Installazione Primary Domain Controller

Installazione Pacchetti

Installare secondo le opzioni standard:

sudo apt-get install samba smbclient acl

Abilitazione ACL

Per poter utilizare i diritti sui files, è necessario abilitare le ACL sui filesystem utilizzati per lo storage dei dati samba.

Supponendo do usare una sola partizione, aggiungere l'opzione acl alla partizione:

sudoedit /etc/fstab

/dev/md0        /               ext3    defaults,errors=remount-ro,acl 0       1

Rimontare il filesystem:

sudo mount / -o remount

Verificare che sia attivo il paramtero acl

mount

/dev/md0 on / type ext3 (rw,errors=remount-ro,acl)

Configurazione di base

Impostare i seguenti parametri:

export DOMAIN_NAME=GSSPA
export SERVER_NAME=GSSERVER
export LAN_IF=eth0

cd /etc/samba
sudo mv smb.conf smb.conf.ori

Rispetto a Sarge printer admin è deprecata, e add user script non accetta comandi multipli col ;

• Creare il file diconfigurazione (sudo resetta le variabili precedentemente definite, quindi non si può creare direttamente):

cat  > /tmp/smb.conf <<EOFile
[global]
        # user and group  management
                add group script = /usr/sbin/groupadd %g
                delete group script = /usr/bin/net groupmap delete ntgroup="%g" ; /usr/sbin/groupdel "%g"
                add user to group script = /usr/bin/gpasswd -a %u %g
                delete user from group script = /usr/bin/gpasswd -d %u %g
                #
                add user script = /etc/samba/adduser.smb %u
                delete user script = /usr/sbin/userdel -r %u
                add machine script = /usr/sbin/useradd -s /bin/false -d /dev/null %u
                #username map = /etc/samba/user.map
                #
                passdb backend = tdbsam
                unix password sync = yes
                passwd program = /usr/bin/passwd %u
                passwd chat = "*Enter new UNIX password*" %n\n "*Retype new UNIX password*" %n\n "*password updated successfully*" .

        # Network role parameter
                netbios name = $SERVER_NAME
                workgroup = $DOMAIN_NAME
                server String = "Server $DOMAIN_NAME"
                domain master = yes
                domain logons = yes
                wins support = yes
                security = user
                local master = yes
                os level = 99
                time server = yes
                encrypt passwords = true
                logon home = \\%L\%U
                logon script = user.cmd
                logon path = \\%L\Profiles\%U
                logon drive = P:

        # Administrators users
                admin users = administrator

        # Logging settings
                syslog = 0
               syslog only = no
              log file = /var/log/samba/smbd
              #log level = 3
              #debug timestamp = yes

        # Network binding
                interfaces = $LAN_IF
                bind interfaces only = Yes

        # Printing
                printing = cups
                printcap name = cups
                load printers = yes

[printers]
        comment = All Printers
        path = /tmp
        guest ok = yes
        printable = yes
        browseable = no

[print$]
        comment = Printer Drivers Share
        path = /var/lib/samba/printers
        public = yes
        guest ok = yes
        browseable = yes
        read only = yes
        write list = administrator


[homes]
        comment = Home Directories
        valid users = %S
        read only = no
        browseable = no
        path = /files/homes/%S

[homes$]
        comment = Home Directories
        admin users = root, administrator, @domainadmins
        read only = no
        browseable = no
        path = /files/homes

[netlogon]
        comment = Domain Logon Service
        path = /files/netlogon
        admin users = administrator, @domainadmins
        write list = administrator, @domainadmins
        guest ok = yes
        browsable = no

[Profiles]
        comment = Roaming Profile Share
        path = /files/profiles
        read only = No
        profile acls = Yes
        # Per evitare di avere desktop.ini aperto all'avvio
        hide files = /desktop.ini/ntuser.ini/NTUSER.*/

[Dati]
        writeable = yes
        path = /files/dati
        admin users = root, administrator, @domainadmins
        inherit permissions = yes
        inherit acls = yes

[Install]
        writeable = yes
        create mode = 775
        path = /files/install
        directory mode = 775
EOFile

• Copiare il file di configurazione:

sudo cp /tmp/smb.conf /etc/samba/smb.conf && rm /tmp/smb.conf

Creare lo script per aggiungere gli utenti:

cat | sudo tee /etc/samba/adduser.smb > /dev/null <<'EOFile'
#!/bin/bash
/usr/sbin/useradd -g users -m $1
mkdir -p /files/homes/$1
chown $1: /files/homes/$1
chmod go-w /files/homes/$1
EOFile

sudo chmod a+x /etc/samba/adduser.smb

Creazione delle directory per le condivisioni

sudo mkdir -p /files/install /files/dati /files/profiles /files/netlogon /files/homes

Settare i diritti per i la Profiles:

cd /files/profiles/
sudo chown :users .
sudo chmod g+w .

Riavviare Samba:

sudo /etc/init.d/samba stop; sudo /etc/init.d/samba start

Creazione delle utenze

Azzerare TUTTO il database di samba, per evitare problemi con i SID:

sudo /etc/init.d/samba stop
sudo rm -f /var/lib/samba/*.tdb
sudo /etc/init.d/samba start

Creare l'utenza per l'administrator assegnandola al gruppo root:

sudo adduser administrator

sudo usermod -g root administrator

Creare l'account Samba, impostando il SID standard -50:

 sudo pdbedit \
      -U $(sudo net getlocalsid | cut -f 6- --delim=" ")-500 \
      -a \
      -u  administrator

Impostare il profilo corretto per profilo ed home:

echo pdbedit -p "\\\\\\\\${SERVER_NAME}\\\\Profiles\\\\Administrator" -h "\\\\\\\\${SERVER_NAME}\\\\Administrator" -u Administrator | sudo bash

Controllarlo:

sudo pdbedit -Lv administrator

Unix username:        administrator
NT username:          
Account Flags:        [UX         ]
User SID:             S-1-5-21-3700084591-738200680-917009653-500
Primary Group SID:    S-1-5-21-3700084591-738200680-917009653-513
Full Name:            Administrator ALL
Home Directory:       \\allserver\administrator
HomeDir Drive:        R:
Logon Script:         user.bat
Profile Path:         \\allserver\profiles\administrator
Domain:               ALLIANCE
Account desc:         
Workstations:         
Munged dial:          
Logon time:           0
Logoff time:          Tue, 19 Jan 2038 04:14:07 CET
Kickoff time:         0
Password last set:    Tue, 11 Dec 2007 15:27:09 CET
Password can change:  Tue, 11 Dec 2007 15:27:09 CET
Password must change: Tue, 19 Jan 2038 04:14:07 CET
Last bad password   : 0
Bad password count  : 0
Logon hours         : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

Risettare la password unix uguale a quella samba, che serve per poter accedere via cups:

sudo passwd administrator

Pulizia delle Utenze

Rimuovere le utenze samba inutili.

ATTENZIONE: NON RIMUOVELRE IN ALTRO MODO, PERCHE' VERREBBERO RIMOSSI ANCHE GLI ACCOUNT UNIX !!

sudo smbpasswd -x backup
sudo smbpasswd -x bin
sudo smbpasswd -x bind
sudo smbpasswd -x daemon
sudo smbpasswd -x Debian-exim
sudo smbpasswd -x games
sudo smbpasswd -x gnats
sudo smbpasswd -x irc
sudo smbpasswd -x list
sudo smbpasswd -x lp
sudo smbpasswd -x mail
sudo smbpasswd -x man
sudo smbpasswd -x news
sudo smbpasswd -x nobody
sudo smbpasswd -x postfix
sudo smbpasswd -x proxy
sudo smbpasswd -x root
sudo smbpasswd -x sshd
sudo smbpasswd -x sync
sudo smbpasswd -x sys
sudo smbpasswd -x uucp
sudo smbpasswd -x www-data
sudo smbpasswd -x aptproxy
sudo smbpasswd -x postgres
sudo smbpasswd -x mnt.vvngrl
sudo smbpasswd -x ntp
sudo smbpasswd -x messagebus
sudo smbpasswd -x munin
sudo smbpasswd -x ntop
sudo smbpasswd -x amavis
sudo smbpasswd -x mysql
sudo smbpasswd -x dovecot
sudo smbpasswd -x postgrey
sudo smbpasswd -x nagios
sudo smbpasswd -x vmware
sudo smbpasswd -x backuppc
sudo smbpasswd -x boinc
sudo smbpasswd -x clamav
sudo smbpasswd -x libuuid

Samba < 3.0.23 (Sarge)

Assicurarsi che le mappature siano azzerate:

sudo net groupmap list

System Operators (S-1-5-32-549) -> -1
Replicators (S-1-5-32-552) -> -1
Guests (S-1-5-32-546) -> -1
Domain Admins (S-1-5-21-3888806968-3546501424-3282427636-512) -> -1
Domain Guests (S-1-5-21-3888806968-3546501424-3282427636-514) -> -1
Power Users (S-1-5-32-547) -> -1
Print Operators (S-1-5-32-550) -> -1
Administrators (S-1-5-32-544) -> -1
Account Operators (S-1-5-32-548) -> -1
Domain Users (S-1-5-21-3888806968-3546501424-3282427636-513) -> -1
Backup Operators (S-1-5-32-551) -> -1
Users (S-1-5-32-545) -> -1

Se così non fosse:

sudo /etc/init.d/samba stop
sudo rm /var/lib/samba/group_mapping.tdb
sudo /etc/init.d/samba start

Mappare:

sudo net groupmap modify ntgroup="Domain Admins" unixgroup=root
sudo net groupmap modify ntgroup="Domain Users"  unixgroup=users
sudo net groupmap modify ntgroup="Domain Guests" unixgroup=nogroup

Verificare:

sudo net groupmap list
System Operators (S-1-5-32-549) -> -1
Replicators (S-1-5-32-552) -> -1
Guests (S-1-5-32-546) -> -1
Domain Admins (S-1-5-21-3888806968-3546501424-3282427636-512) -> root
Domain Guests (S-1-5-21-3888806968-3546501424-3282427636-514) -> nogroup
Power Users (S-1-5-32-547) -> -1
Print Operators (S-1-5-32-550) -> -1
Administrators (S-1-5-32-544) -> -1
Account Operators (S-1-5-32-548) -> -1
Domain Users (S-1-5-21-3888806968-3546501424-3282427636-513) -> users
Backup Operators (S-1-5-32-551) -> -1
Users (S-1-5-32-545) -> -1

Samba > 3.0.23 (Etch)

In questa versione i gruppi de default non sono creati, quindi il mapping va creato, non modificato:

sudo net groupmap add ntgroup="Domain Admins" unixgroup=root rid=512 type=d
sudo net groupmap add ntgroup="Domain Users" unixgroup=users rid=513 type=d
sudo net groupmap add ntgroup="Domain Guests" unixgroup=nogroup rid=514 type=d

Controllare

sudo net groupmap list

Domain Users (S-1-5-21-4083320814-7475195-2141263470-513) -> users
Domain Guests (S-1-5-21-4083320814-7475195-2141263470-514) -> nogroup
Domain Admins (S-1-5-21-4083320814-7475195-2141263470-512) -> root

Impostare il GID di Administrator:

sudo pdbedit -G $(sudo net getlocalsid | cut -f 6- --delim=" ")-512 \
     -u  administrator \
     -r

Controllo delle Utenze

Controllare che l'unico utente configurato sia Administrator:

sudo pdbedit -L

administrator:1012:Administrator GSSS,,,

Creazione delle home directory

Dopo aver creato le utenze con lo User Manager, si possono creare le relative home directories con lo script:

cd /tmp
cat > /tmp/mkhomes <<'EOFile'
#!/bin/bash
#set -x
for NAME in $(pdbedit -L | grep -v '\$'  | cut -f 1 --delim=':' | sort)
do
        echo making /files/homes/$NAME
        mkdir -p /files/homes/$NAME
        chown $NAME: /files/homes/$NAME
done
EOFile

chmod 755 /tmp/mkhomes
sudo /tmp/mkhomes
rm -f /tmp/mkhomes

Creazione automatica degli utenti

ATTENZIONE: NON È POSSIBILE CREARE UN UTENTE CON LO STESSO NOME DEL DOMINIO !!!

Ecco uno script di esempio:

cat > /tmp/creautenti <<'EOFile'
#!/bin/bash
# customizzare le tre variabili
DOM="SR"
ADMINPASS="gal80xl700"
UTENTI="agos \
av \
cassa1 \
cassa2 \
di
findomestic \
ge \
he \
it \
pe \
storemanager \
te \
tv \
videosorveglianza"

# Se non è eseguito come root, abort
if [ "$(whoami)" != "root" ]
then
        echo "You must be root. Aborting"
        exit 1
fi

#crea gli utenti
for NOME in $UTENTI
do
        echo $NOME
        PASSWORD=$NOME
        net rpc user add $NOME  -U "administrator%${ADMINPASS}" -S ${DOM}SERVER
        (echo $PASSWORD ; echo $PASSWORD) | smbpasswd -s $NOME
        pdbedit -p "\\\\${DOM}Server\\Profiles\\$NOME" -h "\\\\${DOM}Server\\$NOME" -u $NOME > /dev/null
done

if (grep lpadmin /etc/group > /dev/null)
then
        #Crea il printadmin
        NOME=printadmin
        PASSWORD=print
        echo $NOME
        net rpc user add $NOME  -U"administrator%${ADMINPASS}" -S ${DOM}SERVER
        (echo $PASSWORD ; echo $PASSWORD) | smbpasswd -s $NOME
        pdbedit -p "\\\\${DOM}Server\\Profiles\\$NOME" -h "\\\\${DOM}Server\\$NOME" -u $NOME > /dev/null
        gpasswd -a printadmin lpadmin
        echo $NOME:$PASSSWORD | chpasswd
fi
EOFile

vi       /tmp/creautenti
chmod +x /tmp/creautenti
sudo     /tmp/creautenti

Installazione servizi di stampa

• Assicurarsi che le directory dei drivers siano presenti e con le permission corrette:

sudo mkdir -p /var/lib/samba/printers/W32X86/
sudo chown -R administrator: /var/lib/samba/printers

Se così non fosse, quando si tenta di caricare un driver, si ottiene un errore.

Installazione e Configurazione CUPS

Riferimenti

• (Samba) Desktop.ini showing up