Difference between revisions of "SAMBA Cross-Domain Trust File Server"
Jump to navigation
Jump to search
Michael.mast (talk | contribs) |
Michael.mast (talk | contribs) |
||
| Line 69: | Line 69: | ||
*<ref>https://wiki.samba.org/index.php/Samba_Member_Server_Troubleshooting</ref>Create file /etc/samba/user.map with the following | *<ref>https://wiki.samba.org/index.php/Samba_Member_Server_Troubleshooting</ref>Create file /etc/samba/user.map with the following | ||
<pre> | <pre> | ||
| − | !root = DOMAIN1\ | + | !root = DOMAIN1\michael.mast |
</pre> | </pre> | ||
*Start services | *Start services | ||
| Line 79: | Line 79: | ||
<pre> | <pre> | ||
sudo smbcontrol all reload-config | sudo smbcontrol all reload-config | ||
| + | </pre> | ||
| + | *At this point we want to make sure a domain security group can manage the share from a Windows server. In my case I created a linuxadmins group. | ||
| + | <pre> | ||
| + | net rpc rights grant "DOMAIN1\lunixadmins' SeDiskOperatorPrivilege -U'DOMAIN1\michael.mast' | ||
| + | </pre> | ||
| + | However, at the time of this writing I am unable to get this to work. Getting the following error | ||
| + | <pre> | ||
| + | Enter DOMAIN1\michael.mast's password: | ||
| + | Could not connect to server 127.0.0.1 | ||
| + | The username or password was not correct. | ||
| + | Connection failed: NT_STATUS_LOGON_FAILURE | ||
</pre> | </pre> | ||
Revision as of 14:07, 21 January 2020
Purpose
Existing file server is not configured properly. Will be moving this non-critical data to a new server running in AWS. Since I can live with some downtime if needed, it is much cheaper to use a small AWS instance than to use the expensive Windows based file service AWS offers.
Host
Host is t3a.small CentOS7 instance running on EC2. At the time of this writing CentOS8 is not available on the AWS store.
Though not a critical system, it will be holding sensitive data and I want native SELinux.
Config
Work in progress
Packages and Domain
- Prep base OS with automatic updates and a firewall. Make sure to edit the yum-cron config to install security only, and to install updates after downloading.
sudo yum upgrade -y
- Edit /etc/dhcp/dhclient.conf to include domain specific settings, then reboot.
prepend domain-search "domain1.tld", "domain2.tld"; prepend domain-name-servers 192.168.1.100, 192.168.1.101; sudo reboot -h now
sudo yum -y install epel-release yum-cron firewalld sudo systemctl enable --now firewalld sudo systemctl enable --now yum-cron sudo hostnamectl set-hostname myfileserver sudo reboot -h now
- Install kerberose and related packages, will join later. [1] Don't forget sssd-libwbclient.
sudo yum install -y realmd krb5-workstation oddjob oddjob-mkhomedir sssd samba-common samba-common-tools samba sssd-libwbclient sudo systemctl enable --now sssd sudo realm join -U <username> domain1.tld
Disk
- Create partition, mount data disk, create fstab entry. The below is for general reference only and omits finding the UUID and what options to use.
sudo fdisk /dev/nvme1n1 sudo mkfs.xfs /dev/nvme1n1p1 sudo mount /dev/disk/by-uuid/556cfbd6-18cf-4721-934c-f35835ee89c8 /mnt/data/
Apply selinux context.
sudo semanage fcontext -a -t samba_share_t "/mnt/data(/.*)?" sudo
Samba Config
- This smb.conf global entry was created using the referenced wiki.samba.org links, as well as referencing a smb.conf file from a FreeNAS server.
[global]
workgroup = DOMAIN1
security = ADS
realm = DOMAIN1.TLD
idmap config *: backend = tdb
idmap config *: range = 3000-7999
idmap config DOMAIN1: backend = rid
idmap config DOMAIN1: range = 10000-999999
idmap config DOMAIN2: backend = rid
idmap config DOMAIN2: range = 1000000-9999999
allow trusted domains = yes
winbind refresh tickets = Yes
vfs objects = acl_xattr
map acl inherit = Yes
store dos attributes = Yes
username map = /etc/samba/user.map
- [4]Create file /etc/samba/user.map with the following
!root = DOMAIN1\michael.mast
- Start services
sudo systemctl enable --now smb sudo systemctl enable --now nmb
sudo smbcontrol all reload-config
- At this point we want to make sure a domain security group can manage the share from a Windows server. In my case I created a linuxadmins group.
net rpc rights grant "DOMAIN1\lunixadmins' SeDiskOperatorPrivilege -U'DOMAIN1\michael.mast'
However, at the time of this writing I am unable to get this to work. Getting the following error
Enter DOMAIN1\michael.mast's password: Could not connect to server 127.0.0.1 The username or password was not correct. Connection failed: NT_STATUS_LOGON_FAILURE
