not seize them! Transferring is the recommended and cleaner way. But it requires that the DC, which currently owns the role you want to transfer, is still working and connected to the network. Transferring makes the old DC know that it does not own the role(s) any more.
If the DC is broken (e. g. hardware defect) and will never come back again, then you can seize the role on a remaining DC. It is very important that the old DC will never be connected to the network again, if it is connected again, this will cause conflicts and lead to an inconsistent AD. This is because the old DC will not notice the change and still feel responsible for tasks related to the role.
How to Handle Situations Where a DC with FSMO Roles Is Offline
There are three situations to distinguish:
1. The downtime is planned and the DC will come back soon (reboot, hardware replacement, etc.):
2. The DC should be demoted:
3. The DC is offline because of a problem:
# /usr/local/samba/bin/samba-tool fsmo show
Seizing a FSMO Role
- Log on to the DC, that should be the new owner of the role you want to transfer.
- Seize the role to the current DC, by executing the following command:
# /usr/local/samba/bin/samba-tool fsmo seize --role=all
Attempting transfer...
Transfer unsuccessful, seizing...
FSMO seize of '...' role successful*
- Make sure, that the old DC is never connected to the network again!
-
- SAMBA integrated CUPS ( Print Server )
- SAMBA integrated CUPS ( Print Server )
A print server accepts print jobs from network computers, queues them locally and then sends them to the appropriate printers. As well as having domain and file service capabilities, Samba can also act as a MS Windows compatible print server. While Samba provides the interface to Windows/SMB machines, CUPS or LDP is used by Samba to send print jobs to the devices.
CUPS provides a mechanism that allows print jobs to be sent to printers in a standard fashion. The print-data goes to a scheduler which sends jobs to a filter system that converts the print job into a format the printer will understand. The filter system then passes the data on to a backend—a special filter that sends print data to a device or network connection. The system makes extensive use of PostScript and rasterization of data to convert the data into a format suitable for the destination printer.
The CUPS scheduler implements Internet Printing Protocol (IPP) over HTTP/1.1. A helper application (cups-lpd) converts Line Printer Daemon protocol (LPD) requests to IPP. The scheduler also provides a web-based interface for managing print jobs, the configuration of the server, and for documentation about CUPS itself.
CUPS can process a variety of data formats on the print server. It converts the print-job data into the final language/format of the printer via a series of filters. It uses MIME types for identifying file formats.
The backends are the ways in which CUPS sends data to printers. There are several backends available for CUPS: parallel, serial, and USB ports, cups-pdf PDF Virtual Printing, as well as network backends that operate via the IPP, JetDirect (AppSocket), Line Printer Daemon ("LPD"), and SMB protocols.
CUPS integrated with SAMBA supports multiple end user operating systems – e.g. Linux all flavors (Desktop OS and Server OS, Windows 7 and higher, Windows server 2003 and higher, Mac OS.
SMB.CONF Configuration.
To integrated CUPS with samba i made below entries in smb.conf.
CUPS web-based administration interface
On all platforms, CUPS has a web-based administration interface that runs on port 631. It particularly helps the need to monitor print jobs and add print queues and printers remotely. This interface is with an enhanced administration interface that allows users to add, modify, delete, configure, and control classes, jobs, and printers. It Supports reports/ monitoring, Auditing and tracking of print queues . It will also do the centralized allocation /DE-allocation of Network printers to the users.
CUPS quotas
CUPS supports page and size-based quotas for each printer. The quotas are tracked individually for each user, but a single set of limits applies to all users for a particular printer. CUPS logsevery page that is printed on a system to the page_log file. Page logging is only available for drivers that provide page accounting information, typically all PostScript and CUPS raster devices. Raw queues and queues using third-party solutions such as Foomatic generally do not have useful page accounting information available.
Structure at GSTN : The HP Laserjet Pro M202dw printers act as print servers and authenticate against the Samba AD.
Quota can be deploye only from command line. Below are the commands to deploy quota:
# lpadmin -p ProLaserJet -o job-quota-period=604800 -o job-k-limit=1024
This sets a limit of a file size of 1 MB (added-up) for each user on the existing printer "ProLaserJet" during one week.
# lpadmin -p ProLaserJet -o job-quota-period=604800 -o job-page-limit=100
This sets a limit of 100 pages (added-up) for each user on the existing printer "ProLaserJet" during one week.
# lpadmin -p ProLaserJet -o job-quota-period=604800 -o job-k-limit=1024 -o job-page-limit=100
>>A day is 60x60x24=86400, a week is 60x60x24x7=604800, and a month is 60x60x24x30=2592000 seconds.)
This sets a combined limit of 1 MB (added-up) and 100 pages (added-up) for each user of existing printer "ProLaserJet" during one week. Whichever limit is reached first will take effect.