[HOW TO] Ubuntu Server 9.04 PDC

[ingcabral]

First of all, I want to thank the Ubuntu community. This is a brief guide with parts taken from this links:

https://help.ubuntu.com/community/Op...-OrgInfo-Posix
and
http://www.howtoforge.com/openldap-s...ler-ubuntu7.10

Thanks all of you guys.

Intro:
Following the previous guides you will find many differences for getting your PDC up and running. For further information, please refer to the links above, I'm just attempting to make a step-through step guide that will make your PDC work in less than 15 minutes. Worked for me the last three times I used this guide, with roaming profiles disabled.
For this example, we will be using the domain 'ubuntudom'. Replace the 'ubuntudom' entry with your own domain name! Files attached here are 100% working if you follow this tutorial step by step.
Hold your breath, here we go:

1) Install OpenLDAP ..

sudo apt-get --yes install slapd ldap-utils db4.2-util

1.1) Completely delete the slapd.d directory inside /etc/ldap/
1.2) Edit /etc/default/slapd and look for the line
SLAPD_CONF=

And add the following:
SLAPD_CONF=/etc/ldap/slapd.conf

2) Install Samba documentation containing the Samba schema. Extract samba.schema and copy to the required system area for OpenLDAP.

sudo apt-get --yes install samba-doc
sudo gunzip /usr/share/doc/samba-doc/examples/LDAP/samba.schema.gz
sudo cp -v /usr/share/doc/samba-doc/examples/LDAP/samba.schema /etc/ldap/schema

3) Decide on an LDAP admin password and generate a SSHA hash key for it.

slappasswd

4) Create an init.ldif file. Name the 4 OUs Users, Groups, Computers and Idmap for use with smbldap-tools. - Remember to replace 'ubuntudom' with your domain name

dn: dc=ubuntudom
objectClass: dcObject
objectClass: organizationalUnit
dc: ubuntudom
ou: Ubuntudom

dn: cn=admin,dc=ubuntudom
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin
description: LDAP administrator
userPassword: {SSHA}paste-here-the-results-of-slappaswd 
# example: userPassword: {SSHA}iPFTqrtFrEET3DSQot2wxCuuljKA9vMU -- DELETE THIS LINE, FOR EXAMPLE PURPOSE


dn: ou=Users,dc=ubuntudom
objectClass: organizationalUnit
ou: Users

dn: ou=Groups,dc=ubuntudom
objectClass: organizationalUnit
ou: Groups

dn: ou=Computers,dc=ubuntudom
objectClass: organizationalUnit
ou: Computers

dn: ou=Idmap,dc=ubuntudom
objectClass: organizationalUnit
ou: Idmap

4) Modify /etc/ldap/slapd.conf for this site, and paste this .. - Remember to replace 'ubuntudom' with your domain name

# Remember to replace suffix "dc=ubuntudom" with your domain name
# Change the rootpw entry with the results from slappaswd (Must match the same you pasted on init.ldif)

# /etc/ldap/slapd.conf
# This is the main slapd configuration file. See slapd.conf(5) for more
# info on the configuration options.

#######################################################################
# Global Directives:

# Features to permit
#allow bind_v2

# Schema and objectClass definitions
include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/nis.schema
include         /etc/ldap/schema/inetorgperson.schema
include         /etc/ldap/schema/samba.schema
include         /etc/ldap/schema/misc.schema

# Where the pid file is put. The init.d script
# will not stop the server if you change this.
pidfile         /var/run/slapd/slapd.pid

# List of arguments that were passed to the server
argsfile        /var/run/slapd/slapd.args

# Read slapd.conf(5) for possible values
loglevel        0

# Where the dynamically loaded modules are stored
modulepath      /usr/lib/ldap
moduleload      back_bdb

# The maximum number of entries that is returned for a search operation
sizelimit 500

# The tool-threads parameter sets the actual amount of cpu's that is used
# for indexing.
tool-threads 1

#######################################################################
# Specific Backend Directives for bdb:
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
backend         bdb
#checkpoint 512 30

#######################################################################
# Specific Backend Directives for 'other':
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
#backend                <other>

#######################################################################
# Specific Directives for database #1, of type bdb:
# Database specific directives apply to this databasse until another
# 'database' directive occurs
database        bdb

# The base of your directory in database #1
suffix          "dc=ubuntudom"

# rootdn directive for specifying a superuser on the database. This is needed
# for syncrepl.
rootdn          "cn=admin,dc=ubuntudom"
rootpw {SSHA}iPFTqrtwr3yT3XGQot2wxCuuljKA9vMU

# Where the database file are physically stored for database #1
directory       "/var/lib/ldap"

# For the Debian package we use 2MB as default but be sure to update this
# value if you have plenty of RAM
dbconfig set_cachesize 0 2097152 0

# Sven Hartge reported that he had to set this value incredibly high
# to get slapd running at all. See http://bugs.debian.org/303057
# for more information.

# Number of objects that can be locked at the same time.
dbconfig set_lk_max_objects 1500
# Number of locks (both requested and granted)
dbconfig set_lk_max_locks 1500
# Number of lockers
dbconfig set_lk_max_lockers 1500

# Indexing options for database #1
#index           objectClass eq, pres
index ou,cn,sn,mail,givenname           eq,pres,sub
index uidNumber,gidNumber,memberUid     eq,pres
index loginShell                        eq,pres
index uniqueMember                      eq,pres
index uid                               pres,sub,eq
index displayName                       pres,sub,eq
index sambaSID                          eq
index sambaPrimaryGroupSID              eq
index sambaDomainName                   eq
index default                           sub
#index   uid         pres,eq,sub

# Save the time that the entry gets modified, for database #1
lastmod         on

# Where to store the replica logs for database #1
# replogfile    /var/lib/ldap/replog

# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below
# These access lines apply to database #1 only
access to attrs=userPassword,shadowLastChange
        by dn="cn=admin,dc=ubuntudom" write
        by anonymous auth
        by self write
        by * none

# Ensure read access to the base for things like
# supportedSASLMechanisms.  Without this you may
# have problems with SASL not knowing what
# mechanisms are available and the like.
# Note that this is covered by the 'access to *'
# ACL below too but if you change that as people
# are wont to do you'll still need this if you
# want SASL (and possible other things) to work
# happily.
access to dn.base="" by * read

# The admin dn has full write access, everyone else
# can read everything.
access to *
        by dn="cn=admin,dc=ubuntudom" write
        by * read

# For Netscape Roaming support, each user gets a roaming
# profile for which they have write access to
#access to dn=".*,ou=Roaming,o=morsnet"
#        by dn="cn=admin,dc=example,dc=ch" write
#        by dnattr=owner write

#######################################################################
# Specific Directives for database #2, of type 'other' (can be bdb too):
# Database specific directives apply to this databasse until another
# 'database' directive occurs
#database        <other>

# The base of your directory for database #2
#suffix         "dc=debian,dc=org"

5) Initialise OpenLDAP database ..

sudo /etc/init.d/slapd stop
sudo rm -rf /var/lib/ldap/*
sudo slapadd -v -l init.ldif
/etc/ldap/slapd.conf: line 109: rootdn is always granted unlimited privileges.
/etc/ldap/slapd.conf: line 126: rootdn is always granted unlimited privileges.
added: "dc=ubuntudom" (00000001)
added: "cn=admin,dc=ubuntudom" (00000002)
added: "ou=Users,dc=ubuntudom" (00000003)
: : :
sudo chown -R openldap:openldap /var/lib/ldap
sudo /etc/init.d/slapd start
Confirm all is OK with a Search ..

ldapsearch -xLLL -b "dc=ubuntudom"
dn: dc=ubuntudom
objectClass: dcObject
objectClass: organizationalUnit
: : :


6) Install and Configure Samba

sudo apt-get --y install libtalloc1 smbclient samba libpam-smbpass

7) Create Samba folders that have not been automatically created ..

sudo mkdir -v /var/lib/samba/profiles
sudo chmod 777 /var/lib/samba/profiles
sudo mkdir -v -p /var/lib/samba/netlogon

8) Edit /etc/samba/smb.conf - so it looks EXACTLY like this but replacing your domain name

[global]
        # Domain name ..
        workgroup = UBUNTUDOM
        # Server name - as seen by Windows PCs ..
        netbios name = SERVERNAME
        # Be a PDC ..
        domain logons = Yes
        domain master = Yes
        # Be a WINS server ..
        wins support = true

        obey pam restrictions = Yes
        dns proxy = No
        os level = 35
        log file = /var/log/samba/log.%m
        max log size = 1000
        syslog = 0
        panic action = /usr/share/samba/panic-action %d
        pam password change = Yes

        # Allows users on WinXP PCs to change their password when they press Ctrl-Alt-Del
        unix password sync = no
        ldap passwd sync = yes

        # Printing from PCs will go via CUPS ..
        load printers = yes
        printing = cups
        printcap name = cups

        # Use LDAP for Samba user accounts and groups ..
        passdb backend = ldapsam:ldap://localhost

        # This must match init.ldif ..
        ldap suffix = dc=ubuntudom
        # The password for cn=admin MUST be stored in /etc/samba/secrets.tdb
        # This is done by running 'sudo smbpasswd -w'.
        ldap admin dn = cn=admin,dc=ubuntudom

        # 4 OUs that Samba uses when creating user accounts, computer accounts, etc.
        # (Because we are using smbldap-tools, call them 'Users', 'Computers', etc.)
        ldap machine suffix = ou=Computers
        ldap user suffix = ou=Users
        ldap group suffix = ou=Groups
        ldap idmap suffix = ou=Idmap
        # Samba and LDAP server are on the same server in this example.
        ldap ssl = no

        # Scripts for Samba to use if it creates users, groups, etc.
        add user script = /usr/sbin/smbldap-useradd -m '%u'
        delete user script = /usr/sbin/smbldap-userdel %u
        add group script = /usr/sbin/smbldap-groupadd -p '%g'
        delete group script = /usr/sbin/smbldap-groupdel '%g'
        add user to group script = /usr/sbin/smbldap-groupmod -m '%u' '%g'
        delete user from group script = /usr/sbin/smbldap-groupmod -x '%u' '%g'
        set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'

        # Script that Samba users when a PC joins the domain ..
        # (when changing 'Computer Properties' on the PC)
        add machine script = /usr/sbin/smbldap-useradd -w '%u'

        # Values used when a new user is created ..
        # (Note: '%L' does not work properly with smbldap-tools 0.9.4-1)
    logon drive =
        logon home =
        logon path =
        logon script =


        # This is required for Windows XP client ..
        server signing = auto
        server schannel = Auto

[homes]
        comment = Home Directories
        valid users = %S
        read only = No
        browseable = No

[netlogon]
        comment = Network Logon Service
        path = /var/lib/samba/netlogon
        admin users = root
        guest ok = Yes
        browseable = No

[Profiles]
        comment = Roaming Profile Share
        # would probably change this to elsewhere in a production system ..
        path = /var/lib/samba/profiles
        read only = No
        profile acls = Yes
        browsable = No

[printers]
        comment = All Printers
        path = /var/spool/samba
        use client driver = Yes
        create mask = 0600
        guest ok = Yes
        printable = Yes
        browseable = No
        public = yes
        writable = yes
        admin users = root
        write list = root

[print$]
        comment = Printer Drivers Share
        path = /var/lib/samba/printers
        write list = root
        create mask = 0664
        directory mask = 0775
        admin users = root

9) Write password for the LDAP admin account (eg. cn=admin,dc=ubuntudom) into /etc/samba/secrets.tdb
sudo smbpasswd -W
Setting stored password for "cn=admin,dc=ubuntudom" in secrets.tdb
New SMB password:
Retype new SMB password:

10) Restart Samba ..

sudo /etc/init.d/samba restart

11) Use the SMB client to check that the Samba server is responding correctly.
smbclient -L localhost -U anonymous%
Anonymous login successful
Domain=[UBUNTUDOM] OS=[Unix] Server=[Samba 3.3.2]

Sharename Type Comment
--------- ---- -------
IPC$ IPC IPC Service (Samba 3.3.2)
print$ Disk Printer Drivers Share

Anonymous login successful
Domain=[UBUNTUDOM] OS=[Unix] Server=[Samba 3.3.2]

Server Comment
--------- -------

SERVERNAME Samba 3.3.

Workgroup Master
--------- -------
UBUNTUDOM SERVERNAME

12) Install smbldap-tools and extract the configure.pl script.

sudo apt-get install smbldap-tools
sudo gunzip /usr/share/doc/smbldap-tools/configure.pl.gz
sudo chmod +x /usr/share/doc/smbldap-tools/configure.pl

13) Before configuring smbldap-tools, check that Samba is running and the Windows domain SID can be retrieved.

ps -e | grep -i "smb"
4956 ? 00:00:00 smbd
5096 ? 00:00:00 smbd
sudo net getlocalsid
SID for domain SERVERNAME is: S-1-5-21-2899629268-4176875250-2352135513

14) Populate the LDAP database with essential Samba entries. This includes the creation of standard groups, such as Administrators and Domain Users.

sudo smbldap-populate
Populating LDAP directory for domain UBUNTUDOM (S-1-5-21-2899629268-4176875250-2352135513)
(using builtin directory structure)
entry dc=ubuntudom already exist.
entry ou=Users,dc=ubuntudom already exist.
entry ou=Groups,dc=ubuntudom already exist.
entry ou=Computers,dc=ubuntudom already exist.
entry ou=Idmap,dc=ubuntudom already exist.
adding new entry: uid=root,ou=Users,dc=ubuntudom
adding new entry: uid=nobody,ou=Users,dc=ubuntudom
adding new entry: cn=Domain Admins,ou=Groups,dc=ubuntudom
adding new entry: cn=Domain Users,ou=Groups,dc=ubuntudom
adding new entry: cn=Domain Guests,ou=Groups,dc=ubuntudom
adding new entry: cn=Domain Computers,ou=Groups,dc=ubuntudom
adding new entry: cn=Administrators,ou=Groups,dc=ubuntudom
adding new entry: cn=Account Operators,ou=Groups,dc=ubuntudom
adding new entry: cn=Print Operators,ou=Groups,dc=ubuntudom
adding new entry: cn=Backup Operators,ou=Groups,dc=ubuntudom
adding new entry: cn=Replicators,ou=Groups,dc=ubuntudom
entry sambaDomainName=UBUNTUDOM,dc=ubuntudom already exist. Updating it...
Please provide a password for the domain root:
Changing UNIX and samba passwords for root
New password:
Retype new password:

15) Following this, stop the LDAP server, run slapindex, and restart the LDAP server.

sudo /etc/init.d/slapd stop
Stopping OpenLDAP: slapd.
sudo slapindex
WARNING!
Runnig as root!
There's a fair chance slapd will fail to start.
Check file permissions!
/etc/ldap/slapd.conf: line 128: rootdn is always granted unlimited privileges.
/etc/ldap/slapd.conf: line 145: rootdn is always granted unlimited privileges.
# Correct the ownership of the index files ..
sudo chown openldap:openldap /var/lib/ldap/*
sudo /etc/init.d/slapd start
Starting OpenLDAP: slapd

16) Add Test Account

sudo smbldap-useradd -a -m -P david

17) Add root and david to the Windows Administrators group and confirm ..

sudo /usr/sbin/smbldap-groupmod -m 'david' 'Administrators'
sudo /usr/sbin/smbldap-groupmod -m 'root' 'Administrators'

18) Add root and david to the Windows Administrators group and confirm ..
sudo /usr/sbin/smbldap-groupmod -m 'david' 'Administrators'
smbldap-groupshow Administrators

19) Add LDAP Authentication on Clients
sudo apt-get --yes install ldap-auth-client
LDAP server Uniform Resource Identifier: ldap://xxxx - enter the name of the LDAPServer here
# EXAMPLE: ldap://servername
Distinguished name of the search base: dc=ubuntudom
LDAP version to use: 3
Make local root Database admin: Yes
Does the LDAP database require login? No
LDAP account for root: cn=admin,dc=ubuntudom
LDAP root account password: <enter the LDAP admin password>
sudo auth-client-config -t nss -p lac_ldap
sudo pam-auth-update ldap

19) Test - see if the list of groups and users includes those users and groups in LDAP.

getent group
: :
- output will include Windows groups held in LDAP ..
Domain Admins:*:512:root
Domain Users:*:513:
Domain Guests:*:514:
Domain Computers:*:515:
Administrators:*:544:root,david
Account Operators:*:548:
Print Operators:*:550:
Backup Operators:*:551:
Replicators:*:552:
: :
getent passwd
- output will include user accounts that only exist in LDAP (eg. david)

20) RESTART YOUR SERVER

21) Join Windows XP PC to the Domain as ubuntudom\root and your root password

22) DONE!

Hope this guide works for everybody

Regards from Argentina,

Ariel

[hambone79]

Great tutorial! Can't wait to try it on my home server this evening.

[rickymarino]

Sos Groso, Sabelo!


Gracias

[ghen]

I'm wiping my 8.04 ldap+samba setup as we speak

(it was only testing environment anyway lol)

In your ldif file when you created your dcObject, you defined dc: ubuntudom .. if I want my dn to be dc=test,dc=local how would I define dc in that line? (I'm just going with test for now)

point 1: in your slapd.conf you set a rootpw {SSHA} ; you should note that it should change like the one in init.ldif

point 2: you never actually say to configure smbldap-tools so I just did it after step 13 and used mostly default settings (pretty straightforward)

point 3: you have a copy/paste error on step 18

note 1: defaultMaxPasswordAge can't be blank (by hitting . during configuration) if you don't want a max password age I guess it would require commenting out that line in /etc/smbldap-tools/smbldap.conf after the config is done... I just made mine 120 days to get past it.



edit: Uh oh, I got to point 19 and failed. everything was fine until that point, but getent group just doesn't respond correctly even after a reboot. I think it has something to do with the ldap-auth-client install, but I don't know how to reconfigure that. I guess I'll try reinstalling it.

well reinstall didn't work, and dpkg-reconfigure ldap-auth-config didn't work, so I had to edit the /etc/ldap.conf file manually. the host line was commented out so I uncommented it and rebooted. Now it works.

2.5 hours from fresh partitioning to joining computers to the domain!

[ingcabral]

Hi Ghen

Of course, the idea of this tutorial is to show how to quickly make it work under 9.04.
That's the reason for the which I said to follow the links for further information. If you read and follow the first one, you will be able to make it work under 8.04, as you need. That tutorial shows how to make it work under that release, and this one, under the new one, with the things that doesn't work under 9.04.

On the second line on slapd.conf, says
# Change the rootpw entry with the results from slappaswd (Must match the same you pasted on init.ldif), but I wasn't able to edit the first post, so I hoped that was about to be read :S

Please feel free to contribute and make your own tutorial if you didn't find this useful.

Best regards,

Ariel

Originally Posted by ghen I'm wiping my 8.04 ldap+samba setup as we speak (it was only testing environment anyway lol) In your ldif file when you created your dcObject, you defined dc: ubuntudom .. if I want my dn to be dc=test,dc=local how would I define dc in that line? (I'm just going with test for now) point 1: in your slapd.conf you set a rootpw {SSHA} ; you should note that it should change like the one in init.ldif point 2: you never actually say to configure smbldap-tools so I just did it after step 13 and used mostly default settings (pretty straightforward) point 3: you have a copy/paste error on step 18 note 1: defaultMaxPasswordAge can't be blank (by hitting . during configuration) if you don't want a max password age I guess it would require commenting out that line in /etc/smbldap-tools/smbldap.conf after the config is done... I just made mine 120 days to get past it. edit: Uh oh, I got to point 19 and failed. everything was fine until that point, but getent group just doesn't respond correctly even after a reboot. I think it has something to do with the ldap-auth-client install, but I don't know how to reconfigure that. I guess I'll try reinstalling it. well reinstall didn't work, and dpkg-reconfigure ldap-auth-config didn't work, so I had to edit the /etc/ldap.conf file manually. the host line was commented out so I uncommented it and rebooted. Now it works. 2.5 hours from fresh partitioning to joining computers to the domain!

[harpss1ngh]

Hi, I'm using this guide to set up a PDC on ubuntu 9.04. I have followed your guide to the T. However, I recieve an error message when following step 4. I get the error message "No such file or directory". I have double checked all the steps up to that point and I'm still stuck on step 4.


Any suggestions?


Great tutorial by the way.

[ingcabral]

Hi!

You have to create the file and just paste the content.
E.g.: # sudo nano /etc/ldap/slapd.conf
If the file doesn't exist, it will be saved when you close the editor (Ctrl-w)

If the problem persists, please post the results of the console and we'll try to figure it out!

Regards

Originally Posted by harpss1ngh Hi, I'm using this guide to set up a PDC on ubuntu 9.04. I have followed your guide to the T. However, I recieve an error message when following step 4. I get the error message "No such file or directory". I have double checked all the steps up to that point and I'm still stuck on step 4. Any suggestions? Great tutorial by the way.

[ghen]

Originally Posted by ingcabral Please feel free to contribute and make your own tutorial if you didn't find this useful.

No disrespect, this is a very easy to follow yet powerful guide. I wanted to try 9.04 as a samba/ldap server so thats why I wiped the other install I definitely found it useful and will probably use it as the main guide when my setup goes production. Thanks.

[faustcoder]

Wow, this is the simplest Samba PDC how-to I have ever seen... Thank you for the work and I look forward to testing this out. Hopefully I can add some info on roaming profiles, etc.

[senor_smile]

I am trying to implement your instructions. I have created a brand new server install (9.04 64 bit).

I followed the directions exactly, and am stuck at step 13:

sudo smbldap-populate Unable to open /etc/opt/IDEALX/smbldap-tools/smbldap.conf for reading ! Compilation failed in require at /usr/sbin/smbldap-populate line 31. BEGIN failed--compilation aborted at /usr/sbin/smbldap-populate line 31.

Everything before this went as expected.