Aggiungere un Domain Controller in Samba

From RVM Wiki
Jump to navigation Jump to search

Installazione Pacchetti e Join al dominio del DC da aggiungere

  • Installare pacchetti
apt install samba krb5-user krb5-config winbind libpam-winbind libnss-winbind
  • Confgurare Kerberos:
vi /etc/krb5.conf

[libdefaults]
  default_realm = EXAMPLE.COM
  dns_lookup_kdc = true
  dns_lookup_realm=false
  • Impostare un DNS di un altro DC:
sudoedit /etc/resolv.conf

nameserver 192.168.1.111
  • Impostare hostname:
sudoedit /etc/hosts

192.168.1.112  mydc02.example.com mydc02
  • Verificare hostname locale:
hostname -f

mydc02.example.com
  • Riavviare:
sudo reboot
  • Test autenticazione
kinit administrator@example.com

klist
  • Fermare tutti i servizi samba:
systemctl stop smbd.service 
systemctl stop nmbd.service 
systemctl stop winbind.service 
systemctl stop samba-ad-dc.service
  • Verificare:
 ps ax | egrep "samba|smbd|nmbd|winbindd"
  • Rinominare il file di configurazione:
mv $(smbd -b | grep "CONFIGFILE" | tr -s ' '| cut -f 3 --delimiter=' ') $(smbd -b | grep "CONFIGFILE" | tr -s ' '| cut -f 3 --delimiter=' ').old
  • Verificare
ls /etc/samba
  • Eliminare i vecchi DB:
for DIR in $(smbd -b | egrep "LOCKDIR|STATEDIR|CACHEDIR|PRIVATE_DIR" | tr -s ' '| cut -f 3 --delimiter=' '); do echo CLEANING $DIR; cd $DIR; find . -name \*.tdb -exec /bin/rm -f '{}' \;; find . -name \*.ldb -exec /bin/rm -f '{}' \;; done
  • Abilitare daemon:
sudo systemctl unmask samba-ad-dc
sudo systemctl enable samba-ad-dc
  • Fare Join:
samba-tool domain join example.com  DC -k yes
  • Impostare come DNS se stessi:
sudoedit /etc/resolv.conf

nameserver 192.168.1.112
  • Setup ID mapping:
vi /etc/samba/smb.conf

[global]
    dns forwarder = 8.8.8.8
    idmap_ldb:use rfc2307 = yes
    template shell = /bin/bash
    winbind use default domain = true
    winbind offline logon = false
    winbind nss info = rfc2307
    winbind enum users = yes
    winbind enum groups = yes
  • Impostare configurazione kerberos:
cp /var/lib/samba/private/krb5.conf /etc/krb5.conf
cat /etc/krb5.conf
  • Restart and enable daemons:
systemctl disable smbd nmbd winbind
systemctl enable samba-ad-dc

systemctl restart samba-ad-dc
  • Forzare DNS update:
samba_dnsupdate --use-samba-tool --verbose
  • Verificare che il DC sia presente in
host example.com

Configurazione Time Sync

  • Installare chrony
apt install chrony ntpdate -y
  • Fare sync manuale
ntpdate -bu pool.ntp.org
  • Configurare chrony aggiungendo le righe:
vi /etc/chrony/chrony.conf

allow 192.168.0.0/24
ntpsigndsocket  /var/lib/samba/ntp_signd
  • Impostare permission:
chown root:_chrony /var/lib/samba/ntp_signd/
chmod 750 /var/lib/samba/ntp_signd/
  • Abilitare e restartare:
systemctl enable chrony
systemctl restart chrony
  • Verificare:
journalctl -u chrony.service -f

Sites

Se ci sono Dc in altre subnet (sedi remote), bisogna, con il tool Windows "Active Directory Sites and Services"

  • Definire i Sites
  • Spostare i Dc nei relativi sites
  • Definire le Subnet associandole ai relativi Sies
  • Fare da ogni Dc
samba_dnsupdate --use-samba-tool --verbose

Verifiche

  • Verify replication:
samba-tool drs showrepl
  • This warning is ok:
 Warning: No NC replicated for Connection!
  • Verify Kerberos authentication
kinit administrator
klist
  • Verify DNS records:
host example.com

ad.metrica.it has address 192.168.1.111
ad.metrica.it has address 192.168.1.120

host -t SRV _kerberos._udp.ad.metrica.it  # UDP Kerberos SRV record

_kerberos._udp.ad.metrica.it has SRV record 0 100 88 metdc01.ad.metrica.it.
_kerberos._udp.ad.metrica.it has SRV record 0 100 88 metdc02.ad.metrica.it.

host -t SRV _ldap._tcp.ad.metrica.it  # TCP LDAP SRV record

_ldap._tcp.ad.metrica.it has SRV record 0 100 389 metdc01.ad.metrica.it.
_ldap._tcp.ad.metrica.it has SRV record 0 100 389 metdc02.ad.metrica.it.

samba_dnsupdate --use-samba-tool --verbose
  • Verify user sync:
# metdc02
samba-tool user create test_user

# metdc01
samba-tool user list | grep test_user
samba-tool user delete test_user

# metdc02
samba-tool user list | grep test_user

DNS Config

  • Add mydc02 as secondary Nameserver in DHCP config

Setup SYSVOL Sync

ssh-keygen -t RSA  
ssh-copy-id root@metdc02.ad.metrica.it
ssh root@metdc02.ad.metrica.it cat .ssh/authorized_keys
  • Creare lo script di sync:
cat > /usr/local/sbin/samba-sysvol-sync <<'EOFile'
#!/bin/bash
echo "Start sysvol sync"
# Check if this is FMSO owner
NUMBER=$(samba-tool fsmo show | grep -i $(hostname) | wc -l)
if [ "$NUMBER" -ne 7 ]
then
	echo "This is not the FMSO Owner DC. Aborting sysvol replication"  1>&2
	exit 127
fi


# get samba domain:
DOMAIN=$(cat /etc/samba/smb.conf | grep realm| tr -d ' ' | cut -f 2 --delimiter='=' |  tr "[:upper:]" "[:lower:]")
echo "DOMAIN is $DOMAIN"

# get list of DCs
DCS=$(ldbsearch -H /var/lib/samba/private/sam.ldb '(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))' dn  | grep -v "CN=Configuration,DC" | grep CN | cut -f 2 --delimiter='=' | cut -f 1 --delimiter=',' | tr "[:upper:]" "[:lower:]" | grep -v $(hostname))
# https://serverfault.com/questions/432572/what-is-correct-objectclass-for-domain-controller-objects

echo "DCs are:"
echo $DCS

echo "Resetting local sysvol ACL"
/usr/bin/samba-tool ntacl sysvolreset

# Backup idmap.ldb
echo "Backup idmap.ldb"
tdbbackup -s .bak /var/lib/samba/private/idmap.ldb

for DC in $DCS
do
	echo "Copy idmap.ldb.bak to ${DC}.${DOMAIN}"
	scp -q /var/lib/samba/private/idmap.ldb.bak ${DC}.${DOMAIN}:/var/lib/samba/private/idmap.ldb
	echo "Run net cache flush on ${DC}.${DOMAIN}"
	ssh ${DC}.${DOMAIN} /usr/bin/net cache flush
	echo "Syncing sysvol to ${DC}.${DOMAIN}"
	rsync -a --quiet --delete-after /var/lib/samba/sysvol/ ${DC}.${DOMAIN}:/var/lib/samba/sysvol/
	echo "Resetting sysvol acl on ${DC}.${DOMAIN}"
	ssh ${DC}.${DOMAIN} /usr/bin/samba-tool ntacl sysvolreset
done
echo "End of sysvol sync"
EOFile

chmod 755 /usr/local/sbin/samba-sysvol-sync
  • Run the script
/usr/local/sbin/samba-sysvol-sync
  • On second DC, verify that GP policies are present:
ls /var/lib/samba/sysvol/ad.metrica.it/Policies/
  • Enable scheduled sync:
cat > /etc/cron.d/samba-sysvol-sync <<EOFile
*/5 * * * * root /usr/local/sbin/samba-sysvol-sync | systemd-cat -t samba-sysvol-sync
EOFile
  • Per vedere cosa logga:
journalctl -t samba-sysvol-sync -f

Riferimenti

Retrieved from "https://kb.rvmgroup.it/index.php?title=Aggiungere_un_Domain_Controller_in_Samba&oldid=11135"