{"id":1590,"date":"2019-03-21T16:09:33","date_gmt":"2019-03-21T15:09:33","guid":{"rendered":"http:\/\/clark.tipistrani.it\/?p=1590"},"modified":"2019-03-21T16:12:22","modified_gmt":"2019-03-21T15:12:22","slug":"samba-4-aggiungere-un-dc-nuovo-a-un-dominio-active-directory-esistente-2","status":"publish","type":"post","link":"http:\/\/clark.tipistrani.it\/?p=1590","title":{"rendered":"Sentinella"},"content":{"rendered":"

Avere un pi\u00f9 di un DC<\/a> (domain controller) in un dominio gestito da Active Directory<\/a> \u00e8 in generale una buona idea, per altro anche nei vecchi domini NT4 un\u00a0 BDC (backup domain controller) era la norma, quindi visto che come si impara negli anni la ridondanza non \u00e8 mai ne troppa ne immotivata.
\nAnche in questo caso ho optato per un partizionamento di questo tipo:<\/p>\n

2 gb swap<\/p>\n

16 gb \/<\/p>\n

2 gb \/samba<\/p>\n

La base sulla quale ho lavorato \u00e8 una Devuan ascii, per scelta e per avere qualcosa di fresco rispetto alla pacchettizzazione ho scelto inoltre di compilare samba da sorgenti<\/a>.
\nAssicuriamoci che il file \/etc\/krb5.conf sia come questo
\n[libdefaults]
\ndns_lookup_realm = false
\ndns_lookup_kdc = true
\ndefault_realm = MYFIRM.LAN
\nVerifichiamo che kerberos funzioni con:<\/p>\n

# kinit administrator
\nPassword for administrator@MYFIRM.LAN:Passw0rd<\/p>\n

# klist<\/p>\n

Ticket cache: FILE:\/tmp\/krb5cc_0
\nDefault principal: administrator@MYFIRM.LAN<\/p>\n

Valid starting Expires Service principal
\n13\/09\/2017 11:48:09 13\/09\/2017 21:48:09 krbtgt\/MYFIRM.LAN@MYFIRM.LAN
\nrenew until 14\/09\/2017 11:48:04<\/p>\n

E ci siamo, adesso si tratta di fare il join al dominio MYFIRM.LAN come Domain Controler che funzioni anche come server DNS impiegando il DNS interno di Samba.<\/p>\n

[root@sentinella ]# samba-tool domain join MYFIRM.LAN DC -U”MYFIRM\\administrator” –dns-backend=SAMBA_INTERNAL –option=’idmap_ldb:use rfc2307 = yes’<\/p>\n

Finding a writeable DC for domain ‘MYFIRM.LAN’
\nFound DC vedetta.myfirm.lan
\nPassword for [MYFIRM\\administrator]:
\nworkgroup is MYFIRM
\nrealm is myfirm.lan
\nDeleted CN=RID Set,CN=SENTINELLA,OU=Domain Controllers,DC=myfirm,DC=lan
\nDeleted CN=SENTINELLA,OU=Domain Controllers,DC=myfirm,DC=lan
\nDeleted CN=NTDS Settings,CN=SENTINELLA,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=myfirm,DC=lan
\nDeleted CN=SENTINELLA,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=myfirm,DC=lan
\nAdding CN=SENTINELLA,OU=Domain Controllers,DC=myfirm,DC=lan
\nAdding CN=SENTINELLA,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=myfirm,DC=lan
\nAdding CN=NTDS Settings,CN=SENTINELLA,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=myfirm,DC=lan
\nAdding SPNs to CN=SENTINELLA,OU=Domain Controllers,DC=myfirm,DC=lan
\nSetting account password for SENTINELLA$
\nEnabling account
\nCalling bare provision
\nLooking up IPv4 addresses
\nLooking up IPv6 addresses
\nNo IPv6 address will be assigned
\nSetting up share.ldb
\nSetting up secrets.ldb
\nSetting up the registry
\nSetting up the privileges database
\nSetting up idmap db
\nSetting up SAM db
\nSetting up sam.ldb partitions and settings
\nSetting up sam.ldb rootDSE
\nPre-loading the Samba 4 and AD schema
\nUnable to determine the DomainSID, can not enforce uniqueness constraint on local domainSIDs<\/p>\n

A Kerberos configuration suitable for Samba AD has been generated at \/usr\/local\/samba\/private\/krb5.conf
\nMerge the contents of this file with your system krb5.conf or replace it with this one. Do not create a symlink!
\nProvision OK for domain DN DC=myfirm,DC=lan
\nStarting replication
\nSchema-DN[CN=Schema,CN=Configuration,DC=myfirm,DC=lan] objects[402\/1550] linked_values[0\/0]
\nSchema-DN[CN=Schema,CN=Configuration,DC=myfirm,DC=lan] objects[804\/1550] linked_values[0\/0]
\nSchema-DN[CN=Schema,CN=Configuration,DC=myfirm,DC=lan] objects[1206\/1550] linked_values[0\/0]
\nSchema-DN[CN=Schema,CN=Configuration,DC=myfirm,DC=lan] objects[1550\/1550] linked_values[0\/0]
\nAnalyze and apply schema objects
\nPartition[CN=Configuration,DC=myfirm,DC=lan] objects[402\/1622] linked_values[0\/1]
\nPartition[CN=Configuration,DC=myfirm,DC=lan] objects[804\/1622] linked_values[0\/1]
\nPartition[CN=Configuration,DC=myfirm,DC=lan] objects[1206\/1622] linked_values[0\/1]
\nPartition[CN=Configuration,DC=myfirm,DC=lan] objects[1608\/1622] linked_values[0\/1]
\nPartition[CN=Configuration,DC=myfirm,DC=lan] objects[1622\/1622] linked_values[34\/34]
\nFailed to commit objects: DOS code 0x000021bf
\nMissing target object – retrying with DRS_GET_TGT
\nPartition[CN=Configuration,DC=myfirm,DC=lan] objects[2024\/1622] linked_values[1\/1]
\nPartition[CN=Configuration,DC=myfirm,DC=lan] objects[2426\/1622] linked_values[0\/1]
\nPartition[CN=Configuration,DC=myfirm,DC=lan] objects[2828\/1622] linked_values[0\/1]
\nPartition[CN=Configuration,DC=myfirm,DC=lan] objects[3230\/1622] linked_values[0\/1]
\nPartition[CN=Configuration,DC=myfirm,DC=lan] objects[3244\/1622] linked_values[33\/34]
\nReplicating critical objects from the base DN of the domain
\nPartition[DC=myfirm,DC=lan] objects[97\/97] linked_values[23\/23]
\nPartition[DC=myfirm,DC=lan] objects[369\/272] linked_values[23\/23]
\nDone with always replicated NC (base, config, schema)
\nReplicating DC=DomainDnsZones,DC=myfirm,DC=lan
\nPartition[DC=DomainDnsZones,DC=myfirm,DC=lan] objects[42\/42] linked_values[0\/0]
\nReplicating DC=ForestDnsZones,DC=myfirm,DC=lan
\nPartition[DC=ForestDnsZones,DC=myfirm,DC=lan] objects[20\/20] linked_values[0\/0]
\nExop on[CN=RID Manager$,CN=System,DC=myfirm,DC=lan] objects[3] linked_values[0]
\nCommitting SAM database
\nAdding 1 remote DNS records for SENTINELLA.myfirm.lan
\nAdding DNS A record SENTINELLA.myfirm.lan for IPv4 IP: 192.168.200.202
\nAdding DNS CNAME record e927bd2b-1358-416d-a903-4946e33f425a._msdcs.myfirm.lan for SENTINELLA.myfirm.lan
\nAll other DNS records (like _ldap SRV records) will be created samba_dnsupdate on first startup
\nReplicating new DNS records in DC=DomainDnsZones,DC=myfirm,DC=lan
\nPartition[DC=DomainDnsZones,DC=myfirm,DC=lan] objects[3\/3] linked_values[0\/0]
\nReplicating new DNS records in DC=ForestDnsZones,DC=myfirm,DC=lan
\nPartition[DC=ForestDnsZones,DC=myfirm,DC=lan] objects[2\/2] linked_values[0\/0]
\nSending DsReplicaUpdateRefs for all the replicated partitions
\nSetting isSynchronized and dsServiceName
\nSetting up secrets database
\nJoined domain MYFIRM (SID S-1-5-21-1842202679-333570776-2307202636) as a DC
\nE il DC di supporto \u00e8 a posto, si tratta adesso di allinearlo al AD-DC, si passa quindi sul AD e si crea una copia del file idmap.ldb che contiene gli ID di utenti e gruppi in formato ‘xidNumber’ con questo comando:<\/p>\n

# tdbbackup -s .bak \/usr\/local\/samba\/private\/idmap.ldb<\/pre>\n
Quindi lo si sposta sul DC nello stesso path e lo si rinomina togliendo il .bak sostituendo di fatto il file esistente sul DC, questa operazione \u00e8 necessaria perch\u00e9 se gli id non sono identici e per come funziona idmap.ldb non lo sono non si pu\u00f2 garantire il funzionamento.
\nA questo punto mi sono trovato in difficolt\u00e0 con l’interpretazione del wiki che dice sostanzialmente di eseguire prima il comando<\/p>\n
# samba-tool ntacl sysvolreset \r\ne poi di tenere sincoronizzato sul DC con uno script ad esempio come questo<\/a> che ho adottato in realta' per non avere una fila di errori che non finiva mai<\/pre>\n
ho dovuto fare esattamente l’opposto a quel punto tuto ha funzionato a dovere.<\/p>\n
samba-tool drs showrepl
\nDefault-First-Site-Name\\SENTINELLA
\nDSA Options: 0x00000001
\nDSA object GUID: cbdfcb64-b9e4-472a-a40d-c98dfe5d0ec7
\nDSA invocationId: 24c73a94-23e4-4d05-bd50-0e3e0181c0a8<\/p>\n
==== INBOUND NEIGHBORS ====<\/p>\n
CN=Schema,CN=Configuration,DC=myfirm,DC=lan
\nDefault-First-Site-Name\\VEDETTA via RPC
\nDSA object GUID: 59217f72-7739-4de9-bd5e-01c3098fd4f8
\nLast attempt @ Thu Mar 21 15:57:31 2019 CET was successful
\n0 consecutive failure(s).
\nLast success @ Thu Mar 21 15:57:31 2019 CET<\/p>\n
DC=DomainDnsZones,DC=myfirm,DC=lan
\nDefault-First-Site-Name\\VEDETTA via RPC
\nDSA object GUID: 59217f72-7739-4de9-bd5e-01c3098fd4f8
\nLast attempt @ Thu Mar 21 15:57:31 2019 CET was successful
\n0 consecutive failure(s).
\nLast success @ Thu Mar 21 15:57:31 2019 CET<\/p>\n
DC=ForestDnsZones,DC=myfirm,DC=lan
\nDefault-First-Site-Name\\VEDETTA via RPC
\nDSA object GUID: 59217f72-7739-4de9-bd5e-01c3098fd4f8
\nLast attempt @ Thu Mar 21 15:57:31 2019 CET was successful
\n0 consecutive failure(s).
\nLast success @ Thu Mar 21 15:57:31 2019 CET<\/p>\n
CN=Configuration,DC=myfirm,DC=lan
\nDefault-First-Site-Name\\VEDETTA via RPC
\nDSA object GUID: 59217f72-7739-4de9-bd5e-01c3098fd4f8
\nLast attempt @ Thu Mar 21 15:57:31 2019 CET was successful
\n0 consecutive failure(s).
\nLast success @ Thu Mar 21 15:57:31 2019 CET<\/p>\n
DC=myfirm,DC=lan
\nDefault-First-Site-Name\\VEDETTA via RPC
\nDSA object GUID: 59217f72-7739-4de9-bd5e-01c3098fd4f8
\nLast attempt @ Thu Mar 21 15:57:31 2019 CET was successful
\n0 consecutive failure(s).
\nLast success @ Thu Mar 21 15:57:31 2019 CET<\/p>\n
==== OUTBOUND NEIGHBORS ====<\/p>\n
CN=Schema,CN=Configuration,DC=myfirm,DC=lan
\nDefault-First-Site-Name\\VEDETTA via RPC
\nDSA object GUID: 59217f72-7739-4de9-bd5e-01c3098fd4f8
\nLast attempt @ NTTIME(0) was successful
\n0 consecutive failure(s).
\nLast success @ NTTIME(0)<\/p>\n
DC=DomainDnsZones,DC=myfirm,DC=lan
\nDefault-First-Site-Name\\VEDETTA via RPC
\nDSA object GUID: 59217f72-7739-4de9-bd5e-01c3098fd4f8
\nLast attempt @ NTTIME(0) was successful
\n0 consecutive failure(s).
\nLast success @ NTTIME(0)<\/p>\n
DC=ForestDnsZones,DC=myfirm,DC=lan
\nDefault-First-Site-Name\\VEDETTA via RPC
\nDSA object GUID: 59217f72-7739-4de9-bd5e-01c3098fd4f8
\nLast attempt @ NTTIME(0) was successful
\n0 consecutive failure(s).
\nLast success @ NTTIME(0)<\/p>\n
CN=Configuration,DC=myfirm,DC=lan
\nDefault-First-Site-Name\\VEDETTA via RPC
\nDSA object GUID: 59217f72-7739-4de9-bd5e-01c3098fd4f8
\nLast attempt @ NTTIME(0) was successful
\n0 consecutive failure(s).
\nLast success @ NTTIME(0)<\/p>\n
DC=myfirm,DC=lan
\nDefault-First-Site-Name\\VEDETTA via RPC
\nDSA object GUID: 59217f72-7739-4de9-bd5e-01c3098fd4f8
\nLast attempt @ NTTIME(0) was successful
\n0 consecutive failure(s).
\nLast success @ NTTIME(0)<\/p>\n
==== KCC CONNECTION OBJECTS ====<\/p>\n
Connection —
\nConnection name: 75efe6bc-244f-44c1-af60-77ce503fefe0
\nEnabled : TRUE
\nServer DNS name : vedetta.myfirm.lan
\nServer DN name : CN=NTDS Settings,CN=VEDETTA,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=myfirm,DC=lan
\nTransportType: RPC
\noptions: 0x00000001
\nWarning: No NC replicated for Connection!<\/p>\n
Il warning \u00e8 di nessuna importanza e lo si trova nelle FAQ<\/p>\n
Testiamo il server DNS locale<\/p>\n
# host -t A myfirm.lan localhost
\nUsing domain server:
\nName: localhost
\nAddress: ::1#53
\nAliases:<\/p>\n
myfirm.lan has address 192.168.2.205
\nmyfirm.lan has address 192.168.2.202
\nCome per l’AD-DC anche qui essendo compilato a mano il samba necessita dello init-script che \u00e8 lo stesso della macchina principale.<\/p>\n
Reference: https:\/\/wiki.samba.org\/index.php\/Joining_a_Samba_DC_to_an_Existing_Active_Directory<\/p>\n
 <\/p>\n","protected":false},"excerpt":{"rendered":"
Avere un pi\u00f9 di un DC (domain controller) in un dominio gestito da Active Directory \u00e8 in generale una buona idea, per altro anche nei vecchi domini NT4 un\u00a0 BDC (backup domain controller) era la norma, quindi visto che come si impara negli anni la ridondanza non \u00e8 mai ne troppa ne immotivata. Anche in […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,14,11,6],"tags":[115,114,15,84],"class_list":["post-1590","post","type-post","status-publish","format-standard","hentry","category-linux","category-networking","category-samba","category-work","tag-ad","tag-dc","tag-dns","tag-samba4"],"_links":{"self":[{"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/posts\/1590","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1590"}],"version-history":[{"count":6,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/posts\/1590\/revisions"}],"predecessor-version":[{"id":1599,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/posts\/1590\/revisions\/1599"}],"wp:attachment":[{"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1590"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1590"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1590"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}