Миграция с windows на samba

Active Directory is solid, secure, and stable platform for user, group, and computer management. I would go as far and say that it is probably the backbone of 99.9% of all organizations world wide. So why would anyone want to switch away from Active Directory? The answer to that question is varied, but the most common reason why are:

• Reduce licensing costs (per user/device cals)
• Reduce Windows foot print
• Advanced features of AD are not needed
• Less than 5,000 users
• Because <insert_favorite_software> is greater than <insert_hated_software>

Let us get started on switching to a Samba4 backend.

This guide assumes the following:

• You already have a domain environment
• The forest functional level is 2003 or greater
• The domain functional level is not greater than 2008 R2
• You are running CentOS/RedHat 7 as your Samba4 host and it is a vanilla minimal install with no added repositories (i.e. you just installed it)
• Your domain is: AD.ANDREWWIPPLER.COM and your NETBIOS is AD.

Installing Samba4

The samba version that ships with CentOS is compiled in legacy NT4 emulation mode. In order to get the AD emulation, we will need to compile Samba4 (Don’t worry, it is very easy and compiles under 20 minutes with a 2 core processor.)

cd /usr/src/
wget https://download.samba.org/pub/samba/stable/samba-4.3.2.tar.gz
sudo tar xf samba-4.3.2.tar.gz
cd samba-4.3.2/

Now we need to install the build tools. (The most updated list is located here)

sudo yum install perl gcc attr libacl-devel libblkid-devel \
    gnutls-devel readline-devel python-devel gdb pkgconfig \
    krb5-workstation zlib-devel setroubleshoot-server libaio-devel \
    setroubleshoot-plugins policycoreutils-python \
    libsemanage-python perl-ExtUtils-MakeMaker perl-Parse-Yapp \
    perl-Test-Base popt-devel libxml2-devel libattr-devel \
    keyutils-libs-devel cups-devel bind-utils libxslt \
    docbook-style-xsl openldap-devel autoconf python-crypto

The next step is to compile and run:

./configure
make -j 2
# The number 2 should be relative to the number of cores on your machine
sudo make install

This process should take less than 20 minutes. After it is done compiling, it will install to /usr/local/samba/. To make it easier to run the new commands, let us add the paths to our global path:

sudo cat << EOF > /etc/profile.d/samba.sh
##add samba to PATH
export PATH=/usr/local/samba/bin/:/usr/local/samba/sbin/:$PATH
EOF
sudo chmod 0644 /etc/profile.d/samba.sh
. /etc/profile

Preparing the system to join AD

Now that Samba is installed, we need to configure our system to interact with Active Directory as well and set up BIND9.

Network related

A static IP as well as DNS must be configured properly for this to work. Ensure the appropriate settings are in /etc/sysconfig/network-scripts/ifcfg-(iface-name). The DNS servers must be an Active Directory domain controller and you should be able to ping it. If modification is done to this file, you will need to restart NetworkManager for changes to take effect. The desired result is to have /etc/resolv.conf appear like the following:

# Generated by NetworkManager
search ad.andrewwippler.com
nameserver 192.168.1.201

In my lab, 192.168.1.201 is a Windows 2008 R2 server named DC1.

Hostname related

If you have not named your CentOS install, it is best to do it now. You will also need to verify that pinging your hostname works and it returns with the ip of the interface you set and not the loopback interface.

sudo hostname dc2.ad.andrewwippler.com
sudo echo 'dc2.ad.andrewwippler.com' > /etc/hostname
echo '192.168.1.202 dc2 dc2.ad.andrewwippler.com' >> /etc/hosts

Kerberos related

Ensure /etc/krb5.conf has the following. The domain needs to be in all caps.

...
[libdefaults]
    ...
    dns_lookup_realm = false
    dns_lookup_kdc = true
    default_realm = AD.ANDREWWIPPLER.COM
...

Testing

We can now test our DNS and Kerberos settings with two simple commands.

kinit administrator

This should ask you for the domain administrator’s password. Once entered you can verify everything is working with klist.

Joining Active Directory

At this point, we have not started Samba, nor do we need to until the very end. We can now issue the join command (with BIND9 support)

sudo samba-tool domain join ad.andrewwippler.com DC -Uadministrator --realm=AD.ANDREWWIPPLER.COM --dns-backend=BIND9_DLZ

Now we will have to configure bind. For convenience sake, I have included my /etc/named.conf

//
// named.conf
//

options {
	listen-on port 53 { any; };
	listen-on-v6 port 53 { any; };
	directory 	"/var/named";
	dump-file 	"/var/named/data/cache_dump.db";
	statistics-file "/var/named/data/named_stats.txt";
	memstatistics-file "/var/named/data/named_mem_stats.txt";
	allow-query     { any; };
	recursion yes;
	dnssec-enable yes;
	dnssec-validation yes;
	dnssec-lookaside auto;
	/* Path to ISC DLV key */
	bindkeys-file "/etc/named.iscdlv.key";
	managed-keys-directory "/var/named/dynamic";
	pid-file "/run/named/named.pid";
	session-keyfile "/run/named/session.key";

        //samba
        tkey-gssapi-keytab "/usr/local/samba/private/dns.keytab";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
	type hint;
	file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
//samba
include "/usr/local/samba/private/named.conf";

Allowing access

Now that we have a functioning samba server (even though it hasn’t started yet), we need to allow it through SELinux and the firewall. Below are the commands to do just that:

Firewall

sudo firewall-cmd --add-port=389/tcp --permanent
sudo firewall-cmd --add-port=389/udp --permanent
sudo firewall-cmd --add-port=636/tcp --permanent
sudo firewall-cmd --add-port=53/tcp --permanent
sudo firewall-cmd --add-port=53/udp --permanent
sudo firewall-cmd --add-port=88/tcp --permanent
sudo firewall-cmd --add-port=88/udp --permanent
sudo firewall-cmd --add-port=464/tcp --permanent
sudo firewall-cmd --add-port=464/udp --permanent
sudo firewall-cmd --add-port=135/tcp --permanent
sudo firewall-cmd --add-port=137/udp --permanent
sudo firewall-cmd --add-port=139/tcp --permanent
sudo firewall-cmd --add-port=138/udp --permanent
sudo firewall-cmd --add-port=445/tcp --permanent
sudo firewall-cmd --add-port=3268/tcp --permanent
sudo firewall-cmd --reload

SELinux

sudo chown named:named /usr/local/samba/private/dns
sudo chgrp named /usr/local/samba/private/dns.keytab
sudo chmod g+r /usr/local/samba/private/dns.keytab
sudo chmod 775 /usr/local/samba/private/dns
sudo chown named:named /usr/local/samba/lib/bind9/dlz_bind9_9.so
sudo chcon -t named_conf_t /usr/local/samba/private/dns.keytab
sudo chcon -t named_conf_t /usr/local/samba/private/named.conf.update
sudo chcon -t named_var_run_t /usr/local/samba/private/dns
sudo chcon -t named_var_run_t /usr/local/samba/lib/bind9/dlz_bind9_9.so
sudo semanage fcontext -a -t named_conf_t /usr/local/samba/private/dns.keytab
sudo semanage fcontext -a -t named_conf_t /usr/local/samba/private/named.conf
sudo semanage fcontext -a -t named_conf_t /usr/local/samba/private/named.conf.update
sudo semanage fcontext -a -t named_var_run_t /usr/local/samba/private/dns
sudo semanage fcontext -a -t named_var_run_t /usr/local/samba/lib/bind9/dlz_bind9_9.so

Now we need to run SELinux in permissive mode and add the policy.

sudo setenforce 0
sudo systemctl restart named
sleep 60
sudo systemctl stop named
cd ~
sudo grep named /var/log/audit/audit.log | audit2allow -M named > named.te
sudo semodule -i named.pp 
sudo setenforce 1
sudo systemctl start named

Init files

Samba does not ship with an init file so we will have to create one and enable it to start at boot.

sudo cat << EOF > /etc/init.d/samba
#!/bin/bash
#
# samba4        This shell script takes care of starting and stopping
#               samba4 daemons.
#
# chkconfig: - 58 74
# description: Samba 4.0 will be the next version of the Samba suite
# and incorporates all the technology found in both the Samba4 alpha
# series and the stable 3.x series. The primary additional features
# over Samba 3.6 are support for the Active Directory logon protocols
# used by Windows 2000 and above.

### BEGIN INIT INFO
# Provides: samba4
# Required-Start: $network $local_fs $remote_fs
# Required-Stop: $network $local_fs $remote_fs
# Should-Start: $syslog $named
# Should-Stop: $syslog $named
# Short-Description: start and stop samba4
# Description: Samba 4.0 will be the next version of the Samba suite
# and incorporates all the technology found in both the Samba4 alpha
# series and the stable 3.x series. The primary additional features
# over Samba 3.6 are support for the Active Directory logon protocols
# used by Windows 2000 and above.
### END INIT INFO

# Source function library.
. /etc/init.d/functions

# Source networking configuration.
. /etc/sysconfig/network

prog=samba
prog_dir=/usr/local/samba/sbin/
lockfile=/var/lock/subsys/$prog

start() {
        [ "$NETWORKING" = "no" ] && exit 1
#       [ -x /usr/sbin/ntpd ] || exit 5
                # Start daemons.
                echo -n $"Starting samba4: "
                daemon $prog_dir/$prog -D
        RETVAL=$?
                echo
        [ $RETVAL -eq 0 ] && touch $lockfile
        return $RETVAL
}

stop() {
        [ "$EUID" != "0" ] && exit 4
                echo -n $"Shutting down samba4: "
        killproc $prog_dir/$prog
        RETVAL=$?
                echo
        [ $RETVAL -eq 0 ] && rm -f $lockfile
        return $RETVAL
}

# See how we were called.
case "$1" in
start)
        start
        ;;
stop)
        stop
        ;;
status)
        status $prog
        ;;
restart)
        stop
        start
        ;;
*)
        echo $"Usage: $0 {start|stop|status|restart}"
        exit 2
esac
EOF
sudo chmod +x /etc/init.d/samba
sudo chkconfig samba on

Flipping the switch

You are now ready to either restart the system or start samba. The next steps to fully migrate to a Samba4 AD backend would be to migrate the FSMO roles to this server. Managing this AD instance is done by loading the Remote Server Administration Tools (RSAT) on a windows client.

Sources

Here are the list of sources and references to compile this tutorial:

• https://wiki.samba.org/index.php/Join_an_additional_Samba_DC_to_an_existing_Active_Directory
• https://wiki.samba.org/index.php/Build_Samba_from_source
• https://wiki.samba.org/index.php/Samba4/InitScript
• https://wiki.samba.org/index.php/Configure_BIND_as_backend_for_Samba_AD
• https://lists.samba.org/archive/samba/2013-March/172397.html (Thanks Thomas Simmons)

Through the integration of the software Samba in Univention Corporate Server we provide you with Microsoft Windows Services.

In this video tutorial we are going to explain you how to migrate a Windows Active Directory domain controller to a UCS Samba domain controller using the application Active Directory Takeover.

First go to the Univention Management Console and install the applications Active Directory-compatible domain controller and Active Directory Takeover for free from the Univention App Center. An instruction for the installation of these applications can be found in the UCS manual.

The Active Directory Takeover allows you to migrate objects, e.g., users and computers, from a Windows AD domain to a UCS Samba domain controller. The objective of this application is to completely switch off a Windows AD DC after a prior takeover by the UCS system.

Joining the Windows AD Domain to the UCS Domain

Open the application AD Takeover via the UMC. You are now guided to the Windows domain authentication. Enter the IP address of the Windows AD domain controller you are going to take over as well as the administrator account of the Windows server and its corresponding password. Click now on „Next“. You then see an import statistic listing all objects which will be migrated. Click now on „Next“ and wait for the following domain join.

Once the join has been completed, please note the command that is shown for the takeover of the group policy. Change now to the Windows Server. Enter here the command you noted via the command line and wait till the process has been completed successfully.

Takeover of the AD Domain by UCS

Now you go back to the UMC and click on „Next“. You can now switch off the Active Directory domain controller. Only once the server has been switched off completely, you click on „Next“. The UCS system now continues the takeover process assuming the role of the Active Directory domain controller. Please click on „Finish“ at the end.

Afterwards you search for the computer module, either via the real-time search or via the tab „devices“ in the UMC. Once the AD takeover has been completed successfully, you should be able to see all computers which used to be in the Windows AD domain.

This was our video tutorial about an Active Directory takeover by a UCS system. In our next video we will be explaining the use of Univention Configuration Registry (UCR) variables.

Сначала необходимо настроить интеграцию учетных записей linux в домен Active Directory.

Ставим пакеты:
sudo apt-get install winbind krb5-user samba-common-bin
sudo service winbind stop

Создаем файл настройки /etc/samba/smb.conf:

[global]
workgroup = EXAMPLE
server string = %h server
wins server = 172.20.0.97 172.20.0.92
log file = /var/log/samba/%m.log
max log size = 1024
syslog = 0
realm = EXAMPLE.COM
security = ads

idmap backend = hash
idmap uid = 10000-4000000000
idmap gid = 10000-4000000000
winbind nss info = hash
idmap cache time = 1800
winbind refresh tickets = true
winbind cache time = 900
winbind offline logon = true
winbind expand groups = 2
winbind use default domain = No
template homedir = /home/%D/%U
template shell = /bin/bash
kerberos method = secrets and keytab


Добавляем в конце файла /usr/share/pam-configs/winbind
вместо
Session:
optional pam_winbind.so
строки
Session:
optional pam_winbind.so
required pam_mkhomedir.so umask=0022 skel=/etc/skel
Session-Initial:
required pam_mkhomedir.so umask=0022 skel=/etc/skel

Это позволит автоматически создавать каталог администратора, зашедшего на сервер по ssh

Включаем pam модуль:
sudo pam-auth-update
Отмечаем [*] Winbind NT/Active Directory authentication

Заменяем файл /etc/krb5.conf:

[libdefaults]
default_realm = EXAMPLE.COM
default_tgs_enctypes = RC4-HMAC DES-CBC-MD5 DES-CBC-CRC
default_tkt_enctypes = RC4-HMAC DES-CBC-MD5 DES-CBC-CRC
preferred_enctypes = RC4-HMAC DES-CBC-MD5 DES-CBC-CRC
dns_lookup_kdc = true
[realms]
EXAMPLE.COM = {
auth_to_local = RULE:[1:$0\$1](^EXAMPLE\.COM\\.*)s/^EXAMPLE\.COM/EXAMPLE/
auth_to_local = DEFAULT
}
[appdefaults]
pam = {
mappings = EXAMPLE\\(.*) $1@EXAMPLE.COM
forwardable = true
validate = true
}
httpd = {
mappings = EXAMPLE\\(.*) $1@EXAMPLE.COM
reverse_mappings = (.*)@EXAMPLE\.COM EXAMPLE\$1
}

Меняем строки файла /etc/nsswitch.conf:
passwd: compat winbind
group: compat winbind

Включаем в домен:
sudo net ads join -U Administrator

Запускаем winbind
sudo service winbind start

Проверяем работоспособность командой:
id EXAMPLE\\Administrator
При корректной работе будет выведен список групп пользователя EXAMPLE\Administrator.

Добавляем в файл /etc/ssh/ssh_config строки:
GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes

Добавляем в файл /etc/ssh/sshd_config
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
AllowGroups EXAMPLE\netadmins admin root
Это позволит заходить по ssh на сервер членам группы EXAMPLE\netadmins

Разрешаем группе EXAMPLE\netadmins авторизовываться в правами root:
Через команду
sudo visudo
добавляем строку
%EXAMPLE\\netadmins ALL=(ALL) ALL

Интеграция сервера в домен закончена. Теперь участники группы EXAMPLE\netadmins могут заходить по ssh и пользоваться командой sudo.

Настраиваем файл-сервер samba

Устанавливаем пакеты:
sudo apt-get install samba attr acl

Добавляем в вышеприведенный /etc/samba/smb.conf

socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=24576 SO_SNDBUF=24576
load printers = no
printing = bsd
printcap name = /dev/null
disable spoolss = yes
# Enable recycle bin and file acl like on ntfs volume (xfs or ext3/ext4 filesystem needed full acl work only on samba >3.5)
map acl inherit = yes
acl group control = yes

[all]
path = /var/shares/all
read only = no
hide unreadable = no

vfs objects = recycle acl_xattr streams_xattr

inherit acls = yes

include = /etc/samba/recycle.conf
guest ok = no
veto files = /lost+found/

Создаем файл /etc/samba/recycle.conf
recycle:repository = .Корзина
recycle:keeptree = Yes
recycle:touch = Yes
recycle:versions = Yes
recycle:maxsize = 209715200
recycle:exclude = *.tmp|*.temp|*.o|*.obj|~$*|*.~??|*.TMP
recycle:excludedir = /tmp|/temp|/cache
recycle:noversions = *.doc|*.xls|*.ppt

На сервере отключается поддержка печати и включается расширенная настройка списка доступа на файловой системе, максимально приближеного к NTFS. Поддержка расширенных список доступа и потоков NTFS обеспечивается файловыми системами xfs, ext3, ext4. Монтировать том для ext3/ext4 необходимо с параметром noatime,acl,user_xattr. Для XFS монтировать с параметрами noatime, attr2.
Дополнительно используется vfs-модуль recycle. Он позволяет не удалять файлы а складывать их в каталог .Корзина.

Перенос файлов с Windows сервера.

Для переноса файлов с windows сервера на сервер samba можно использовать утилиту robocopy из Windows Server 2003 Resource Kit Tools
Например, для копирования файлов с сервера srv1 на сервер srv2 выполните команду:
robocopy \\srv1\all \\srv2\all /e /zb /copy:dats /xd DfsrPrivate /purge

На samba сервер нельзя скопировать информацию о владельце файла и протоколе аудита. Поэтому используется параметр /copy:dats. Параметр /xd указывает пропустить каталог DfsrPrivate.

The CIFS/Samba implementation in FreeNAS is excellent, we have several FreeNAS boxes and VMs going in an active directory enviroment, using AD for permissions on the shares. It’s also extremely easy to set up and configure.

Once we’ve set up the FreeNAS box and enabled the CIFS/Samba service, we add the following to the ‘Auxiliary Parameters’ box in the CIFS service settings:

   client use spnego = yes
   winbind enum groups = no
   winbind enum users = no
   winbind separator = +
   winbind use default domain = yes
   wide links = no

Some of this may be unnecessary, but make sure to keep the ‘wide links = no’ in there as it mitigates a potential samba directory traversal vulnerability.

You can the create your shares. To set permissions via AD, we would add the following line to the ‘Auxiliary Parameters’ box for each individual share with the groups and/or users we want to have access to the share:

Valid Users = @OURDOMAIN+Somegroup @OURDOMAIN+'Some Other Group' OURDOMAIN+someuser OURDOMAIN+someotheruser

Note the groups preceded by ‘@’, everything is separated by spaces, and groups or users with a space in their name are single-quoted.

FreeNAS installs and runs on FreeBSD rather than Linux, which allows it to include things like ZFS, but if you’re determined to use Linux, OpenFiler is the Linux-based version of the same project.

If you do want to roll your own rather than use one of these distros (though they will simplify things for you immensely), you also might want to look into Likewise as an alternative to Samba for getting your box on the AD domain.

EDIT: Wow, sounds like you’ve got a lot of shares to migrate — you may be able to script the addition of new shares, but be careful — the smb.conf file gets overwritten from the /conf/config.xml file in FreeNAS each time the system restarts. You might be able to create the xml share definitions from your sharenum output to then paste into copfig.xml, using an example share you make as the template, but these get their own uuid from FreeNAS so I’m not sure how that will work — I suggest experimenting after install and before you migrate.