KitsNet - User contributions [en]

Linux:Samba AD Factory

2021-05-16T17:20:39Z

2603:7000:9800:4742:69A9:3976:3F81:221B:

To use [https://www.samba.org/ Samba] as an Active Directory Domain Controller, Samba must be built from source. While various RPM distros have been made available in the past (and continue to do so today), relying upon these for continued support of these build packages is an operational hazard. Instead, KitsNet has a formalized process to operate a Samba AD "Factory", where [https://www.samba.org/samba/download/ source kits] will be downloaded and built into binaries under the <code>/usr/local/samba</code> directory tree. The resulting binary tree will be packaged into a tarball and subsequently deployed to the Active Directory Domain Controllers for the ''knada.lan.kitsnet.us'' domain. <blockquote>''There is still an issue with serving time from the DCs. The answer will be found by going through https://wiki.samba.org/index.php/Time_Synchronisation'' </blockquote>

== Build CentOS 8 / Rocky Linux 8 Base System for Factory ==
The Factory system is that which will be used to download [https://www.samba.org/samba/download/ Samba source kits] to build a binary tree and resulting tarball. There will be one of these systems based on a basic Linux Virtual Server Guest<ref name=":0">[[KVM:guests#Making_a_Guest|KVM:guests#Making_a_Guest]]</ref> with 1.5 GB RAM, 4 vCPU and two disks:

* T0 disk0 10 GB (V0uv''###'' /tmp 1024 MB, /swap 512 MB, /boot 1 GB, and the rest for root)
* T3 disk1 16 GB (V3uv''###'' /var 3 GB, /usr/local 13 GB)

The system will have a DHCP reservation as <code><''new-guest''>.lan.kitsnet.us</code>. When running the Anaconda installer, add to Software Selection, Additional software for Selected Environment: ''Development Tools'' .
== Build CentOS 8 / Rocky Linux 8 Base System for Samba AD DC ==
The Samba AD DC systems are those running Samba as Active Directory Domain Controllers for the knada.lan.kitsnet.us domain. There will be at least two of these systems, each based on a basic Linux Virtual Server Guest<ref name=":0" /> with 1.5 GB RAM, 2 vCPU and two disks:

* T0 disk0 14 GB (V0uv''###'' /tmp 512 MB, /swap 3 GB, /boot 1 GB, root 7 GB)
* T3 disk1 4 GB (V3uv''###'' /var 2 GB)

Since these system will be domain-joined, it is important that they have a DHCP reservation as <code><''new-guest''>.'''knada'''.lan.kitsnet.us</code>.

=== Environment Customization ===

==== path ====

* add <code>/usr/local/samba/bin</code> and <code>/usr/local/samba/sbin</code> to:
**<code>secure_path</code> in <code>/etc/sudoers</code>
** <code>PATH</code> in <code>/etc/crontab</code>
** <code>PATH</code> in <code>/etc/anacrontab</code>
* carefully add <code>/usr/local/samba/sbin</code> and <code>/usr/local/samba/bin</code> appropriately (check order) to <code>PATH</code> in /etc/csh.login
* add <code>/usr/local/samba/sbin</code> to <code>pathmunge</code> in /etc/profile:
<syntaxhighlight lang="sh">
if [ "$EUID" = "0" ]; then
pathmunge /usr/sbin
pathmunge /usr/local/sbin
pathmunge /usr/local/samba/sbin
pathmunge /usr/local/samba/bin after
else
pathmunge /usr/local/sbin after
pathmunge /usr/sbin after
pathmunge /usr/local/samba/sbin after
pathmunge /usr/local/samba/bin
fi
</syntaxhighlight>

==== Firewall ====
<syntaxhighlight lang="shell-session">
# firewall-cmd --set-default-zone=internal
# firewall-cmd --zone=internal --change-interface ens3 --permanent
# firewall-cmd --add-service={dns,ldap,ldaps,kerberos} --permanent
# firewall-cmd --add-port={389/udp,135/tcp,135/udp,138/udp,138/tcp,137/tcp,137/udp,139/udp,139/tcp,445/tcp,445/udp,3268/udp,3268/tcp,3269/tcp,3269/udp,49152/tcp,49153/tcp,49154/tcp} --permanent
# firewall-cmd --reload
</syntaxhighlight>

===== Port Reference =====

* 88=kerberos
* 135=epmap
* 137=netbios-ns
* 138=netbios-dgm
* 139=netbios-ssn
* 389=ldap
* 445=microsoft-ds
* 464=kpasswd
* 636=ldaps
* 3268=msft-gc

* 3269=msft-gc-ssl

==== Backup ====
Copy <code>backup_samba-ad-dc</code> to <code>/usr/local/sbin/</code><syntaxhighlight lang="shell-session">
# mkdir /var/lib/samba-ad-dc_backup
# chgrp kitsnet_adm /var/lib/samba-ad-dc_backup
# chmod o-rx /var/lib/samba-ad-dc_backup
</syntaxhighlight>

==== rsyslog ====

* add to end of <code>/etc/rsyslog.conf</code> the line <code>*.* @192.168.15.80:514</code> <syntaxhighlight lang="shell-session">
# systemctl restart rsyslog.service
# systemctl enable rsyslog.service
</syntaxhighlight>

== Setup Server to Build or Run Samba AD DC ==
Complete the preparations documented in [https://wiki.samba.org/index.php/https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller Setting up Samba as an Active Directory Domain Controller]

=== Factory Build Server Packages ===
Refer to [https://wiki.samba.org/index.php/Package_Dependencies_Required_to_Build_Samba Package Dependencies Required to Build Samba] and incorporate the [https://wiki.samba.org/index.php/Package_Dependencies_Required_to_Build_Samba#Manually_maintained_Distribution-specific_Package_lists Manually maintained Distribution-specific Package lists] and the Red Hat Enterprise Linux 8 / CentOS 8 section. It will also be necessary to <code>dnf install dbus-devel python3-markdown</code>

=== Samba AD DC Server Packages ===
<syntaxhighlight lang="shell-session">
# dnf install avahi-libs cups-libs python3-markdown patch pam-devel python3-cryptography python3-dns krb5-workstation libtasn1-tools
# dnf install lmdb-devel
# mkdir /usr/local/samba
</syntaxhighlight>

=== Check Filesystem Support on all Servers ===
Refer to [https://wiki.samba.org/index.php/File_System_Support File System Support] for details KistNet standard is for using xfs, so there is only one option to check for:<syntaxhighlight lang="shell-session">
# uname -r
4.18.0-240.22.1.el8_3.x86_64
# grep -E "CONFIG_EXT4_FS_POSIX_ACL" /boot/config-4.18.0-240.22.1.el8_3.x86_64
CONFIG_EXT4_FS_POSIX_ACL=y
</syntaxhighlight>Install the <code>attr</code> package with <code>dnf install attr</code>. Next, refer to the [https://wiki.samba.org/index.php/File_System_Support#Testing_your_filesystem Testing your filesystem] section of the documentation for the verification steps

== Download Samba Source to Factory Build Server ==

* Create the base of the Factory source directory structure
<syntaxhighlight lang="shell-session">
# mkdir /usr/local/SambaAD-Factory
# chown psmode:kitsnet_adm /usr/local/SambaAD-Factory</syntaxhighlight>
* Check https://download.samba.org/pub/samba/stable/ to identify the latest <code>*.tar.gz</code> and <code>wget</code> that file
* <code>tar -xzvf</code> the downloaded file with <code>-C /usr/local/SambaAD-Factory</code>

== Build Samba AD DC Factory Distribution ==
Enter the version-specific directory under <code>/usr/local/SambaAD-Factory</code><syntaxhighlight lang="shell-session">
$ ./configure --mandir=/usr/local/samba/man
$ make uninstall
$ du /usr/local/samba
0 /usr/local/samba/etc
0 /usr/local/samba/var/lib
0 /usr/local/samba/var/locks
0 /usr/local/samba/var/cache
0 /usr/local/samba/var/lock
0 /usr/local/samba/var/run
0 /usr/local/samba/var
0 /usr/local/samba/private
0 /usr/local/samba/bind-dns
0 /usr/local/samba/
$ make -j 8
$ rm -R /usr/local/samba/*
$ make -j 8 install
$ cd ../dist
$ tar czf samba-4.14.3-factory.tar.gz --owner=root -C /usr/local samba
$ tar --list --verbose --file samba-4.14.3-factory.tar.gz
</syntaxhighlight>

== Deploy Samba AD DC Factory Distribution on AD DC ==

On '''''initial deploy only''''', use: <syntaxhighlight lang="shell-session">
$ sudo tar xvf samba-4.14.3-factory.tar.gz -C /usr/local/
</syntaxhighlight>on all updates after that, use: <syntaxhighlight lang="shell-session">
$ sudo tar xvf samba-4.14.3-factory.tar.gz -C /usr/local/ --exclude="samba/bind-dns" --exclude="samba/etc" --exclude="samba/private" --exclude="samba/var"
</syntaxhighlight>

* check for <code>knada.lan.kitsnet.us</code> to end of search line in <code>/etc/resolv.conf</code>
* test DNS and SRV record resolution per [https://wiki.samba.org/index.php/Linux_and_Unix_DNS_Configuration Linux and Unix DNS Configuration]
* Verify the server is ready per the steps in [https://wiki.samba.org/index.php/Joining_a_Samba_DC_to_an_Existing_Active_Directory#Installing_Samba Preparing the Host for Joining the Domain]
* copy <code>/usr/local/samba/share/setup/krb5.conf</code> to <code>/etc/krb5.conf</code> and modify to:
<syntaxhighlight>
[libdefaults]
default_realm = KNADA.LAN.KITSNET.US
dns_lookup_realm = false
dns_lookup_kdc = true
dns_lookup_kdc = true

[realms]
KNADA.LAN.KITSNET.US = {
default_domain = knada.lan.kitsnet.us
}

#[domain_realm]
# ${HOSTNAME} = KNADA.LAN.KITSNET.US</syntaxhighlight>
* Initialize Kerberos with
<syntaxhighlight lang="shell-session">
# kinit administrator
# klist</syntaxhighlight>

=Join to Active Directory as a Domain Controller=
<syntaxhighlight lang="shell-session">
# script join-kitsnet.log
# samba-tool domain join knada.lan.kitsnet.us DC -k yes --option='idmap_ldb:use rfc2307 = yes'
</syntaxhighlight>
If log output directs it, <code>cp /usr/local/samba/private/krb5.conf /etc/</code> <blockquote>
Information about ID mapping is available at https://wiki.samba.org/index.php/Identity_Mapping_Back_Ends and https://wiki.samba.org/index.php/Idmap_config_ad. It appears from walker's smb.conf that we have: <code>idmap_ldb:use rfc2307 = yes</code></blockquote>
Add to <code>/usr/local/samba/etc/smb.conf</code> in the <code>[global]</code> section: <syntaxhighlight>
dns forwarder = 192.168.15.1
time server = yes
</syntaxhighlight>Then: <syntaxhighlight lang="shell-session">
# sudo smbcontrol all reload-config
# sudo samba
</syntaxhighlight>The last command will trigger samba startup. Until this is done, <code>samba-tool drs showrepl</code> will show cryptic, scary error messages.

To trigger RID block creation on the new Domain Controller <code>sudo samba-tool user create <''new-user''> --given-name "Silly" --surname "Person"</code>

== Managing Samba Service on the AD DC ==
Refer to [https://wiki.samba.org/index.php/Managing_the_Samba_AD_DC_Service_Using_Systemd Managing the Samba AD DC Service Using Systemd] for how to add Samba to <code>systemctl</code>

== Transferring FSMO Roles ==
See [https://wiki.samba.org/index.php/Transferring_and_Seizing_FSMO_Roles Transferring and Seizing FSMO Roles] for background on FSMO roles and management. Note that when transferring <code>domaindns</code> and <code>forestdns</code> roles, add <code>-U administrator</code> to end of the command:<syntaxhighlight lang="shell-session">
# samba-tool fsmo transfer --role=forestdns -U administrator
</syntaxhighlight>

== Advertise AD DC as DNS Server ==
On <code>radix.kitsnet.us</code> update the file <code>/etc/config/dhcp</code> in the <code>config dnsmasq</code> section to add a line for the new DC:<syntaxhighlight>
list server '/knada.lan.kitsnet.us/192.168.15.84'
</syntaxhighlight>

----

Linux:Samba AD Factory

2021-05-16T17:20:09Z

2603:7000:9800:4742:69A9:3976:3F81:221B:

To use [https://www.samba.org/ Samba] as an Active Directory Domain Controller, Samba must be built from source. While various RPM distros have been made available in the past (and continue to do so today), relying upon these for continued support of these build packages is an operational hazard. Instead, KitsNet has a formalized process to operate a Samba AD "Factory", where [https://www.samba.org/samba/download/ source kits] will be downloaded and built into binaries under the <code>/usr/local/samba</code> directory tree. The resulting binary tree will be packaged into a tarball and subsequently deployed to the Active Directory Domain Controllers for the ''knada.lan.kitsnet.us'' domain. <blockquote>There is still an issue with serving time from the DCs. The answer will be found by going through https://wiki.samba.org/index.php/Time_Synchronisation </blockquote>

== Build CentOS 8 / Rocky Linux 8 Base System for Factory ==
The Factory system is that which will be used to download [https://www.samba.org/samba/download/ Samba source kits] to build a binary tree and resulting tarball. There will be one of these systems based on a basic Linux Virtual Server Guest<ref name=":0">[[KVM:guests#Making_a_Guest|KVM:guests#Making_a_Guest]]</ref> with 1.5 GB RAM, 4 vCPU and two disks:

* T0 disk0 10 GB (V0uv''###'' /tmp 1024 MB, /swap 512 MB, /boot 1 GB, and the rest for root)
* T3 disk1 16 GB (V3uv''###'' /var 3 GB, /usr/local 13 GB)

The system will have a DHCP reservation as <code><''new-guest''>.lan.kitsnet.us</code>. When running the Anaconda installer, add to Software Selection, Additional software for Selected Environment: ''Development Tools'' .
== Build CentOS 8 / Rocky Linux 8 Base System for Samba AD DC ==
The Samba AD DC systems are those running Samba as Active Directory Domain Controllers for the knada.lan.kitsnet.us domain. There will be at least two of these systems, each based on a basic Linux Virtual Server Guest<ref name=":0" /> with 1.5 GB RAM, 2 vCPU and two disks:

* T0 disk0 14 GB (V0uv''###'' /tmp 512 MB, /swap 3 GB, /boot 1 GB, root 7 GB)
* T3 disk1 4 GB (V3uv''###'' /var 2 GB)

Since these system will be domain-joined, it is important that they have a DHCP reservation as <code><''new-guest''>.'''knada'''.lan.kitsnet.us</code>.

=== Environment Customization ===

==== path ====

* add <code>/usr/local/samba/bin</code> and <code>/usr/local/samba/sbin</code> to:
**<code>secure_path</code> in <code>/etc/sudoers</code>
** <code>PATH</code> in <code>/etc/crontab</code>
** <code>PATH</code> in <code>/etc/anacrontab</code>
* carefully add <code>/usr/local/samba/sbin</code> and <code>/usr/local/samba/bin</code> appropriately (check order) to <code>PATH</code> in /etc/csh.login
* add <code>/usr/local/samba/sbin</code> to <code>pathmunge</code> in /etc/profile:
<syntaxhighlight lang="sh">
if [ "$EUID" = "0" ]; then
pathmunge /usr/sbin
pathmunge /usr/local/sbin
pathmunge /usr/local/samba/sbin
pathmunge /usr/local/samba/bin after
else
pathmunge /usr/local/sbin after
pathmunge /usr/sbin after
pathmunge /usr/local/samba/sbin after
pathmunge /usr/local/samba/bin
fi
</syntaxhighlight>

==== Firewall ====
<syntaxhighlight lang="shell-session">
# firewall-cmd --set-default-zone=internal
# firewall-cmd --zone=internal --change-interface ens3 --permanent
# firewall-cmd --add-service={dns,ldap,ldaps,kerberos} --permanent
# firewall-cmd --add-port={389/udp,135/tcp,135/udp,138/udp,138/tcp,137/tcp,137/udp,139/udp,139/tcp,445/tcp,445/udp,3268/udp,3268/tcp,3269/tcp,3269/udp,49152/tcp,49153/tcp,49154/tcp} --permanent
# firewall-cmd --reload
</syntaxhighlight>

===== Port Reference =====

* 88=kerberos
* 135=epmap
* 137=netbios-ns
* 138=netbios-dgm
* 139=netbios-ssn
* 389=ldap
* 445=microsoft-ds
* 464=kpasswd
* 636=ldaps
* 3268=msft-gc

* 3269=msft-gc-ssl

==== Backup ====
Copy <code>backup_samba-ad-dc</code> to <code>/usr/local/sbin/</code><syntaxhighlight lang="shell-session">
# mkdir /var/lib/samba-ad-dc_backup
# chgrp kitsnet_adm /var/lib/samba-ad-dc_backup
# chmod o-rx /var/lib/samba-ad-dc_backup
</syntaxhighlight>

==== rsyslog ====

* add to end of <code>/etc/rsyslog.conf</code> the line <code>*.* @192.168.15.80:514</code> <syntaxhighlight lang="shell-session">
# systemctl restart rsyslog.service
# systemctl enable rsyslog.service
</syntaxhighlight>

== Setup Server to Build or Run Samba AD DC ==
Complete the preparations documented in [https://wiki.samba.org/index.php/https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller Setting up Samba as an Active Directory Domain Controller]

=== Factory Build Server Packages ===
Refer to [https://wiki.samba.org/index.php/Package_Dependencies_Required_to_Build_Samba Package Dependencies Required to Build Samba] and incorporate the [https://wiki.samba.org/index.php/Package_Dependencies_Required_to_Build_Samba#Manually_maintained_Distribution-specific_Package_lists Manually maintained Distribution-specific Package lists] and the Red Hat Enterprise Linux 8 / CentOS 8 section. It will also be necessary to <code>dnf install dbus-devel python3-markdown</code>

=== Samba AD DC Server Packages ===
<syntaxhighlight lang="shell-session">
# dnf install avahi-libs cups-libs python3-markdown patch pam-devel python3-cryptography python3-dns krb5-workstation libtasn1-tools
# dnf install lmdb-devel
# mkdir /usr/local/samba
</syntaxhighlight>

=== Check Filesystem Support on all Servers ===
Refer to [https://wiki.samba.org/index.php/File_System_Support File System Support] for details KistNet standard is for using xfs, so there is only one option to check for:<syntaxhighlight lang="shell-session">
# uname -r
4.18.0-240.22.1.el8_3.x86_64
# grep -E "CONFIG_EXT4_FS_POSIX_ACL" /boot/config-4.18.0-240.22.1.el8_3.x86_64
CONFIG_EXT4_FS_POSIX_ACL=y
</syntaxhighlight>Install the <code>attr</code> package with <code>dnf install attr</code>. Next, refer to the [https://wiki.samba.org/index.php/File_System_Support#Testing_your_filesystem Testing your filesystem] section of the documentation for the verification steps

== Download Samba Source to Factory Build Server ==

* Create the base of the Factory source directory structure
<syntaxhighlight lang="shell-session">
# mkdir /usr/local/SambaAD-Factory
# chown psmode:kitsnet_adm /usr/local/SambaAD-Factory</syntaxhighlight>
* Check https://download.samba.org/pub/samba/stable/ to identify the latest <code>*.tar.gz</code> and <code>wget</code> that file
* <code>tar -xzvf</code> the downloaded file with <code>-C /usr/local/SambaAD-Factory</code>

== Build Samba AD DC Factory Distribution ==
Enter the version-specific directory under <code>/usr/local/SambaAD-Factory</code><syntaxhighlight lang="shell-session">
$ ./configure --mandir=/usr/local/samba/man
$ make uninstall
$ du /usr/local/samba
0 /usr/local/samba/etc
0 /usr/local/samba/var/lib
0 /usr/local/samba/var/locks
0 /usr/local/samba/var/cache
0 /usr/local/samba/var/lock
0 /usr/local/samba/var/run
0 /usr/local/samba/var
0 /usr/local/samba/private
0 /usr/local/samba/bind-dns
0 /usr/local/samba/
$ make -j 8
$ rm -R /usr/local/samba/*
$ make -j 8 install
$ cd ../dist
$ tar czf samba-4.14.3-factory.tar.gz --owner=root -C /usr/local samba
$ tar --list --verbose --file samba-4.14.3-factory.tar.gz
</syntaxhighlight>

== Deploy Samba AD DC Factory Distribution on AD DC ==

On '''''initial deploy only''''', use: <syntaxhighlight lang="shell-session">
$ sudo tar xvf samba-4.14.3-factory.tar.gz -C /usr/local/
</syntaxhighlight>on all updates after that, use: <syntaxhighlight lang="shell-session">
$ sudo tar xvf samba-4.14.3-factory.tar.gz -C /usr/local/ --exclude="samba/bind-dns" --exclude="samba/etc" --exclude="samba/private" --exclude="samba/var"
</syntaxhighlight>

* check for <code>knada.lan.kitsnet.us</code> to end of search line in <code>/etc/resolv.conf</code>
* test DNS and SRV record resolution per [https://wiki.samba.org/index.php/Linux_and_Unix_DNS_Configuration Linux and Unix DNS Configuration]
* Verify the server is ready per the steps in [https://wiki.samba.org/index.php/Joining_a_Samba_DC_to_an_Existing_Active_Directory#Installing_Samba Preparing the Host for Joining the Domain]
* copy <code>/usr/local/samba/share/setup/krb5.conf</code> to <code>/etc/krb5.conf</code> and modify to:
<syntaxhighlight>
[libdefaults]
default_realm = KNADA.LAN.KITSNET.US
dns_lookup_realm = false
dns_lookup_kdc = true
dns_lookup_kdc = true

[realms]
KNADA.LAN.KITSNET.US = {
default_domain = knada.lan.kitsnet.us
}

#[domain_realm]
# ${HOSTNAME} = KNADA.LAN.KITSNET.US</syntaxhighlight>
* Initialize Kerberos with
<syntaxhighlight lang="shell-session">
# kinit administrator
# klist</syntaxhighlight>

=Join to Active Directory as a Domain Controller=
<syntaxhighlight lang="shell-session">
# script join-kitsnet.log
# samba-tool domain join knada.lan.kitsnet.us DC -k yes --option='idmap_ldb:use rfc2307 = yes'
</syntaxhighlight>
If log output directs it, <code>cp /usr/local/samba/private/krb5.conf /etc/</code> <blockquote>
Information about ID mapping is available at https://wiki.samba.org/index.php/Identity_Mapping_Back_Ends and https://wiki.samba.org/index.php/Idmap_config_ad. It appears from walker's smb.conf that we have: <code>idmap_ldb:use rfc2307 = yes</code></blockquote>
Add to <code>/usr/local/samba/etc/smb.conf</code> in the <code>[global]</code> section: <syntaxhighlight>
dns forwarder = 192.168.15.1
time server = yes
</syntaxhighlight>Then: <syntaxhighlight lang="shell-session">
# sudo smbcontrol all reload-config
# sudo samba
</syntaxhighlight>The last command will trigger samba startup. Until this is done, <code>samba-tool drs showrepl</code> will show cryptic, scary error messages.

To trigger RID block creation on the new Domain Controller <code>sudo samba-tool user create <''new-user''> --given-name "Silly" --surname "Person"</code>

== Managing Samba Service on the AD DC ==
Refer to [https://wiki.samba.org/index.php/Managing_the_Samba_AD_DC_Service_Using_Systemd Managing the Samba AD DC Service Using Systemd] for how to add Samba to <code>systemctl</code>

== Transferring FSMO Roles ==
See [https://wiki.samba.org/index.php/Transferring_and_Seizing_FSMO_Roles Transferring and Seizing FSMO Roles] for background on FSMO roles and management. Note that when transferring <code>domaindns</code> and <code>forestdns</code> roles, add <code>-U administrator</code> to end of the command:<syntaxhighlight lang="shell-session">
# samba-tool fsmo transfer --role=forestdns -U administrator
</syntaxhighlight>

== Advertise AD DC as DNS Server ==
On <code>radix.kitsnet.us</code> update the file <code>/etc/config/dhcp</code> in the <code>config dnsmasq</code> section to add a line for the new DC:<syntaxhighlight>
list server '/knada.lan.kitsnet.us/192.168.15.84'
</syntaxhighlight>

----