Samba/LDAP configuration (RHEL5)

Next Door Laboratories

| donate | html/css | terms of use

updated 02/03/2011

http://pbraun.nethence.com/doc/net/samba-ldap.html

http://pbraun.nethence.com/doc/www/phpldapadmin.html

Introduction

A straightforward tutorial to configure Samba/LDAP as a Primary Domain Controller / Directory on RHEL5.

Requirements

Make sure you've got those RHEL packages installed,

rpm -q \

openldap \

openldap-clients \

openldap-servers \

nss_ldap \

samba \

samba-client \

perl-DBI \

perl-Convert-ASN1 \

perl-XML-NamespaceSupport \

perl-XML-SAX \

perl-Net-SSLeay \

perl-IO-Socket-SSL \

perl-LDAP \

perl-Digest-SHA1

Note. the "nss_ldap" package provides the PAM/LDAP library,

ls -l /lib/security/pam_ldap.so

Plus those few ones from EPEL (http://fedoraproject.org/wiki/EPEL),

mkdir epelsmbldap/

cd epelsmbldap/

wget http://download.fedora.redhat.com/pub/epel/5/i386/perl-Crypt-SmbHash-0.12-6.el5.noarch.rpm

wget http://download.fedora.redhat.com/pub/epel/5/i386/perl-Digest-MD4-1.5-4.el5.i386.rpm

wget http://download.fedora.redhat.com/pub/epel/5/i386/perl-Jcode-2.06-6.el5.noarch.rpm

wget http://download.fedora.redhat.com/pub/epel/5/i386/perl-Unicode-Map-0.112-12.el5.i386.rpm

wget http://download.fedora.redhat.com/pub/epel/5/i386/perl-Unicode-Map8-0.12-15.el5.i386.rpm

wget http://download.fedora.redhat.com/pub/epel/5/i386/perl-Unicode-MapUTF8-1.11-7.el5.noarch.rpm

wget http://download.fedora.redhat.com/pub/epel/5/i386/perl-Unicode-String-2.09-7.el5.i386.rpm

rpm -ivh *.rpm

cd ../

rpm -q \

perl-Crypt-SmbHash \

perl-Digest-MD4 \

perl-Jcode \

perl-Unicode-Map \

perl-Unicode-Map8 \

perl-Unicode-MapUTF8 \

perl-Unicode-String

Network settings

Configure at least local static lookups,

vi /etc/hosts

like e.g.,

127.0.0.1 localhost

SERVER_IP lusers.example.net lusers

OpenLDAP server

Add that schema,

cd /etc/openldap/schema/

#cp /usr/share/doc/samba-3.0.25b/LDAP/samba.schema ./

cp /usr/share/doc/samba-3.0.33/LDAP/samba.schema ./

Configure the daemon,

cd /etc/openldap/

slappasswd

# (copy/paste the SSHA password into the following configuration)

mv slapd.conf slapd.conf.dist

cat > slapd.conf <<EOF9

include /etc/openldap/schema/core.schema

include /etc/openldap/schema/cosine.schema

include /etc/openldap/schema/inetorgperson.schema

include /etc/openldap/schema/nis.schema

include /etc/openldap/schema/samba.schema

allow bind_v2

pidfile /var/run/openldap/slapd.pid

argsfile /var/run/openldap/slapd.args

database bdb

suffix "dc=lusers,dc=example,dc=net"

rootdn "cn=admin,dc=lusers,dc=example,dc=net"

rootpw {SSHA}PASTE_HERE

directory /var/lib/ldap

index objectClass eq,pres

index ou,cn,mail,surname,givenname eq,pres,sub

index uidNumber,gidNumber,loginShell eq,pres

index uid,memberUid eq,pres,sub

index nisMapName,nisMapEntry eq,pres,sub

EOF9

Note. it's also possible to use an ldap password in clear text

Note. no need to force the hash type with password-hash

Fix some database setting,

cd /var/lib/ldap/

cp /etc/openldap/DB_CONFIG.example DB_CONFIG

chown ldap:ldap DB_CONFIG

chmod 600 DB_CONFIG

OpenLDAP directory initialization

Start, check and stop the service,

cd ~/

service ldap start

ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts

# (should return two lines)

service ldap stop

slapcat

# (should return empty)

Initialize the database,

cd /etc/openldap/

cat > init.ldif <<EOF9

dn: dc=lusers,dc=example,dc=net

objectclass: top

objectclass: organization

objectclass: dcObject

o: ORGANIZATION

dc: lusers

dn: cn=admin,dc=lusers,dc=example,dc=net

objectclass: organizationalRole

cn: admin

EOF9

slapadd -l init.ldif

chown -R ldap:ldap /var/lib/ldap/

chmod 600 /var/lib/ldap/*

slapcat

# (should return two paragraphs)

Note. for 'dc: lusers' we need to have 'dn: dc=lusers,...'

Note. in case you need to try again, here's how to (brutally) clean it up,

#cd /var/lib/ldap/

#rm -rf *

#cp /etc/openldap/DB_CONFIG.example DB_CONFIG

#chown ldap:ldap DB_CONFIG

#chmod 600 DB_CONFIG

Start, enable and verify the ldap daemon,

service ldap start

chkconfig ldap on

ldapsearch -x -b "dc=lusers,dc=example,dc=net"

# (should return two entries)

Samba Primary Domain Controller

Extract smbldap-tools,

cd ~/

wget http://download.gna.org/smbldap-tools/packages/smbldap-tools-0.9.6.tar.gz

tar xzf smbldap-tools-0.9.6.tar.gz

Configure the samba daemons,

cd /etc/samba/

[[ ! -f smb.conf.dist ]] && mv smb.conf smb.conf.dist

sed -n '1,/^\[netlogon\]$/p;' ~/smbldap-tools-0.9.6/doc/smb.conf | grep -v '\[netlogon\]' > smb.conf.tmp

sed '

/^$/d;

/^#/d;

/^[[:space:]]*#/d;

s/DOMSMB/MYDOMAIN/g;

s|/opt/IDEALX/|/usr/local/|g;

s/cn=Manager/cn=admin/g;

s/dc=idealx,dc=org/dc=lusers,dc=example,dc=net/g;

s/dc=company,dc=com/dc=lusers,dc=example,dc=net/g;

s/idealx.com/example.net/g;

s/PDC-SRV/LUSERS/g;

s/Samba Server %v/Samba\/LDAP on steroids/g

/min passwd length/d;

/printer admin/d;

' smb.conf.tmp > smb.conf && rm -f smb.conf.tmp

#s/IDEALX-NT/EXAMPLE/g;

#' /usr/share/doc/samba-3.0.25b/LDAP/smbldap-tools-0.9.2/smb.conf > smb.conf

cat >> smb.conf <<EOF9

[homes]

comment = Home Directories

browseable = no

writable = yes

; valid users = %S

; valid users = MYDOMAIN\%S

EOF9

Note. removing netlogon, shares and printers, otherwise make sure those are really available.

Samba needs to know the ldap admin user password (not ldap root which will be populated later on),

smbpasswd -w LDAP_PASSWORD

Start and enable the samba daemons,

testparm

service smb restart

chkconfig smb on

Check everything's fine,

tail -F /var/log/messages &

tail -F /var/log/samba/* &

#echo 'screen -t "smb" 0 tail -F /var/log/samba/nmbd.log /var/log/samba/smbd.log' >> ~/.screenrc

service smb status

Smbldap-tools connector

Eventually fetch latest smbldap-tools (http://download.gna.org/smbldap-tools/packages/) and deploy them,

cd /usr/local/sbin/

#cp /usr/share/doc/samba-3.0.25b/LDAP/smbldap-tools-0.9.2/smbldap-* ./

#cp /usr/share/doc/samba-3.0.25b/LDAP/smbldap-tools-0.9.2/smbldap_tools.pm ./

cp ~/smbldap-tools-0.9.6/smbldap-* ./

cp ~/smbldap-tools-0.9.6/smbldap_tools.pm ./

chmod +x smbldap*

Configure the connector (without TLS in this example),

mkdir -p /etc/smbldap-tools/

cd /etc/smbldap-tools/

sed '

/^$/d;

/^#/d;

/^[[:space:]]*#/d;

s/DOMSMB/MYDOMAIN/g;

s|/opt/IDEALX/|/usr/local/|g;

s/cn=Manager/cn=admin/g;

s/dc=idealx,dc=org/dc=lusers,dc=example,dc=net/g;

s/dc=company,dc=com/dc=lusers,dc=example,dc=net/g;

s/idealx.com/example.net/g;

s/PDC-SRV/LUSERS/g;

s/dc=iallanis,dc=info/dc=lusers,dc=example,dc=net/g;

s/ldap.iallanis.info/127.0.0.1/g;

s/iallanis.info/example.net/g;

s/ldapTLS="1"/ldapTLS="0"/;

/cafile/d;

/clientcert/d;

/clientkey/d;

' ~/smbldap-tools-0.9.6/smbldap.conf > smbldap.conf

#' /usr/share/doc/samba-3.0.25b/LDAP/smbldap-tools-0.9.2/smbldap.conf > smbldap.conf

find out and fix the domain controller SID in that config,

net getlocalsid

vi smbldap.conf

change,

SID=SID_HERE

Configure the access information,

cd /etc/smbldap-tools/

cat > smbldap_bind.conf <<EOF9

masterDN="cn=admin,dc=lusers,dc=example,dc=net"

masterPw="LDAP_PASSWORD"

EOF9

Fix file permissions,

cd /etc/smbldap-tools/

chmod 644 smbldap.conf

chmod 600 smbldap_bind.conf

LDAP user mapping

Local user mapping against the LDAP is mandatory as Samba needs UNIX users too.

Configure the LDAP-UNIX user mapping,

authconfig-tui

enable,

user information: use ldap (/etc/nsswitch.conf)

authentication: use ldap authentication

authentication: local authorization is sufficient

ldap settings,

server: ldap://127.0.0.1/

base dn: dc=lusers,dc=example,dc=net

Note. those files (at least) get altered,

#/etc/nsswitch.conf

#/etc/pam.d/system-auth-ac

#/etc/ldap.conf

#/etc/openldap/ldap.conf

LDAP tree for smbldap-tools

Populate the LDAP tree (groups and two users: nobody and root),

smbldap-populate

and provide a DOMAIN_ROOT_PASSWORD (netbios domain administrator).

Check for new groups,

net groupmap list

Check for samba service with the newly created domain/ldap root user,

smbclient -L 127.0.0.1

(DOMAIN_ROOT_PASSWORD)

Ready to go

Create an ldap user for the machine you want to join the domain with,

smbldap-useradd -W windows-host$

Note the trailing '$' for the 'Computer' group

You should now be able to join the "MYDOMAIN" domain from that Windows box with those creditentials:

Password : DOMAIN_ROOT_PASSWORD

Troubbleshooting

If you get this error message in the samba logs,

fetch_ldap_pw: neither ldap secret retrieved!

it's simply because 'secrets.tdb' is missing. Provide samba with the admin ldap user password (smbpasswd -w LDAP_PASSWORD), not the domain/ldap root one.

If you get this error message when trying to join the domain (French Windows XP here),

le nom d'utilisateur est introuvable

make sure the machine/user has been created first (smbldap-useradd -W).

If you get this error message when trying to join the domain (French Windows XP here),

le chemin réseau n'a pas été trouvé

make sure the samba daemons are up and running (check with smbclient -L 127.0.0.1).

Usage

Create a group,

smbldap-groupadd -a GROUPNAME

Create a user,

smbldap-useradd -a -g GROUPNAME -G 'Domain Users' -m -s /bin/ksh -d /home/USERNAME -F '' -P USERNAME

Note. primary group 'GROUPNAME' and secondary group 'Domain Users'

Note. other possible groups : "Administrators" and "Domain Admins"

Check in the LDAP repository for USERNAME's primary group,

dn: uid=USERNAME,ou=Users,dc=lusers,dc=example,dc=net

...

gidNumber: GID_NUMBER

and secondary groups (primary group is also referenced as secondary group in the LDAP repo),

dn: cn=GROUPNAME,ou=Groups,dc=lusers,dc=example,dc=net

...

memberUid: USERNAME

also,

dn: cn=Domain Users,ou=Groups,dc=lusers,dc=example,dc=net

...

memberUid: USERNAME

Check,

#net groupmap list

getent group | grep GROUPNAME

getent passwd | grep USERNAME

smbldap-usershow USERNAME

smbclient -U USERNAME -L 127.0.0.1

# (you can also try to connect with ssh as long as /etc/nsswitch.conf passwd shadow and group points to ldap too)

Maintainance

Restart the whole thing,

service smb stop

service ldap restart

service smb start

References

smbldap-tools documentation : /usr/share/doc/samba-3.0.25b/LDAP/smbldap-tools-0.9.2/INSTALL

Samba (v.3) PDC LDAP howto : http://www.unav.es/cti/ldap-smb/smb-ldap-3-howto.html

Redhat knowledge base : http://kbase.redhat.com/faq/

http://wiki.samba.org/index.php/Samba_&_LDAP

http://damstux.free.fr/wiki/index.php?title=PDC_Samba_LDAP

Additionnal links

Official guide : http://us3.samba.org/samba/docs/man/Samba-Guide/happy.html

Simple PDC : http://www.oregontechsupport.com/samba/samba-pdc.php

Ldap scripts alternative : http://ldapscripts.sourceforge.net/

+ http://contribs.martymac.com/sambaConfig/smb.conf

+ http://contribs.martymac.com/sambaConfig/base.ldif

Another alternative : http://sourceforge.net/projects/smb-scripts/

Fedora Directory : http://fdstools.wiki.sourceforge.net/

(FR) Guide on debian : http://www.coagul.org/spip.php?article625

(FR) Yet another debian guide : http://damstux.free.fr/wiki/index.php?title=PDC_Samba_et_LDAP