View source for Linux:Samba AD Factory

To use [https://www.samba.org/ Samba] as an Active Directory Domain Controller, Samba must be built from source. While various RPM distros have been made available in the past (and continue to do so today), relying upon these for continued support of these build packages is an operational hazard. Instead, KitsNet has a formalized process to operate a Samba AD "Factory", where [https://www.samba.org/samba/download/ source kits] will be downloaded and built into binaries under the <code>/usr/local/samba</code> directory tree. The resulting binary tree will be packaged into a tarball and subsequently deployed to the Active Directory Domain Controllers for the ''knada.lan.kitsnet.us'' domain. 

== Build CentOS 8 / Rocky Linux 8 Base System for Factory ==
The Factory system is that which will be used to download [https://www.samba.org/samba/download/ Samba source kits] to build a binary tree and resulting tarball. There will be one of these systems based on a basic Linux Virtual Server Guest<ref name=":0">[[KVM:guests#Making_a_Guest|KVM:guests#Making_a_Guest]]</ref> with 1.5&nbsp;GB RAM, 4 vCPU and two disks:

* T0 disk0 10&nbsp;GB (V0uv''###'' /tmp 1024&nbsp;MB, /swap 512&nbsp;MB, /boot 1&nbsp;GB, and the rest for root)
* T3 disk1 16&nbsp;GB (V3uv''###'' /var 3&nbsp;GB, /usr/local 13&nbsp;GB)

The system will have a DHCP reservation as <code><''new-guest''>.lan.kitsnet.us</code>. When running the Anaconda installer, add to <u>Software Selection</u>,  <u>Additional software for Selected Environment</u>:  ''Development Tools'' .
== Build CentOS 8 / Rocky Linux 8 Base System for Samba AD DC ==
The Samba AD DC systems are those running Samba as Active Directory Domain Controllers for the knada.lan.kitsnet.us domain. There will be at least two of these systems, each based on a basic Linux Virtual Server Guest<ref name=":0" /> with 1.5&nbsp;GB RAM, 2 vCPU and two disks:

* T0 disk0 14&nbsp;GB (V0uv''###'' /tmp 512&nbsp;MB, /swap 3&nbsp;GB, /boot 1&nbsp;GB, root 7&nbsp;GB)
* T3 disk1 4&nbsp;GB (V3uv''###'' /var 2&nbsp;GB)

Since these system will be domain-joined, it is important that they have a DHCP reservation as <code><''new-guest''>.'''knada'''.lan.kitsnet.us</code>. 

=== Guest Environment Customization ===

==== path ====

* add <code>/usr/local/samba/bin</code> and <code>/usr/local/samba/sbin</code> to: 
** <code>secure_path</code> in /etc/sudoers 
** <code>PATH</code> in /etc/crontab 
** <code>PATH</code> in /etc/anacrontab 
* carefully add <code>/usr/local/samba/sbin</code> and <code>/usr/local/samba/bin</code> appropriately (check order) to <code>PATH</code> in /etc/csh.login 
* add  <code>/usr/local/samba/sbin</code> to <code>pathmunge</code> in /etc/profile:
<syntaxhighlight lang="sh">
if [ "$EUID" = "0" ]; then
    pathmunge /usr/sbin
    pathmunge /usr/local/sbin
    pathmunge /usr/local/samba/sbin
    pathmunge /usr/local/samba/bin after
else
    pathmunge /usr/local/sbin after
    pathmunge /usr/sbin after
    pathmunge /usr/local/samba/sbin after
    pathmunge /usr/local/samba/bin
fi
</syntaxhighlight>

==== Firewall ====
<syntaxhighlight lang="shell-session">
# firewall-cmd --set-default-zone=internal
# firewall-cmd --zone=internal --change-interface ens3 --permanent
# firewall-cmd --add-service={dns,ldap,ldaps,kerberos} --permanent
# firewall-cmd --add-port={389/udp,135/tcp,135/udp,138/udp,138/tcp,137/tcp,137/udp,139/udp,139/tcp,445/tcp,445/udp,3268/udp,3268/tcp,3269/tcp,3269/udp,49152/tcp,49153/tcp,49154/tcp} --permanent
# firewall-cmd --reload
</syntaxhighlight>

===== Port Reference =====

* 88=kerberos 
* 135=epmap 
* 137=netbios-ns 
* 138=netbios-dgm 
* 139=netbios-ssn 
* 389=ldap 
* 445=microsoft-ds 
* 464=kpasswd 
* 636=ldaps 
* 3268=msft-gc 

* 3269=msft-gc-ssl

==== Backup ====
Copy <code>backup_samba-ad-dc</code> to <code>/usr/local/sbin/</code><syntaxhighlight lang="shell-session">
# mkdir /var/lib/samba-ad-dc_backup
# chgrp kitsnet_adm  /var/lib/samba-ad-dc_backup
# chmod o-rx /var/lib/samba-ad-dc_backup
</syntaxhighlight>

==== rsyslog ====

* add to end of <code>/etc/rsyslog.conf</code> the line <code>*.*  @192.168.15.80:514</code> <syntaxhighlight lang="shell-session">
# systemctl restart rsyslog.service
# systemctl enable rsyslog.service
</syntaxhighlight>

== Setup Server to Build or Run Samba AD DC ==
Complete the preparations documented in [https://wiki.samba.org/index.php/https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller Setting up Samba as an Active Directory Domain Controller]

=== Factory Build Server Packages ===
Refer to [https://wiki.samba.org/index.php/Package_Dependencies_Required_to_Build_Samba Package Dependencies Required to Build Samba] and incorporate the [https://wiki.samba.org/index.php/Package_Dependencies_Required_to_Build_Samba#Manually_maintained_Distribution-specific_Package_lists Manually maintained Distribution-specific Package lists] and the Red Hat Enterprise Linux 8 / CentOS 8 section. It will also be necessary to <code>dnf install dbus-devel python3-markdown</code>

=== Samba AD DC Server Packages ===
<syntaxhighlight lang="shell-session">
# dnf install avahi-libs cups-libs python3-markdown patch pam-devel python3-cryptography python3-dns krb5-workstation libtasn1-tools 
# dnf install lmdb-devel
# mkdir /usr/local/samba
</syntaxhighlight>

=== Check Filesystem Support on all Servers ===
Refer to [https://wiki.samba.org/index.php/File_System_Support File System Support] for details KistNet standard is for using xfs, so there is only one option to check for:<syntaxhighlight lang="shell-session">
# uname -r
4.18.0-240.22.1.el8_3.x86_64
# grep -E "CONFIG_EXT4_FS_POSIX_ACL" /boot/config-4.18.0-240.22.1.el8_3.x86_64
CONFIG_EXT4_FS_POSIX_ACL=y
</syntaxhighlight>Install the <code>attr</code> package with <code>dnf install attr</code>. Next, refer to the [https://wiki.samba.org/index.php/File_System_Support#Testing_your_filesystem Testing your filesystem] section of the documentation for the verification steps

== Download Samba Source to Factory Build Server ==

* Create the base of the Factory source directory structure
<syntaxhighlight lang="shell-session">
# mkdir /usr/local/SambaAD-Factory
# chown psmode:kitsnet_adm /usr/local/SambaAD-Factory
</syntaxhighlight>

* Check https://download.samba.org/pub/samba/stable/ to identify the latest *.tar.gz and <code>wget</code> that file 
* <code>tar -xzvf</code> the downloaded file with <code>-C /usr/local/SambaAD-Factory</code>
* cd to the new directory and then <code>./configure</code> (watch for errors in config.log)

yum list 

== Build Samba AD DC ==
asdfg



----