AD Samba4
From Stadm
Contents
- 1 Samba 4 Active Directory Install
- 2 Windows Domain
- 2.1 Add Windows computer to domain
- 2.2 Adding Profile path to Samba
- 2.3 Change Security on Profiles folder
- 2.4 Install RSAT
- 2.5 Adding User and profile path
- 2.6 Folder Security
- 2.7 Folder Redirection with GPO
- 2.8 Map a Network Drive with GPO
- 2.9 Windows Update GPO
- 2.10 SSSD
- 2.11 ACL
- 2.12 ID Mapping/Group Mapping
- 2.13 save
- 3 References
Samba 4 Active Directory Install
Installing Samba 4 onto CentOS
- Install a minimal install of CentOS
- change the hostname
vi /etc/sysconfig/network
- Edit "HOSTNAME=***" to say "HOSTNAME=samba" or whatever you want to name the server
- manually edit or add network-scripts if not there
cd /etc/sysconfig/network-scripts/ vi ifcfg-eth0
- Make sure these options are included
DEVICE=eth0 HWADDR=**:**:**:**:**:** TYPE=ETHERNET ONBOOT=yes NM_CONTROLLED=yes BOOTPROTO=dhcp
- restart the network
service network restart
- run yum update
- install vim or an editor of your choice, vi comes included with minimal
- SELinux must be disabled:
vim /etc/sysconfig/selinux
- change "SELINUX=enforcing" to "SELINUX=disabled"
- restart the computer
shutdown -r now
- install a couple packages that will be required for building and installing samba
yum install glibc glibc-devel gcc python* libacl-devel krb5-server krb5-workstation krb5-libs pam_krb5 make gnutls-devel \ openssl-devel bind bind-libs bind-utils libblkid-devel readline-devel gdb python-devel *ldap* *gnutls* *acl* cups sqlite-devel\ setroubleshoot-server popt-devel libxml2-devel libpcap-devel libidn-devel cups-devel
- install git, git will be used to download samba
- NOTE:scp instead of git from local computer, use version 4.2 8f8e843, version 4.2 91186fc from GIT not fully functional anymore
yum install git-core git clone http://gitweb.samba.org/samba.git ~/samba-master
- master git now located at(3-17-14)
git://git.samba.org/samba.git.
- reboot server so all packages and updates are applied
shutdown -r now
- login and build the samba install
cd ~/samba-master ./configure --enable-debug --enable-selftest
- if it completes successfully, make sure it is Building with Active Directory support, if not you may have forgotten a few packages
make make install
Creating script for starting and stopping samba service
cd /etc/init.d cp rdisc samba vim samba :%s/rdisc/samba/g :wq
- change daemon location from /sbin/samba to /usr/loca/samba/sbin/samba, as well as killproc location
- Delete RDISCOPT variable, remove usage from daemon command
- change what gets echoed to the screen
Enabling Samba 4 as DC
- add samba path to $PATH
echo 'export PATH=$PATH:/usr/local/samba/bin' >> ~/.bashrc echo 'export PATH=$PATH:/usr/local/samba/sbin' >> ~/.bashrc
- run command
/usr/local/samba/bin/samba-tool domain provision
- the domain-provision tool should pick all defaults automatically, however they can be changed to your liking
- once the provision tool has finished successfully restart the server
shutdown -r now
- once system has started enable samba 4 and add it start at boot, change to start with chkconfig after service script is created
/usr/local/samba/sbin/samba vim /etc/rc.d/rc.local
- append "/usr/local/samba/sbin/samba" without quotations to the end of the file and then save
- samba version as well as samba client version can be checked using the following commands
/usr/local/samba/sbin/samba -V /usr/local/samba/bin/smbclient --version
Configuring DNS
- DNS forwarding was set up on the domain provision ing using the samba-tool
cat /usr/local/samba/etc/smb.conf
- there should be a line under "[global]" that says "dns forwarder = ***.***.***.***", if not it was not enabled during domain provisioning
- edit resolv.conf
vim /etc/resolv.conf
- edit to look exactly like:
domain mydomain.com nameserver 128.***.***.**
- where "128.***.***.***" is the ipaddress of the centos server
- next go back and edit ifcfg-eth0 in network-scripts
vim /etc/sysconfig/network-scripts/ifcfg-eth0
- change the file to look like this
DEVICE="eth0" BOOTPROTO="none" DNS1="128.***.***.**" #this is host ipaddress GATEWAY=128.**.***.* HWADDR="84:B4:C1:0A:**:**" IPADDR="128.***.***.**" IPV6INIT="no" NM_CONTROLLED="yes" ONBOOT="yes" PREFIX="24" TYPE="Ethernet"
- reboot so that all changes may take effect
shutdown -r now
- login and test that the DNS is working properly
host -t SRV _ldap._tcp.mydomain.com
- where mydomain.com is then name of the domain you are on
- output should look like, where samba is the hostname of your server
_ldap._tcp.mydomain.com has SRV record 0 100 389 samba.mydomain.com
- test with
host -t SRV _kerberos._udp.mydomain.com
- output
_kerberos._udp.mydomain.com has SRV record 0 100 88 samba.mydomain.com
- last test
host -t A samba.mydomain.com.
- output should return your ip adddress
samba.mydomain.com has address 192.168.0.2
- if test did not produce those outputs DNS has not been configured properly
Firewall
- settings:
-A INPUT -p tcp --dport 53 -j ACCEPT -A INPUT -p udp --dport 53 -j ACCEPT -A INPUT -p udp --dport 137:138 -j ACCEPT -A INPUT -p tcp --dport 139 -j ACCEPT -A INPUT -p tcp --dport 445 -j ACCEPT -A INPUT -p tcp --dport 135 -j ACCEPT -A INPUT -p tcp --dport 88 -j ACCEPT -A INPUT -p udp --dport 88 -j ACCEPT -A INPUT -p tcp --dport 464 -j ACCEPT -A INPUT -p tcp --dport 389 -j ACCEPT -A INPUT -p udp --dport 389 -j ACCEPT -A INPUT -p tcp --dport 1024 -j ACCEPT -A INPUT -p tcp --dport 636 -j ACCEPT -A INPUT -p tcp --dport 3268 -j ACCEPT -A INPUT -p tcp --dport 3269 -j ACCEPT -A INPUT -p udp --dport 445 -j ACCEPT -A INPUT -p tcp --dport 25 -j ACCEPT -A INPUT -p tcp --dport 135 -j ACCEPT -A INPUT -p tcp --dport 5722 -j ACCEPT -A INPUT -p udp --dport 464 -j ACCEPT -A INPUT -p tcp --dport 137 -j ACCEPT
Kerberos
- make a backup of original kerberos file and replace it with the copy generated by samba
mv /etc/krb5.conf /etc/krb5.conf.bak cp /usr/local/samba/share/setup/krb5.conf /etc/krb5.conf
- edit the new krb5.conf file and change the ${REALM} variable to the realm selected during domain provisioning, ALL CAPS
vim /etc/krb5.conf
- test Kerberos using the kinit command
kinit administrator@MYDOMAIN.COM
- if Kerberos is working you will be asked for your password
- verify that it is working by running klist, output should look something along the lines of
Ticket cache: FILE:/tmp/krb5cc_0 Default principal: administrator@MYDOMAIN.COM Valid starting Expires Service principal 07/25/13 15:23:33 07/26/13 1:23:33 krbtgt/MYDOMAIN.COM@MYDOMAIN.COM renew until 07/26/13 15:23:31
NTP
- install ntp
yum install ntp
- start ntp
/etc/init.d/ntpd start
- add ntp to start up
chkconfig ntpd on
Windows Domain
Add Windows computer to domain
- manually edit network settings to point DNS to samba4 server
- assign static ip so there are no problems with joining computers to domain
- ping samba4 server at ip address to verify you can see it
ping 128.***.***.****
- ping FQDN to verify DNS is working
ping samba4.mydomain.com
- should get replies form both verifying that you can communicate with server and that DNS is functioning
- run the date command in your server
date
- Change the date and time on Windows Computer so that it is within a few seconds of the server, Kerberos requires the times between computers be no more than a few seconds apart
- Right click on "My Computer" and click "Properties"
- Under "Computer name, domain, and workgroup settings" click change settings
- Under "Member of" check "Domain"
- Type in the name of your domain in full uppercase letters, ex.
- MYDOMAIN.COM
- When asked enter in the username and password for the Administrator created during the samba-tool domain provisioning
- Once you have joined the domain restart the computer and you can now log in to the domain
Adding Profile path to Samba
- make a folder where the profiles will be stored
mkdir /usr/local/samba/var/profiles
- Add the following to smb.conf to inlcude that location
vim /usr/local/samba/var/profiles [profiles] path = /usr/local/samba/etc/smb.conf read only = No
- restart samba
/usr/local/samba/bin/smbcontrol all reload-config
- once restarted check the shares on your samba server, profiles should appear under there
smbclient -L localhost -U%
Change Security on Profiles folder
- login to the domain as administrator onto a windows 7 computer
- open up my computer and navigate to "\\servername" , ex. "\\samba4"
- Right Click on the folder and select properties
- Change security to allow Domain Administrators Full Control
- add Domain Users to Security with options, Traverse folder/execute file. List Folder/read data, Create folder/append data
Install RSAT
- Download Remote Server Administration Tool from the microsoft website, http://www.microsoft.com/en-us/download/details.aspx?id=7887
- Install, Once installed open up control panel and then open up programs, then programs and features
- on the left pane click "Turn Windows features on or off"
- Select all under Remote Server Administration Tool, then click okay
Adding User and profile path
- From a windows computer with RSAT installed run: dsa.msc
- create a new user and edit its properties to include a profile path of "\\servername\profiles\%USERNAME%"
- then run: gpupdate \force
- Login with new user on domain and roaming profile will be created under /usr/local/samba/var/profiles on the server
Folder Security
- create a share for where users folder redirections will go, want on a NFS, demoing on local drive
[users] path = usr/local/samba/var/data/users comment = temp user folders for folder redirection, move to NFS read only = No
- make the folder or have the NFS mouted
mkdir -p usr/local/samba/var/data/users chown root:3000000 usr/local/samba/var/data/users chmod 755 usr/local/samba/var/data/users
- login into windows computer using a domain administrator to change permissions on users folder
- navigate to users folder on windows computer \\domainame.edu
- right click on users folder and select properties, go to security tab, click on advanced, click change permissions
- remove all current permissions, add new permissions making sure "Include inheritable permissions from the object's parents" is NOT checked
- add:
- Administrator: Full Control : This Folder, Subfolder, and Files
- Domain Admins: Full Control : This Folder, Subfolder, and Files
- SYSTEM: Full Control : This Folder, Subfolder, and Files
- CREATOR OWNER: Full Control : Subfolder, and Files
- Authenticated Users: Traverse Folder/Execute FIle, List Folder/Read Data, Create Files/Write Data, Create Folders/Append Data, Change Permissions: This Folder Only
- restart service and check that settings stay
- using getfacl
getfacl /data/users
- returns
# file: users # owner: root # group: root user::rwx user:root:rwx group::--- group:root:--- group:3000002:rwx group:3000003:rwx group:3000008:rwx mask::rwx other::--- default:user::rwx default:user:root:rwx default:group::--- default:group:root:--- default:group:3000002:rwx default:group:3000008:rwx default:mask::rwx default:other::---
Folder Redirection with GPO
- Download admx files for windows 7/2008 and place them in \\mydomain.edu\sysvol\domainname.edu\policies\PolicyDefinitions
- service samba restart
- Create OU in AD and add a couple users
- Open up Group Policy Management
- Do not edit default domain policy, instead right click on the OU, Create GPO and link to OU
- edit linked GPO
- Go to User Configuration => Policies => Windows Settings => Folder Redirection
- Click each folder and change setting under "Target" tab to:
- Setting: Basic - Redirect everyone's folder to the same location
- Target Folder Location: Create a folder for each user under the root path
- Root path:\\MYDOMAIN.EDU\users
- under the "Settings" tab
- Uncheck "Grant the user exclusive rights to (name_of_folder)"
- under policy removal: Leave the folder in the new location when policy is removed should remain checked
- Since folder redirection windows will ask for conformation every time you try and open a shortcut because they are stored on NFS
- Go to User Configuration => Policies => Windows Settings => Internet Explorer Maintenance => Security
- NOTE!!!: This can only be done from a Windows 7 Machine running RSAT, server 2012 and Windows 8 deprecated this feature
- reference:https://social.technet.microsoft.com/Forums/windowsserver/en-US/1f6a0d43-e81f-4038-88f6-75d8921fdf82/missing-group-policy-internet-explorer-maintenance
- Double Click Security Zones and Content Ratings
- A windows may pop up before you can edit settings click "continue"
- click modify settings, click on Local intranet, click Sites, click Advanced
- add:
file://mydomain.edu
- click, close, OK, OK, and Apply
- Configuring Automatic Resolution Policy(when sync conflicts rise keep the last modified file)
- Navigate to Computer Configuration => Preferences => Windows Settings => Registry
- create a new registry item
- add: Software\Microsoft\Windows\CurrentVersion\NetCache\SyncConflictHandling :to the key path
- in the UNC path add the share you want to Auto resolve conflicts with, \\DOMAIN\users
- set Value Data to 4
- 0-7:
- 1:Keep the local state. This overwrites the remote copy with the local copy's contents. If the local copy was deleted, this deletes the remote copy on the server.
- 2:Keep the remote state. This overwrites the local copy with the remote copy's contents. If the remote copy was deleted, this deletes the local copy in the Offline Files cache.
- 4:Retains the state of the latest operation as determined by last-change times of the items in conflict. If the local item was deleted, the time of deletion is used for comparison.
- 0-7:
- save and apply
Map a Network Drive with GPO
- Go to User Configuration => Preferences => Windows Settings => Drive Maps
- Create new mapped drive with:
Action:Create Location: \\mydomainname.edu\folder\location Reconnect:Checked Use:"*" (pick any drive letter) Hide/Show this drive:No Change Hide/Show all drives:No Change
- click Okay
- samba must be restarted for GPO to take effect
- make sure all the right ports are open on your firewall or mapped drive may not connect, tcp 137, udp 137 etc..
Windows Update GPO
- Download ADM files from Microsoft, http://www.microsoft.com/en-us/download/details.aspx?id=18664
- Install when asked, navigate to where it installed the ADM files. Usually C:\Program Files(x86)\Microsoft Group Policy\Windows Server...\...
- copy only wuau.adm to \\mydomain.edu\sysvol\mydomain.edu\Policies\PolicyDefinitions\
- Edit GPO
- Go to Computer Configuration => Policies => Administrative Templates => Windows Components => Windows Update
- still testing, enable the following
Configure Automatic Updates: Enabled: Auto Download and Schedule Install: Every Day: 17:00 Allow Automatic Updates immediate installation: Enabled No auto-restart with logged on user for scheduled automatic updates installations: Enabled Reschedule Automatic Updates scheduled installations: Enabled: 10 minutes
SSSD
vim /etc/sssd/sssd.conf [domain/default] ldap_tls_reqcert = allow ldap_id_use_start_tls = True cache_credentials = True ldap_search_base = dc=domain,dc=edu krb5_realm = $REALM id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldap://domain.edu ldap_tls_cacertdir = /etc/openldap/cacerts ldap_schema = rfc2307bis ldap_user_fullname = displayName ldap_user_search_base = ou=idmap,dc=domain,dc=edu ldap_group_search_base = ou=Group,dc=domain,dc=edu ldap_group_member = member ldap_group_nesting_level = 4 ldap_tls_cacert = /etc/openldap/cacerts/cacert.pem ldap_tls_reqcert = demand ldap_default_bind_dn = cn=Manager,dc=domain,dc=edu ldap_default_authtok_type = password ldap_default_authtok = ****** debug_level = 8 [sssd] services = nss, pam config_file_version = 2 domains = default [nss]
[pam]
ACL
- set privileges
net rpc rights grant 'Domain\Domain Admins' SeDiskOperatorPrivilege -Uadministrator
- view privileges
net rpc rights list accounts -Uadministrator
- https://wiki.samba.org/index.php/Setup_and_configure_file_shares
- http://manpages.ubuntu.com/manpages/lucid/man1/setfacl.1.html
- http://www.linuxtopia.org/online_books/network_administration_guides/samba_reference_guide/23_AccessControls_25.html
- http://pic.dhe.ibm.com/infocenter/zos/v1r13/index.jsp?topic=%2Fcom.ibm.zos.r13.bpxa500%2Fsfacl.htm
- add group acl to folder or file
setfacl -m "g:groupname:permissions" folder
ID Mapping/Group Mapping
- https://wiki.samba.org/index.php/Adding_users_with_samba_tool
- http://linuxcostablanca.blogspot.com/2012/02/samba-4-posix-domain-user.html
save
http://pig.made-it.com/samba-ldap-member.html http://doub.home.xs4all.nl/samba-ldap/index.html http://www.samba.org/samba/docs/man/Samba-Guide/unixclients.html#sdcsdmldap http://www.samba.org/samba/docs/man/Samba-Guide/unixclients.html#ch9-sdmnss https://wiki.samba.org/index.php/Samba4/Domain_Member http://directory.fedoraproject.org/wiki/Howto:Samba http://ptgmedia.pearsoncmg.com/images/013188221X/downloads/013188221X_book.pdf
References
- http://www.alexwyn.com/computer-tips/centos-samba4-active-directory-domain-controller
- http://www.golinuxhub.com/2012/08/create-roaming-profiles-in-samba4.html
- http://opentodo.net/2013/01/samba4-as-ad-domain-controller-on-centos-6/
- http://wiki.samba.org/index.php/Samba_%26_Windows_Profiles
- http://clintboessen.blogspot.com/2012/08/open-file-security-warning.html
- http://stealthpuppy.com/configuring-an-automatic-resolution-policy-for-offline-files-in-windows-7/