Diff for "Samba/DcWithLdapBackend"

Differences between revisions 33 and 38 (spanning 5 versions)

Translation(s): English - ?Português Brasileiro

This page is a walkthrough of how to set up a Samba Windows NT-style Domain Controller with LDAP as an authentication mechanism.

Windows computers will be able to join the domain as they would a regular Windows NT domain. Users will be able to log on to the domain from Windows machines using the pGina client.

Note: the old, NT-style Domain Controller setup is not to be confused with the newer Samba/ActiveDirectoryDomainController setup available in Samba 4.

Requirements

Setup the OpenLDAP (slapd) server
Optionally, setup a LDAP directory management utility (for example PhpLdapAdmin)

Install Samba

We will now install Samba that will be used to emulate a Windows NT server

Install the samba package
Answer no when asked whether you want to modify smb.conf or not
?Load the samba schema into OpenLDAP

gunzip -c /usr/share/doc/samba/examples/LDAP/samba.ldif.gz > samba.ldif
ldapadd -Q -Y EXTERNAL -H ldapi:/// -f samba.ldif

Restart the ldap server: systemctl restart slapd

Create the LDAP directory structure

ToDo: example adding OUs using ldapadd/ldif files

The Samba domain setup requires three OrganizationalUnit objects at the root of your LDAP hierarchy:

ou=users,dc=example,dc=org
ou=groups,dc=example,dc=org
ou=machines,dc=example,dc=org

Configure Samba to use LDAP

Edit the samba server configuration file: nano /etc/samba/smb.conf
We will configure Samba to use the ldapsam account database backend. Replace the default passdb backend=tdbsam with

# which backend will be used for storing user/group information
passdb backend = ldapsam:ldap://127.0.0.1

# base for all ldap suffixes and for storing the sambaDomain object
ldap suffix = dc=example,dc=org
 where machines should be added to the ldap tree.
ldap machine suffix = ou=machines
# where users should be added to the ldap tree.
ldap user suffix = ou=users
# where groups should be added to the ldap tree.
ldap group suffix = ou=groups

# Distinguished Name (DN) name used by Samba to contact the LDAP server
# when retreiving user account information
ldap admin dn = cn=admin,dc=example,dc=org


# provide the netlogon service for Windows 9X network logons for the
# workgroup it is in.
domain logons = yes

# honor privileges assigned to specific SIDs via net rpc rights
enable privileges = yes

Test the configuration, set the samba password and restart the service:

testparm
smbpasswd -w password
systemctl restart samba

Using slapcat/ldapsearch, verify that a DomainName record was added at the root of the LDAP tree. (ToDo: add example commands)
create the following Samba3 Mappings under ou=groups:

Unix/Windows Name: admins
GID: 20000
SID ending number: 512

Unix/Windows Name: users
GID: 20001
SID ending number: 513

Unix/Windows Name: guests
GID: 20002
SID ending number: 514

Configure authentication using LDAP

The server must be set up to allow local account authentication using accounts stored in LDAP.

Install the libnss-ldapd and libpam-ldapd packages. During installation, provide the following configuration:
- ldap://127.0.0.1/ as LDAP server URI
- dc=example,dc=org as search base,
- 3 as Samba version
- cn=admin,dc=example,dc=org as the LDAP admin account (replace with your own value if different)
Restart the samba service: systemctl restart samba
Verify that users, guests, and admins are retrieved by executing: getent group

See ?LDAP/NSS with libnss-ldapd and ?LDAP/PAM with libpam-ldapd for more information

To improve performance, you may ?setup nscd to cache account information locally so that the LDAP server is not queried on every operation. In addition you must then set the following setting in /etc/samba/smb.conf:

# sync the LDAP password with the NT and LM hashes for normal accounts
# (NOT for workstation, server or domain trusts) on a password change via SAMBA.
ldap passwd sync = yes

Page refactoring in progress below this point

Setup users in the Domain

log back into phpldapadmin and create the following Samba3 Users under the users OU:

First Name	Last Name	username	UID	SID ending	Group	Home Directory
Domain	Admin	adminstrator	10000	21000	admins	/home/buster/adminstrator
(your)	(name)	(username)	10001	21001	admins	/home/buster/(username)

verify the new users are in the database:

getent passwd

create home directory

mkdir /home/buster
mkdir /home/buster/(username)
cp /etc/skel/.* /home/buster/(username)
chown -R (username):users /home/buster/(username)

Create Machine accounts for domain members

log back into phpldapadmin and create the a Samba3 machines under the machines OU:

Machine Name	UID
(machinename)$	30000

smbpwd -a root

enter your root password

Join a windows client to the domain

go to your windows machine and right-click on mycomputer and select properties
on the name tab select change
select the domain radio button and enter buster.lan and click ok
enter root for the username
enter your root password
you should see a welcome to the buster.lan domain message and then reboot and you can log in using user from your LDAP database.

CategoryNetwork | CategorySoftware | CategorySystemAdministration | CategoryObsolete | ToDo: merge with other Samba pages

-  ⇤ ← Revision 33 as of 2021-01-17 16:15:02 → 
  Size: 6029
  Editor: nodiscc
  Comment: WIP refactoring
+   ← Revision 38 as of 2021-01-17 16:45:11 → ⇥
  Size: 6259
  Editor: nodiscc
  Comment: WIP refactor
-Deletions are marked like this.
+Additions are marked like this.
 Line 36:
-{{{#!wiki note
Page refactoring in progress below this point
+== Create the LDAP directory structure ==

ToDo: example adding OUs using ldapadd/ldif files

The Samba domain setup requires three `OrganizationalUnit` objects at the root of your LDAP hierarchy:

{{{
ou=users,dc=example,dc=org
ou=groups,dc=example,dc=org
ou=machines,dc=example,dc=org
-Line 40:
+Line 49:
-== Configure the Domain structure in LDAP ==
Through our PHPLDAPADMIN we are going to configure the domain.<<BR>>
open a webbrowser and go to: https://pdc/phpldapadmin/ (replace pdc with your server name or IP, replace https with http if phpldapadmin does not use SSL)<<BR>>
login with the following user:<<BR>>
{{{
cn=admin,dc=buster,dc=lan
}}}
use the password entered when you installed LDAP<<BR>>
expand the root node and then click on “Create new entry here”<<BR>>
select OU and click “proceed”<<BR>>
enter users for the OU name and click “Create object”<<BR>>
repeat the previous three steps and create two other OUs called “groups” and “machines”<<BR>>
<<BR>>
-Line 55:
+Line 51:
-Now configure Samba to use LDAP.<<BR>>
+ * Edit the samba server configuration file: `nano /etc/samba/smb.conf`
 * We will configure Samba to use the `ldapsam` account database backend. Replace the default `passdb backend=tdbsam` with
-Line 57:
+Line 56:
-vim /etc/samba/smb.conf
}}}
find:
{{{
passdb backend=tdsam
}}}
and replace it with:
{{{
+# which backend will be used for storing user/group information
-Line 66:
+Line 58:
-ldap suffix = dc=buster,dc=lan
+# base for all ldap suffixes and for storing the sambaDomain object
ldap suffix = dc=example,dc=org
 where machines should be added to the ldap tree.
-Line 68:
+Line 63:
+# where users should be added to the ldap tree.
-Line 69:
+Line 65:
+# where groups should be added to the ldap tree.
-Line 70:
+Line 67:
-ldap admin dn = cn=admin,dc=nomis52,dc=net
ldap delete dn = no
-Line 73:
+Line 68:
-# be a PDC
+# Distinguished Name (DN) name used by Samba to contact the LDAP server
# when retreiving user account information
ldap admin dn = cn=admin,dc=example,dc=org


# provide the netlogon service for Windows 9X network logons for the
# workgroup it is in.
-Line 76:
+Line 77:
-# allow user privileges
+# honor privileges assigned to specific SIDs via net rpc rights
-Line 80:
+Line 81:
-== Testing the configuration ==
make sure testparm executes successfully:
+ * Test the configuration, set the samba password and restart the service:
-Line 84:
+Line 85:
+smbpasswd -w password
systemctl restart samba
-Line 86:
+Line 89:
-Set the samba password and restart samba
{{{
smbpasswd -w password
/etc/init.d/samba restart
}}}

Log back into phpldapadmin and verify that the DomainName record exists below the root<<BR>>
create the following Samba3 Mappings under the groups OU:<<BR>>

||Unix/Windows Name||GID||SID ending number||
||admins||20000||512||
||users||20001||513||
||guests||20002||514||
+ * Using slapcat/ldapsearch, verify that a {{{DomainName}}} record was added at the root of the LDAP tree. (ToDo: add example commands)
 * create the following Samba3 Mappings under {{{ou=groups}}}:
-Line 101:
+Line 93:
-aptitude install libnss-ldap
}}}
Enter the server name as ldap://127.0.0.1/ when prompted<<BR>>
put in the search base as dc=buster,dc=lan  (replace with your domain structure)<<BR>>
put in the samba version as 3<<BR>>
enter the admin profile as cn=admin,dc=buster,dc=lan (replace with your domain structure)<<BR>>
enter the admin password<<BR>>
accept with OK<<BR>>

{{{
vim /etc/nsswitch.conf
}}}
add “ldap” after every compat<<BR>>

verify that users, guests, and admins exist by executing:
{{{
getent group
}}}

== Configure Server to authenticate locally using LDAP ==
{{{
aptitude install libpam-ldap
}}}
Answer yes<<BR>>
Answer no<<BR>>
Enter the admin profile - cn=admin,dc=buster,dc=lan (replace with your domain structure)<<BR>>
Enter your admin password<<BR>>

{{{
vim /etc/pam.d/common-account
}}}
add the following to the end of the file:
{{{
account		sufficient	pam_ldap.so
account		required	pam_unix.so	try_first_pass
+Unix/Windows Name: admins
GID: 20000
SID ending number: 512
-Line 139:
+Line 99:
-vim /etc/pam.d/common-auth
+Unix/Windows Name: users
GID: 20001
SID ending number: 513
-Line 141:
+Line 103:
-add the following line to the beginning of the file:
-Line 143:
+Line 105:
-password sufficient pam_ldap.so
+Unix/Windows Name: guests
GID: 20002
SID ending number: 514
-Line 145:
+Line 109:
-restart ssh and samba
+== Configure authentication using LDAP ==

The server must be set up to allow local account authentication using accounts stored in LDAP.
 * [[PackageManagement#Installing.2C_removing.2C_upgrading_software|Install]] the [[DebianPkg:libnss-ldapd]] and [[DebianPkg:libpam-ldapd]] packages. During installation, provide the following configuration:
   * `ldap://127.0.0.1/` as LDAP server URI
   * `dc=example,dc=org` as search base, 
   * `3` as Samba version
   * `cn=admin,dc=example,dc=org` as the LDAP admin account (replace with your own value if different)
 * Restart the samba service: `systemctl restart samba`
 * Verify that users, guests, and admins are retrieved by executing: `getent group`


See [[NSS#NSS_Setup_with_libnss-ldapd|LDAP/NSS with libnss-ldapd]] and [[PAM#PAM_Setup_with_libpam-ldapd|LDAP/PAM with libpam-ldapd]] for more information


To improve performance, you may [[NSS#Offline_caching_of_NSS_with_nscd|setup nscd]] to cache account information locally so that the LDAP server is not queried on every operation. In addition you must then set the following setting in `/etc/samba/smb.conf`:
-Line 147:
+Line 129:
-/etc/init.d/ssh restart (if ssh is installed)
/etc/init.d/samba restart
+# sync the LDAP password with the NT and LM hashes for normal accounts
# (NOT for workstation, server or domain trusts) on a password change via SAMBA.
ldap passwd sync = yes
-Line 150:
+Line 133:
-install nscd
{{{
aptitude install nscd
vim /etc/samba/smb.conf
}}}
add the following line to the file:
{{{
ldap password sync=yes
+{{{#!wiki note
Page refactoring in progress below this point