Domain Controller and File Sharing¶

Configuring a Domain Server with Zentyal¶

LDAP configuration options¶

This first section describes the functionality and information available in Zentyal’s LDAP directory using any of the domain operation modes. The next sections will describe how to configure and make use of the features of those modes.

By going to the Domain menu you can check the operation mode of your LDAP server before enabling the module. If you have already enabled Users, Computers and File Sharing, your server will operate as a Stand-alone server by default.

Once you have enabled the module, you can access Users and Computers –> LDAP settings, where you can see some general LDAP information on the upper block

LDAP configuration in Zentyal

Base DN:

Base name of the domain names in this server, it matches the local domain. Your local domain is configured from System ‣ General, Domain. It will appear as blocked (you can not delete it) in your DNS module.

Default User DN:

Name of the default user container.

Default Groups DN:

Name of the default groups container.

In the lower part, you can configure some PAM Settings

PAM configuration

By enabling [10] PAM (Pluggable Authentication Modules) you allow the users configured in the directory to be valid users in the local server as well. This way, you can, for example, create a user in your directory and access the Zentyal server through SSH using those credentials.

[10]	https://es.wikipedia.org/wiki/Pluggable_Authentication_Modules

Managing Users, Groups and Computers¶

By going to Users and Computers ‣ Manage you will see the LDAP tree. From this interface you can also create and delete nodes, manage the LDAP attributes and adjust the permissions for other LDAP-connected services.

LDAP tree

On the left side, you can see the tree, with your “local” domain as the root. There are several Organizational Units already created.

• Computers: Hosts joined to the domain, both servers and desktops, this section is useful for inventory reasons and also to apply host-based rules.
• Groups: Generic OU container node for the groups in your organization.
• Users: Generic OU container node for the users in your organization.
• Domain Controllers: Servers that replicate this directory information, they can also take on the different FSMO roles of a Samba4/Active Directory domain.

An Organizational Unit is a container for other objects, like groups, users or even other nested OUs. It’s a concept closely related to the tree data structure and the different policies associated with each node. If you are not using Samba4/Active Directory capabilities, you probably don’t need to create new Organizational Units in your domain.

You can delete any node using the trash can icon or you can create a new one by clicking on a container and then on the green plus icon.

Adding a new user

It’s important to note that each time you create a user in the LDAP tree, a directory /home/<username> is created in the file system of the server, if the directory already exists, you may have problems creating the user. Move or remove the directory before creating the user if this is the case.

The Contacts are personal information objects not related with the authorization mechanism. In other words, contacts will not be able to login on the domain services.

On the right side you can see and modify the LDAP attributes of the currently selected node, for example, the last name of an user. If you are using a Commercial Edition of Zentyal, you can also upload a profile photo for the user from here.

Clicking on a user, you can also modify user’s membership to the different groups, and make use of the user plugins. At the right bottom of the interface, you will see a section named Modules Configuration, this section has a variable number of subsections, depending on the Zentyal modules installed and enabled. From here, you can modify the specific parameters of that module regarding this user. The default configuration of the user plugins depends on the User Template explained below.

Mail user plugin interface

Clicking on a group, you can also modify the users belonging to the group, create distribution mail lists and change the type of group. The Security Group (default) contains users that will be able to login on the domain services, the Distribution Group contains user that will be used for other purposes, like mail lists.

Editing a group

User Template¶

By going to Users and Computers –> User Template you can modify the default service settings for the new user, for example, the default domain for their mail account. It’s important to note that any modifications will only be applied to the users created after changing the template. The number of sections is variable, depending on the user-related Zentyal modules present on your system.

User Template

Configuring Zentyal as a Standalone Domain server¶

Before enabling the Domain Controller and File Sharing module you need to check certain server configurations. The reason is that during module activation the Domain is provisioned. This means that the LDAP, DNS and Kerberos data is initialized, creating all the LDAP objects, Kerberos security principals, DNS zones and so on. The operation can be reverted but it’s certainly more difficult than disabling and re-enabling other modules.

Before enabling the “Domain Controller and File Sharing” module for the first time make sure that:

• You have configured the operation mode (by default Domain Controller), but you can also configure your server to be an additional controller joined to another node. In the latter case, configure the server role and credentials to join the domain before enabling the module and look at the other instructions below. If this server is the first (or the only) Domain Controller, you don’t have to modify anything.

Configuring Zentyal as the Standalone Domain Controller

• Your local domain and host name parameters are correct. You can check this from System ‣ General, Hostname and Domain section. If you want to change this data, save changes and reboot the machine before enabling the module.

Checking Host Name and Domain

• In the DNS module configuration, you have a “local” domain that matches the one you have configured in System ‣ General, this domain has to contain the server Hostname as an A register (inside the Hostnames section) and this hostname has to have at least one local IP address. You have to associate all the internal IP addresses where you want to provide Domain services to the server’s DNS hostname.

zentyal hostname inside the zentyal-domain.lan DNS domain, pointing to all the internal IP addresses

• NTP module is installed and enabled, and your clients are receiving NTP information from the server, preferably via DHCP.

Once you have enabled Users, Computers and File Sharing you can provide File Sharing functionality, join Windows Clients to your Zentyal server, Configure and Link the Group Policy Objects and accept connections from additional controllers, either Windows Server® or Zentyal.

Probably, one of the first operations you need to perform in your domain is to create a user in the directory and join it to the Domain Admins group, this will give the user all the effective permissions over the domain.

Joining an user to the Domain Admins group

Joining a Windows client to the domain¶

The process of joining a Windows Client to your domain is identical to joining with a Windows Server®.

First of all, you need to use the Domain Admin user that you previously created.

Now, accessing the Windows client:

• Make sure Zentyal server and the Windows client can reach each other though a local network
• Make sure the Windows client has Zentyal as its DNS server
• Make sure both Server and client are perfectly time sync’ed using NTP

After checking the preconditions, you can join the domain the usual way.

Joining a domain with Windows

You will then enter the Domain Admin user to join.

Domain Admin credentials

After the process is complete, the Windows host will appear under the Computers OU and will apply the configured GPOs and obtain Kerberos tickets automatically (see the Kerberos section below).

Windows host in the LDAP tree

Now, you can log in your Windows client using the LDAP users created in Zentyal’s LDAP.

Roaming profiles and folder redirection¶

Zentyal offers the possibility to enable the roaming profiles for the Microsoft Windows clients.

Roaming profiles checkbox

When the roaming profiles are enabled, the data and configurations of the users are stored in the server in addition to the local profile. When the user authenticates on any of the domain client machines, the profile stored on the server is loaded locally and when the user logs out the remote profile is synchronized with the local profile.

The need to synchronize the local and the remote profiles when logging in and logging out increases significantly the time required to perform both operations. This problem can be mitigated with the “folder redirection” that allows the client to mount the remote resource locally.

The folder redirection configuration process is described in detail in the Samba documentation [11] in the Using a Group Policy Preference.

Kerberos Authentication System¶

Kerberos is an automatic authentication service that integrates with Samba4/Active Directory and all the compatible services across your domain.

The client only needs to provide his/her credentials once to obtain the “main” ticket, Ticket Granting Ticket.

This is done automatically with a Windows client joined to the domain, login credentials are sent to the Domain Controller (any of them), and if the LDAP user is correct, the controller automatically provides the TGT along with other tickets needed for file sharing to the client.

You can list the tickets currently active in your client using the command ‘klist’.

Kerberos tickets after domain login

In Debian/Ubuntu systems it also possible to obtain the Kerberos TGT installing the package heimdal-clients.

Obtaining Kerberos TGT in Ubuntu

Once the client has obtained the Kerberos TGT, all the other Kerberos-compatible services in your domain will accept Kerberos tickets, that are automatically issued on demand to authenticate the users.

This mechanism has two main advantages:

• Security: Passwords are secured while they travel through the local networks, the system is robust against sniffing or replay.
• Convenience: User just needs to provide credentials once, the other auth tickets are obtained transparently.

Zentyal Services currently compatible with Kerberos authorization:

• File Sharing (SMB/CIFS)
• Electronic mail
• HTTP Proxy

Changing the user password¶

Zentyal administrator can change the password of any user from the web interface. In most cases, however, it is more convenient that the user have the means to change his/her password without having to notify the administrator. This can be done in a few different ways:

• If the user has a Windows client joined to the Samba domain, the user can directly change the password after having logged in as a domain user by clicking CTRL + ALT + DEL . This change will be reflected on the server.

• From the SOGo webadmin.

• On a Linux client, the user must install the heimdal-clients package and then run:

  $ kinit <user>@DOMAIN
  $ kpasswd
  

For example:

$ kinit user1@ZENTYAL-DOMAIN.LAN
user1@ZENTYAL-DOMAIN.LAN's Password:
$ kpasswd
user1@ZENTYAL-DOMAIN.LAN's Password:
New password:
Verify password - New password:
Success : Password changed

Group Policy Objects (GPO)¶

The Group Policy Objects are policies associated to containers of the Domain.

Using GPOs, you can autoconfigure and enforce policies, global policies for all the domain or specific policies for Organizational Units or Sites.

Typical uses of the GPOs include:

• Installing and upgrading software packages without user intervention
• Configuring a HTTP Proxy in the browsers or the Certification Authority of the domain
• Deploying scripts to be executed in the client at login or logoff time
• Restricting part of the configuration of the Windows client to the user

It’s possible to create and enforce any GPO using a Windows client joined to the domain. This can be done by installing Microsoft RSAT tools and logging into the client using the Domain Admin LDAP account, you will use RSAT interface to design the desired GPO.

Managing GPO from RSAT tools in a Windows client

By using this tool, the GPOs will be automatically added to the domain SYSVOL and enforced by the Zentyal server.

Joining Zentyal Server to an existing domain¶

Integrating Samba4 technologies, Zentyal is able to become an Additional Controller of an existing domain, joining a Windows Server® or any Samba4-based controller, like another Zentyal server.

After domain join, LDAP, the DNS domain associated with Samba (local domain) and Kerberos information will be transparently replicated.

There are some points to verify before joining another controller:

• Zentyal’s local LDAP data will be destroyed, since it will be overwritten with the domain LDAP information
• All the controllers have to be perfectly time synced, preferably using NTP
• When the users are synchronized from the other controller, Zentyal will create their associated /home/<username> directories, check that these will not collide with pre-existing home directories
• All the controllers have to belong to the same domain
• DNS configuration is critical, other domain controllers will try to push the information to the IP provided by your DNS system

If you have external IPs associated to your hostname (i.e. zentyal.zentyal-domain.lan), you may face synchronization problems if any of the controllers tries to use that IP to push data. Even if you have several internal IPs, you may have the same problem, because the DNS system performs round-robin when answering DNS queries. If that’s your case, you may want to uncomment sortlist = yes on the /etc/zentyal/dns.conf file and restart the DNS server. This way, the DNS system will always put the IP that matches the query netmask first.

Once you have checked all the points, you can join the domain from the Domain menu.

Joining the domain as an additional controller of a Windows Server

Saving the changes will take longer than usual, because Samba4 will be reprovisioned and all the domain information replicated.

Zentyal LDAP tree synchronized with the Windows Server

Exploring the LDAP tree from the Windows Server will also show the new domain controller.

Windows LDAP tree showing the new controller

From now on, Samba local DNS domain, LDAP and Kerberos information will be synchronized both ways. You can manage the LDAP information (users, groups, OUs) in any of the controllers and the information will be replicated to the others.

The process of joining to another Zentyal server is exactly the same.

Total Migration¶

All the domain controllers have the mentioned domain information, however there are some specific roles that belong to a specific server host, these are called FSMO roles or Operations Masters.

Operation Masters are critical to the domain functioning, there are five FSMO roles:

• Schema master: LDAP schema master, defines and pushes updates of the LDAP format
• Domain naming master: Creates and Deletes the domains of the forests
• Infrastructure master: Provides domain-unique GUID, SID and DN IDs
• Relative ID Master: Relative IDs assigned to the Security Principals
• PDC Emulator: Compatibility with Windows 2000/2003 hosts, root time server

Using the Total Migration script you can transfer all these roles to a Zentyal server joined to the domain.

From the /usr/share/zentyal-samba directory you execute:

administrator@zentyal:/usr/share/zentyal-samba$ sudo ./ad-migrate
WARNING: This script will transfer all FSMO roles from the current owners to
the local server.
After all roles has been successfully transferred, you can shutdown
the other domain controllers.
Do you want to continue [Y/n]? Y

Checking server mode...

Checking if server is provisioned...

Synchronizing sysvol share...
syncing    [SYSVOL] files and directories including ACLs, without DOS Attributes

Transferring FSMO roles...
Transferring Schema Master role from owner: CN=NTDS Settings,...
Transferring Domain Naming Master role from owner: CN=NTDS Settings,...
Transferring PDC Emulation Master role from owner: CN=NTDS Settings,...
Transferring RID Allocation Master role from owner: CN=NTDS Settings,...
Transferring Infrastructure Master role from owner: CN=NTDS Settings,...

Migrated successfully!

From now on, Zentyal is the only critical controller in the domain, and all the features should continue working even if you turn off the others controllers, save scalability and network considerations.

Importing and exporting users and groups¶

To help you to import and export users and groups, Zentyal provides the following scripts that allow you to carry out these tasks. If you have a commercial edition, you can do this directly from the GUI ( Users and Computers -> Import/Export ), otherwise, you will have to execute manually the scripts located in /usr/share/zentyal-samba/.

Actions available in the Domain Controller and File Sharing module.

name;CN;Description;email;typeOfGroup;idGroup

## For a Security group

devsecops;OU=sysadmins,DC=lab61,DC=lan;Dev Sec Ops;devsecops@lab61.lan;1;;3112;

## For a Distribution group

news;CN=Groups,DC=zentyal-domain,DC=lan;News;news@zentyal-domain.lan;0;;;

username;CN;firstName;;lastName;displayName;Description;email;password;;IDnumber;CN-GroupBelong:CN-GroupBelong

## For a simple user

alba;CN=Users,DC=zentyal-domain,DC=lan;Alba;;Hernandez;Alba Hernandez;;"";password;;65540;CN=news,CN=Groups,DC=zentyal-domain,DC=lan:CN=rrhh,CN=Users,DC=zentyal-  domain,DC=lan;

## For an user with all the fiels filled

maria;OU=sysadmins,DC=zentyal-domain,DC=lan;Maria maria;;Jimenez;Maria Jimenez;Developer;"maria@zentyal-domain.lan";password;;65537;CN=devsecops,OU=sysadmins,DC=zentyal-domain,DC=lan:CN=news,CN=Groups,DC=zentyal-domain,DC=lan;

Limitations on import and export¶

• The account passwords can not be exported. The .csv file uses the string “password” as the default password.
• Organizational Units are not exported. Therefore, before importing a .csv file that contains any OU, you must create the OU previously.
• Non-ASCII characters such as accents will not be exported correctly. Therefore, you should edit these entries in the .csv file before importing.
• The .csv files generated by the export scripts contain the domain as CN. Therefore, the data import will fail if the new server does not have the same domain name configured. However, you can modify this value in the .csv files.
• In case you want to import users or groups that contain the configured email, you need to disable the Mail option of the user template Users and Computers -> User Template.

User template

Know Limitations¶

It’s important to check the list of current known limitations of Samba4 before planning your domain:

• Only one domain in the forest, Samba doesn’t support multiple domains or multiple forests
• Functional Domain level of the forest and the domain has to be min. 2003 R2, current max. 2008 R2
• Your hostname can not match your NETBIOS name, the NETBIOS name is generated using the left part of the domain, for example, if your hostname is ‘zentyal’ your domain can not be ‘zentyal.lan’, but it could be ‘zentyal-domain.lan’
• Trust relationships between domains and forests are not supported
• GPOs will not be synced, but this can be workarounded manually following the official Samba documentation [13]
• Users with non-ASCII names are not supported (accent marks, hyphen, special characters)

Known issues¶

To enable the access to the shares, for some Windows systems and devices as network printers, you’ll have to customize your shares configuration by adding this parameter:

ntlm auth = yes

Samba indiscriminatelly allows zone transfer when the domain controller is enabled. Although several related bugs have been fixed in Samba and Bind9, this undesirable behaviour still happens in the Samba4 + Bind9 implementation used by Zentyal.

This behaviour can be mitigated by introducing a specific iptables rule.

To confirm the vulnerability:

dig AXFR lab6.lan @10.5.20.77 +short

To mitigate this behaviour, proceed to capture the network traffic on the interface where you wish to block the queries by using Wireshark or Tcpdump:

0000   00 04 00 01 00 06 f0 1f af 29 9f 72 00 00 08 00   ......ð.¯).r....
0010   45 00 00 67 0a 0e 40 00 40 06 f3 e4 0a 05 14 3e   E..g..@.@.óä...>
0020   0a 05 14 57 e3 8d 00 35 3d 17 7a c0 da 44 06 65   ...Wã..5=.zÀÚD.e
0030   80 18 00 e5 3c f8 00 00 01 01 08 0a d4 90 96 04   ...å<ø......Ô...
0040   a4 b8 c6 be 00 31 78 9f 00 20 00 01 00 00 00 00   ¤¸Æ¾.1x.. ......
0050   00 01 04 6c 61 62 36 03 6c 61 6e 00 00 fc 00 01   ...lab6.lan..ü..
0060   00 00 29 10 00 00 00 00 00 00 0c 00 0a 00 08 28   ..)............(
0070   2a ec 65 b7 a5 2d 1f

Take the hexadecimal digits that correspond the zone name (lab6.lan in this case) and the digits ‘00 fc 00 01’ that identify the AXFR query and add a firewall ruel. See an example below:

iptables -t filter -I INPUT 1 -i eth0 -p tcp -m tcp --dport 53 -m string --algo kmp --hex-string '|6c 61 62 36 03 6c 61 6e 00 00 fc 00 01|' -j DROP