En este tutorial se explica el procedimiento para configurar un controlador de dominio primario utilizando LDAP y Samba en CentOS 7, además de unir una máquina con Windows 2008 R2 al dominio generado.
Sistema Linux: CentOS 7.4 (1708) con IP 10.2.48.125
Sistema Windows: Windows 2008 R2 con IP 10.2.48.86
Se asume que se tiene configurado un repositorio yum funcional y que SELinux se encuentra deshabilitado.
Instalación de paquetes necesarios
yum install openldap openldap-clients openldap-servers migrationtools samba
Copia de archivos de configuración
cp /usr/share/doc/samba-4.7.1/LDAP/samba.ldif /etc/openldap/schema/
cp /usr/share/openldap-servers/slapd.ldif /root/
Generación de contraseña administrativa para LDAP
[root@servidor-ldap ~]# slappasswd
New password:
Re-enter new password:
{SSHA}abc123xyz789def456ghi012jkl345mno
Editar el archivo slapd.ldif copiado y modificar el dominio base. Cambiar dc=my-domain,dc=com por el dominio deseado, por ejemplo dc=empresa-local,dc=net. Los valores destacados requieren configuración específica.
1 #
2 # See slapd-config(5) for details on configuration options.
3 # This file should NOT be world readable.
4 #
5
6 dn: cn=config
7 objectClass: olcGlobal
8 cn: config
9 olcArgsFile: /var/run/openldap/slapd.args
10 olcPidFile: /var/run/openldap/slapd.pid
11 #
12 # TLS settings
13 #
14 olcTLSCACertificatePath: /etc/openldap/certs
15 olcTLSCertificateFile: "OpenLDAP Server"
16 olcTLSCertificateKeyFile: /etc/openldap/certs/password
17 #
18 # Do not enable referrals until AFTER you have a working directory
19 # service AND an understanding of referrals.
20 #
21 #olcReferral: ldap://root.openldap.org
22 #
23 # Sample security restrictions
24 # Require integrity protection (prevent hijacking)
25 # Require 112-bit (3DES or better) encryption for updates
26 # Require 64-bit encryption for simple bind
27 #
28 #olcSecurity: ssf=1 update_ssf=112 simple_bind=64
29
30
31 #
32 # Load dynamic backend modules:
33 # - modulepath is architecture dependent value (32/64-bit system)
34 # - back_sql.la backend requires openldap-servers-sql package
35 # - dyngroup.la and dynlist.la cannot be used at the same time
36 #
37
38 #dn: cn=module,cn=config
39 #objectClass: olcModuleList
40 #cn: module
41 #olcModulepath: /usr/lib/openldap
42 #olcModulepath: /usr/lib64/openldap
43 #olcModuleload: accesslog.la
44 #olcModuleload: auditlog.la
45 #olcModuleload: back_dnssrv.la
46 #olcModuleload: back_ldap.la
47 #olcModuleload: back_mdb.la
48 #olcModuleload: back_meta.la
49 #olcModuleload: back_null.la
50 #olcModuleload: back_passwd.la
51 #olcModuleload: back_relay.la
52 #olcModuleload: back_shell.la
53 #olcModuleload: back_sock.la
54 #olcModuleload: collect.la
55 #olcModuleload: constraint.la
56 #olcModuleload: dds.la
57 #olcModuleload: deref.la
58 #olcModuleload: dyngroup.la
59 #olcModuleload: dynlist.la
60 #olcModuleload: memberof.la
61 #olcModuleload: pcache.la
62 #olcModuleload: ppolicy.la
63 #olcModuleload: refint.la
64 #olcModuleload: retcode.la
65 #olcModuleload: rwm.la
66 #olcModuleload: seqmod.la
67 #olcModuleload: smbk5pwd.la
68 #olcModuleload: sssvlv.la
69 #olcModuleload: syncprov.la
70 #olcModuleload: translucent.la
71 #olcModuleload: unique.la
72 #olcModuleload: valsort.la
73 #
74 # Schema settings
75 #
76
77 dn: cn=schema,cn=config
78 objectClass: olcSchemaConfig
79 cn: schema
80
81 include: file:///etc/openldap/schema/core.ldif
82 include: file:///etc/openldap/schema/corba.ldif
83 include: file:///etc/openldap/schema/cosine.ldif
84 include: file:///etc/openldap/schema/duaconf.ldif
85 include: file:///etc/openldap/schema/dyngroup.ldif
86 include: file:///etc/openldap/schema/inetorgperson.ldif
87 include: file:///etc/openldap/schema/java.ldif
88 include: file:///etc/openldap/schema/misc.ldif
89 include: file:///etc/openldap/schema/nis.ldif
90 include: file:///etc/openldap/schema/openldap.ldif
91 include: file:///etc/openldap/schema/ppolicy.ldif
92 include: file:///etc/openldap/schema/collective.ldif
93 include: file:///etc/openldap/schema/samba.ldif
94
95
96
97 #
98 # Frontend settings
99 #
100
101 dn: olcDatabase=frontend,cn=config
102 objectClass: olcDatabaseConfig
103 objectClass: olcFrontendConfig
104 olcDatabase: frontend
105 #
106 # Sample global access control policy:
107 # Root DSE: allow anyone to read it
108 # Subschema (sub)entry DSE: allow anyone to read it
109 # Other DSEs:
110 # Allow self write access
111 # Allow authenticated users read access
112 # Allow anonymous users to authenticate
113 #
114 #olcAccess: to dn.base="" by * read
115 #olcAccess: to dn.base="cn=Subschema" by * read
116 #olcAccess: to *
117 # by self write
118 # by users read
119 # by anonymous auth
120 #
121 # if no access controls are present, the default policy
122 # allows anyone and everyone to read anything but restricts
123 # updates to rootdn. (e.g., "access to * by * read")
124 #
125 # rootdn can always read and write EVERYTHING!
126 #
127
128 #
129 # Configuration database
130 #
131
132 dn: olcDatabase=config,cn=config
133 objectClass: olcDatabaseConfig
134 olcDatabase: config
135 olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none
136
137 #
138 # Server status monitoring
139 #
140 dn: olcDatabase=monitor,cn=config
141 objectClass: olcDatabaseConfig
142 olcDatabase: monitor
143 olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=empresa-local,dc=net" read by * none
144
145 #
146 # Backend database definitions
147 #
148
149 dn: olcDatabase=hdb,cn=config
150 objectClass: olcDatabaseConfig
151 objectClass: olcHdbConfig
152 olcDatabase: hdb
153 olcSuffix: dc=empresa-local,dc=net
154 olcRootDN: cn=Manager,dc=empresa-local,dc=net
155 olcDbDirectory: /var/lib/ldap
156 olcDbIndex: objectClass eq,pres
157 olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
158 olcRootPW: {SSHA}xyz789abc123def456ghi789jkl012 #El password contiene tabulación previa
Generación de la estructura de configuración
rm -rf /etc/openldap/slapd.d/*
slapadd -F /etc/openldap/slapd.d/ -n 0 -l /root/slapd.ldif
slaptest -u -F /etc/openldap/slapd.d/
Si aparece el mensaje "config file testing succeeded", la configuración es válida.
[root@servidor-ldap root]# slaptest -u -F /etc/openldap/slapd.d/
config file testing succeeded
[root@servidor-ldap root]#
Inciialización de servicios y permisos
chown -Rv ldap.ldap /etc/openldap/slapd.d
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown -Rv ldap.ldap /var/lib/ldap/DB_CONFIG
systemctl start slapd.service
Verificación del servicio
[root@servidor-ldap root]# systemctl status slapd.service
● slapd.service - OpenLDAP Server Daemon
Loaded: loaded (/usr/lib/systemd/system/slapd.service; disabled; vendor preset: disabled)
Active: active (running) since Wed 2018-06-06 11:18:27 CST; 1 day 8h ago
Docs: man:slapd
man:slapd-config
man:slapd-hdb
man:slapd-mdb
file:///usr/share/doc/openldap-servers/guide.html
Process: 1218 ExecStart=/usr/sbin/slapd -u ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS (code=exited, status=0/SUCCESS)
Process: 1180 ExecStartPre=/usr/libexec/openldap/check-config.sh (code=exited, status=0/SUCCESS)
Main PID: 1220 (slapd)
CGroup: /system.slice/slapd.service
└─1220 /usr/sbin/slapd -u ldap -h ldapi:/// ldap:///
Generación de datos LDAP base
vim /usr/share/migrationtools/migrate_common.ph
# Default DNS domain
$DEFAULT_MAIL_DOMAIN = "empresa-local.net";
# Default base
$DEFAULT_BASE = "dc=empresa-local,dc=net";
chmod +x /usr/share/migrationtools/migrate_common.ph
/usr/share/migrationtools/migrate_base.pl > /root/base.ldif
/usr/share/migrationtools/migrate_passwd.pl /etc/passwd /root/user.ldif
/usr/share/migrationtools/migrate_group.pl /etc/group /root/group.ldif
Eliminar entradas no relacionadas de los archivos LDIF generados y proceder con la importación.
ldapadd -D "cn=Manager,dc=empresa-local,dc=net" -W -x -f base.ldif
ldapadd -D "cn=Manager,dc=empresa-local,dc=net" -W -x -f group.ldif
ldapadd -D "cn=Manager,dc=empresa-local,dc=net" -W -x -f user.ldif
Sin errores, la importación fue exitosa.
Configuración de日志de LDAP
vi /etc/rsyslog.conf
local4.* /var/log/ldap.log #Agregar al final
touch /var/log/ldap.log
systemctl restart rsyslog.service
Instalación de componentes Samba
yum install nss-pam-ldapd samba-winbind sssd-ldap perl perl-LDAP.noarch epel-release smbldap-tools.noarch sssd* pam_ldap openldap-clients
cp /etc/samba/smb.conf /etc/samba/smb.conf.bak
cp /usr/share/doc/smbldap-tools-0.9.11/smb.conf.example /etc/samba/smb.conf
vim /etc/samba/smb.conf
[global]
workgroup = empresa-local
netbios name = PDC-SRV
deadtime = 10
log level = 1
log file = /var/log/samba/log.%m
max log size = 5000
debug pid = yes
debug uid = yes
utmp = yes
security = user
domain logons = yes
os level = 64
logon path =
logon home =
logon drive =
logon script =
passdb backend = ldapsam:"ldap://10.2.48.125"
ldap ssl = no
ldap admin dn = cn=Manager,dc=empresa-local,dc=com
ldap delete dn = no
## Sync UNIX password with Samba password
## Method 1:
unix password sync = no
ldap password sync = yes
## Method 2:
;ldap password sync = no
;unix password sync = yes
;passwd program = /usr/sbin/smbldap-passwd -u '%u'
;passwd chat = "Changing *\nNew password*" %n\n "*Retype new password*" %n\n"
ldap suffix = dc=empresa-local,dc=net
ldap user suffix = ou=Users
ldap group suffix = ou=Groups
ldap machine suffix = ou=Computers
ldap idmap suffix = ou=Idmap
add user script = /usr/sbin/smbldap-useradd -m '%u' -t 1
rename user script = /usr/sbin/smbldap-usermod -r '%unew' '%uold'
delete user script = /usr/sbin/smbldap-userdel '%u'
set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'
add group script = /usr/sbin/smbldap-groupadd -p '%g'
delete group script = /usr/sbin/smbldap-groupdel '%g'
add user to group script = /usr/sbin/smbldap-groupmod -m '%u' '%g'
delete user from group script = /usr/sbin/smbldap-groupmod -x '%u' '%g'
add machine script = /usr/sbin/smbldap-useradd -w '%u' -t 1
[NETLOGON]
path = /var/lib/samba/netlogon
browseable = no
[PROFILES]
path = /var/lib/samba/profiles
browseable = no
writeable = yes
create mask = 0611
directory mask = 0700
csc policy = disable
map system = yes
map hidden = yes
Los parámetros deben ajustarse según los requerimientos específicos del entorno.
systemctl start smb
smbldap-config
smbldap-populate
Configuración de nsswitch.conf
1 # To use db, put the "db" in front of "files" for entries you want to be
2 # looked up first in the databases
3 #
4 # Example:
5 #passwd: db files nisplus nis
6 #shadow: db files nisplus nis
7 #group: db files nisplus nis
8
9 passwd: files ldap
10 shadow: files ldap
11 group: files ldap
12 #initgroups: files sss
13
14 #hosts: db files nisplus nis dns
15 hosts: files ldap myhostname
16
17 # Example - obey only what nisplus tells us...
18 #services: nisplus [NOTFOUND=return] files
19 #networks: nisplus [NOTFOUND=return] files
20 #protocols: nisplus [NOTFOUND=return] files
21 #rpc: nisplus [NOTFOUND=return] files
22 #ethers: nisplus [NOTFOUND=return] files
23 #netmasks: nisplus [NOTFOUND=return] files
24
25 bootparams: nisplus [NOTFOUND=return] files
26
27 ethers: files
28 netmasks: files
29 networks: files
30 protocols: files
31 rpc: files
32 services: files sss
33
34 netgroup: files ldap
35
36 publickey: nisplus
37
38 automount: files ldap
39 aliases: files nisplus
Configuración de /etc/nslcd.conf
1 # This is the configuration file for the LDAP nameservice
2 # switch library's nslcd daemon. It configures the mapping
3 # between NSS names (see /etc/nsswitch.conf) and LDAP
4 # information in the directory.
5 # See the manual page nslcd.conf(5) for more information.
6
7 # The user and group nslcd should run as.
8 uid nslcd
9 gid ldap
10
11 # The uri pointing to the LDAP server to use for name lookups.
12 # Multiple entries may be specified. The address that is used
13 # here should be resolvable without using LDAP (obviously).
14 #uri ldap://127.0.0.1/
15 #uri ldaps://127.0.0.1/
16 #uri ldapi://%2fvar%2frun%2fldapi_sock/
17 # Note: %2f encodes the '/' used as directory separator
18 uri ldap://10.2.48.125/
19
20 # The LDAP version to use (defaults to 3
21 # if supported by client library)
22 #ldap_version 3
23
24 # The distinguished name of the search base.
25 base dc=empresa-local,dc=net
26
27 # The distinguished name to bind to the server with.
28 # Optional: default is to bind anonymously.
29 #binddn cn=proxyuser,dc=example,dc=com
30
31 # The credentials to bind with.
32 # Optional: default is no credentials.
33 # Note that if you set a bindpw you should check the permissions of this file.
34 #bindpw secret
35
36 # The distinguished name to perform password modifications by root by.
37 #rootpwmoddn cn=admin,dc=example,dc=com
38
39 # The default search scope.
40 #scope sub
41 #scope one
42 #scope base
43
44 # Customize certain database lookups.
45 #base group ou=Groups,dc=example,dc=com
46 #base passwd ou=People,dc=example,dc=com
47 #base shadow ou=People,dc=example,dc=com
48 #scope group onelevel
49 #scope hosts sub
50
51 # Bind/connect timelimit.
52 #bind_timelimit 30
53
54 # Search timelimit.
55 #timelimit 30
56
57 # Idle timelimit. nslcd will close connections if the
58 # server has not been contacted for the number of seconds.
59 #idle_timelimit 3600
60
61 # Use StartTLS without verifying the server certificate.
62 #ssl start_tls
63 #tls_reqcert never
64
65 # CA certificates for server certificate verification
66 #tls_cacertdir /etc/ssl/certs
67 #tls_cacertfile /etc/ssl/ca.cert
68
69 # Seed the PRNG if /dev/urandom is not provided
70 #tls_randfile /var/run/egd-pool
71
72 # SSL cipher suite
73 # See man ciphers for syntax
74 #tls_ciphers TLSv1
75
76 # Client certificate and key
77 # Use these, if your server requires client authentication.
78 #tls_cert
79 #tls_key
80
81 # Mappings for Services for UNIX 3.5
82 #filter passwd (objectClass=User)
83 #map passwd uid msSFU30Name
84 #map passwd userPassword msSFU30Password
85 #map passwd homeDirectory msSFU30HomeDirectory
86 #map passwd homeDirectory msSFUHomeDirectory
87 #filter shadow (objectClass=User)
88 #map shadow uid msSFU30Name
89 #map shadow userPassword msSFU30Password
90 #filter group (objectClass=Group)
91 #map group member msSFU30PosixMember
92
93 # Mappings for Services for UNIX 2.0
94 #filter passwd (objectClass=User)
95 #map passwd uid msSFUName
96 #map passwd userPassword msSFUPassword
97 #map passwd homeDirectory msSFUHomeDirectory
98 #map passwd gecos msSFUName
99 #filter shadow (objectClass=User)
100 #map shadow uid msSFUName
101 #map shadow userPassword msSFUPassword
102 #filter group (objectClass=Group)
103 #map group member posixMember
104
105 # Mappings for Active Directory
106 #pagesize 1000
107 #referrals off
108 #idle_timelimit 800
109 #filter passwd (&(objectClass=user)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*))
110 #map passwd uid sAMAccountName
111 #map passwd homeDirectory unixHomeDirectory
112 #map passwd gecos displayName
113 #filter shadow (&(objectClass=user)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*))
114 #map shadow uid sAMAccountName
115 #map shadow shadowLastChange pwdLastSet
116 #filter group (objectClass=group)
117
118 # Alternative mappings for Active Directory
119 # (replace the SIDs in the objectSid mappings with the value for your domain)
120 #pagesize 1000
121 #referrals off
122 #idle_timelimit 800
123 #filter passwd (&(objectClass=user)(objectClass=person)(!(objectClass=computer)))
124 #map passwd uid cn
125 #map passwd uidNumber objectSid:S-1-5-21-3623811015-3361044348-30300820
126 #map passwd gidNumber objectSid:S-1-5-21-3623811015-3361044348-30300820
127 #map passwd homeDirectory "/home/$cn"
128 #map passwd gecos displayName
129 #map passwd loginShell "/bin/bash"
130 #filter group (|(objectClass=group)(objectClass=person))
131 #map group gidNumber objectSid:S-1-5-21-3623811015-3361044348-30300820
132
133 # Mappings for AIX SecureWay
134 #filter passwd (objectClass=aixAccount)
135 #map passwd uid userName
136 #map passwd userPassword passwordChar
137 #map passwd uidNumber uid
138 #map passwd gidNumber gid
139 #filter group (objectClass=aixAccessGroup)
140 #map group cn groupName
141 #map group gidNumber gid
142 # This comment prevents repeated auto-migration of settings.
143 ssl no
144 tls_cacertdir /etc/openldap/cacerts
Actualización de /etc/openldap/ldap.conf
#
# LDAP Defaults
#
# See ldap.conf(5) for details
# This file should be world readable but not world writable.
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
TLS_CACERTDIR /etc/openldap/cacerts
# Turning this off breaks GSSAPI used with krb5 when rdns = false
SASL_NOCANON on
URI ldap://10.2.48.125/
BASE dc=empresa-local,dc=net
Ejecución de authconfig-tui (interfaz interactiva)
Reinicio de servicios necesarios
systemctl restart slapd
systemctl restart smb
systemctl restart nmb
systemctl restart nslcd
systemctl restart nscd
systemctl restart winbind.service
Verificación de unión al dominio desde el srevidor
net rpc join -U root%miPassword123
net rpc testjoin
[root@servidor-ldap etc]# net rpc testjoin
Join to 'EMPRESA-LOCAL' is OK
[root@servidor-ldap etc]#
El servidor LDAP-PDC está configurado correctamente.
Para completar la integración del cliente Windows, es necesario modificar la configuración DNS del sistema Windows apuntando hacia la dirección IP del servidor LDAP (10.2.48.125). Adicionalmente, se deben realizar modificaciones en el registro del sistema Windows.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlset\services\LanmanWorkstation\
Parameters]
"DomainCompatibilityMode"=dword:00000001
"DNSNameResolutionRequired"=dword:00000000
Una vez aplicados estos cambios, el sistema Windows 2008 R2 podrá unirse exitosamente al dominio LDAP configurado.