Samba for DR (Ahmedabad)- Punjab's IFMS-IWDMS Project
Samba for DR (Ahmedabad)- Punjab's IFMS-IWDMS Project
[#__RefHeading__4_990031682 Samba for DR (Ahmedabad)- Punjab's IFMS-IWDMS Project1]
[#__RefHeading__6_990031682 Introduction3]
[#__RefHeading__8_990031682 Prerequisites3]
[#__RefHeading__10_990031682 Servers3]
[#__RefHeading__12_990031682 Integration of Samba with 389-Directory Server4]
[#__RefHeading__14_990031682 Requirements4]
[#__RefHeading__16_990031682 PAM Configuration5]
[#__RefHeading__18_990031682 Samba Setup6]
[#__RefHeading__20_990031682 Populating 389-DS with PDC Entry8]
[#__RefHeading__22_990031682 PDC across subnets8]
[#__RefHeading__24_990031682 Samba's smb.conf9]
[#__RefHeading__26_990031682 Samba troubleshooting11]= Introduction = The client wanted a Mirror copy of Slave Domain Controller, with a centralized authentication mechanism. To ensure this, Samba 3.5 was installed with 389-Directory server at the backend.
This document has been divided into two parts, one detailing the installation of the Samba; and the other showing the steps taken to integrate it with the ldap server, 389-DS and configuring it as a Primary Domain Controller (PDC).
Prerequisites
1) yum must be configured to ensure Samba and other dependencies can be downloaded
# yum install samba*
2) Setup ssh logins via auth-keys. (Password-less login). While not necessary, this makes things work MUCH faster between all the servers.
3) 389-DS must already be setup prior to this installation
Servers
Two servers have been set up as follows:
pbdrntp.pbifmsiwdms.pjb - 192.168.10.81
Ony one server is connected to a SAN, and the Samba shares as well as th stored here. The cluster used is Red Hat Cluster Suite (RHCS).
Integration of Samba with 389-Directory Server
Requirements
• openldap-servers (contains migration utilities used in this document)
• 389-DS (the directory server should already be installed)
• samba, samba-client, samba-common (samba server, also provides schema needed for storing samba information)
• schema to ldif migration script (can be downloaded from here:
http://directory.fedoraproject.org/download/ol-schema-migrate.pl)
First off we need to provide 389-DS with a samba schema that it understands. Now lets break down how 389-DS implements extending schemas :
• All schema files are in ldif format and loaded during server start .
• All schema's are located in /etc/dirsrv/slapd-pbdrldap/schema.
• Filenames are sequential and loaded in order and 99user.ldif is always the last schema to be loaded.
For this document we are going to name our schema file 61samba.ldif. As stated above we need to provide 389-DS with a schema it understands which involves converting the provided /usr/share/doc/samba/LDAP/samba.schema to ldif format. Luckily, there is a utility provided 3rd party that will assist in doing this which can be found at http://directory.fedoraproject.org/download/ol-schema-migrate.pl
We do this on the 389-DS server.
Use of this script is straight forward :
# perl ol-schema-migrate.pl -b \
/usr/share/doc/samba-*/LDAP/samba.schema \
> /etc/dirsrv/slapd-<server>/schema/61samba.ldif
Once the ldif is in place restart the slapd service :
# service dirsrv restart
PAM Configuration
Chack if nss_ldap is installed with:
# rpm -qa|grep -i nss-ldap
otherwise:
# yum install nss-pam-ldapd
On both the samba nodes, run this:
authconfig --enableldap --enableldapauth --disablenis \
--enablecache --ldapserver=pbdrldap.pbifmsiwdms.pjb\
--ldapbasedn=dc=pbifmsiwdms,dc=pjb --updateall
Then ensure ldap.conf has the following settings:
URI ldap://pbdrldap.pbifmsiwdms.pjb/
BASE dc=pbifmsiwdms,dc=pjb
HOST pbdrntp.pbifmsiwdms.pjb
binddn "cn=Directory manager"
bindpw asd1234f
rootbinddn "cn=Directory manager"
port 389
bind_policy soft
nss_reconnect_tries 2
nss_base_passwd ou=People,dc=pbifmsiwdms,dc=pjb?one
nss_base_passwd ou=Computers,dc=pbifmsiwdms,dc=pjb?one
nss_base_shadow ou=People,dc=pbifmsiwdms,dc=pjb?one
nss_base_group ou=Groups,dc=pbifmsiwdms,dc=pjb?one
Without configuring ldap.conf, samba will not search posix accounts into ldap. Also, ensure that DNS has been setup.
Samba Setup
Change /etc/nsswitch.conf to have the following:
passwd: files ldap sss
shadow: files ldap sss
group: files ldap sss
Copy /etc/samba/smb.conf fom Chandigarh DC to Ahmedabad Dr as it is and changes are below :
- Add “hosts allow” entry for DR Network 172.22.0.0/24
[global]
workgroup = PUNJABGOVT
netbios name = PUNJABGOVT1
hosts allow = 127.0.0.1 192.168.10.0/24 192.168.20.0/24 192.168.70.0/24 10.10.20.0/24 10.10.22.0/24 172.22.0.0/16
security = user
map untrusted to domain = Yes
passdb backend = ldapsam:"ldap://pbdrldap.pbifmsiwdms.pjb"
ldap admin dn = cn=Directory manager
ldap suffix = dc=pbifmsiwdms,dc=pjb
ldap user suffix = ou=People
ldap machine suffix = ou=Computers
ldap group suffix = ou=Groups
ldap ssl = off
ldap passwd sync = yes
obey pam restrictions = no
passwd program = /usr/local/sbin/smbldap-passwd %u
passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n *password\supdated\ssuccessfully* .
log file = /var/log/samba/%m.log
log level = 3
max log size = 1000
syslog only = no
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
os level = 65
domain logons = yes
domain master = yes
local master = yes
preferred master = yes
wins proxy = yes
wins support = yes
logon path = \\%L\profiles\%U
logon home = \\%L\%U
logon drive = H:
template shell = /bin/false
name resolve order = wins lmhosts hosts bcast
encrypt passwords = yes
logon script = logon.cmd
add user script = /usr/sbin/smbldap-useradd -a %u
add machine script = /usr/sbin/smbldap-useradd -w %u
delete user script = /usr/sbin/smbldap-userdel '%u'
delete user from group script = /usr/sbin/smbldap-groupmod -x '%u' '%g'
set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'
lm announce = yes
pam password change = yes
enable privileges = yes
;server string = PunjabGovt
dns proxy = no
winbind enum groups = No
winbind trusted domains only = yes
winbind use default domain = no
map untrusted to domain = Yes
map to guest = bad user
username map = /etc/samba/smbusers
add group script = /usr/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/sbin/smbldap-groupdel "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
admin users = root
[netlogon]
path = /mnt/gfs2/samba/netlogon
read only = yes
browsable = no
guest ok = yes
[profiles]
path = /mnt/gfs2/samba/profiles
read only = no
create mask = 0600
directory mask = 0700
[profiles.V2]
copy = profiles
browseable = no
[homes]
browsable = no
writable = yes
path = /mnt/gfs2/share/%u
[nitrobit]
path = /mnt/gfs2/samba/nitrobit
read only = no
public = yes
browsable = yes
writable = yes
guest ok =yes
Copy /mnt/gfs2 as it is from Chandigarh DC to DR
Create a password for the ldap admin dn (the Directory Manager's Password) in Samba's secret file:
# smbpasswd -w <ldap-admin-password>
Setting stored password for "cn=Directory Manager" in secrets.tdb
Populating 389-DS with PDC Entry
At this point you should have a Samba PDC and a properly configured 389-DS ready to take the appropriate Samba entries. Now we are going to check entries of samba entries on LDAP.
#ldapsearch –x –D”cn=”Directory Manager” –w asd1234f | grep sambaDomainName
#smbldap-usershow admin
#net rpc groupmap list
LDAP already have all the samba entries and not required to create because LDAP is integrated here in smb.conf
passdb backend = ldapsam:"ldap://pbdrldap.pbifmsiwdms.pjb"
ldap admin dn = cn=Directory manager
ldap suffix = dc=pbifmsiwdms,dc=pjb
ldap user suffix = ou=People
ldap machine suffix = ou=Computers
ldap group suffix = ou=Groups
PDC across subnets
Windows machines find the Samba server via NetBios. With the default configuration, this takes place only in the subnet the server is in. To enable the PDC across subnets, we need to configure Samba as a WINS (Windows Internet Name Service) Server.
To ensure this, we enter the following lines in smb.conf:
domain master = yes
preferred master = yes
local master = yes
wins support = yes
wins proxy = yes
os level = 65
Samba's smb.conf
[global]
workgroup = PUNJABGOVT
netbios name = PUNJABGOVT1
hosts allow = 127.0.0.1 192.168.10.0/24 192.168.20.0/24 192.168.70.0/24 10.10.20.0/24 10.10.22.0/24 172.22.0.0/16
security = user
map untrusted to domain = Yes
passdb backend = ldapsam:"ldap://pbdrldap.pbifmsiwdms.pjb"
ldap admin dn = cn=Directory manager
ldap suffix = dc=pbifmsiwdms,dc=pjb
ldap user suffix = ou=People
ldap machine suffix = ou=Computers
ldap group suffix = ou=Groups
ldap ssl = off
ldap passwd sync = yes
obey pam restrictions = no
passwd program = /usr/local/sbin/smbldap-passwd %u
passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n *password\supdated\ssuccessfully* .
log file = /var/log/samba/%m.log
log level = 3
max log size = 1000
syslog only = no
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
os level = 65
domain logons = yes
domain master = yes
local master = yes
preferred master = yes
wins proxy = yes
wins support = yes
logon path = \\%L\profiles\%U
logon home = \\%L\%U
logon drive = H:
template shell = /bin/false
name resolve order = wins lmhosts hosts bcast
encrypt passwords = yes
logon script = logon.cmd
add user script = /usr/sbin/smbldap-useradd -a %u
add machine script = /usr/sbin/smbldap-useradd -w %u
delete user script = /usr/sbin/smbldap-userdel '%u'
delete user from group script = /usr/sbin/smbldap-groupmod -x '%u' '%g'
set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'
lm announce = yes
pam password change = yes
enable privileges = yes
;server string = PunjabGovt
dns proxy = no
winbind enum groups = No
winbind trusted domains only = yes
winbind use default domain = no
map untrusted to domain = Yes
map to guest = bad user
username map = /etc/samba/smbusers
add group script = /usr/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/sbin/smbldap-groupdel "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
admin users = root
[netlogon]
path = /mnt/gfs2/samba/netlogon
read only = yes
browsable = no
guest ok = yes
[profiles]
path = /mnt/gfs2/samba/profiles
read only = no
create mask = 0600
directory mask = 0700
[profiles.V2]
copy = profiles
browseable = no
[homes]
browsable = no
writable = yes
path = /mnt/gfs2/share/%u
[nitrobit]
path = /mnt/gfs2/samba/nitrobit
read only = no
public = yes
browsable = yes
writable = yes
guest ok =yes
Nitrobit has been configured to use this following directory:
/mnt/gfs2/samba/nitrobit
Finally start the Samba service:
# service smb start; chkconfig smb on
# service nmb start; chkconfig nmb on
Samba troubleshooting
If the client computers get the error that they cannot contact the Domain Controller specified, then check if nmb is running. If not, start it.
# service nmb start
To check if an account can connect:
# smbclient -L samba.pbifmsiwdms.pjb -U <username>
To check if a user is read from the ldap server:
# getent passwd <username>
For example:
# getent passwd admin
admin:*:11071:5122:System User:/home/admin:/bin/bash
This will show the user's POSIX details, as stored on the 389-DS server.
It can be similarly used for groups, as follows:
# getent group 'Domain Admins'
Domain Admins:*:5122:admin
To see the group mappings:
# net groupmap list
To add a group:
# net groupmap add rid=513 \
ntgroup='PUNJABGOVT\Domain Users' \
unixgroup='Domain Users'
To see a group's members:
# net rpc group members "Domain Admins”
To see a members's groups:
# net rpc user info admin
To get the SID:
# net getdomainsid