Samba4 Development
Introduction
This wiki page will be used to track the integration effort of Samba 4 into SME 9+
Lead developer: Gzartman
Overview and Objectives
The primary objective of this effort is to create Active Directory support on SME 9+ with a focus on simplicity and easy in integration, as is done on many of the other sub-systems on SME Server. Other distributions with Samba 4 support take the approach of providing a fairly complex front end to Samba 4 with many configuration parameters and options. Our approach for Samba 4 is to stream line implementation to provide a straight forward and simple set of UI parameters for the administrator to deploy Active Directory in a configuration that will work in most deployments. Support for the full array of Samba 4 options is provided under the hood in SME Server, but will be available primary from the console. The SME Server community may decide to create an Advanced Samba server-manager panel to control and configure some of the more advanced features available in Samba 4, but the Core SME Server deployment of Active Directory will remain focused on simplicity.
Deployment of Samba 4 on SME Server means that many of the authentication mechanisms on SME Server need to change to integrate with Active Directory, therefore this development effort is quite far reaching.
Samba 4 on SME Server is targeted for Koozali SME Server 10, but is currently be developed simultaneously on both version 9.2 and 10.
Current Status
Current Release: Alpha 6
Samba 4 on SME Server will be provided by way of the package smeserver-samba, which will upgrade and obsolete e-smith-samba. The current release of Samba 4 on SME Server is available here: SME Server Samba 4 Packages
These packages are currently not provided by the Koozali buildsys because there is still a fair bit of work to do to integrate this code with existing SME services. Since Samba 4 on SME Server includes many other sub-systems, inclusion of the Samba 4 code is not being including in current development streams until the code is closer to release so as not to hold up other development activities. However, this code is available in CVS.
Samba 4 Packages
Upstream Centos 6 and 7 do not provide Samba 4 packages with full Active Directory support. This is because Samba 4 Kerberos is based upon Heimdal Kerberos whereas the upstream vendor uses MIT Kerberos. Heimdal Kerberos and MIT Kerberos are not compatible with one another and so the upstream vendor has decided to disable Kerberos support in Samba until such time as Samba supports MIT Kerberos. Details can be found here https://wiki.samba.org/index.php/MIT_Build and here https://blog.cryptomilk.org/2014/07/09/samba-ad-dc-in-fedora-and-rhel/
To further development of support for Samba 4 on the Koozali SME Server, Samba 4 packages from Sernet were selected. These packages will not immediately install cleaning on SME 9 due to the customization of Centos associated with SME 9, so the Sernet packages where re-built for SME 9. Details of this rebuild along with a link to the rebuilt packages are located in bugzilla:8075. After rebuilding, these packages do install cleanly but the services will not start using the init.d scripts provided with the packaged due to changes made during the re-build of the packages for SME 9.
The SME Server DevTeam is currently working on creating modified upstream packages for SME 10 alpha. More to come soon.
Installation
RPMs for this release can be found here: SME Server Samba 4 Packages
Install Instructions:
- Download all rpms to a fresh SME 9.1 install.
- yum localinstall *.rpm
- signal-event post-upgrade; signal-event reboot
- Once the server comes back up, provision the domain with: signal-event provision-domain-controller admin_password
Note: The password utilities in the server-manager are not yet working. We will be working to include SSSD in the next alpha and then all password utilities and functions will work as expected.
Change Log / Release Notes
Alpha 6
- Final alpha on SME 9. Going forward, this code will be moved to the SME 10 alpha release for ongoing development and testing
- Change the way we are naming alpha package versions because it is becoming difficult to apply alpha level changes with patch files. Each alpha release will have its own source archive
- Rewrite server-manager user accounts panel for AD integration
- Move smb.conf and AD schema extension fragments to /etc/samba
- Extend AD schema to include the attributes: lockable, removable, and emailForward
- Replace user-create event with user-initialize
- Update user-modify, user-delete, user-lock events for AD integration
- Extensive clean-up smb.conf fragments now that we have a working Samba 4 deployment, including default configuration dbase parameters
- Create user-AD-enable and user-AD-disable actions
- Further enhancement and refinement to esmith::AD
Alpha 5
- Extend Active Directory schema to include quota and smeCustom attributes via the koozaliUser objectClass
- Remove adjust-samba event and use services2adjust
- Add Group-create-AD action
- Design changes to provision-domain-controller and bootstrap-provision-dc events to provision samba entirely cold using ldif
- Add pseudonym support to esmith::AD
- Further enhancement to esmith::AD to provide user & group management functionality similar to that provided by AccountsDB
- Re-write createlinks to flow a more logical sequence
- Fix dnsforwarder in smb.conf
- Fix several esmith::AD::User and esmith::AD::Group methods broken in 0.1-0-3 when we added runtime binding
Alpha 4
- Add dnscache and tinydns config per bug [SME: 9711]
- Add iptables preroute rule for DNS per bug [SME: 9711]
- Fix issues with domain admins assignment during provisioning
- Nearly full re-write of user-create-AD action to utilize esmith::AD class
- Add Legacy Mode to user-create-AD action to allow this action to work with AccountsDB
- Add user-create-AD to user-create event
- Add user-AD-disable action to disable AD user
- Continued development and enhancement to esmith::AD including POD documentation
- Continued development and enhancement to esmith::AD::User including POD documentation
- Add esmith::AD::OU to manage Organizational Units in the Active Directory
- Fix realm definition in provision action
Alpha 3
- Reconfigure provision event to account for default Samba complex password policy
- Abstract core LDAP queries in esmith::AD using runtime binding
Alpha 2
- Set requires to e-smith-base-5.6.0-30+ [SME:8668]
- Set requires for e-smith-LPRng-2.5.0+ [SME:8632]
Alpha 1
- Roll new smeserver alpha package for Samba4 [SME:8075]
Bugzilla references
bugzilla:4667
bugzilla:8075 Adding Samba 4
bugzilla:8632 Modify e-smith-dnscache for Samba 4 support
bugzilla:8638 Modify e-smith-dnscache for Samba 4 support
bugzilla:8660 User account authentication with Active Directory and AccountsDB
bugzilla:8663 Proftpd and active directory authentication (Samba 4)
bugzilla:8665 esmith::AD perl module for interacting with Active Directory
bugzilla:8668 Get rid of PPTP when we upgrade to Samba 4
bugzilla:8670 Qmail updates for Samba 4
bugzilla:8674 Remove smbpasswd and WINS pieces for Samba 4
bugzilla:8675 e-smith-LDAP + Samba 4
bugzilla:8687 Add SSSD daemon for Samba 4 local authentication
bugzilla:8703 Samba 4: Home directory
bugzilla:9651 Remove Samba Parts from esmith::Util for Samba 4
bugzilla:9653 Pseudonyms handling with Active Directory
bugzilla:9662 System Initialization and Re-Configuration with Active Directory
bugzilla:9700 Consider removing /sbin/e-smith/samba_check_password
bugzilla:9708 Evaluate registry fragments in server-resources for Samba 4
bugzilla:9711 Include dnscache and tinydns config in smeserver-samba for Samba 4 DNS queries
bugzilla:9712 Reconfigure shadowcopy for Samba 4
bugzilla:9713 Reconfigure recycle bin for Samba 4
bugzilla:9715 Reconfigure recycle bin for Samba 4
bugzilla:9755 Reconfigure recycle bin for Samba 4
bugzilla:9799 Reconfigure recycle bin for Samba 4
bugzilla:9800 Reconfigure recycle bin for Samba 4
bugzilla:9802 Reconfigure recycle bin for Samba 4
bugzilla:9804 Reconfigure recycle bin for Samba 4
bugzilla:9806 Reconfigure recycle bin for Samba 4
bugzilla:9807 Reconfigure recycle bin for Samba 4
Active Directory Schema
Following is a direct dump of the active directory from a freshly provisioned SME Server domain. The DNS/Kerberos domain is domain.com, the hostname is virgin, and the windows domain is sme-server. The ipaddress for this test machine is 192.168.0.67. These data is quite long, but I found it very useful; as it is extremely difficult to find these attributes in any documentation about Samba 4 and ADDC:
Samba 4 Active Directory Schema
