Samba 4 - domain controller - Revision history

Martin: /* Setting password complexity */

2018-07-27T21:24:53Z

Setting password complexity

← Older revision		Revision as of 21:24, 27 July 2018
Line 221:		Line 221:
	I couldn't get password complexity to work with the samba server and it is currently not working.		I couldn't get password complexity to work with the samba server and it is currently not working.

	Also keep in mind samba functions like a windows ~~2003~~ server so you can't do any fine-grained control of password policy in different groups/OU - it is globally defined.		Also keep in mind samba functions like a windows 2008 R2 server so you can't do any fine-grained control of password policy in different groups/OU - it is globally defined.

	It has to be done from the command line:		It has to be done from the command line:

			Edit: It is possible to also set min-pwd-lenght (was using GC to control with 2003 samba AD before)
	<pre>		<pre>
	~# samba-tool domain passwordsettings set --complexity=off		~# samba-tool domain passwordsettings set --min-pwd-length=5 --complexity=off
	Password complexity deactivated!		Password complexity deactivated!
	All changes applied successfully!		All changes applied successfully!
Line 235:		Line 237:
	Store plaintext passwords: off		Store plaintext passwords: off
	Password history length: 24		Password history length: 24
	Minimum password length: 7		Minimum password length: 5
	Minimum password age (days): 1		Minimum password age (days): 1
	Maximum password age (days): 42		Maximum password age (days): 42

Martin: /* Apache and AD/LDAP binds */

2014-06-03T14:47:39Z

Apache and AD/LDAP binds

← Older revision		Revision as of 14:47, 3 June 2014
Line 364:		Line 364:
	I require the user to be in the OU CompanyUsers and also have a group membership in ldap.		I require the user to be in the OU CompanyUsers and also have a group membership in ldap.
	* I could not get it to work without having to resolve to ou=xxx - I tried with cn=users, but didn't work for some reason		* I could not get it to work without having to resolve to ou=xxx - I tried with cn=users, but didn't work for some reason
			** Retried with newer apache - I had no issues getting it to work with cn=Users and just using default groups/user setups
	<pre>		<pre>
	<Directory /var/www/openldap/>		<Directory /var/www/openldap/>

Martin at 14:44, 3 June 2014

2014-06-03T14:44:55Z

← Older revision		Revision as of 14:44, 3 June 2014
Line 359:		Line 359:
	= Setup openLDAP proxy for AD =		= Setup openLDAP proxy for AD =
	* https://wiki.samba.org/index.php/Authenticating_other_services_against_AD		* https://wiki.samba.org/index.php/Authenticating_other_services_against_AD

			= Apache and AD/LDAP binds =
			* I created a user, ldapuser - who binds to AD and will lookup a user.
			I require the user to be in the OU CompanyUsers and also have a group membership in ldap.
			* I could not get it to work without having to resolve to ou=xxx - I tried with cn=users, but didn't work for some reason
			<pre>
			<Directory /var/www/openldap/>
			AuthName "AD authentication"
			AuthBasicProvider ldap
			AuthType Basic
			AuthLDAPGroupAttribute member
			AuthLDAPGroupAttributeIsDN On
			AuthLDAPURL ldap://dc01.hq.skytech.dk:389/ou=CompanyUsers,dc=hq,dc=skytech,dc=dk?sAMAccountName?sub?(objectClass=*)
			AuthLDAPBindDN cn=ldapuser,cn=Users,dc=hq,dc=skytech,dc=dk
			AuthLDAPBindPassword XXXX
			require ldap-group cn=ldap,ou=CompanyUsers,dc=hq,dc=skytech,dc=dk
			</Directory>
			</pre>

Martin at 10:57, 3 June 2014

2014-06-03T10:57:34Z

← Older revision		Revision as of 10:57, 3 June 2014
Line 356:		Line 356:
	ldbedit --url=/var/lib/samba/private/sam.ldb CN=martin		ldbedit --url=/var/lib/samba/private/sam.ldb CN=martin
	</pre>		</pre>

			= Setup openLDAP proxy for AD =
			* https://wiki.samba.org/index.php/Authenticating_other_services_against_AD

Martin: /* Setup as domain controller */

2014-06-03T10:51:15Z

Setup as domain controller

← Older revision		Revision as of 10:51, 3 June 2014
Line 54:		Line 54:
	</pre>		</pre>

	== ~~Copy kerberos conf~~ ==		== Configure Kerberos ==
	~~( Default configs should have been created by now~~ ..~~. )~~		Usually the krb5.conf file is generated when samba is initially setup; for debian/ubuntu look in: /var/lib/samba/private/krb5.conf
			If it fits the items below, copy it to /etc

	<pre>		<pre>
	~~mv /etc/krb5.conf~~{~~,.default~~}		[libdefaults]
	~~cp /var/lib/samba/private/krb5.conf /etc~~		default_realm = ${REALM}
			dns_lookup_realm = false
			dns_lookup_kdc = true
	</pre>		</pre>
			* Note: If you have forgotten your realm, run samba-tool testparm --suppress-prompt \| grep realm, to find it out.

	= Setup replicator/secondary domain controller =		= Setup replicator/secondary domain controller =

Martin at 09:05, 3 June 2014

2014-06-03T09:05:11Z

← Older revision		Revision as of 09:05, 3 June 2014
Line 344:		Line 344:
	administrator@domain.com -W		administrator@domain.com -W
	rm ldap.ldif		rm ldap.ldif
			</pre>

			= Edit ldap data =
			To change for user martin:
			<pre>
			ldbedit --url=/var/lib/samba/private/sam.ldb CN=martin
	</pre>		</pre>

Martin at 11:50, 20 May 2014

2014-05-20T11:50:20Z

← Older revision		Revision as of 11:50, 20 May 2014
Line 82:		Line 82:
	</pre>		</pre>

			== Joining a windows domain - checklist ==
	* If needed, force replication between DC from samba (if it fails from Windows it often works via samba-tools):		* If needed, force replication between DC from samba (if it fails from Windows it often works via samba-tools):
	<pre>		<pre>
	samba-tool drs replicate dc02.hq.skytech.dk dc01.hq.skytech.dk DC=HQ,DC=SKYTECH,DC=DK		samba-tool drs replicate dc02.hq.skytech.dk dc01.hq.skytech.dk DC=HQ,DC=SKYTECH,DC=DK
	</pre>		</pre>

			* Sysvol data is not copied automatically to samba - you must do this yourself. Copying with rsync will not create the correct ACL. So copy with any tool and run the below cmd to setup [default] sysvol perms.

	* If you need to reset (fix) permissions on sysvol share on samba issue:		* If you need to reset (fix) permissions on sysvol share on samba issue:

Martin at 10:23, 2 May 2014

2014-05-02T10:23:37Z

← Older revision		Revision as of 10:23, 2 May 2014
Line 326:		Line 326:
	= Things to watch out for / checklist =		= Things to watch out for / checklist =
	* I accidentally installed krb5-admin-server on top of samba. Which is all good and stuff when you install it, but on next reboot samba won't start. It will complain about krb ports being used. Whereas the error log is pretty obvious really, it keep me looking for some hours. Eventually I actually _read_ the log and found that krb5 was started before samba... disable in /etc/default/krb5-admin-server and set start to false.		* I accidentally installed krb5-admin-server on top of samba. Which is all good and stuff when you install it, but on next reboot samba won't start. It will complain about krb ports being used. Whereas the error log is pretty obvious really, it keep me looking for some hours. Eventually I actually _read_ the log and found that krb5 was started before samba... disable in /etc/default/krb5-admin-server and set start to false.

			= Change password via LDAP =
			From mailinglist:
			<pre>
			#!/bin/bash
			password=test
			password='"'$password'"'
			u16pass=`printf $password\|iconv -f ascii -t UTF16LE\|base64`
			echo "dn: CN=John Smith,cn=Users,DC=domain,DC=com" >ldap.ldif
			echo "changetype: modify" >>ldap.ldif
			echo "replace: unicodePwd" >>ldap.ldif
			echo "unicodePwd:: $u16pass" >>ldap.ldif
			ldapmodify -v -c -a -f ldap.ldif -H ldaps://server.domain.com -D
			administrator@domain.com -W
			rm ldap.ldif
			</pre>

Martin: /* Remove samba and migrate/move to pure windows servers */

2014-05-02T06:10:37Z

Remove samba and migrate/move to pure windows servers

← Older revision		Revision as of 06:10, 2 May 2014
Line 307:		Line 307:

	= Remove samba and migrate/move to pure windows servers =		= Remove samba and migrate/move to pure windows servers =

			== Demote samba server ==
			<pre>
			samba-tool domain demote
			</pre>

			Possible clean up entries in AD.

	== Change all FSMO roles to win2003 ==		== Change all FSMO roles to win2003 ==
	Follow the guide here and update		Follow the guide here and update

Martin at 17:03, 1 May 2014

2014-05-01T17:03:16Z

← Older revision		Revision as of 17:03, 1 May 2014
Line 86:		Line 86:
	samba-tool drs replicate dc02.hq.skytech.dk dc01.hq.skytech.dk DC=HQ,DC=SKYTECH,DC=DK		samba-tool drs replicate dc02.hq.skytech.dk dc01.hq.skytech.dk DC=HQ,DC=SKYTECH,DC=DK
	</pre>		</pre>

			* If you need to reset (fix) permissions on sysvol share on samba issue:
			<pre>
			samba-tool ntacl sysvolreset
			</pre>


	== Switching to 'backup' DC if PDC dies horribly ==		== Switching to 'backup' DC if PDC dies horribly ==