# Installing and configuring a Samba-AD RODC on Redhat or derivatives

Note

EnterpriseLinux8 distribution and derivatives do not yet embed Samba-AD packages. Indeed Samba-AD relies on Heimdal Kerberos for Active Directory support while RedHat only distributes and supports products based on Kerberos-MIT.

## Choosing the DNS suffix for the domain

For the choice of the domain name, there are two options:

- Use a DNS suffix ending in `.lan`, for example `mydomain.lan`.

- Use a sub-domain of a public domain you own, for example `ad.mycompany.com`.

Attention

In any case it is absolutely necessary to avoid suffixes in `.local` because this suffix has been appropriated by Apple for its Bonjour protocol / mDNS.

In the instructions below, the domain name will be `mydomain.lan` which you will replace with the domain name of your choice.

## Installing the RedHat10 or derivative server

To install a new Redhat10 (physical or virtual machine) without a GUI and only with the SSH service installed (minimal type installation), use this procedure for Redhat [https://www.wapt.fr/fr/doc/waptserver-install/redhat/install-redhat-base.html].

This documentation is also valid for an older Redhat or derivative host.

Note

We recommend the installation of Samba-AD on Linux (Debian or RedHat10 or derivative), configured according to the ANSSI Recommendations for configuring a GNU / Linux system [https://www.ssi.gouv.fr/uploads/2015/10/NP_Linux_Configuration.pdf].

Note

Make sure you don’t have dependencies to SSSD.

## Configuring the network functions of your server

### Configuring the DNS name

Hint

The name of your new Samba-AD server must not exceed 15 characters (limit linked to `sAMAccountName` in Active Directory). In this documentation we will use the name srvads.

The server name must be a FQDN name, i.e. the concatenation of the machine name and the DNS suffix.

- Modify the file `/etc/hostname` and fill in the FQDN name of the server:

      srvads.mydomain.lan

- Edit `/etc/hosts`, fill in the name FQDN and the short name of the server.

Hint

- On the line corresponding to the IP address of the Samba-AD server put first the FQDN name, then the short name.

- Do not modify the line(s) containing the term `localhost`:

    # /etc/hosts of the Samba-AD server
    10.0.0.10 srvads.mydomain.lan srvads

### Configuring the IP address of your server

- Define a static IP address using the nmcli command or nmtui for a semi-graphical interface (Click here [https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/networking_guide/sec-configuring_ip_networking_with_nmtui#sec-Configuring_IP_Networking_with_nmtui] for more information about the nmtui command). The name of the interface name can be different, like `enp0s17`, `eth0` for example.

    nmcli con mod enp0s17 ipv4.method manual ipv4.addresses 10.0.0.10/24 ipv4.gateway 10.0.0.254 ipv4.dns 10.0.0.1

Hint

If you have a corporate proxy.

To add the proxy to install Yum packages, add the following lines at the end of `/etc/yum.conf` adapting them to your context:

    proxy=http://proxy.mydomain.lan:3128
    #proxy_username=
    #proxy_password=

To configure the proxy for the different commands of the root user, add the following lines at the end of `/root/.bashrc`:

    export http_proxy=http://proxy.mydomain.lan:3128
    export https_proxy=http://proxy.mydomain.lan:3128
    export ftp_proxy=http://proxy.mydomain.lan:3128
    #export no_proxy=.lan,.local

To take this change into account immediately, do source /root/.bashrc.

### Configuring the security of your server

- After the reboot, Update the distribution, make sure en_US.utf8 locale is installed, set the system language to English to make it easier to find problems in the logs:

      dnf upgrade -y
      dnf install langpacks-en glibc-langpack-en -y
      localectl set-locale LANG=en_US.utf8
      localectl status

- Ensure that SELinux is deactivated:

      vi /etc/selinux/config

  Then in the file, replace the current value by (beware, you have to modify the line SELINUX= and not the line SELINUXTYPE=!):

      SELINUX=disabled

  After reboot, check that SELinux is disabled, the sestatus command should return:

      SELinux status: disabled

- Configure firewall rules to open the ports necessary for Samba-AD to work:

      systemctl start firewalld
      systemctl enable firewalld
      firewall-cmd --zone=public --add-port=53/tcp --add-port=53/udp --permanent
      firewall-cmd --zone=public --add-port=88/tcp --add-port=88/udp --permanent
      firewall-cmd --zone=public --add-port=135/tcp --permanent
      firewall-cmd --zone=public --add-port=389/tcp --add-port=389/udp --permanent
      firewall-cmd --zone=public --add-port=445/tcp --permanent
      firewall-cmd --zone=public --add-port=464/tcp --add-port=464/udp --permanent
      firewall-cmd --zone=public --add-port=636/tcp --permanent
      firewall-cmd --zone=public --add-port=3268/tcp --permanent
      firewall-cmd --zone=public --add-port=3269/tcp --permanent
      firewall-cmd --zone=public --add-port=50000-51000/tcp --permanent
      firewall-cmd --zone=public --add-port=49152-65535/tcp --permanent
      systemctl restart firewalld

- Disable avahi-daemon (mDNS protocol / bonjour):

      systemctl stop avahi-daemon.service avahi-daemon.socket
      systemctl disable avahi-daemon.service avahi-daemon.socket

### Adding useful tools for your server

- Update the distribution and install the EPEL repository and some essential tools (subscription-manager commands are only available on RedHat distros, not derivative):

RHEL10-RHEL9

    subscription-manager repos --enable codeready-builder-for-rhel-9-$(arch)-rpms
    dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm
    yum install -y wget sudo screen nmap telnet tcpdump rsync net-tools bind-utils htop

RHEL8

    yum update -y
    yum install -y epel-release
    yum install -y wget sudo screen nmap telnet tcpdump rsync net-tools bind-utils htop

You can now go to the next step and install Samba-AD on your RedHat10 or derivative distribution.

Packages of the latest version 4.22 validated by the Tranquil IT team can be downloaded from the url redhat-samba-4.22 [https://samba.tranquil.it/redhat10/samba-4.22/].

When it will be necessary to upgrade to Samba-4.23, just change the repository url to redhat-samba-4.23 [https://samba.tranquil.it/redhat10/samba-4.23/] and follow the upgrade notes on the upgrade page.

- Retrieve the RPM signature key and configure a YUM repository (note: CentOS7 support ends with Samba 4.20):

RHEL10

    wget -O /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-10 https://samba.tranquil.it/RPM-GPG-KEY-TISSAMBA-10
    rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-10
    echo "[tis-samba]
    name=tis-samba
    baseurl=https://samba.tranquil.it/redhat10/samba-4.22/
    gpgcheck=1
    gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-10" > /etc/yum.repos.d/tissamba.repo

RHEL9

    wget -O /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-9 https://samba.tranquil.it/RPM-GPG-KEY-TISSAMBA-9
    rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-9

    echo "[tis-samba]
    name=tis-samba
    baseurl=https://samba.tranquil.it/redhat9/samba-4.22/
    gpgcheck=1
    gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-9" > /etc/yum.repos.d/tissamba.repo

RHEL8

    wget -O /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-8 https://samba.tranquil.it/RPM-GPG-KEY-TISSAMBA-8
    rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-8

    echo "[tis-samba]
    name=tis-samba
    baseurl=https://samba.tranquil.it/redhat8/samba-4.22/
    gpgcheck=1
    gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-8" > /etc/yum.repos.d/tissamba.repo

- Verify the key fingerprint with sha256sum:

      # For RHEL9 / RHEL10 :
      sha256sum /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-9 || sha256sum /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-10
          05f21f368bdeb01453e37c3af2b8fcabba8986e2ce2b0d0298df6456a0bef60a /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-{[9-10]}

      # For RHEL8 :
      sha256sum /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-8
          b3cd8395e3d211a8760e95b9bc239513e9384d6c954d17515ae29c18d32a4a11 /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-8

- Install the Samba-AD packages for RedHat and derivative distributions :

      yum --enablerepo=crb install -y samba samba-dc samba-winbind samba-winbind-clients krb5-workstation ldb-tools bind chrony bind-utils samba-client python3-markdown

  Warning

  –enablerepo=crb will only work with derivative distros. If you are using a RedHat distro, please use the following command to enable crb repo:

      subscription-manager repos --enable codeready-builder-for-rhel-9-$(arch)-rpms

Attention

For RODC support, it is imperative to use a version of Samba higher than 4.9. The RODC support is globally functional but it is not complete, it lacks NTLM authentication forwarding when the password hash has not been synchronized.

#### Setting up the RODC service

- Configure the `/etc/resolv.conf` file by pointing to your RW domain controller.

- Join the machine to the domain:

      samba-tool domain join mydomain.lan RODC -U MYDOMAIN\\Administrator

- In `/etc/samba/smb.conf`, add the DNS forwarder:

      dns forwarder = 8.8.8.8

- Start the Samba service with systemctl start samba.

- Edit `/etc/resolv.conf` to make it point to itself:

      search mydomain.lan
      nameserver 127.0.0.1

#### Testing user password replication on the RODC server

- On srvads, add a user as a member of the Allowed RODC Password Replication Group.

- On srvrodc:

      samba-tool rodc preload myuser --server=srvads.mydomain.lan

- If all went well:

      Replicating DN CN=myuser,CN=Users,DC=mondomaine,DC=lan
      Exop on[CN=myuser,CN=Users,DC=mondomaine,DC=lan] objects[1] linked_values[0]