Assignment 4: SMB server (the core II)

Installation and configuration of the muilti-platform UNIX-Windows system: SAMBA

In addition to NFSv4, we should install and set up an SMB/CIFS service on server-03, using SAMBA software. Also, we will need LDAP validation for the SAMBA service, in order to use the SAMBA resources available using credentials. Then, the pre-requisite is an OpenLDAP server configured with a directory that can accept authentication requests.

More details in references [8][9][10][11]

1. Pre-Installation: Configure the LDAP service on server-01 to integrate SAMBA and enable LDAP validation with the SAMBA service:

   • In order for OpenLDAP to be used as a backend for SAMBA, logically, the DIT will need to use attributes that can properly describe Samba data. Such attributes can be obtained by introducing a Samba LDAP schema.

     • Install the samba package that contains the LDAP schema, necessary to integrate with SAMBA:

       1. SAMBA documentation

     • Now, import that schema (.ldif format) into the config DIT of LDAP directory:

       • /usr/share/doc/samba/examples/LDAP/samba.schema

   • Set up new LDAP “access lists” so the "admin" and “owner” users only have written permissions on the following fields:

     • userPassword

     • sambaLMPassword

     • sambaNTPassword

   • Also, we can set up new indexes based on these SAMBA attributes to improve performance when a client performs a filtered search on the DIT:

     • sambaSID eq

     • sambaPrimaryGroupSID eq

     • sambaGroupType eq

     • sambaSIDList eq

     • sambaDomainName eq

2. Installation: Install the SAMBA service on server-03. Required packages:

   • SAMBA

   • SAMBA and SMB tools

   • SAMBA documentation

   • SMB-LDAP tools (samba-common-bin).

3. SAMBA configuration: Now it's time to configure SAMBA on server-03 as a resource sharing service, in order to export the local directory “samba” and the CD/DVD device to the LOCAL network (10.128.0.0). Remember to use server-01 as validation backend in SAMBA:

   • Work group: “LOCALDOMAIN”

   • Security level: “user” (ROLE_STANDALONE)

   • Net bios: SAMBA CSDA

   • Min client/server protocol: NT1

   • OpenLDAP (over SSL) backend:

     • backend: ldapsam:ldaps://server-01.localdomain

     • ldap suffix: dc=localdomain

     • ldap admin dn: cn=admin,dc=localdomain

     • ldap suffix: dc=localdomain

     • ldap group suffix: ou=groups

     • ldap user suffix = ou=people

     • ldap machine suffix: ou=machines

   • Shared directory: /export/samba

     • SMB name: “samba”

     • Sharing option: “public”

     • Allow clients to modify the contents of shared directory

     • The directory will be browseable

   • Shared device: CD/DVD

     • SMB name: “cdrom”

     • Sharing option: “public”

     • Do not allow clients to modify the contents of shared directory

     • The directory will be browseable

   • Configure the samba daemon to become a “standalone” service.

   • Store the LDAP “cn=admin” password in a local secret file. Use smbpasswd command.

4. Post-configuration: SAMBA-LDAP INTEGRATION: Use the smbldap-tools to populate the LDAP directory. In particular, use it to add functional structures to LDAP to enable LDAP authentication in SAMBA. Thus, we can manage and take control over access to SAMBA resources.

   • Smbldap-tools configuration: Take a look at ANNEX 1 and ANNEX 2.

     • Get SID using:

     $ net getlocalsid

   • Now, use smbldap-tools to:

     • Adapt LDAP database for SAMBA support ("repopulate")

     • Add a new LDAP-SAMBA user (user4) which we use to check the SAMBA resources access:

       1. uidNumber: 20004

       2. Password: temporal4

       3. Supplementary groups: 2001

5. Start-up:

   • Check that the main file of SAMBA configuration is syntactically all right.

   • Restart the SAMBA service.

6. Checking:

   • Check the new SAMBA service (from server-03) according to the following commands:

     • Command 1: (Anonymous) It shows (lists) the different resources that the SAMBA service has available for sharing on the intranet:

       $ smbclient –L //server-03/

     • Command 2: It provides an interactive “shell” to browse and access SAMBA shared resources:

     $ smbclient –L //server-03/

pageReferences and Resources