GSTN - Additional Domain Controller (ADC ) Implementation Document
Setup additional Samba Domain Controller installation document.
1. Configure yum repository for Packages installation.
Edit /etc/yum.repos.d/local.repo
Make below entries. Save file and exit.
[local]
name=local
baseurl=file:///mnt
gpgcheck=0
enabled=1
2. Set hostname.
# hostnamectl set-hostname gd9104.gstn.local
3. Assign the Ipv4 address.
# nmcli connection modify eth0 ipv4.addresses 172.18.101.15/24 ipv4.method manual ipv4.gateway 172.18.101.1 connection.autoconnect yes ipv4.dns 172.18.101.15
4. Assign the Ipv6 address and restart the network services.
# nmcli connection modify eth0 ipv6.addresses 2404:a800:1000:d:7800::f/69 ipv6.method manual ipv6.gateway 2404:a800:1000:d:7800::1 connection.autoconnect yes ipv6.dns 2404:a800:1000:d:7800::f
# systemctl restart network.service
5. Edit /etc/hosts file.
# vi /etc/hosts
6. Make below entries in /etc/hosts file and reboot the server.
172.18.101.15gd9104.gstn.localgd9104
2404:a800:1000:d:7800::fgd9104.gstn.localgd9104
7. After rebooting server logged in as root user and Install Dependencies for samba .
# yum install perl gcc attr libacl-devel libblkid-devel gnutls-devel readline-devel python-devel gdb pkgconfig krb5-workstation zlib-devel setroubleshoot-server libaio-devel setroubleshoot-plugins policycoreutils-python libsemanage-python perl-ExtUtils-MakeMaker perl-Parse-Yapp perl-Test-Base popt-devel libxml2-devel libattr-devel keyutils-libs-devel cups-devel bind-utils libxslt docbook-style-xsl openldap-devel autoconf python-crypto pam-devel
8. Download samba tar file from https://www.samba.org/ and extract it.
# tar xvzf samba-4.4.4.tar.gz
9. Enter in samba-4.4.4 directory and run configure command.
# cd samba-4.4.4/
# ./configure
Configure done successfully.
10. Run make command.
# make
Make command finished successfully.
11. Run make install command.
# make install
Make install command completed successfully.
12. Create a file /etc/rc.d/init.d/samba4
# vi /etc/rc.d/init.d/samba4
13. Paste the below content in /etc/rc.d/init.d/samba4 file and save and exit.
#! /bin/bash
#
# samba4 Bring up/down samba4 service
#
# chkconfig: - 90 10
# description: Activates/Deactivates all samba4 interfaces configured to \
# start at boot time.
#
### BEGIN INIT INFO
# Provides:
# Should-Start:
# Short-Description: Bring up/down samba4
# Description: Bring up/down samba4
### END INIT INFO
# Source function library.
. /etc/init.d/functions
if [ -f /etc/sysconfig/samba4 ]; then
. /etc/sysconfig/samba4
fi
CWD=$(pwd)
prog="samba4"
start() {
# Attach irda device
echo -n $"Starting $prog: "
/usr/local/samba/sbin/samba
sleep 2
if ps ax | grep -v "grep" | grep -q /samba/sbin/samba ; then success $"samba4 startup"; else failure $"samba4 startup"; fi
echo
}
stop() {
# Stop service.
echo -n $"Shutting down $prog: "
killall samba
sleep 2
if ps ax | grep -v "grep" | grep -q /samba/sbin/samba ; then failure $"samba4 shutdown"; else success $"samba4 shutdown"; fi
echo
}
status() {
/usr/local/samba/sbin/samba --show-build
}
# See how we were called.
case "$1" in
start)
start
;;
stop)
stop
;;
status)
status irattach
;;
restart|reload)
stop
start
;;
*)
echo $"Usage: $0 {start|stop|restart|status}"
exit 1
esac
exit 0
14. Set the permissions on samba4 file and export path.
# chmod 755 /etc/rc.d/init.d/samba4
# chmod +x /etc/rc.d/init.d/samba4
# ln -s /etc/rc.d/init.d/samba4 /etc/rc3.d/S80samba4
# chkconfig --add samba4
# chkconfig samba4 on
# export PATH=/usr/local/samba/bin/:/usr/local/samba/sbin/:$PATH
15. Edit in /etc/krb5.conf file.
# vi /etc/krb5.conf
16. Make below entries in /etc/krb5.conf file.
[libdefaults]
default_realm = GSTN.LOCAL
dns_lookup_realm = false
dns_lookup_kdc = true
17. Edit in /etc/resolv.conf file.
18. Make below entries and save file.
search gstn.local
nameserver 172.18.101.14
nameserver 172.18.101.15
nameserver 2404:a800:1000:d:7800::f
19. Verify a correct name resolution by running below command. We should get output like in screen shot.
# host -t A gd9103.gstn.local
20. Run "kinit" to obtain a Kerberos ticket, and to verify that you had received a Kerberos ticket, run: "klist -e" :
# kinit administrator
# klist -e
21. Run below command to join the existing domain as a Domain Controller.
# /usr/local/samba/bin/samba-tool domain join gstn.local DC -Uadministrator --realm=GSTN.LOCAL --dns-backend=BIND9_DLZ
22. We will receive output like below in screen shot after successfull joining.
23. Fix keytab permissions.
Fix permissions on the "dns.keytab" file, to allow BIND to read this file. Run below commands.
# chmod 640 /usr/local/samba/private/dns.keytab
# chgrp named /usr/local/samba/private/dns.keytab
# chown named:named /usr/local/samba/private/named.conf
24. Now edit /etc/named.conf file.
# vi /etc/named.conf
25. Make below entries.
tkey-gssapi-keytab "/usr/local/samba/private/dns.keytab";
listen-on port 53 { 127.0.0.1; any; };
listen-on-v6 port 53 { ::1; any; };
allow-query { localhost; any; };
And also add below line at the end of the /etc/named.conf file. Save and exit.
include "/usr/local/samba/private/named.conf";
26. Resolve the A record of the new joined Domain Controller.
If the record could not be resolved to its IP, you will receive the following output instead:
Host gd9104.gstn.local. not found: 3(NXDOMAIN)
In this case we have to add record manually to the AD DNS zone on PDC. For Ipv4 run below command.
# /usr/local/samba/bin/samba-tool dns add gd9103 gstn.local gd9104 A 172.18.101.15 -Uadministrator
Password for [GSTN\administrator]:
*********
Record added successfully
For Ipv6 run below command.
# /usr/local/samba/bin/samba-tool dns add gd9103 gstn.local gd9104 AAAA 2404:a800:1000:d:7800::f -Uadministrator
Password for [GSTN\administrator]:
*********
Record added successfully
27. Start samba service.
# systemctl start samba4.service
# chkconfig --add samba4
# chkconfig samba4 on
28. Check status of samba services.
# systemctl status samba4.service
29. Directory Replication.
A few minutes after we have started Samba, connections with other DCs will be established automatically.
Run below command to check the replication.
# /usr/local/samba/bin/samba-tool drs showrepl
30. If replication is working, Start named services.
# systemctl start named.service
# systemctl enable named.service
# systemctl status named.service
31. Best practice: DNS configuration on DCs
A best practice for DNS configuration on DCs is, that you don't define the IP of the local DNS as the first nameserver.
/etc/resolv.conf on gd9103.gstn.local:
# Generated by NetworkManager
search gstn.local
nameserver 172.18.101.15
nameserver 172.18.101.14
nameserver 2404:a800:1000:d:7800::e
/etc/resolv.conf on gd9104.gstn.local:
# Generated by NetworkManager
search gstn.local
nameserver 172.18.101.14
nameserver 172.18.101.15
nameserver 2404:a800:1000:d:7800::f
32. SYSVOL replication.
Samba AD currently doesn't provide support for SysVol replication. To achive this important feature in a Multi-DC environment, until it's implemented, workarounds are necessary to keep it in sync. This HowTo provides a basic workaround solution based on rsync.
This tool is unidirectional, this means files can only be transferred in one direction. That's why for rsync-based SysVol replication, you have to choose one DC on which you do all modifications like GPO edits, logon script changes, etc. A good choice for this "master" host is the one that contains the FSMO roles. All other DC's retrieve the changes from this host, this is because modifications on them are overwritten when syncing.
1. Setup SysVol replication:
a. Install rsync on the pdc by runing below command.
# yum install rsync
b. Open /etc/rsyncd.conf file and make below entries.
[SysVol]
path = /usr/local/samba/var/locks/sysvol/
comment = Samba Sysvol Share
uid = root
gid = root
read only = yes
auth users = sysvol-replication
secrets file = /usr/local/samba/etc/rsyncd.secret
c. Create a file /usr/local/samba/etc/rsyncd.secret.
# vi /usr/local/samba/etc/rsyncd.secret
d. Make below entry in rsyncd.secret file.
sysvol-replication:Pa$$w0rD
and set 600 permission on this file.
# chmod 600 /usr/local/samba/etc/rsyncd.secret
e. Restart rsyncd services.
# systemctl restart rsyncd.service
2. Setup on secondary Domain Controller
a. Install rsync on the adc by runing below command.
# yum install rsync
b. Create a password file /usr/local/samba/etc/rsync-sysvol.secret.
# vi /usr/local/samba/etc/rsync-sysvol.secret
c. Fill it with the password you set on the PDC for the sysvol-replication rsync account.
Pa$$w0rD
d. Set 600 permission on this file and restart rsync service.
# chmod 600 /usr/local/samba/etc/rsyncd.secret
# systemctl restart rsyncd.service
e. For replicating the SysVol folder, run the following command (--dry-run means that no modifications are actually made):
# /usr/bin/rsync --dry-run -XAavz --delete-after --password-file=/usr/local/samba/etc/rsync-sysvol.secret rsync://sysvol-replication@172.18.101.14/SysVol/ /usr/local/samba/var/locks/sysvol/
f. If everything looks sane, run the command without the --dry-run option and let rsync do the replication.
To automate synchronisation, run the command via cron.
# */2 * * * * /usr/bin/rsync -XAavz --delete-after --password-file=/usr/local/samba/etc/rsync-sysvol.secret rsync://sysvol-replication@172.18.101.14/SysVol/ /usr/local/samba/var/locks/sysvol/
