SAMBA Cross-Domain Trust File Server

Purpose

Existing file server is not configured properly. Will be moving this non-critical data to a new server running in AWS. Since I can live with some downtime if needed, it is much cheaper to use a small AWS instance than to use the expensive Windows based file service AWS offers.

Host

Host is t3a.small CentOS7 instance running on EC2. At the time of this writing CentOS8 is not available on the AWS store.
Though not a critical system, it will be holding sensitive data and I want native SELinux.

Config

Work in progress

• Prep base OS with automatic updates and a firewall. Make sure to edit the yum-cron config to install security only, and to install updates after downloading.

sudo yum upgrade -y

• Edit /etc/dhcp/dhclient.conf to include domain specific settings, then reboot.

prepend domain-search "domain1.tld", "domain2.tld";
prepend domain-name-servers 192.168.1.100, 192.168.1.101;
sudo reboot -h now

sudo yum install epel-release yum-cron firewalld
sudo systemctl enable --now firewalld
sudo systemctl enable --now yum-cron
sudo hostnamectl set-hostname myfileserver
sudo reboot -h now

• Install kerberose and related packages, start sssd service, join realm.

sudo yum install -y realmd krb5-workstation oddjob oddjob-mkhomedir sssd samba-common samba-common-tools
sudo systemctl enable --now sssd
sudo realm join -U <username> domain1.tld