Well-unknown facts

FOREWORD:

As you already know Active Directory is a powerful tool for network resource management, however did you know that its basic component LDAP can also help you to enhance and regulate collaborative processes between network users?
By using a centralized user/customer database you can connect apparently different applications and turn them into one (more or less ) solid software solution.

Oh, and what about SSL and TLS? It means that the server we are going to build won’t implement any kind of encrypted authentication, but it will use so-called “plain” method.

OK, stop crying and think about the opportunities opening up to you: this guide doesn’t force you to use any specific encryption method, so you can decide to implement one later (which is highly recommended).

MY RECOMMENDATIONS:

I prefer starting from scratch, which means a fresh Debian Wheezy installation (you can set up one by using Debian netinst ISO).
Also I would recommend using a minimalistic configuration: without a standard desktop environment and as a consequence – no useless GUI applications pulled in automatically (by saying “useless” I mean that we don’t need word processing software or games on a Debian server).

So let’s start with package installation. First of all make sure that your /etc/apt/sources.list contains at least these few rows otherwise insert them and update your APT catalogs:

deb http://ftp.debian.org/debian/ wheezy main contrib non-free
deb http://security.debian.org/ wheezy/updates main contrib non-free

deb-src http://ftp.debian.org/debian/ wheezy main contrib non-free
deb-src  http://security.debian.org/ wheezy/updates main contrib non-free

Now you can install a desktop environment and some handy GUI tools, such as terminal emulator:

apt-get install gdm3 gnome-terminal gedit gparted iceweasel

Personally I avoid to install GUI stuff or at least remove it when the server goes to production.

INITIAL SETUP:

Let’s start with real stuff now. First of all install basic domain components such as Samba, OpenLDAP and integration tools for these applications.

apt-get -f install samba samba-doc slapd ldap-utils smbldap-tools

Insert OpenLDAP root password
Insert Samba Workgroup/DOMAIN
...

When installation is finished you must add Samba schema in OpenLDAP, then create a temporary conf file in order to import Samba and some other schemes.

zcat /usr/share/doc/samba-doc/examples/LDAP/samba.schema.gz > /etc/ldap/schema/samba.schema
nano schema_convert.conf

Now paste the following content into this new file:

include /etc/ldap/schema/samba.schema

Now let’s generate a ldif file

mkdir -p /tmp/ldif_output
slapcat -f schema_convert.conf -F /tmp/ldif_output -n0 -s "cn={12}samba,cn=schema,cn=config" > /tmp/cn=new_schema.ldif
nano /tmp/cn=new_schema.ldif

Edit the output file and remove “{12}” from line 1 and 3 so you will have this header:

dn: cn=samba,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: samba

..oh and remove lines below (placed at the end of the file):

structuralObjectClass: olcSchemaConfig
entryUUID: bd8a7a82-3cb8-102f-8d5f-070b4e5d16f8
creatorsName: cn=config
createTimestamp: 20100815125953Z
entryCSN: 20100815125953.198505Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20100815125953Z
...

Now you can merge the ldif file you’ve just exported ldif with your OpenLDAP database:

ldapadd -Y EXTERNAL -H ldapi:/// -f ./tmp/cn=new_schema.ldif

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=samba,cn=schema,cn=config"

Now create another ldif file for samba indexes:

cat > samba_indexes.ldif
# file content
dn: olcDatabase={1}hdb,cn=config
changetype: modify
add: olcDbIndex
olcDbIndex: uidNumber eq
olcDbIndex: gidNumber eq
olcDbIndex: loginShell eq
olcDbIndex: uid eq,pres,sub
olcDbIndex: memberUid eq,pres,sub
olcDbIndex: uniqueMember eq,pres
olcDbIndex: sambaSID eq
olcDbIndex: sambaPrimaryGroupSID eq
olcDbIndex: sambaGroupType eq
olcDbIndex: sambaSIDList eq
olcDbIndex: sambaDomainName eq
olcDbIndex: default sub

..and import it and restart OpenLDAP server:

ldapmodify -Y EXTERNAL -H ldapi:/// -f samba_indexes.ldif

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={1}hdb,cn=config"

UPDATE, thanks to hyc I discovered that the instruction below are potentially harmful:

/etc/init.d/slapd restart

Stopping OpenLDAP: slapd.
Starting OpenLDAP: slapd.

DAEMON CONFIGURATION:

Create or edit the /etc/ldap/ldap.conf file in order to set basic domain settings such as domain base name and master/slave addresses:

BASE    dc=company,dc=com
URI    ldap://127.0.0.1 ldap://127.0.0.1

Now modify Samba settings, you can use an example conf file as a template:

cp /usr/share/doc/smbldap-tools/examples/smb.conf.example /etc/samba/smb.conf
nano /etc/samba/smb.conf

Modify the configuration file as follows:

# line 2: change workgroup name to any one you like
workgroup = COMPANY

# line 25: specify ldap server
passdb backend = ldapsam:"ldap://127.0.0.1/"

# line 26: change to
ldap ssl = no

# line 27: change LDAP admin DN (LDAP server's one)
ldap admin dn = cn=admin,dc=server,dc=world

# line 39: change LDAP suffix (LDAP server's one)
ldap suffix = dc=company,dc=com

# append somewhere in [global] section, pay attention to duplicate entries
Dos charset = CP932
Unix charset = UTF-8
display charset = UTF-8

hide unreadable = yes
hide dot files = no
restrict anonymous = 0

admin users = Administrator root addmachine
username map = /etc/samba/usermap
realm = COMPANY.COM

guest ok = no
map to guest = Bad User
null passwords = no
wins support = yes
idmap uid = 10000-90000
idmap gid = 10000-90000
idmap backend = ldap:ldaps://127.0.0.1
name resolve order = wins lmhosts host bcast
dns proxy = no
load printers = no
smb ports = 139

### Speed up ####
strict locking = no
sync always = no
wide links  = no
getwd cache = true
load printers = false
printcap name = /dev/null
use sendfile = yes
read raw = yes
write raw = yes
socket options = TCP_NODELAY IPTOS_LOWDELAY SO_SNDBUF=65536 SO_RCVBUF=65536

Now add Samba shares and create logon script, then append/modify shares at the bottom of /etc/samba/smb.conf file:

[ NETLOGON ]
   path = /home/netlogon
   browseable = no
   share modes = no

[ PROFILES ]
  path = /home/profiles
  comment  = Profiles
  read only = no
  profile acls = yes
  browsable = no
  root preexec = /etc/samba/scripts/mk_profile "%u"

[ PUBLIC ]
   path = /home/public
   comment = Shared data storage
   read only = no

When creating logon script pay attention to Carriage Return/Linefeed (CR/LF).
Below there is an example of domain configuration with roaming user profiles enabled, if you don’t need/want it – just leave logon path parameter empty.

logon home = \\%L\%U\
logon drive = U:
logon path = \\%L\profiles\%U
logon script = %U.bat OR logon.bat

Insert Administrator user and insert it into Samba usermap ():

smbldap-groupadd -a Administrator
smbldap-useradd -am -g Administrator Administrator
smbldap-passwd Administrator

Changing UNIX and samba passwords for domainadm
New password:
Retype new password:

cat > /etc/samba/usermap
addmachine = COMPANY.COM\addmachine/admin
root = COMPANY.COM\root/admin
Administrator = COMPANY.COM\Administrator/admin

Finally you can check the conf file for errors by running “testparm” command.
Now let’s start to implement Samba< ->OpenLDAP integration. First of all insert a new password for Samba administration account:

smbpasswd -W
add LDAP admin's password

Setting stored password for "cn=admin,dc=server,dc=world" in secrets.tdb

New SMB password:
Retype new SMB password:

I have bad news for you now: in Debian Squeezy (and lower) there was a possibility to configure the Samba and OpenLDAP integration automatically by using configure.pl script, but for some odd reason it’s not available in Wheezy smbldap-tools package, even if you try to extract it from older versions and try to run you will get a lot of errors from Perl interpreter.
So just copy example configuration files to /etc/smbldap-tools folder and change them as follows.

cp /usr/share/doc/smbldap-tools/examples/smbldap_bind.conf /etc/smbldap-tools/smbldap_bind.conf
cp /usr/share/doc/smbldap-tools/examples/smbldap.conf /etc/smbldap-tools/smbldap.conf

Edit /etc/smbldap-tools/smbldap.conf file first:

nano /etc/smbldap-tools/smbldap.conf

# Replace the SID value below with the result of "net getlocalsid" command
SID="S-1-5-21-00000000000-0000000000000-000000000000"

# Change the following domain name value
sambaDomain="COMPANY.COM"

# Configure master and slave DC servers addresses and ports, duplicate settings if you don't have a slave controller: 
slaveLDAP=127.0.0.1
slavePort="389"

masterLDAP=127.0.0.1
masterPort="389"

# As I said no SSL and TLS
ldapTLS="0"
ldapSSL="0"

# Ex: suffix=dc=IDEALX,dc=ORG
suffix="dc=company,dc=com"

# Where are stored Users
usersdn="ou=Users,${suffix}"

# Where are stored Computers
computersdn="ou=Computers,${suffix}"

# Where are stored Groups
groupsdn="ou=Groups,${suffix}"

# Where are stored Idmap entries (used if samba is a domain member server)
idmapdn="ou=Idmap,${suffix}"

# Where to store next uidNumber and gidNumber available for new users and groups
sambaUnixIdPooldn="sambaDomainName=${sambaDomain},${suffix}"

# Default scope Used
scope="sub"

# Unix password hash scheme (CRYPT, MD5, SMD5, SSHA, SHA, CLEARTEXT)
password_hash="SSHA"

# if password_hash is set to CRYPT, you may set a salt format.
# default is "%s", but many systems will generate MD5 hashed
# passwords if you use "$1$%.8s". This parameter is optional!
password_crypt_salt_format="%s"

# Default Login Shell
userLoginShell="/bin/bash"

# Home directory
userHome="/home/%U"

# Default mode used for user homeDirectory
userHomeDirectoryMode="700"

# Gecos
userGecos="System User"

# Default User (POSIX and Samba) GID
defaultUserGid="513"

# Default Computer (Samba) GID
defaultComputerGid="515"

# Skel dir
skeletonDir="/etc/skel"

# Treat shadowAccount object or not
shadowAccount="1"

# Default password validation time (time in days) Comment the next line if
# you don't want password to be enable for defaultMaxPasswordAge days (be
# careful to the sambaPwdMustChange attribute's value)
defaultMaxPasswordAge="45"

# The UNC path to home drives location (%U username substitution)
userSmbHome="\\SRV\%U"

# The UNC path to profiles locations (%U username substitution)
userProfile="\\SRV\profiles\%U"

# The default Home Drive Letter mapping
userHomeDrive="U:"

# The default user netlogon script name (%U username substitution)
userScript="logon.bat"

# Domain appended to the users "mail"-attribute
mailDomain="mail.com"

with_smbpasswd="0"
smbpasswd="/usr/bin/smbpasswd"

# Allows not to use slappasswd (if with_slappasswd="0" in smbldap.conf)
# but prefer Crypt:: libraries
with_slappasswd="0"
slappasswd="/usr/sbin/slappasswd"

Now let’s edit /etc/smbldap-tools/smbldap_bind.conf as follows:

slaveDN="cn=admin,dc=company,dc=com"
slavePw="Plain text password"
masterDN="cn=admin,dc=company,dc=com"
masterPw="Plain text password"

Then it’s /etc/ldap/slapd.conf turn:

include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include        /etc/ldap/schema/nis.schema
include        /etc/ldap/schema/inetorgperson.schema
include        /etc/ldap/schema/samba.schema

# Where the pid file is put. The init.d script
pidfile         /var/run/slapd/slapd.pid

# List of arguments that were passed to the server
argsfile        /var/run/slapd/slapd.args

# Read slapd.conf(5) for possible values
loglevel        none

# Where the dynamically loaded modules are stored
modulepath    /usr/lib/ldap
moduleload    back_hdb

# The maximum number of entries that is returned for a search operation
sizelimit 500

# The tool-threads parameter sets the actual amount of cpu's that is used for indexing.
tool-threads 1

# Backend specific directives apply to this backend until another 'backend' directive occurs
backend        hdb

# The base of your directory in database #1
suffix          "dc=company,dc=com"

# rootdn directive for specifying a superuser on the database. This is needed for syncrepl.
rootdn          "cn=admin,dc=company,dc=com"

# Admin password hashed
rootpw          {SSHA}RoeqPPUTZfRvS3hkA3ubqVtB7KgcTXid

#SYNC LOOK AT THE END OF THE FILE
    moduleload syncprov
    index entryCSN,entryUUID eq
    overlay syncprov
    syncprov-checkpoint 100 10
    syncprov-sessionlog 200

# Where the database file are physically stored for database #1
directory       "/var/lib/ldap"

# For the Debian package we use 2MB as default but be sure to update this
# value if you have plenty of RAM
dbconfig set_cachesize 0 2097152 0

# Number of objects that can be locked at the same time.
dbconfig set_lk_max_objects 1500
# Number of locks (both requested and granted)
dbconfig set_lk_max_locks 1500
# Number of lockers
dbconfig set_lk_max_lockers 1500

# Indexing options for database #1
index objectClass eq,pres
index uid,uidNumber,gidNumber,memberUid     eq,pres
index ou,cn,mail,surname,givenname    eq,pres,sub
index loginShell                        eq,pres
index displayName                       pres,sub,eq
index nisMapName,nisMapEntry            eq,pres,sub
index sambaSID    eq
index sambaPrimaryGroupSID    eq
index sambaDomainName    eq
index sambaGroupType eq
index sambaSIDList eq
index uniqueMember eq
index default                           sub

# Save the time that the entry gets modified, for database #1
lastmod         on

# Checkpoint the BerkeleyDB database periodically in case of system
# failure and to speed slapd shutdown.
checkpoint      512 30

# Access query settings
access to attrs=userPassword,sambaNTPassword,sambaLMPassword,sambaPwdMustChange,sambaPwdLastSet,krbPrincipalKey
       by dn="cn=admin,dc=company,dc=com" write
   by dn="uid=replicant,dc=company,dc=com" read
       by anonymous auth
       by self write
       by * write

# Change this too
access to dn.base="" by * write

# The admin dn has full write access, everyone else can read everything.
access to *
       by dn="cn=admin,dc=company,dc=com" write
       by * read

# Master< ->Slave sync parameters, you might need it in the future ;D
# timelimit 30
# bind_timelimit 30
# bind_policy soft
# nss_initgroups_ignoreusers root,ldap

Finally we can try to start the entire “thing” by starting each server individually (the execution order is very important):

/etc/init.d/slapd restart
/etc/init.d/samba restart
/etc/init.d/winbind restart

If you get some errors please keep in mind that all of these services store their logs in /var/log/*, those are priceless for troubleshooting your domain issues

WINDOWS 7 COMPATIBILITY TWEAKS:

As first step add these rows into your /etc/samba/smb.conf file:

winbind uid = 10000-90000
winbind gid = 10000-90000
winbind enum users = yes
winbind enum groups = yes
winbind separator = +
password server = server_name
winbind use default domain = Yes
encrypt passwords = yes

Then modify Windows registry on client computers by using the reg file below (needs restart to take effect):

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
"GlobalMaxTcpWindowsSize"=dword:00020148
"TcpWindowsSize"=dword:00020148
"Tcp1323Opts"=dword:00000003

WHAT’S NEXT?

Now you are ready for domain administration and client configuration.
If you are a Microsoft-oriented administrator you would prefer using a Windows GUI solution rather than using bash, I personally like LDAPAdmin, it’s intuitive, but still very powerful. It has one big limitation it does not provide support for “secure” domains implementing TLS (only SSL). Give a try:

http://ldapadmin.sourceforge.net/index.html

I would like to go on with domain stuff by sharing my experience in OpenLDAP-based service installation and consolidation (such as MediaWiki, Redmine/Bugzilla, Subversion, Pure-FTP, SOGo, IMAP/SMTP servers etc).

Please contact me if you have any correction to commit to this guide or simply if you need a clarification on installation process, I will be always glad to help you.

P.S. My next post will be about the obvious connection between ACTA and SOPA/PIPA, actually the complete title is: “Who is Manny Acta? Sopa anti-piracy soup. Pippa is bored of misspells.”

Manny Acta, baseball manager who wants to stop piracy in Europe

Sopa (just "soup" in Spanish). Really?

"Stop PIPA" or "stop Pippa", what is the right spelling