Linux:Samba AD Factory

To use Samba as an Active Directory Domain Controller, Samba must be built from source. While various RPM distros have been made available in the past (and continue to do so today), relying upon these for continued support of these build packages is an operational hazard. Instead, KitsNet has a formalized process to operate a Samba AD "Factory", where source kits will be downloaded and built into binaries under the /usr/local/samba directory tree. The resulting binary tree will be packaged into a tarball and subsequently deployed to the Active Directory Domain Controllers for the knada.lan.kitsnet.us domain.

1 Build CentOS 8 / Rocky Linux 8 Base System for Factory

The Factory system is that which will be used to download Samba source kits to build a binary tree and resulting tarball. There will be one of these systems based on a basic Linux Virtual Server Guest with 1.5 GB RAM, 4 vCPU and two disks:

• T0 disk0 10 GB (V0uv### /tmp 1024 MB, /swap 512 MB, /boot 1 GB, and the rest for root)
• T3 disk1 16 GB (V3uv### /var 3 GB, /usr/local 13 GB)

The system will have a DHCP reservation as <new-guest>.lan.kitsnet.us. When running the Anaconda installer, add to Software Selection, Additional software for Selected Environment: Development Tools .

2 Build CentOS 8 / Rocky Linux 8 Base System for Samba AD DC

The Samba AD DC systems are those running Samba as Active Directory Domain Controllers for the knada.lan.kitsnet.us domain. There will be at least two of these systems, each based on a basic Linux Virtual Server Guest with 1.5 GB RAM, 2 vCPU and two disks:

• T0 disk0 14 GB (V0uv### /tmp 512 MB, /swap 3 GB, /boot 1 GB, root 7 GB)
• T3 disk1 4 GB (V3uv### /var 2 GB)

Since these system will be domain-joined, it is important that they have a DHCP reservation as <new-guest>.knada.lan.kitsnet.us.

2.1 Guest Environment Customization

2.1.1 path

• add /usr/local/samba/bin and /usr/local/samba/sbin to:
  • secure_path in /etc/sudoers
  • PATH in /etc/crontab
  • PATH in /etc/anacrontab
• carefully add /usr/local/samba/sbin and /usr/local/samba/bin appropriately (check order) to PATH in /etc/csh.login
• add /usr/local/samba/sbin to pathmunge in /etc/profile:

if [ "$EUID" = "0" ]; then
    pathmunge /usr/sbin
    pathmunge /usr/local/sbin
    pathmunge /usr/local/samba/sbin
    pathmunge /usr/local/samba/bin after
else
    pathmunge /usr/local/sbin after
    pathmunge /usr/sbin after
    pathmunge /usr/local/samba/sbin after
    pathmunge /usr/local/samba/bin
fi

2.1.2 Firewall

# firewall-cmd --set-default-zone=internal
# firewall-cmd --zone=internal --change-interface ens3 --permanent
# firewall-cmd --add-service={dns,ldap,ldaps,kerberos} --permanent
# firewall-cmd --add-port={389/udp,135/tcp,135/udp,138/udp,138/tcp,137/tcp,137/udp,139/udp,139/tcp,445/tcp,445/udp,3268/udp,3268/tcp,3269/tcp,3269/udp,49152/tcp,49153/tcp,49154/tcp} --permanent
# firewall-cmd --reload

2.1.2.1 Port Reference

• 88=kerberos
• 135=epmap
• 137=netbios-ns
• 138=netbios-dgm
• 139=netbios-ssn
• 389=ldap
• 445=microsoft-ds
• 464=kpasswd
• 636=ldaps
• 3268=msft-gc

• 3269=msft-gc-ssl

2.1.3 Backup

Copy backup_samba-ad-dc to /usr/local/sbin/

# mkdir /var/lib/samba-ad-dc_backup
# chgrp kitsnet_adm  /var/lib/samba-ad-dc_backup
# chmod o-rx /var/lib/samba-ad-dc_backup

2.1.4 rsyslog

• add to end of /etc/rsyslog.conf *.* @192.168.15.80:514

  # systemctl restart rsyslog.service
  # systemctl enable rsyslog.service