Nethence Documentation Lab Webmail Your IP BBDock  


Those documents are obsolete, please use the Nethence Documentation instead.

HomeUnixWindowsOracleObsoleteHardwareDIYMechanicsScriptsConfigsPrivate

Samba/LDAP configuration (RHEL5)
updated 02/03/2011
 
http://pbraun.nethence.com/doc/net/samba-ldap.html
http://pbraun.nethence.com/doc/www/phpldapadmin.html
 
 
Introduction
A straightforward tutorial to configure Samba/LDAP as a Primary Domain Controller / Directory on RHEL5.
 
 
Requirements
Make sure you've got those RHEL packages installed,
rpm -q \
openldap \
openldap-clients \
openldap-servers \
nss_ldap \
samba \
samba-client \
perl-DBI \
perl-Convert-ASN1 \
perl-XML-NamespaceSupport \
perl-XML-SAX \
perl-Net-SSLeay \
perl-IO-Socket-SSL \
perl-LDAP \
perl-Digest-SHA1
Note. the "nss_ldap" package provides the PAM/LDAP library,
ls -l /lib/security/pam_ldap.so
 
Plus those few ones from EPEL (http://fedoraproject.org/wiki/EPEL),
mkdir epelsmbldap/
cd epelsmbldap/
wget http://download.fedora.redhat.com/pub/epel/5/i386/perl-Crypt-SmbHash-0.12-6.el5.noarch.rpm
wget http://download.fedora.redhat.com/pub/epel/5/i386/perl-Digest-MD4-1.5-4.el5.i386.rpm
wget http://download.fedora.redhat.com/pub/epel/5/i386/perl-Jcode-2.06-6.el5.noarch.rpm
wget http://download.fedora.redhat.com/pub/epel/5/i386/perl-Unicode-Map-0.112-12.el5.i386.rpm
wget http://download.fedora.redhat.com/pub/epel/5/i386/perl-Unicode-Map8-0.12-15.el5.i386.rpm
wget http://download.fedora.redhat.com/pub/epel/5/i386/perl-Unicode-MapUTF8-1.11-7.el5.noarch.rpm
wget http://download.fedora.redhat.com/pub/epel/5/i386/perl-Unicode-String-2.09-7.el5.i386.rpm
rpm -ivh *.rpm
cd ../
rpm -q \
perl-Crypt-SmbHash \
perl-Digest-MD4 \
perl-Jcode \
perl-Unicode-Map \
perl-Unicode-Map8 \
perl-Unicode-MapUTF8 \
perl-Unicode-String
 
 
Network settings
Configure at least local static lookups,
vi /etc/hosts
like e.g.,
127.0.0.1  localhost
SERVER_IP  lusers.example.net  lusers
 
 
OpenLDAP server
Add that schema,
cd /etc/openldap/schema/
#cp /usr/share/doc/samba-3.0.25b/LDAP/samba.schema ./
cp /usr/share/doc/samba-3.0.33/LDAP/samba.schema ./
 
Configure the daemon,
cd /etc/openldap/
slappasswd
# (copy/paste the SSHA password into the following configuration)
mv slapd.conf slapd.conf.dist
cat > slapd.conf <<EOF9
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/samba.schema

allow bind_v2
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args

database bdb
suffix "dc=lusers,dc=example,dc=net"
rootdn "cn=admin,dc=lusers,dc=example,dc=net"
rootpw {SSHA}PASTE_HERE
directory /var/lib/ldap

index objectClass eq,pres
index ou,cn,mail,surname,givenname eq,pres,sub
index uidNumber,gidNumber,loginShell eq,pres
index uid,memberUid eq,pres,sub
index nisMapName,nisMapEntry eq,pres,sub
EOF9
Note. it's also possible to use an ldap password in clear text
Note. no need to force the hash type with password-hash
 
Fix some database setting,
cd /var/lib/ldap/
cp /etc/openldap/DB_CONFIG.example DB_CONFIG
chown ldap:ldap DB_CONFIG
chmod 600 DB_CONFIG
 
 
OpenLDAP directory initialization
Start, check and stop the service,
cd ~/
service ldap start
ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts
# (should return two lines)
service ldap stop
slapcat
# (should return empty)
 
Initialize the database,
cd /etc/openldap/
cat > init.ldif <<EOF9
dn: dc=lusers,dc=example,dc=net
objectclass: top
objectclass: organization
objectclass: dcObject
o: ORGANIZATION
dc: lusers

dn: cn=admin,dc=lusers,dc=example,dc=net
objectclass: organizationalRole
cn: admin
EOF9
slapadd -l init.ldif
chown -R ldap:ldap /var/lib/ldap/
chmod 600 /var/lib/ldap/*
slapcat
# (should return two paragraphs)
Note. for 'dc: lusers' we need to have 'dn: dc=lusers,...'
Note. in case you need to try again, here's how to (brutally) clean it up,
#cd /var/lib/ldap/
#rm -rf *
#cp /etc/openldap/DB_CONFIG.example DB_CONFIG
#chown ldap:ldap DB_CONFIG
#chmod 600 DB_CONFIG
 
Start, enable and verify the ldap daemon,
service ldap start
chkconfig ldap on
ldapsearch -x -b "dc=lusers,dc=example,dc=net"
# (should return two entries)
 
 
Samba Primary Domain Controller
Extract smbldap-tools,
cd ~/
wget http://download.gna.org/smbldap-tools/packages/smbldap-tools-0.9.6.tar.gz
tar xzf smbldap-tools-0.9.6.tar.gz
 
Configure the samba daemons,
cd /etc/samba/
[[ ! -f smb.conf.dist ]] && mv smb.conf smb.conf.dist
sed -n '1,/^\[netlogon\]$/p;' ~/smbldap-tools-0.9.6/doc/smb.conf | grep -v '\[netlogon\]' > smb.conf.tmp
sed '
/^$/d;
/^#/d;
/^[[:space:]]*#/d;
s/DOMSMB/MYDOMAIN/g;
s|/opt/IDEALX/|/usr/local/|g;
s/cn=Manager/cn=admin/g;
s/dc=idealx,dc=org/dc=lusers,dc=example,dc=net/g;
s/dc=company,dc=com/dc=lusers,dc=example,dc=net/g;
s/idealx.com/example.net/g;
s/PDC-SRV/LUSERS/g;

s/Samba Server %v/Samba\/LDAP on steroids/g
/min passwd length/d;
/printer admin/d;
' smb.conf.tmp > smb.conf && rm -f smb.conf.tmp
#s/IDEALX-NT/EXAMPLE/g;
#' /usr/share/doc/samba-3.0.25b/LDAP/smbldap-tools-0.9.2/smb.conf > smb.conf
cat >> smb.conf <<EOF9

[homes]
comment = Home Directories
browseable = no
writable = yes
; valid users = %S
; valid users = MYDOMAIN\%S
EOF9
Note. removing netlogon, shares and printers, otherwise make sure those are really available.
 
Samba needs to know the ldap admin user password (not ldap root which will be populated later on),
smbpasswd -w LDAP_PASSWORD
 
Start and enable the samba daemons,
testparm
service smb restart
chkconfig smb on
 
Check everything's fine,
tail -F /var/log/messages &
tail -F /var/log/samba/* &
#echo 'screen -t "smb" 0 tail -F /var/log/samba/nmbd.log /var/log/samba/smbd.log' >> ~/.screenrc
service smb status
 
 
Smbldap-tools connector
Eventually fetch latest smbldap-tools (http://download.gna.org/smbldap-tools/packages/) and deploy them,
cd /usr/local/sbin/
#cp /usr/share/doc/samba-3.0.25b/LDAP/smbldap-tools-0.9.2/smbldap-* ./
#cp /usr/share/doc/samba-3.0.25b/LDAP/smbldap-tools-0.9.2/smbldap_tools.pm ./
cp ~/smbldap-tools-0.9.6/smbldap-* ./
cp ~/smbldap-tools-0.9.6/smbldap_tools.pm ./
chmod +x smbldap*
 
Configure the connector (without TLS in this example),
mkdir -p /etc/smbldap-tools/
cd /etc/smbldap-tools/
sed '
/^$/d;
/^#/d;
/^[[:space:]]*#/d;
s/DOMSMB/MYDOMAIN/g;
s|/opt/IDEALX/|/usr/local/|g;
s/cn=Manager/cn=admin/g;
s/dc=idealx,dc=org/dc=lusers,dc=example,dc=net/g;
s/dc=company,dc=com/dc=lusers,dc=example,dc=net/g;
s/idealx.com/example.net/g;  
s/PDC-SRV/LUSERS/g;

s/dc=iallanis,dc=info/dc=lusers,dc=example,dc=net/g;
s/ldap.iallanis.info/127.0.0.1/g;
s/iallanis.info/example.net/g;
s/ldapTLS="1"/ldapTLS="0"/;
/cafile/d;
/clientcert/d;
/clientkey/d;
' ~/smbldap-tools-0.9.6/smbldap.conf > smbldap.conf
#' /usr/share/doc/samba-3.0.25b/LDAP/smbldap-tools-0.9.2/smbldap.conf > smbldap.conf
find out and fix the domain controller SID in that config,
net getlocalsid
vi smbldap.conf
change,
SID=SID_HERE
 
Configure the access information,
cd /etc/smbldap-tools/
cat > smbldap_bind.conf <<EOF9
masterDN="cn=admin,dc=lusers,dc=example,dc=net"
masterPw="LDAP_PASSWORD"
EOF9
 
Fix file permissions,
cd /etc/smbldap-tools/
chmod 644 smbldap.conf
chmod 600 smbldap_bind.conf
 
 
LDAP user mapping
Local user mapping against the LDAP is mandatory as Samba needs UNIX users too.
 
Configure the LDAP-UNIX user mapping,
authconfig-tui
enable,
user information: use ldap (/etc/nsswitch.conf)
authentication: use ldap authentication
authentication: local authorization is sufficient
ldap settings,
server: ldap://127.0.0.1/
base dn: dc=lusers,dc=example,dc=net
Note. those files (at least) get altered,
#/etc/nsswitch.conf
#/etc/pam.d/system-auth-ac
#/etc/ldap.conf
#/etc/openldap/ldap.conf
 
 
LDAP tree for smbldap-tools
Populate the LDAP tree (groups and two users: nobody and root),
smbldap-populate
and provide a DOMAIN_ROOT_PASSWORD (netbios domain administrator).
 
Check for new groups,
net groupmap list
 
Check for samba service with the newly created domain/ldap root user,
smbclient -L 127.0.0.1
(DOMAIN_ROOT_PASSWORD)
 
 
Ready to go
Create an ldap user for the machine you want to join the domain with,
smbldap-useradd -W windows-host$
Note the trailing '$' for the 'Computer' group
 
You should now be able to join the "MYDOMAIN" domain from that Windows box with those creditentials:
Login : root
Password : DOMAIN_ROOT_PASSWORD
 
 
Troubbleshooting
If you get this error message in the samba logs,
fetch_ldap_pw: neither ldap secret retrieved!
it's simply because 'secrets.tdb' is missing. Provide samba with the admin ldap user password (smbpasswd -w LDAP_PASSWORD), not the domain/ldap root one.
 
If you get this error message when trying to join the domain (French Windows XP here),
le nom d'utilisateur est introuvable
make sure the machine/user has been created first (smbldap-useradd -W).
 
If you get this error message when trying to join the domain (French Windows XP here),
le chemin réseau n'a pas été trouvé
make sure the samba daemons are up and running (check with smbclient -L 127.0.0.1).
 
 
Usage
Create a group,
smbldap-groupadd -a GROUPNAME
 
Create a user,
smbldap-useradd -a -g GROUPNAME -G 'Domain Users' -m -s /bin/ksh -d /home/USERNAME -F '' -P USERNAME
Note. primary group 'GROUPNAME' and secondary group 'Domain Users'
Note. other possible groups : "Administrators" and "Domain Admins"
 
Check in the LDAP repository for USERNAME's primary group,
dn: uid=USERNAME,ou=Users,dc=lusers,dc=example,dc=net
...
gidNumber: GID_NUMBER
and secondary groups (primary group is also referenced as secondary group in the LDAP repo),
dn: cn=GROUPNAME,ou=Groups,dc=lusers,dc=example,dc=net
...
memberUid: USERNAME
also,
dn: cn=Domain Users,ou=Groups,dc=lusers,dc=example,dc=net
...
memberUid: USERNAME
 
Check,
#net groupmap list
getent group | grep GROUPNAME
getent passwd | grep USERNAME
smbldap-usershow USERNAME
smbclient -U USERNAME -L 127.0.0.1
# (you can also try to connect with ssh as long as /etc/nsswitch.conf passwd shadow and group points to ldap too)
 
 
Maintainance
Restart the whole thing,
service smb stop
service ldap restart
service smb start
 
 
References
smbldap-tools documentation : /usr/share/doc/samba-3.0.25b/LDAP/smbldap-tools-0.9.2/INSTALL
Samba (v.3) PDC LDAP howto
Redhat knowledge base
http://wiki.samba.org/index.php/Samba_&_LDAP
http://damstux.free.fr/wiki/index.php?title=PDC_Samba_LDAP
 
 
Additionnal links
Official guide
Simple PDC
Ldap scripts alternative
+ http://contribs.martymac.com/sambaConfig/smb.conf
+ http://contribs.martymac.com/sambaConfig/base.ldif
Another alternative
Fedora Directory
(FR) Guide on debian
(FR) Yet another debian guide
 
 
 

Last update: Mar 02, 2011