Installing A Samba Pdc, Using samba 3 and WBEL/CentOS Options

[hughesjr]

Samba 3 as a Primary Domain Controller on RHEL Clones

There are a couple points that I want to make clear. Samba 3 CAN NOT do Windows 2000 Server Active Directory Services (ADS) domain control. It can provide Windows NT 4.0 type domain control.

For a time, Windows Groups could not be used by Samba. With Samba 3, Windows Groups can now be used (here is the explanation). In fact, you can control your users and groups using a Domain Member computer (an NT/2K/XP-Pro client) and the Microsoft User Manager for Domains (download srvtools.exe from here, we will discuss it's use later in the guide). If all your clients are Win 95/98/ME then you can instead use the Nexus.exe tool for Win95.

Windows 95/98/ME/XP-Home clients do not fully utilize the NT4 type domain control ... and in fact, they use a subset of it called LanMan Network Login (LanMan was the precursor to NT4 domain control). Windows NT/2000/XP-Pro clients can fully integrate into the NT4 domain.

This guide is based on information in the official Samba 3 PDC Howto. Please read that info thoroughly before starting this guide. There are several links in the PDC Howto that you need to understand, including:

Domain Membership

Group Mapping

Machine Trust Accounts

Account Information Databases

Profile Management

Policy Management

Besides the Logon server aspect (the Domain Controller), there are 2 other aspects to address in an NT 4 domain environment. They are the Master Browser and the WINS server. Both can be read about in the Network Browsing section of the Official Samba 3 Guide.

In this guide, we will configure a Samba 3 PDC that is also the Master Browser and the Primary WINS server.

Microsoft white papers about WINS and Master Browsers (1, 2, 3) ... for more information.

Now on with the guide.

I will use WhiteBox Enterprise Linux as my RedHat based server Distro. CentOS or TaoLinux can also be used (the only differences will be where the yum update servers are and where to download the initial 3 files required to add yum functionality to the server). The install would be very similar on Fedora Core 1 or 2 as well.

You will need to be able to edit files with an editor. Part of the minimal install has both vi and nano installed. If you are going to install X, then you may have gedit, kedit, emacs, or maybe another editor. I will just say edit the files ... you do so with your perfered editor.

1. The first step is going to be to do a minimal install of WhiteBoxEL. This is accomplishished by selecting a custom install and unchecking everything. This will give you an install with about 540mb of packages. It is the minumum recommended install by RedHat of their Enterprise product.

The server should have a static IP address, if possible on your network.

(There is no real reason why this server can't have X installed, it is not required that this server have only a basic install. If you want to install other services, select them as part of the installation). If you install other than a minimal install, you can issue the command:

rpm -q yum libxml2-python libxml2

If all 3 packages are installed, you can skip step 2.

2. If you did a minimal install, now install yum ... this will require the packages libxml2-python and libxml2. How I did this install for WBEL is as follows (all steps below will be on WhiteBoxEL ... CentOS steps would be similar, but the filenames might be slightly different ... as would be the yum repository locations):

CODE

wget http://www.geekstyle.net/white_box/3.0/en/os/i386/RedHat/RPMS/yum-2.0.4-2.WB1.noarch.rpm

wget  http://www.geekstyle.net/white_box/3.0/en/os/i386/RedHat/RPMS/libxml2-python-2.5.10-5.i386.rpm

wget  http://www.geekstyle.net/white_box/3.0/en/os/i386/RedHat/RPMS/libxml2-2.5.10-5.i386.rpm

After the files were downloaded, I installed them with the command:

rpm -Uvh libxml2-python-2.5.10-5.i386.rpm libxml2-2.5.10-5.i386.rpm yum-2.0.4-2.WB1.noarch.rpm

3. Now, edit the file /etc/yum.conf to add the proper repositories ... my /etc/yum.conf file is here:

http://www.hughesjr.com/wbel/yum.conf.txt

4. Update all the packages on the system to the lastest updates with this command:

yum upgrade

5. Now we need to install, or verify installed all the packages that we need for setting up a SAMBA PDC.

yum install samba samba-client samba-common

There are 2 other SAMBA tools, samba-swat and redhat-config-samba that are helpful in some senarios, but won't be particularly helpful in this situation ... so I won't install them in this guide. You can install them now as well, if you want (add their names in the bove command).

At this point, we need to restart our server, as we have changed the kernel. Make sure to select the new kernel when booting.

6. Now we need to backup the original configuration file (/etc/samba/smb.conf) and replace it with a file that has the setup we need.

cd /etc/samba
mv smb.conf smb.conf.orig

7. In our example, we need to make some assumptions ... I will assume that we do not need DNS or DHCP to be done by this server. It will be the Master Browser, WINS, and PDC server for the Domain.

Here is what our server can do:

The NetBIOS name of the Samba server is set to PDC

The Domain name is set to NEWDOM

The passdb backend parameter specifies the creation and use of the tdbsam password backend. This is a binary database that has excellent scalability for a large number of user account entries.

WINS serving is enabled by the wins support = Yes, and name resolution is set to use it by means of the name resolve order = wins bcast hosts entry.

The Samba server is configured for use by Windows clients as a time server.

Samba is configured to directly interface with CUPS via the direct internal interface that is provided by CUPS libraries. This is achieved with the printing = CUPS as well as the printcap name = CUPS entries.

External interface scripts are provided to enable Samba to interface smoothly to essential operating system functions for user and group management. This is important to enable workstations to join the Domain, and is also important so that you can use the Windows NT4 Domain User Manager, as well as the Domain Server Manager. These tools are provided as part of the SRVTOOLS.EXE toolkit (see link above).

The smb.conf file specifies that the Samba server will operate in (default) security = user mode.

Domain logon services as well as a Domain logon script are specified. The logon script will be used to add robustness to the overall network configuration.

Roaming profiles are enabled through the specification of the parameter, logon path = \\%L\profiles\%U. %L will be the server's name ... %U is the user who logs in. It is the administrator's responsibility to ensure there is a directory in the root of the profile share for each user.

Microsoft Office files are vetoed from opportunistic locking controls. This should help to prevent lock contention related file access problems.

Explicit controls are effected to restrict access to the IPC$ share to local networks only. The IPC$ share plays an important role in network browsing and in establishment of network connections.
Every user has a private home directory on the UNIX/Linux host. This is mapped to a network drive that is the same for all users.

8. Here is new Samba configuration file (/etc/smb.conf). Add this text with your editor and save it:

http://www.hughesjr.com/wbel/smb.conf.txt

9. Make the required directories and set permissions:

mkdir -p /shared
chmod -R ug+rwxs,o+rx-w /shared

mkdir -p /var/spool/samba
mkdir -p /var/lib/samba/{netlogon/scripts,profiles}
chown -R root.root /var/spool/samba
chown -R root.root /var/lib/samba
chmod a+rwxt /var/spool/samba

10. For each user account that is created on the system, the following commands should be executed (substitute the real username for username:

mkdir /var/lib/samba/profiles/username
chown username.users /var/lib/samba/profiles/username
chmod ug+wrx,o+wrx,-w /var/lib/samba/profiles/username

11. Create a logon script. It is important that each line is correctly terminated with a carriage return and line-feed combination (i.e., DOS encoding). The following procedure works if the right tools (unix2dos and dos2unix) are installed (they are in our WBEL install). First, create a file called /var/lib/samba/netlogon/scripts/logon.bat.unix with the following contents (all files that contain the character are included in linked text files, because there is sometimes having that character show up in browsers):

http://www.hughesjr.com/wbel/logon.bat.unix.txt

Convert the UNIX file to a DOS file using the unix2dos as shown here:

unix2dos < /var/lib/samba/netlogon/scripts/logon.bat.unix > /var/lib/samba/netlogon/scripts/logon.bat

then make the logon.bat file executable with the command:

chmod 755 /var/lib/samba/netlogon/scripts/logon.bat

12. Add the root user to the password backend as follows:

smbpasswd -a root

13. Create the Standard NT-Unix group mappings with the following commands:

net groupmap modify ntgroup="Domain Admins" unixgroup=root
net groupmap modify ntgroup="Domain Users" unixgroup=users
net groupmap modify ntgroup="Domain Guests" unixgroup=nobody

Add any aditional groups with the above command ... the Unix group needs to be added first via groupadd.

Check that the groups are setup with the command:

net groupmap list | sort

The output should look like this:

Account Operators (S-1-5-32-548) -> -1
Administrators (S-1-5-32-544) -> -1
Backup Operators (S-1-5-32-551) -> -1
Domain Admins (S-1-5-21-179504-2437109-488451-512) -> root
Domain Guests (S-1-5-21-179504-2437109-488451-514) -> nobody
Domain Users (S-1-5-21-179504-2437109-488451-513) -> users
Guests (S-1-5-32-546) -> -1
Power Users (S-1-5-32-547) -> -1
Print Operators (S-1-5-32-550) -> -1
Replicators (S-1-5-32-552) -> -1
System Operators (S-1-5-32-549) -> -1
Users (S-1-5-32-545) -> -1

14. You must add all users with the command on the Linux server:

Linux:
useradd -m username
passwd username

Windows:
smbpasswd -a username
15. Setup and start the cups and samba services:

chkconfig cups on
chkconfig smb on
/etc/rc.d/init.d/cups restart
/etc/rc.d/init.d/smb restart

16: edit the /etc/nsswitch.conf file. This file controls the operation of the various resolver libraries that are part of the Linux Glibc libraries. Edit this file so that it contains the following entries:

hosts: files dns wins

Testing:

1 . Ping PDC with the command:

ping PDC

The result should be like this:

PING PDC (192.168.0.29) 56(84) bytes of data.
64 bytes from PDC (192.168.0.29): icmp_seq=0 ttl=0 time=0.102 ms
64 bytes from PDC (192.168.0.29): icmp_seq=1 ttl=0 time=0.035 ms

2 . Issue the command:

testparm -s

Output:

Load smb config files from /etc/samba/smb.conf
Processing section "[IPC$]"
Processing section "[homes]"
Processing section "[printers]"
Processing section "[netlogon]"
Processing section "[profiles]"
Processing section "[shared]"
Loaded services file OK.
# Global parameters
[global]
workgroup = NEWDOM
netbios name = PDC
interfaces = eth0
bind interfaces only = Yes
passdb backend = tdbsam
pam password change = Yes
passwd chat = *New*Password* %nn *Re-enter*new*password* %nn *Password*changed*
username map = /etc/samba/smbusers
unix password sync = Yes
log level = 1
syslog = 0
log file = /var/log/samba/%m
max log size = 50
smb ports = 139 445
name resolve order = wins bcast hosts
time server = Yes
printcap name = CUPS
show add printer wizard = No
add user script = /usr/sbin/useradd -m %u
delete user script = /usr/sbin/userdel -r %u
add group script = /usr/sbin/groupadd %g
delete group script = /usr/sbin/groupdel %g
add user to group script = /usr/sbin/usermod -G %g %u
add machine script = /usr/sbin/useradd -s /bin/false -d /dev/null %u
shutdown script = /var/lib/samba/scripts/shutdown.sh
abort shutdown script = /sbin/shutdown -c
logon script = scriptslogon.bat
logon path = \\%L\profiles\%U
logon drive = X:
logon home = \\%L\home\%U
domain logons = Yes
preferred master = Yes
wins support = Yes
utmp = Yes
map acl inherit = Yes
printing = cups
veto oplock files = /*.doc/*.xls/*.mdb/

[IPC$]
path = /tmp
hosts allow = 192.168.0.0/24, 127.0.0.1
hosts deny = 0.0.0.0/0

[homes]
comment = Home Directories
valid users = %S
read only = No
browseable = No

[printers]
comment = SMB Print Spool
path = /var/spool/samba
guest ok = Yes
printable = Yes
use client driver = Yes
default devmode = Yes
browseable = No

[netlogon]
comment = Network Logon Service
path = /var/lib/samba/netlogon
guest ok = Yes
locking = No

[profiles]
comment = Profile Share
path = /var/lib/samba/profiles
read only = No
profile acls = Yes

[shared]
comment = Network Shares
path = /shared
read only = No

3 . Issue the command:

smbclient -L PDC -U%

Output:

Domain=[NEWDOM] OS=[Unix] Server=[Samba 3.0.2-6.3E]

Sharename Type Comment
--------- ---- -------
IPC$ IPC IPC Service (Samba 3.0.2-6.3E)
netlogon Disk Network Logon Service
profiles Disk Profile Share
shared Disk Network Shares
ADMIN$ IPC IPC Service (Samba 3.0.2-6.3E)
Domain=[NEWDOM] OS=[Unix] Server=[Samba 3.0.2-6.3E]

Server Comment
--------- -------
PDC Samba 3.0.2-6.3E

Workgroup Master
--------- -------
HOME SERVER1
NEWDOM PDC