Aggiungere un Domain Controller in Samba - Revision history

Gabriele.vivinetto: /* Setup SYSVOL Sync */

2024-04-18T09:51:02Z

Setup SYSVOL Sync

← Older revision		Revision as of 09:51, 18 April 2024
Line 209:		Line 209:
	ssh root@metdc02.ad.metrica.it cat .ssh/authorized_keys		ssh root@metdc02.ad.metrica.it cat .ssh/authorized_keys

			* Installare ldb-tools
			apt install ldb-tools
	* Creare lo script di sync:		* Creare lo script di sync:
	<pre>		<pre>

Gabriele.vivinetto: /* Setup SYSVOL Sync */

2024-04-18T09:49:04Z

Setup SYSVOL Sync

← Older revision		Revision as of 09:49, 18 April 2024
Line 206:		Line 206:

	ssh-keygen -t RSA		ssh-keygen -t RSA
	ssh-copy-id root@metdc02.ad.metrica.it		ssh-copy-id -i /root/.ssh/id_rsa.pub root@metdc02.ad.metrica.it
	ssh root@metdc02.ad.metrica.it cat .ssh/authorized_keys		ssh root@metdc02.ad.metrica.it cat .ssh/authorized_keys

Gabriele.vivinetto: /* Configurazione Time Sync */

2024-04-18T09:31:45Z

Configurazione Time Sync

← Older revision		Revision as of 09:31, 18 April 2024
Line 108:		Line 108:
	* Installare chrony		* Installare chrony

	apt install chrony ntpdate -y		apt install chrony ntpdate --purge

	* Fare sync manuale		* Fare sync manuale

Gabriele.vivinetto: /* Verifiche */

2024-04-11T15:08:04Z

Verifiche

← Older revision		Revision as of 15:08, 11 April 2024
Line 157:		Line 157:
	klist		klist

	* Verify DNS records:		* Impostare il dominio per i test:
	host ~~example.com~~		export DOMAIN=example.com
			* Verify DNS records of DCs:
			host $DOMAIN \| sort

	ad.~~metrica.it~~ has address 192.168.1.111		example.com has address 192.168.1.111
	~~ad.metrica~~.it has address 192.168.1.120		example.com has address 192.168.1.120

	host -t SRV _kerberos._udp.~~ad.metrica.it # UDP Kerberos SRV record~~		* Verify DNS records of KDCs:

			host -t SRV _kerberos._udp.$DOMAIN \| sort

	_kerberos._udp.ad.metrica.it has SRV record 0 100 88 metdc01.ad.metrica.it.		_kerberos._udp.ad.metrica.it has SRV record 0 100 88 metdc01.ad.metrica.it.
	_kerberos._udp.ad.metrica.it has SRV record 0 100 88 metdc02.ad.metrica.it.		_kerberos._udp.ad.metrica.it has SRV record 0 100 88 metdc02.ad.metrica.it.

	host -t SRV _ldap._tcp.~~ad.metrica.it # TCP LDAP SRV record~~		* Verify DNS records of LDAPs:

			host -t SRV _ldap._tcp.$DOMAIN \| sort

	_ldap._tcp.ad.metrica.it has SRV record 0 100 389 metdc01.ad.metrica.it.		_ldap._tcp.ad.metrica.it has SRV record 0 100 389 metdc01.ad.metrica.it.
Line 196:		Line 202:
	*Eventualmente vedere [https://samba.tranquil.it/doc/en/samba_advanced_methods/samba_tis_sysvolsync.html#samba-tis-sysvolsync Synchronizing SYSVOLs between multiple domain controllers — Samba-AD 4.19 documentation]		*Eventualmente vedere [https://samba.tranquil.it/doc/en/samba_advanced_methods/samba_tis_sysvolsync.html#samba-tis-sysvolsync Synchronizing SYSVOLs between multiple domain controllers — Samba-AD 4.19 documentation]
	*'''All GPO edits should be made only on the first DC that owns FMSO Roles'''		*'''All GPO edits should be made only on the first DC that owns FMSO Roles'''
	*'''The script must be run on this DC.'''		*'''The script must be run on this DC that owns the FMSO Roles.'''
	*To start the process of SysVol replication, first generate a SSH key on the first Samba AD DC and transfer the key to the second DC by issuing the below commands.		*To start the process of SysVol replication, first generate a SSH key on the first Samba AD DC and transfer the key to the second DC by issuing the below commands.

Gabriele.vivinetto: /* Installazione Pacchetti e Join al dominio del DC da aggiungere */

2024-04-11T14:52:43Z

Installazione Pacchetti e Join al dominio del DC da aggiungere

← Older revision		Revision as of 14:52, 11 April 2024
Line 34:		Line 34:
	*Test autenticazione		*Test autenticazione

	kinit administrator@~~example~~.~~com~~		kinit administrator@EXAMPLE.COM

	klist		klist

Gabriele.vivinetto: /* Installazione Pacchetti e Join al dominio del DC da aggiungere */

2024-04-11T14:51:06Z

Installazione Pacchetti e Join al dominio del DC da aggiungere

← Older revision		Revision as of 14:51, 11 April 2024
Line 9:		Line 9:
	<pre>		<pre>
	[libdefaults]		[libdefaults]
	default_realm = EXAMPLE.COM		default_realm = EXAMPLE.COM
	dns_lookup_kdc = true		dns_lookup_kdc = true
	dns_lookup_realm=false		dns_lookup_realm=false
	</pre>		</pre>

Gabriele.vivinetto: /* Setup SYSVOL Sync */

2024-04-11T14:27:43Z

Setup SYSVOL Sync

← Older revision		Revision as of 14:27, 11 April 2024
Line 264:		Line 264:
	EOFile		EOFile
	</pre>		</pre>

			* Per vedere cosa logga:

			journalctl -t samba-sysvol-sync -f

	=Riferimenti=		=Riferimenti=

Gabriele.vivinetto: /* Setup SYSVOL Sync */

2024-04-11T14:25:26Z

Setup SYSVOL Sync

← Older revision		Revision as of 14:25, 11 April 2024
Line 134:		Line 134:

	journalctl -u chrony.service -f		journalctl -u chrony.service -f

			== Sites ==
			Se ci sono Dc in altre subnet (sedi remote), bisogna, con il tool Windows "Active Directory Sites and Services"

			* Definire i Sites
			* Spostare i Dc nei relativi sites
			* Definire le Subnet associandole ai relativi Sies
			* Fare da ogni Dc

			samba_dnsupdate --use-samba-tool --verbose

	=Verifiche=		=Verifiche=
Line 184:		Line 194:

	=Setup SYSVOL Sync=		=Setup SYSVOL Sync=
	*~~This method ensures GPO objects consistency across~~ domain controllers~~, but has one huge drawback. It works only in one direction because rsync will transfer all changes from the source DC to the destination DC when synchronizing GPO directories~~.		*Eventualmente vedere [https://samba.tranquil.it/doc/en/samba_advanced_methods/samba_tis_sysvolsync.html#samba-tis-sysvolsync Synchronizing SYSVOLs between multiple domain controllers — Samba-AD 4.19 documentation]
			*'''All GPO edits should be made only on the first DC that owns FMSO Roles'''
	* ~~Objects which no longer exist on the source will be deleted from the destination as well. In order to limit and avoid any conflicts, all~~ GPO edits should be made only on the first DC.		*'''The script must be run on this DC.'''
			*To start the process of SysVol replication, first generate a SSH key on the first Samba AD DC and transfer the key to the second DC by issuing the below commands.
	* To start the process of SysVol replication, first generate a SSH key on the first Samba AD DC and transfer the key to the second DC by issuing the below commands.

	ssh-keygen -t RSA		ssh-keygen -t RSA
Line 194:		Line 203:
	ssh root@metdc02.ad.metrica.it cat .ssh/authorized_keys		ssh root@metdc02.ad.metrica.it cat .ssh/authorized_keys

	~~rsync -XAavz --chmod=775 --delete-after --progress --stats \~~		* Creare lo script di sync:
	/~~var~~/~~lib~~/samba/sysvol~~/ \~~		<pre>
	~~root@metdc02.ad.metrica.it:~~/~~var/lib/samba~~/sysvol~~/ \~~		cat > /usr/local/sbin/samba-sysvol-sync <<'EOFile'
	--~~dry~~-~~run~~		#!/bin/bash
			echo "Start sysvol sync"
			# Check if this is FMSO owner
			NUMBER=$(samba-tool fsmo show \| grep -i $(hostname) \| wc -l)
			if [ "$NUMBER" -ne 7 ]
			then
			echo "This is not the FMSO Owner DC. Aborting sysvol replication" 1>&2
			exit 127
			fi


	* If the simulation process works as expected, run the rsync command again without the --~~dry~~-~~run option in order to actually replicate GPO objects across your domain controllers.~~		# get samba domain:
			DOMAIN=$(cat /etc/samba/smb.conf \| grep realm\| tr -d ' ' \| cut -f 2 --delimiter='=' \| tr "[:upper:]" "[:lower:]")
			echo "DOMAIN is $DOMAIN"

	~~rsync -XAavz --chmod~~=~~775~~ -~~-delete-after --progress --stats \~~		# get list of DCs
	/var/lib/samba/~~sysvol~~/ \		DCS=$(ldbsearch -H /var/lib/samba/private/sam.ldb '(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))' dn \| grep -v "CN=Configuration,DC" \| grep CN \| cut -f 2 --delimiter='=' \| cut -f 1 --delimiter=',' \| tr "[:upper:]" "[:lower:]" \| grep -v $(hostname))
	~~root@metdc02~~.ad.~~metrica~~.it:/~~var~~/~~lib~~/~~samba~~/~~sysvol~~/		# https://serverfault.com/questions/432572/what-is-correct-objectclass-for-domain-controller-objects

	* On second DC, ~~verofy~~ that GP policies are present:		echo "DCs are:"
			echo $DCS

			echo "Resetting local sysvol ACL"
			/usr/bin/samba-tool ntacl sysvolreset

			# Backup idmap.ldb
			echo "Backup idmap.ldb"
			tdbbackup -s .bak /var/lib/samba/private/idmap.ldb

			for DC in $DCS
			do
			echo "Copy idmap.ldb.bak to ${DC}.${DOMAIN}"
			scp -q /var/lib/samba/private/idmap.ldb.bak ${DC}.${DOMAIN}:/var/lib/samba/private/idmap.ldb
			echo "Run net cache flush on ${DC}.${DOMAIN}"
			ssh ${DC}.${DOMAIN} /usr/bin/net cache flush
			echo "Syncing sysvol to ${DC}.${DOMAIN}"
			rsync -a --quiet --delete-after /var/lib/samba/sysvol/ ${DC}.${DOMAIN}:/var/lib/samba/sysvol/
			echo "Resetting sysvol acl on ${DC}.${DOMAIN}"
			ssh ${DC}.${DOMAIN} /usr/bin/samba-tool ntacl sysvolreset
			done
			echo "End of sysvol sync"
			EOFile
			</pre>

			chmod 755 /usr/local/sbin/samba-sysvol-sync
			* Run the script
			/usr/local/sbin/samba-sysvol-sync
			* On second DC, verify that GP policies are present:

	ls /var/lib/samba/sysvol/ad.metrica.it/Policies/		ls /var/lib/samba/sysvol/ad.metrica.it/Policies/
Line 212:		Line 260:

	<pre>		<pre>
	cat > /etc/cron.d/samba-sysvol-~~replication~~ <<EOFile		cat > /etc/cron.d/samba-sysvol-sync <<EOFile
	/5 * * * root ~~rsync -XAavz --chmod=775 --delete-after --progress --stats /var/lib/samba/sysvol~~/ ~~root@gapsrv03.ad.gapartners.eu:~~/~~var~~/~~lib~~/samba/sysvol~~/ > /var/log/samba/~~samba-sysvol-~~replication.log 2>&1~~		/5 * * * root /usr/local/sbin/samba-sysvol-sync \| systemd-cat -t samba-sysvol-sync
	EOFile		EOFile
	</pre>		</pre>

	* Check su dc01 e dc2:
	~~samba-tool ntacl sysvolcheck~~

	* Fix the DB ACL on GPO and VFS ACL errors
	~~samba-tool ntacl sysvolreset~~

	=Riferimenti=		=Riferimenti=

Gabriele.vivinetto: /* Verifiche */

2024-04-11T11:06:55Z

Verifiche

← Older revision		Revision as of 11:06, 11 April 2024
Line 163:		Line 163:
	_ldap._tcp.ad.metrica.it has SRV record 0 100 389 metdc02.ad.metrica.it.		_ldap._tcp.ad.metrica.it has SRV record 0 100 389 metdc02.ad.metrica.it.

	* If DNS records are missing (*[https://lists.samba.org/archive/samba-technical/2015-October/109959.html [~~Samba] Missing~~ DNS entry after "domain join"]), try:		* If DNS records are missing (*[https://lists.samba.org/archive/samba-technical/2015-October/109959.html <nowiki>[SambaMissing DNS entry after "domain join"]</nowiki>]), try:
	~~samba_dnsupdate --verbose~~		samba_dnsupdate --use-samba-tool --verbose

	* If this fails, try
	samba_dnsupdate --use-samba-tool
	* Verify user sync:		* Verify user sync:

Gabriele.vivinetto: /* Installazione Pacchetti e Join al dominio del DC da aggiungere */

2024-04-11T10:53:20Z

Installazione Pacchetti e Join al dominio del DC da aggiungere

← Older revision		Revision as of 10:53, 11 April 2024
Line 95:		Line 95:

	systemctl restart samba-ad-dc		systemctl restart samba-ad-dc

			* Forzare DNS update:

			samba_dnsupdate --use-samba-tool --verbose

			* Verificare che il DC sia presente in

			host example.com

	== Configurazione Time Sync ==		== Configurazione Time Sync ==