Samba for DR (Ahmedabad)- Punjab's IFMS-IWDMS Project

Samba for DR (Ahmedabad)- Punjab's IFMS-IWDMS Project

Navdeep Mathur

Introduction

The client wanted a Mirror copy of Slave Domain Controller, with a centralized authentication mechanism. To ensure this, Samba 3.5 was installed with 389-Directory server at the backend.

This document has been divided into two parts, one detailing the installation of the Samba; and the other showing the steps taken to integrate it with the ldap server, 389-DS and configuring it as a Primary Domain Controller (PDC).

Prerequisites

1) yum must be configured to ensure Samba and other dependencies can be downloaded

# yum install samba*

2) Setup ssh logins via auth-keys. (Password-less login). While not necessary, this makes things work MUCH faster between all the servers.

3) 389-DS must already be setup prior to this installation

Servers

Two servers have been set up as follows:

pbdrntp.pbifmsiwdms.pjb - 192.168.10.81

Ony one server is connected to a SAN, and the Samba shares as well as th stored here. The cluster used is Red Hat Cluster Suite (RHCS).

Integration of Samba with 389-Directory Server

Requirements

• openldap-servers (contains migration utilities used in this document)

• 389-DS (the directory server should already be installed)

• samba, samba-client, samba-common (samba server, also provides schema needed for storing samba information)

• schema to ldif migration script (can be downloaded from here:

http://directory.fedoraproject.org/download/ol-schema-migrate.pl)

First off we need to provide 389-DS with a samba schema that it understands. Now lets break down how 389-DS implements extending schemas :

• All schema files are in ldif format and loaded during server start .

• All schema's are located in /etc/dirsrv/slapd-pbdrldap/schema.

• Filenames are sequential and loaded in order and 99user.ldif is always the last schema to be loaded.

For this document we are going to name our schema file 61samba.ldif. As stated above we need to provide 389-DS with a schema it understands which involves converting the provided /usr/share/doc/samba/LDAP/samba.schema to ldif format. Luckily, there is a utility provided 3rd party that will assist in doing this which can be found at http://directory.fedoraproject.org/download/ol-schema-migrate.pl

We do this on the 389-DS server.

Use of this script is straight forward :

# perl ol-schema-migrate.pl -b \
/usr/share/doc/samba-*/LDAP/samba.schema \
> /etc/dirsrv/slapd-<server>/schema/61samba.ldif

Once the ldif is in place restart the slapd service :

# service dirsrv restart

PAM Configuration

Chack if nss_ldap is installed with:

# rpm -qa|grep -i nss-ldap

otherwise:

# yum install nss-pam-ldapd

On both the samba nodes, run this:

authconfig --enableldap --enableldapauth --disablenis \
--enablecache --ldapserver=pbdrldap.pbifmsiwdms.pjb\
--ldapbasedn=dc=pbifmsiwdms,dc=pjb --updateall

Then ensure ldap.conf has the following settings:

URI ldap://pbdrldap.pbifmsiwdms.pjb/ 
BASE dc=pbifmsiwdms,dc=pjb
HOST pbdrntp.pbifmsiwdms.pjb
binddn "cn=Directory manager"
bindpw asd1234f
rootbinddn "cn=Directory manager"
port 389
bind_policy soft
nss_reconnect_tries 2
nss_base_passwd ou=People,dc=pbifmsiwdms,dc=pjb?one
nss_base_passwd ou=Computers,dc=pbifmsiwdms,dc=pjb?one
nss_base_shadow ou=People,dc=pbifmsiwdms,dc=pjb?one
nss_base_group ou=Groups,dc=pbifmsiwdms,dc=pjb?one

Without configuring ldap.conf, samba will not search posix accounts into ldap. Also, ensure that DNS has been setup.

Samba Setup

Change /etc/nsswitch.conf to have the following:

passwd: files ldap sss
shadow: files ldap sss
group: files ldap sss

Copy /etc/samba/smb.conf fom Chandigarh DC to Ahmedabad Dr as it is and changes are below :

1. Add “hosts allow” entry for DR Network 172.22.0.0/24

[global]
workgroup = PUNJABGOVT
netbios name = PUNJABGOVT1
hosts allow = 127.0.0.1 192.168.10.0/24 192.168.20.0/24 192.168.70.0/24 10.10.20.0/24 10.10.22.0/24 172.22.0.0/16
security = user
map untrusted to domain = Yes
passdb backend = ldapsam:"ldap://pbdrldap.pbifmsiwdms.pjb"
ldap admin dn = cn=Directory manager
ldap suffix = dc=pbifmsiwdms,dc=pjb
ldap user suffix = ou=People
ldap machine suffix = ou=Computers
ldap group suffix = ou=Groups
ldap ssl = off
ldap passwd sync = yes
obey pam restrictions = no
passwd program = /usr/local/sbin/smbldap-passwd %u
passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n *password\supdated\ssuccessfully* .
log file = /var/log/samba/%m.log
log level = 3
max log size = 1000
syslog only = no
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
os level = 65
domain logons = yes
domain master = yes
local master = yes
preferred master = yes
wins proxy = yes
wins support = yes
logon path = \\%L\profiles\%U
logon home = \\%L\%U
logon drive = H:
template shell = /bin/false
name resolve order = wins lmhosts hosts bcast
encrypt passwords = yes
logon script = logon.cmd
add user script = /usr/sbin/smbldap-useradd -a %u
add machine script = /usr/sbin/smbldap-useradd -w %u
delete user script = /usr/sbin/smbldap-userdel '%u'
delete user from group script = /usr/sbin/smbldap-groupmod -x '%u' '%g'
set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'
lm announce = yes
pam password change = yes
enable privileges = yes
;server string = PunjabGovt
dns proxy = no
winbind enum groups = No
winbind trusted domains only = yes
winbind use default domain = no
map untrusted to domain = Yes
map to guest = bad user
username map = /etc/samba/smbusers
add group script = /usr/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/sbin/smbldap-groupdel "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
admin users = root
[netlogon]
path = /mnt/gfs2/samba/netlogon
read only = yes
browsable = no
guest ok = yes
[profiles]
path = /mnt/gfs2/samba/profiles
read only = no
create mask = 0600
directory mask = 0700
[profiles.V2]
copy = profiles
browseable = no
[homes]
browsable = no
writable = yes
path = /mnt/gfs2/share/%u
[nitrobit]
path = /mnt/gfs2/samba/nitrobit
read only = no
public = yes
browsable = yes
writable = yes
guest ok =yes

Copy /mnt/gfs2 as it is from Chandigarh DC to DR

Create a password for the ldap admin dn (the Directory Manager's Password) in Samba's secret file:

# smbpasswd -w <ldap-admin-password>

Setting stored password for "cn=Directory Manager" in secrets.tdb

Populating 389-DS with PDC Entry

At this point you should have a Samba PDC and a properly configured 389-DS ready to take the appropriate Samba entries. Now we are going to check entries of samba entries on LDAP.

#ldapsearch –x –D”cn=”Directory Manager” –w asd1234f | grep sambaDomainName
#smbldap-usershow admin
#net rpc groupmap list

LDAP already have all the samba entries and not required to create because LDAP is integrated here in smb.conf

passdb backend = ldapsam:"ldap://pbdrldap.pbifmsiwdms.pjb"
ldap admin dn = cn=Directory manager
ldap suffix = dc=pbifmsiwdms,dc=pjb
ldap user suffix = ou=People
ldap machine suffix = ou=Computers
ldap group suffix = ou=Groups

PDC across subnets

Windows machines find the Samba server via NetBios. With the default configuration, this takes place only in the subnet the server is in. To enable the PDC across subnets, we need to configure Samba as a WINS (Windows Internet Name Service) Server.

To ensure this, we enter the following lines in smb.conf:

domain master = yes
preferred master = yes
local master = yes
wins support = yes
wins proxy = yes
os level = 65

Samba's smb.conf

[global]
workgroup = PUNJABGOVT
netbios name = PUNJABGOVT1
hosts allow = 127.0.0.1 192.168.10.0/24 192.168.20.0/24 192.168.70.0/24 10.10.20.0/24 10.10.22.0/24 172.22.0.0/16
security = user
map untrusted to domain = Yes
 passdb backend = ldapsam:"ldap://pbdrldap.pbifmsiwdms.pjb"
ldap admin dn = cn=Directory manager
ldap suffix = dc=pbifmsiwdms,dc=pjb
ldap user suffix = ou=People
ldap machine suffix = ou=Computers
ldap group suffix = ou=Groups
ldap ssl = off
ldap passwd sync = yes
obey pam restrictions = no
passwd program = /usr/local/sbin/smbldap-passwd %u
passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n *password\supdated\ssuccessfully* .
log file = /var/log/samba/%m.log
log level = 3
max log size = 1000
syslog only = no
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
os level = 65
domain logons = yes
domain master = yes
local master = yes
preferred master = yes
wins proxy = yes
wins support = yes
logon path = \\%L\profiles\%U
logon home = \\%L\%U
logon drive = H:
template shell = /bin/false
name resolve order = wins lmhosts hosts bcast
encrypt passwords = yes
logon script = logon.cmd
add user script = /usr/sbin/smbldap-useradd -a %u
add machine script = /usr/sbin/smbldap-useradd -w %u
delete user script = /usr/sbin/smbldap-userdel '%u'
delete user from group script = /usr/sbin/smbldap-groupmod -x '%u' '%g'
set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'
lm announce = yes
pam password change = yes
enable privileges = yes
;server string = PunjabGovt
dns proxy = no
winbind enum groups = No
winbind trusted domains only = yes
winbind use default domain = no
map untrusted to domain = Yes
map to guest = bad user
username map = /etc/samba/smbusers
add group script = /usr/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/sbin/smbldap-groupdel "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
admin users = root
[netlogon]
path = /mnt/gfs2/samba/netlogon
read only = yes
browsable = no
guest ok = yes
[profiles]
path = /mnt/gfs2/samba/profiles
read only = no
create mask = 0600
directory mask = 0700
[profiles.V2]
copy = profiles
browseable = no
[homes]
browsable = no
writable = yes
path = /mnt/gfs2/share/%u
[nitrobit]
path = /mnt/gfs2/samba/nitrobit
read only = no
public = yes
browsable = yes
writable = yes
guest ok =yes

Nitrobit has been configured to use this following directory:

/mnt/gfs2/samba/nitrobit

Finally start the Samba service:

# service smb start; chkconfig smb on
# service nmb start; chkconfig nmb on

Samba troubleshooting

If the client computers get the error that they cannot contact the Domain Controller specified, then check if nmb is running. If not, start it.

# service nmb start

To check if an account can connect:

# smbclient -L samba.pbifmsiwdms.pjb -U <username>

To check if a user is read from the ldap server:

# getent passwd <username>

For example:

# getent passwd admin

admin:*:11071:5122:System User:/home/admin:/bin/bash

This will show the user's POSIX details, as stored on the 389-DS server.

It can be similarly used for groups, as follows:

# getent group 'Domain Admins'

Domain Admins:*:5122:admin

To see the group mappings:

# net groupmap list

To add a group:

# net groupmap add rid=513 \

ntgroup='PUNJABGOVT\Domain Users' \

unixgroup='Domain Users'

To see a group's members:

# net rpc group members "Domain Admins”

To see a members's groups:

# net rpc user info admin

To get the SID:

# net getdomainsid