Linux praktikum 3

Including a Linux computer in a Windows Server domain

Task: Create a file server with a public folder on Linux with the possibility to authorize domain users.

Requirements: A virtual machine with Windows Server and enabled Active Directory (Group Policy settings are not required). Create a test user in Active Directory and set a password for it. Put the static IP address of Windows Server 192.168.1.10/255.255.255.0.

Introduction and preconfiguration

It is often necessary to put a Linux machine into an existing Windows domain. For example to make a file server using Samba. For this you will need a Kerberos client, Samba and Winbind.

Before starting the praktikum, it is advised to make a backup (Snapshot) of the virtual machine

Set the correct time zone and synchronize the system time:

sudo dpkg-reconfigure tzdata

It is advisable to update before installation:

sudo apt update

After the package list is updated upgrade packages by using

sudo apt upgrade

To install Kerberos, Samba and Winbind you need to use

sudo apt install krb5-user samba winbind smbclient

If Kerberos asks for a domain name, press Enter

You may also need to install the following libraries:

sudo apt install libpam-krb5 libpam-winbind libnss-winbind 

Next you will need to configure all of the above tools to work with your domain. Let's say you want to enter the domain DOMAIN.LOCAL, whose domain controller is the server dc01.domain.local with IP address 192.168.1.10. The same server is also the primary DNS server for the domain. Your computer will be called smb01 with ip-address 192.168.1.114.

DNS Setup

First, you need to change the DNS settings on your machine by assigning domain-controller as the DNS server and as the search domain the required domain.

1. If you have a static IP address, in Ubuntu Server you should change the contents of /etc/netplan/50-cloud-init.yaml file like this

nano /etc/netplan/00-installer-config.yaml network:

   ethernets:
       enp0s3:
           addresses:
               - 192.168.1.114/24
           nameservers:
               search: [domain.local]
               addresses: [192.168.1.10, 127.0.0.53]
   version: 2

It is important to make indentation with spaces, not tabs!

Explanation:

192.168.1.114 - IP address of the Linux machine with Ubuntu,

192.168.1.10 - IP address of the server with Active Directory.

2. If you have a dynamic IP address, in Ubuntu Server you need to change the contents of /etc/netplan/00-installer-config.yaml file like this: network:

   ethernets:
       enp0s3:
           dhcp4: true
           nameservers:
               search: [domain.local] 
               addresses: [192.168.1.10, 127.0.0.53]
   version: 2 

And now run the commands to create network settings:

netplan generate

and if the system did not display any errors, then

netplan apply

Restart the network

systemctl restart systemd-networkd

Check that Linux can find DNS servers:

systemd-resolve --status

Link 3 (enp0s8)
      Current Scopes: DNS
DefaultRoute setting: yes
       LLMNR setting: yes
MulticastDNS setting: no
  DNSOverTLS setting: no
      DNSSEC setting: no
    DNSSEC supported: no
  Current DNS Server: 192.168.1.10
         DNS Servers: 192.168.1.10
                      127.0.0.53
          DNS Domain: domain.local

Now make sure that you have set the correct computer name in the /etc/hostname file:

smb01

In addition, you need to edit the file /etc/hosts so that it contains an entry with the full domain name of the computer and necessarily a short hostname, referring to one of the internal IPs:

# Computer names:

   127.0.0.1               localhost 
   192.168.1.114       smb01.domain.local            smb01 

You should immediately check that our domain controller is normally "pinged" by the short and full name, so that in the future you will not get an error that the domain controller is not found:

ping dc01
ping dc01.domain.local

Restart the network

systemctl restart systemd-networkd

Time Synchronization Settings

Next, you need to configure the time synchronization with the domain controller. If the difference is more than 5 minutes you will not be able to get a sheet from Kerberos. For a one time synchronization you can use the command:

sudo timedatectl set-ntp on

Reboot the machine to apply the changes.

Setting up authorization via Kerberos

Kerberos terminology Ticket - temporary data issued to the client for authentication on the server that hosts the required service.

Client - some entity on the network (user, host or service) that can receive a ticket from Kerberos

The key distribution center (KDC) is a service that issues Kerberos tickets.

Realm is the network used by Kerberos, consisting of KDC servers and multiple clients. The realm name is case sensitive, usually uppercase and matches the domain name.

Principal - A unique name for the client for which Kerberos authentication is allowed. It is written in the form root[/instance]@REALM.

Let's start by setting up authorization in the domain via the Kerberos protocol. You will need to change the /etc/krb5.conf file in [libdefaults] and specify your domain name [libdefaults]

     default_realm = DOMAIN.LOCAL

These are not all possible Kerberos configuration options, only the main ones. However, these are usually sufficient.

Now it is time to check that we can be authorized in the domain. To do this run the command

kinit username@DOMAIN.LOCAL

Instead of username you should write the name of an existing domain user, For example test, which we created earlier.

The domain name must be written in capital letters!

If you don't get any errors, then you have configured everything correctly and the domain is giving you Kerberos ticket.

To verify that a ticket has been obtained, run the command

klist

You can delete all tickets with the command

kdestroy

If you can verify that a ticket has been obtained, you have finished the authorization set up

Common kinit errors

Some of the most common errors are listed below:

kinit(v5): Clock skew too great while getting initial credentials

This means that your computer does not have the time synchronized with the domain controller (see above).

kinit(v5): Preauthentication failed while getting initial credentials

You entered the wrong password.

kinit(v5): KDC reply did not match expectations while getting initial credentials

The strangest error. Make sure that the name realm in krb5.conf as well as the domain in kinit command are capitalized:

DOMAIN.LOCAL = {

1. ...

kinit username@DOMAIN.LOCAL

kinit(v5): Client not found in Kerberos database while getting initial credentials

The specified user does not exist in the domain.

Setting up Samba and domain login

In order to enter the domain, you need to write the correct settings in /etc/samba/smb.conf. At this point you should only be interested in some of the options from the [global] section. Below is an example of a part of the Samba configuration file with commentary on the meaning of the important parameters:

Find these lines in the [global] section

# Change this to the workgroup/NT-domain name your Samba server will part of 
workgroup = WORKGROUP

And after that add the following lines:

    # These two options should be written in uppercase, with workgroup without the last section after the dot, and realm - the full name of the domain 
    workgroup = DOMAIN 
    realm = DOMAIN.LOCAL
    # These two options are responsible for authorization via AD 
    security = domain
    # These are important
    dns proxy = no
    socket options = TCP_NODELAY
    # If you do not want samba to try to get into a domain or workgroup leadership, or become a domain controller, then write these five options:
    domain master = no 
    local master = no 
    preferred master = no 
    os level = 0 
    # Disable printer support 
    load printers = no 
    show add printer wizard = no 
    printcap name = /dev/null 
    disable spoolss = yes 

After you have edited the smb.conf, run the command

sudo testparm

It will check your configuration for errors and give you a summary of it:

# testparm 
Load smb config files from /etc/samba/smb.conf 
Loaded services file OK. 
idmap range not specified for domain '*' 
ERROR: Invalid idmap range for domain *!

Server role: ROLE_DOMAIN_MEMBER Press enter to see a dump of your service definitions

As you can see, we have set the parameters for our computer to become a domain member. Now it is time to try to log on to the domain. To do this, enter the command:

net ads join -U administrator -D DOMAIN.LOCAL

And in case of success, you will see something like this:

# net ads join -U administrator -D DOMAIN 
Enter username's password: 
Using short domain name -- DOMAIN 
Joined 'SMB01' to realm 'domain.local'

If there are no more messages, then everything is good. You can also enter the command:

net ads testjoin

If everything is good it will output:

Join is OK

But sometimes after the message about joining the domain you get an error like this:

DNS update failed!

This is not very good, and in this case it is recommended to read again the section about setting up DNS above and understand what you have done wrong. After that, you should remove the computer from the domain and try to enter it again. If you believe that you have configured everything correctly, and DNS still does not update, you can manually enter a record for your computer on your DNS server and everything will work, if there are no other errors and you have successfully logged into the domain. But it is better to find out why DNS is not automatically updated. It may be related not only to your computer, but also to an incorrect AD setting.

Before you try to find out why the DNS is not updating, remember to reboot the computer after entering the domain!

It is quite possible that this will solve the problem. If everything went without errors,then you have successfully logged on to the domain! You can look in AD to make sure. In the Computers container, you should see an object with the name of the domain-joined computer. Also, it is a good idea to check that you can see the resources in the domain. To do this, use smbclient. But this requires a kerberos ticket, i.e. if we have deleted them, we get them again via kinit (see above). Let's see what resources have been given to the network by the DC01 computer:

smbclient -k -L DC01

You should see a list of shared resources on this computer

Winbind setup

If you need to work with domain users in any way, e.g. to set up shared resources with differentiated access, you will need in addition to Samba Winbind - a special daemon used to connect your local Linux user and group management system to the Active Directory server. Simply put Winbind is needed if you want to see domain users on your Ubuntu computer.

Winbind allows you to project all users and all groups of AD into your Linux system by assigning them IDs from a given range. In this way you can assign domain users as owners of folders and files on your computer and perform any other user and group related operations. The same /etc/samba/smb.conf file is used to configure Winbind. Add the following lines to the [global] section after the previous ones:

Winbind setup in /etc/samba/smb.conf:

    winbind enum groups = yes
    winbind enum users = yes
    winbind use default domain = yes
    template shell = /bin/bash
    template homedir = /home/%D/%U
    winbind refresh tickets = yes
    winbind enum users = yes
    winbind enum groups = yes
    winbind cache time = 10
    idmap config * : range = 10000 - 20000
    password server = *

To add the public directory /home/shared with the name shared add the following section to the end of the file and do not forget to create this directory:

[shared] 
    path = /home/shared 
    read only = No 
    browseable = yes 
    create mask = 0755 
    directory mask = 0755 
    write list = user 
    guest ok = no 

Now restart the Winbind daemon and Samba in the following order:

sudo /etc/init.d/winbind stop
sudo smbd restart
sudo /etc/init.d/winbind start

Now launch

sudo testparm

After restart, check that Winbind has established a trust relationship with AD command:

wbinfo -t

Checking the trust secret for domain DCN via RPC calls succeeded

And also that Winbind saw users and groups from AD with commands:

 
   wbinfo -u
   wbinfo -g

These two commands should list users and groups from the domain, respectively. Either with or without the DOMAIN prefix, depending on the value you gave to the "winbind use default domain" parameter in smb.conf.

So Winbind works, but it is not yet integrated into the system

Adding Winbind as a source of users and groups

In order for your Ubuntu to work transparently with domain users, in particular so that you can assign domain users as owners of folders and files, you should tell Ubuntu to use Winbind as an additional source of information about users and groups. To do this, change 3 lines in /etc/nsswitch.conf:

    passwd: files systemd winbind
    group: files systemd winbind
    hosts: files dns wins

Now check that Ubuntu asks Winbind for user and group information by running

getent passwd 
getent group

The first command should return all the contents of your /etc/passwd file, i.e. your local users, plus the domain users with IDs from the range you set in smb.conf. The second should do the same for groups.

Now you can take any user of the domain (for example test) and make him the owner of some directory

chown test /home/shared

Reboot Linux

reboot

Try now to connect the \\smb01\shared network drive from the Windows Server using Map Network Drive with the domain user name domain/test. Create files and folders there.

Ubuntu authorization through domain users

Despite the fact that all domain users are now in fact full system users (as you can see by running the last two commands in the previous section), it is still not possible to log in as any of them. To enable authorization for domain users on your Ubuntu computer, you need to configure PAM to work with Winbind.

Run the installer:

pam-auth-update

Make sure that all items are ticked, in particular:

• Winbind NT/Active Directory authentication • Create home directory on login

After that, restart your computer and at the login prompt enter the username and password from your domain

Sources: https://help.ubuntu.ru/wiki/ввод_в_домен_windows https://help.ubuntu.com/community/ActiveDirectoryWinbindHowto https://help.ubuntu.com/community/ADAuthentication