Centrify Suite. Samba Integration Guide. Centrify Corporation. December, 2011

Transcription

1 Centrify Suite Samba Integration Guide December, 2011 Centrify Corporation

2 Legal notice This document and the software described in this document are furnished under and are subject to the terms of a license agreement or a non-disclosure agreement. Except as expressly set forth in such license agreement or non-disclosure agreement, Centrify Corporation provides this document and the software described in this document as is without warranty of any kind, either express or implied, including, but not limited to, the implied warranties of merchantability or fitness for a particular purpose. Some states do not allow disclaimers of express or implied warranties in certain transactions; therefore, this statement may not apply to you. This document and the software described in this document may not be lent, sold, or given away without the prior written permission of Centrify Corporation, except as otherwise permitted by law. Except as expressly set forth in such license agreement or non-disclosure agreement, no part of this document or the software described in this document may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, or otherwise, without the prior written consent of Centrify Corporation. Some companies, names, and data in this document are used for illustration purposes and may not represent real companies, individuals, or data. This document could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein. These changes may be incorporated in new editions of this document. Centrify Corporation may make improvements in or changes to the software described in this document at any time Centrify Corporation. All rights reserved. Portions of Centrify DirectControl are derived from third party or open source software. Copyright and legal notices for these sources are listed separately in the Acknowledgements.txt file included with the software. U.S. Government Restricted Rights: If the software and documentation are being acquired by or on behalf of the U.S. Government or by a U.S. Government prime contractor or subcontractor (at any tier), in accordance with 48 C.F.R (for Department of Defense (DOD) acquisitions) and 48 C.F.R and (for non-dod acquisitions), the government s rights in the software and documentation, including its rights to use, modify, reproduce, release, perform, display or disclose the software or documentation, will be subject in all respects to the commercial license rights and restrictions provided in the license agreement. Centrify, DirectAudit, DirectControl and DirectSecure are registered trademarks and DirectAuthorize and DirectManage are trademarks of Centrify Corporation in the United States and other countries. Microsoft, Active Directory, Windows, Windows NT, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and other countries. Centrify Suite is protected by U.S. Patents 8,024,360 and 7,591,005. The names of any other companies and products mentioned in this document may be the trademarks or registered trademarks of their respective owners. Unless otherwise noted, all of the names used as examples of companies, organizations, domain names, people and events herein are fictitious. No association with any real company, organization, domain name, person, or event is intended or should be inferred.

3 Contents About this guide 5 Intended audience Using this guide Conventions used in this guide Where to go for more information Contacting Centrify Chapter 1 Using Centrify Suite technology with Samba 9 Integrating Centrify Suite and Samba Integrating Samba with DirectControl Express Chapter 2 Install the Centrify-enabled Samba package 13 Verifying the software required Deciding how to work with old Samba installations Installing Centrify-enabled Samba and adbindproxy Upgrading from a previous release Chapter 3 Configuring Centrify-enabled Samba 25 Verifying the environment before you begin Verifying DNS settings on the local computer Running the adbindproxy.pl Verifying the Samba integration Modifying the Samba smb.conf configuration file Appendix A Migrating existing Samba users to DirectControl 39 Migrating UNIX profiles to Active Directory Migrating Samba servers to Centrify Zones Appendix B Using adbindproxy.pl 41 Index 45 3

4 4

5 About this guide The Centrify Suite centrally secures cross-platform data centers through Active Directorybased identity and access management for a wide range of heterogeneous systems, hypervisors and applications. Built on an integrated architecture that leverages patented technology, the Centrify Suite of solutions help centralize ID, access privilege delegation and policy management to reduce the organization s IT expense and complexity, improve end-user productivity, strengthen security and enhance regulatory compliance initiatives. Key components of the Centrify Suite include integrated authentication, access control, role-based privilege management, user-level auditing and server protection solutions, consisting of Centrify DirectControl, Centrify DirectAuthorize, Centrify DirectAudit, Centrify DirectSecure, and Centrify DirectManage. This book describes how to install and configure Centrify-enabled Samba, a customized version of the open source file and print sharing program, on a UNIX computer that has the DirectControl Agent already installed. Intended audience This book is written for an experienced system administrator familiar with the unpacking and installation of programs on UNIX computers. In addition, the instructions assume that you have a working knowledge of Samba and how to perform common administrative tasks for creating and maintaining Samba shares. This book also requires you to have a working knowledge of DirectControl and how to perform common administrative tasks using the DirectManage Administrator Console and the Active Directory Users and Computers administration tool. If you are unfamiliar with DirectControl, see the Centrify Suite Administrator s Guide. Using this guide The book guides you through the installation and configuration of Centrify-enabled Samba. It is organized as follows: Chapter 1, Using Centrify Suite technology with Samba, provides a brief overview of Samba, and how Samba, DirectControl, and Active Directory work together to provide a secure, integrated environment. Chapter 2, Install the Centrify-enabled Samba package, describes how to unpack and install the Centrify Samba package. 5

6 Conventions used in this guide Chapter 3, Configuring Centrify-enabled Samba, describes how to use the Samba configuration file and test your integration of Samba, DirectControl, and Active Directory. Appendix A, Migrating existing Samba users to DirectControl, describes how to migrate existing users from Samba servers to DirectControl. Appendix B, Using adbindproxy.pl, describe the adbindproxy.pl utility, which enables you to configure Samba for interoperability with DirectControl. Conventions used in this guide The following conventions are used in this guide: For simplicity, UNIX is used in this guide to refer to all supported versions of the UNIX, Linux, and Macintosh OS X operating systems unless otherwise noted. Fixed-width font is used for sample code, program names, program output, file names, and commands that you type at the command line. When italicized, this font is used to indicate variables. In addition, in command line reference information, square brackets ([ ]) indicate optional arguments. Bold text is used to emphasize commands, buttons, or user interface text, and to introduce new terms. Italics are used for book titles and to emphasize specific words or terms. The variable release is used in place of a specific release number in the file names for individual DirectControl software packages. For example, centrifydc-release-sol8-sparclocal.tgz in this guide refers to the specific release of the DirectControl Agent for Solaris on SPARC available on the DirectControl CD or in a DirectControl download package. On the CD or in the download package, the file name indicates the DirectControl version number. For example, if the software package installs DirectControl version number 4.4.2, the full file name is centrifydc sol8-sparc-local.tgz. Where to go for more information Before you start, be sure to read through the Release Notes included with the software package. This file provides the most up-to-date information about the package, including system requirements and supported platforms, and any additional information that may not be included in other documentation. For information about how to set up and use Samba, you should review the guides included in the Samba distribution, or the documentation available at including: Official Samba-3 HOWTO and Reference Guide Samba-3 by Example Samba Integration Guide 6

7 Where to go for more information The following books describe the Centrify Suite components and how to integrate them into your environment. Planning and Deployment Guide provides guidelines, strategies, and best practices to help you plan for and deploy DirectControl in a production environment.this guide covers issues you should consider in planning a DirectControl deployment project. The Planning and Deployment Guide should be used in conjunction with the information covered in the Administrator s Guide. Administrator s Guide describes how to perform administrative tasks using the DirectControl Administrator Console and UNIX command line programs. The Administrator s Guide focuses on managing your environment after deployment, including creating a zone structure and managing identity and access for users in your UNIX environment. ADEdit Programmer s Guide describes the ADEdit UNIX tool used to manage DirectControl through a UNIX CLI or through scripts. The guide provides a conceptual overview, programming tutorials and examples, and reference sections that describe each ADEdit command and ADEdit library script in detail. Group Policy Guide describes the DirectControl group policies you can use to customize user-based and computer-based configuration settings. This guide provides an overview of how group policies are applied and how to install and enable DirectControl-specific policies. Configuration Parameters Reference Guide provides reference information for the Centrify DirectControl configuration parameters that enable you to customize your environment. Many of these settings can also be controlled through group policies. Administrator s Guide for Mac OS X provides information for Mac OS X system administrators about the administrative issues and tasks that are specific or unique to a Mac OS X environment. If you are deploying in an environment with Mac OS X servers or workstations, you should refer to this guide for information about the group policies that only apply to Mac OS X computers and users. Authentication Guide for Apache describes how to install and configure the DirectControl for Web Applications product with Apache servers and applications. Authentication Guide for Java Applications describes how to install and configure the DirectControl for Web Applications product with Tomcat, JBoss, WebLogic, and WebSphere servers and J2EE applications. SAP Authentication Guide provides complete information for configuring the SAP server and SAPgui to use DirectControl and Active Directory for authentication. Individual UNIX man pages for command reference information for DirectControl UNIX command line programs. About this guide 7

8 Contacting Centrify Contacting Centrify If you have a problem during DirectControl software installation or configuration, need help with Active Directory configuration, or want clarification on best practices contact your Centrify System Engineer or Technical Support. Go to and login for the Technical Support contact information. Samba Integration Guide 8

9 Chapter 1 Using Centrify Suite technology with Samba This chapter introduces Centrify-enabled Samba the highlights the integration issues when enterprise networks want to combine the services of Centrify Suite products and Samba to share UNIX computer files and printers. The following topics are covered: Integrating Centrify Suite and Samba Integrating Samba with DirectControl Express Integrating Centrify Suite and Samba Samba is a popular, open source, file and printer sharing program that allows a UNIX host to participate as an Active Directory services domain member. When Samba is installed, Windows users can share files and printers on the UNIX computers. The Centrify Suite is an integrated set of commercial identity management products that enable a UNIX host to participate as an Active Directory domain member. When Centrify Suite products are installed, the UNIX user and group accounts and privileges can be managed entirely through Active Directory. When open-source Samba is configured as an Active Directory domain member and the Centrify Suite DirectControl agent are both installed on the same UNIX host, however, two problems can arise: Samba and DirectControl both attempt to create and manage the same Active Directory computer account object (based on the UNIX host name), causing one of the products to stop working. Conflicting UIDs and GIDs are generated by Samba and the Centrify Suite DirectManage tools for the same Active Directory users and groups. (The two programs use different algorithms for generating these values.) The result is file ownership conflicts and access control problems. To resolve these issues, Centrify-enabled Samba should be used instead of any existing Samba running on the UNIX system. Centrify-enabled Samba supports the standard Samba protocols and eliminates the potential contentions and UID/GID conflicts. The Centrify-enabled Samba package consists of the following component: Compiled and packaged version of Centrify-enabled Samba. adbindproxy module: Intercepts Samba UNIX ID mapping requests and reroutes them to DirectControl for processing. This module ensures that Samba and DirectControl agree on the UNIX attribute values. 9

10 Integrating Centrify Suite and Samba adbindproxy.pl PERL configuration script: Automates most of the setup process and designates DirectControl as the manager of the shared computer object. The following figure provides a conceptual view of the complete solution architecture using Active Directory, Samba, and Centrify Suite components. If you have not been using Samba up to this point, or if you have been using an older Samba security method (such as user or server), the integration process makes it easy to configure Samba as an Active Directory member. On the other hand, if you have already been using Samba as an Active Directory domain member and have assigned UIDs and GIDs to Active Directory users and groups, the PERL configuration script helps migrate these UIDs and GIDs for use with Centrify-enabled Samba. Samba Integration Guide 10

11 Integrating Samba with DirectControl Express The integrated solution, composed of the DirectControl Agent (installed separately), the pre-compiled, Centrify-enabled Samba program and adbindproxy, the Centrify winbind proxy program, provides the following: Samba and DirectControl use the same Active Directory computer object without conflicts. Consistent user and group attributes are applied on files across Windows and UNIX computers. All UNIX user identity attributes, including the UID, GID, home directory and login shell in UNIX profiles, are centrally stored and managed in Active Directory. Both Kerberos and NTLM Samba authentication methods are supported. Standard Samba access-control features are implemented, augmented by the Centrify Zones technology. Integrating Samba with DirectControl Express Centrify DirectControl Express is a special deployment option of the Centrify Suite technology that automatically generates UNIX attributes for Active Directory users and computers. DirectControl Express does not use Centrify Zones technology. Most of the procedures described in this manual work the same for both the standard and Express deployments, with the following limitations: You cannot migrate existing, Samba-generated UID s and GIDs to DirectControl. This is only an issue if you have already been running Samba as an Active Directory member. You can, however, manually convert the Samba-generated UIDs and GIDs to the same IDs generated by the DirectManage Administrator console. You cannot use Centrify Zones to restrict access to Samba shares. See the Samba documentation for ways to implement share restriction if it is something you need. Alternatively, consider upgrading to the full Centrify Suite. Chapter 1 Using Centrify Suite technology with Samba 11

12 Integrating Samba with DirectControl Express Samba Integration Guide 12

13 Chapter 2 Install the Centrify-enabled Samba package This chapter describes host to install Centrify-enabled Samba on the UNIX computers in your environment and enable interoperability between DirectControl and Samba. The following topics are covered: Verifying the software required Deciding how to work with old Samba installations Installing Centrify-enabled Samba and adbindproxy Upgrading from a previous release Verifying the software required Samba is an open source software package that is freely available on the Samba project site ( In addition, virtually every distribution of Linux and many commercial UNIX operating environments include a binary version of Samba as an integral part of the package. To get Samba interoperability with Centrify Suite products, you must use the precompiled version of Samba that is provided by Centrify. Centrify-enabled Samba includes patches to the Samba programs. Although these patches may be included in future versions of Samba if approved by the Samba development team, for now, they only exist in Centrify-enabled Samba. Required Centrify Suite software Before you install the Samba package, confirm that you have the following software installed on your Windows and UNIX systems that you have the software required; see the release notes for compatibility information: The DirectControl for Windows software package, for the DirectControl Administrator Console. Note If you are running the DirectControl Express, you do not need to install the DirectControl Administrator Console. The DirectControl Agent software package, for the specific operating environments you want to support. The Centrify-enabled Samba archive file that contains the centrifydc-samba and centrifydc-adbindproxy installation packages for the specific operating environments you want to support. 13

14 Deciding how to work with old Samba installations You must install the DirectControl Agent, and the Centrify-enabled Samba and adbindproxy packages, on each computer on which you intend to set up Samba-based SMB file servers. Centrify Suite software installation If you have not already done so: Follow the instructions in the DirectControl Administrator s Guide to install the DirectControl Administrator Console on at least one Windows computer and configure at least one zone. Apply the latest operating system patches on the computers where you intend to install the DirectControl Agent and Centrify-enabled Samba to ensure the operating systems are up to date. Copy the Centrify Suite and Centrify-enabled Samba software packages to an empty working directory on each UNIX computer to avoid potential conflicts with other packages. Follow the instructions in DirectControl Administrator s Guide to install the DirectControl Agent on each UNIX computer. Use the instructions in this book to create your Centrify Zones and to join the Samba servers to the Active Directory domain. Deciding how to work with old Samba installations Many UNIX vendors, especially those who offer Linux, bundle Samba with the operating system. If an existing Samba installation resides on your target computer, it will conflict with the Centrify-enabled Samba package you are about to install. This section explains the choices you have if you find an existing Samba installation and your options. To check for an existing Samba installation, do one of the following: Run your package management software. For example, on RedHat Enterprise Linux: rpm -qa grep -i samba If you have Samba installed, the command returns something similar to the following: samba-client-version samba-common-version where version is the current samba version number. Search for Samba utilities such as net or smbstatus (typically found in the /usr/bin directory) or the Samba daemons, such as smbd, nmbd, or winbind (typically found in / usr/sbin). For example, enter the following command: ls -l /usr/bin grep -i smbstatus -rwxr-xr-x 1 root root Oct smbstatus Samba Integration Guide

15 Deciding how to work with old Samba installations If you find no evidence of an existing Samba, skip to Installing Centrify-enabled Samba and adbindproxy on page 17. In addition, you can safely answer Yes to the question Do you want to create symbolic links when you run the adbindproxy.pl configuration script. If a Samba already exists on the target computer then you must do one of the following BEFORE you install Centrify-enabled Samba: Remove it: see Remove existing Samba installations Replace it: see Replace existing Samba installations Co-exist with it: see Co-existing with existing Samba installations Remove existing Samba installations Ideally, the best solution is to remove the existing Samba installation using your platform's package management software. However, in practice, this is often difficult to do because not only are multiple Samba components installed (client, server, and library components) but in many cases other installed packages depend on the Samba components and must be removed first. Note Before you remove your existing Samba package you may want to save the existing winbind UID and GID assignments. See Upgrading from a non-centrify-enabled version of Samba on page 22 for the rationale and instructions. In such cases, you may have to follow and remove all dependencies, then work back and remove all Samba components, which can be a very complicated process. On the other hand, some package managers, such as rpm, allow you to remove Samba components ignoring dependencies. See Upgrading from a non-centrify-enabled version of Samba on page 22 for examples that show how to remove an existing Samba with various package managers. When you install Centrify-enabled Samba it replaces most if not all of the dependencies. Replace existing Samba installations A second strategy is to replace the existing Samba by creating symbolic links to Centrifyenabled Samba. When you run adbindproxy.pl to configure Samba, you are prompted to create symbolic links. Replacing an existing installation is a simple and effective strategy. In this case, adbindproxy.pl renames any existing Samba binaries it finds by adding a suffix (.pre_adbindproxy). For example, an existing smbd would be renamed smbd.pre_adbindproxy. Then adbindproxy.pl creates a symbolic link from the original name to the Centrify-enabled Samba component; for example: /usr/sbin/smbd => /opt/centrify/samba/sbin/smbd Chapter 2 Install the Centrify-enabled Samba package 15

16 Deciding how to work with old Samba installations During installation you are not required to do any manual work to remove the existing Samba installation. You will, however, need to use a package manager option that ignores file conflicts and dependencies, such as the rpm --replacefiles and --nodeps options (see Upgrading from a previous release on page 20 for an example,). After installation, the adbindproxy configuration script automatically takes care of creating symbolic links and renaming the existing Samba binaries when you answer Yes to the prompt, Do you want to create symbolic links... (see Running the adbindproxy.pl on page 26). Note Before you replace your existing Samba package you may want to save the existing winbind UID and GID assignments. See Upgrading from a non-centrify-enabled version of Samba on page 22 for the rationale and instructions. After installation and configuration, because they have been renamed, there is no chance that the old Samba binaries can be mistakenly executed in place of the Centrify-enabled Samba binary. The downside to this strategy is that as far as the operating system is concerned, the original Samba is still installed, so you must be careful when installing operating system patches to avoid inadvertently overwriting Centrify-enabled Samba binaries with ones from the patches. Co-existing with existing Samba installations The third strategy is to leave an existing Samba installation in place when you install Centrify-enabled Samba. After installation, when you configure Centrify-enabled Samba, do not replace the existing binaries with symbolic links to Centrify-enabled Samba. That is, after installation, when you run the Samba configuration script, answer No to the prompt, Do you want to create symbolic links... (see Running the adbindproxy.pl on page 26). The original Samba binaries are not modified. Centrify-enabled Samba is installed in the directory /opt/centrify/samba, while the original Samba binaries remain in their current directories (typically /usr/bin and /usr/sbin). With coexistence you do not have to be concerned with inadvertently overwriting Centrify-enabled Samba binaries when applying operating system patches. However, you have to be careful to be certain that you are executing the correct Samba binaries. Typically, you need to use the complete path (/opt/centrify/samba/bin/sambaprogramname) when executing Centrify-enabled Samba binaries, or you can modify the PATH environment variable to define the path to the Centrify-enabled Samba binaries first. Samba Integration Guide

17 Installing Centrify-enabled Samba and adbindproxy Installing Centrify-enabled Samba and adbindproxy Use the instructions in this section to install the Centrify-enabled Samba and the adbindproxy program. Note If you have not already done so, before continuing, be certain to look at Upgrading from a previous release on page 20 for instructions that may be pertinent, depending on your current DirectControl and Centrify-enabled Samba installation. Depending on the version of DirectControl you are using, some related programs for Centrify-enabled Samba may be installed by default with the DirectControl Agent. The Centrify-enabled Samba package and the Centrify adbindproxy package, however, are separate, add-on software packages installed separately from the DirectControl Agent or the Centrify Suite. For information about configuring the Centrify-enabled Samba environment to work with DirectControl after installation, see Configuring Centrifyenabled Samba on page 25. Extracting the contents of Centrify-enabled Samba package In these instructions, a sample file name of centrify-samba-v.v.v-platform-arch.tgz is used in place of the full file name. The full file name for the Centrify-enabled Samba package includes the Centrify-enabled Samba version and supported platform information. For example, the full file name may look similar to this: centrify-samba-v.v.v-platform-arch.tgz where: v.v.v is the DirectControl version number platform indicates the target operating system; for example, Red Hat Enterprise Linux, HP UX, AIX, Solaris, etc. arch indicates the processor architecture; for example, Intel x86 32-bit, Intel x bit, Solaris SPARC, Solaris x86, etc. 1 Go to the Centrify Download Center to get the Centrify-enabled Samba package. You get to the Download Center from the Centrify home page. Next, click the Support tab and select the Customer Support Portal. Entre your User Name and Password. From the Support portal select the Customer Download Center. Chapter 2 Install the Centrify-enabled Samba package 17

18 Installing Centrify-enabled Samba and adbindproxy In the Download Center, select Centrify-Enabled Samba from the Centrify-Enabled Tools. 2 Download the centrify samba-release-platform-arch.tgz file corresponding to the target computer s DirectControl version, operating system, and processor architecture. 3 Uncompress the contents of the file. For example, on a Red Hat Enterprise Linux Samba Integration Guide

19 Installing Centrify-enabled Samba and adbindproxy computer you would use the following: gunzip centrify-samba-v.v.v-platform-arch.tgz 4 Extract the contents of the file. For example, on a Red Hat Enterprise Linux computer you would use the following: tar xvf centrify-samba-v.v.v-platform-arch.tar After extracting the contents of the file, you should see the following files: Centrify-Samba-v.v.v-Release-Notes.txt: Generic release for this release of the Centrify-enabled Samba package. release-notes-samba-platform.txt: Supplemental, platform-specific release notes. centrifydc-samba-s.s.s-v.v.v-platform-arch.rpm (where s.s.s is the base Samba version number): the Centrify-enabled Samba package centrifydc-adbindproxy-v.v.v-platform-arch.rpm: The 5 Review the two text files for release-specific information about the package that was available after this document was published. The packages are now read for installation. Use the following steps to install the Centrify-enabled Samba and then adbindproxy. In these steps the file name centrifydc-samba-*.rpm is used in place of the full file name. You can use the wildcard symbol (*) to substitute for a portion of the file name if there are no conflicting files in the directory. Note If you are updating from a previous version of Centrify-enabled Samba or have a vendor-supplied Samba installed on the computer, see Upgrading from a previous release on page 20before proceeding. Be sure to enter the full path name in the command line if multiple versions of the same file exist in the same directory. 1 Run the appropriate command for your platform to install the centrifydc-samba package. The following table shows sample commands using the common package installers for each platforms. For this platform Linux-based computers Red Hat Enterprise Linux CentOS Linux Scientific Linux Oracle Linux You can run For 32-bit systems: rpm -Uvh centrifydc-samba-*.rpm For 64-bit systems: rpm -Uvh centrifydc-samba-*.rpm Chapter 2 Install the Centrify-enabled Samba package 19

20 Upgrading from a previous release For this platform Sun Solaris HP-UX IBM AIX Debian Linux Ubuntu Linux SuSE Linux OpenSuSE Linux You can run On SPARC systems: gunzip centrifydc-samba-*-sol8-sparc-local.gz pkgadd -d centrifydc-samba-* For x86 systems, the commands are the same but the file names are different; for example: centrifydc-samba-*-sol9-x86-local For HP-UX on PA-RISC: gunzip centrifydc-samba-*-hp11.11.gz swinstall -s /path/centrifydc-samba-*-hp11.11.depot CentrifyDC-Samba For other HP-UX versions and platforms the commands are the same but the file names are different. For example on HP-UX Itanium 64-bit systems: centrifydc-samba-*-hp11.23-ia64.depot.gz For AIX 5.2 or later: gunzip centrifydc-samba-*-aix5.1-ppc.bff.gz inutoc. installp -ay -d centrifydc-samba-*-aix5.1-ppc.bff CentrifyDC.samba Check that you have libcupsys2-gnutls10 ( or later) installed If you have the required libraries, run the following command to install: 32-bit processor: dpkg i centrifydc-samba-*-deb5-i386.deb 64-bit processor: dpkg i centrifydc-samba-*-deb5-x86_64.deb For 32-bit systems: rpm -ivh centrifydc-samba-*-suse8-i386.rpm 2 Repeat the installation command for your platform, this time specify centrifydcadbindproxy-*.rpm For 64-bit systems: rpm -ivh centrifydc-samba-*-suse9-x86_64.rpm Note SuSE Linux 9 requires the cups package. This concludes the installation of Centrify-enabled Samba and the adbindproxy. Skip to Chapter 3, Configuring Centrify-enabled Samba to continue. Upgrading from a previous release The following sections describe how to upgrade from previous versions of DirectControl and Centrify-enabled Samba. Upgrading from a DirectControl version earlier than and Centrify-enabled Samba or earlier on page 21 Upgrading from DirectControl or later and Centrify-enabled Samba or earlier on page 22 Samba Integration Guide

21 Upgrading from a previous release Upgrading from a non-centrify-enabled version of Samba on page 22 Before proceeding, run the adinfo --version command on the UNIX computer to determine which version of DirectControl (CentrifyDC) you are running Upgrading from a DirectControl version earlier than and Centrifyenabled Samba or earlier The adbindproxy in this version of Centrify-enabled Samba requires at least DirectControl and a version of Centrify-enabled Samba greater than version In addition, the CentrifyDC idmap program, which was installed as part of Centrify-enabled Samba, conflicts with adbindproxy and must be removed. Use the following steps to upgrade from a Centrify-enabled Samba installation with a version of DirectControl earlier than 4.4.2, and Centrify-enabled Samba or earlier: 1 Copy the existing startup script /etc/init.d/centrifydc-samba file and rename it /etc/init.d/centrifydc-samba.upgrade. For example: cd /etc/init.d cp centrifydc-samba./centrifydc-samba.upgrade Note On HP-UX, there are two files you must copy and save before upgrading, /sbin/ init.d/centrifydc-samba and /etc/rc.config.d/centrifydc-samba.rc. For both of these files, append.upgrade to the file name. 2 Use the appropriate local operating system command or package manager to remove the old version of the idmap program. For example, the following table lists the common commands associated with each platform: For this platform Most Linux variants Debian/Ubuntu Sun Solaris HP-UX IBM AIX You can run rpm e CentrifyDC-idmap dpkg P centrifydc-idmap pkgrm CentrifyDC-idmap swremove CentrifyDC-idmap installp u CentrifyDC.idmap 3 Replace the Centrify Suite DirectControl and DirectManage components on all of the Windows and UNIX computer(s). See the DirectControl Administrator s Guide for the installation instructions. 4 Install Centrify-enabled Samba and adbindproxy as described in Installing Centrifyenabled Samba and adbindproxy on page 17. Note You may see package conflict errors during this step. If so, rerun the rpm command with the --nodeps and --replacefiles option. The --nodeps option installs the Chapter 2 Install the Centrify-enabled Samba package 21

22 Upgrading from a previous release Centrify-enabled Samba package without checking for dependencies; the -- replacefiles option replaces conflicting files with the files from the new package. This concludes Centrify-enabled Samba and adbindproxy installation. Go to Configuring Centrify-enabled Samba on page 25 to continue. Upgrading from DirectControl or later and Centrify-enabled Samba or earlier The adbindproxy in Centrify-enabled Samba requires at least DirectControl and a version of Centrify-enabled Samba greater than version If the target system has DirectControl or later but your Centrify-enabled Samba is version or earlier, use the following steps to update Centrify-enabled Samba, install Centrify-enabled Samba and adbindproxy as described in Installing Centrify-enabled Samba and adbindproxy on page 17. Note You may see package conflict errors during this step. If so, rerun the rpm installation command with the --nodeps and --replacefiles options. The --nodeps option installs the Centrify-enabled Samba package without checking for dependencies, while the -- replacefiles option replaces conflicting files with files from the new package. This concludes Centrify-enabled Samba and adbindproxy installation. Go to Configuring Centrify-enabled Samba on page 25 to continue. Upgrading from a non-centrify-enabled version of Samba If you have a Samba already installed on your system AND determine it serves you best to replace it (see Deciding how to work with old Samba installations on page 14 for a discussion of your options) use the following procedure too upgrade to Centrify-enabled Samba: 1 Save the existing winbind UID and GID assignments: If you have been running Samba and winbind on the computer where you are going to install Centrify-enabled Samba, save the existing winbind UID and GID assignments before you install the new software. This allows you to import these assignments into a Centrify Zone and map it to users and groups in Active Directory. If winbind is currently configured in your /etc/nsswitch.conf file, run the following commands to save the information to a file before installing: getent passwd grep -e -f /etc/passwd > /tmp/passwd.winbind getent group grep -e -f /etc/group > /tmp/group.winbind See Migrating existing Samba users to DirectControl on page 39 for more information. 2 Use the appropriate local operating system command or package manager to manually remove the old version of the Samba program. For example, you can use the following Samba Integration Guide

23 Upgrading from a previous release commands to remove the existing Samba program: For this platform Most Linux variants Debian/Ubuntu Sun Solaris HP-UX IBM AIX You can run rpm e samba-common-version dpkg P samba-common-version pkgrm samba-common-version swremove samba-common-version installp u samba-common-version You may see package conflict errors during this step that cause package removal to fail. In this case, proceed with the next step and be certain to use the --nodeps and -- replacefiles options when installing DirectControl Samba. 3 Install Centrify-enabled Samba and adbindproxy. See Installing Centrify-enabled Samba and adbindproxy on page 17 for the instructions. Since you are upgrading you may see package conflict errors when you run the package manager for Centrify-enabled Samba. If so, rerun the rpm command with the --nodeps or --replacefiles options. The --nodeps option installs the Centrify-enabled Samba package without checking for dependencies; the --replacefiles option replaces conflicting files with files in the new package. 4 Run the adbindproxy.pl script to configure Centrify-enabled Samba; see Running the adbindproxy.pl on page 26. Chapter 2 Install the Centrify-enabled Samba package 23

24 Upgrading from a previous release Samba Integration Guide

25 Chapter 3 Configuring Centrify-enabled Samba This chapter describes how to configure Centrify DirectControl and Centrify-enabled Samba to work together properly. The following topics are covered: Verifying the environment before you begin Verifying DNS settings on the local computer on page 26 Running the adbindproxy.pl on page 26 Verifying the Samba integration on page 32 Modifying the Samba smb.conf configuration file on page 35 Verifying the environment before you begin Centrify-enabled Samba includes the adbindproxy.pl script that performs most of the configuration steps for you. Before running this script, however, you should verify the environment is ready for configuration and you are ready to proceed. At this point, you should check that: Centrify DirectControl is installed on a Windows computer in an Active Directory domain. You have created at least one zone, either the default zone or a zone you created with the zone wizard. Note If you are running Centrify DirectControl in Express Mode, or have connected to a domain through Auto Zone, you will not have any zones configured. You can still configure Centrify-enabled Samba to run with DirectControl. You have added or imported some users and groups into the Centrify Zone. Only Active Directory users who are members of the Centrify Zone are able to access Samba shares on the local computer. The DirectControl Agent is installed on the computer where you have installed the Centrify-enabled Samba. Older, incompatible versions of Samba have been removed or updated with Centrifyenabled Samba on the computer that hosts the Samba shares. Note Although you are not required to remove older Samba versions, you should be careful to use versions with the proper operating system patches. You can use the adbindproxy.pl configuration script to automatically move and rename an older Samba 25

26 Verifying DNS settings on the local computer version to a different directory, or you can manually remove or rename an older Samba installation prior to running the adbindproxy.pl configuration script. The adbindproxy package is installed on the computer. Verifying DNS settings on the local computer Centrify Suite relies on DNS to locate its domain controller and monitor connection status. If you are unsure whether DNS is configured properly, you can run the adcheck utility, or manually inspect and, if necessary, edit the /etc/resolv.conf and /etc/hosts files to ensure server host names and IP addresses can be successfully resolved. Running adcheck Centrify Suite includes a utility, adcheck, which runs a number of operating system, network, and Active Directory checks to verify that your domains are correctly configured for DirectControl. You can run adcheck to verify your DNS settings, as follows: /usr/share/centrifydc/bin/adcheck -t net domainname where: -t net runs only the network check. domainname specifies the domain; for example, ajax.org. You should see output similar to the following: /usr/share/centrifydc/bin/adcheck -t net ajax.org NSHOSTS : Check hosts line in /etc/nsswitch.conf : Pass DNSPROBE : Probe DNS server : Pass DNSCHECK : Analyze basic health of DNS servers : Pass WHATSSH : Is this an SSH that DirectControl works well with : Pass SSH : SSHD version and configuration : Pass If adcheck encounters any problems with the configuration, it prints a warning or error message that includes information on how to correct the problem. Running the adbindproxy.pl This section describes how to configure Samba using the adbindproxy.pl script. Note If your current environment has Windows users accessing data on Samba member servers that are joined to the Active Directory domain, you may want to migrate those users to DirectControl. This way, you can use Centrify Zones to manage conflicting identities and rationalize UIDs and GIDs. See Migrating UNIX profiles to Active Directory on page 39 to migrate those users. Complete the migration before integrating Centrify-enabled Samba and DirectControl. Samba Integration Guide 26

27 Running the adbindproxy.pl The adbindproxy.pl script performs the following tasks: Determines the computer s operating system and adjusts accordingly. For example, for Solaris-based machines it verifies that all of the patches necessary to run Samba have been installed. Confirms that the DirectControl Agent is installed. Confirms the Centrify-enabled Samba has been installed. Checks for and reports any conflicting Samba installations. Note If the script finds another Samba installed, you have several options, see Deciding how to work with old Samba installations on page 14. Prompts you to create symbolic links to the Centrify-enabled Samba binaries in /usr/ bin and /usr/sbin. If you have existing links it backs up the originals. Determines if you are joined to an Active Directory domain and, if you are, displays the domain name and Centrify Zone. Asks if you want to join Centrify-enabled Samba to the current Active Directory domain or another. If you choose another, the script guides you through the current domain leave and new domain join processes. Note If you want to modify or set advanced join settings (for example, update PAM or NSS config, use DES for encryption, or use a computer alias), either run adleave before you run adbindproxy.pl or select a different domain when prompted in the script. Otherwise, the script does NOT prompt you to enter advanced join settings. If you have a previous Samba installation, asks if you want to keep the smb.conf settings or use new ones. adbindproxy.pl automatically saves the existing copy. Note The script automatically looks for an existing smb.conf file using the smbd -b command. If your current version of smbd does not support the -b option or you have smb.conf in a custom directory the script will not find it. If you want to use your existing smb.conf, move it to /etc/samba before you run the script. Removes old state files from previous instances of Samba, including any existing winbind entries from the /etc/nsswitch.conf file. Restarts the Centrify-enabled Samba clients (nmbd, winbindd, adbindd and smdb). Installs scripts to automatically start the correct Samba and DirectControl services each time the computer boots. Before you run adbindproxy.pl, read through the prompts described below to make sure you re prepared with the answers To begin, logon and switch to the root user and proceed with the following steps: 1 Start script: From root enter perl /usr/share/centrifydc/bin/adbindproxy.pl 2 Please specify Centrify Samba s path if it is not in [/opt/centrify/samba] Chapter 3 Configuring Centrify-enabled Samba 27

28 Running the adbindproxy.pl Press Enter to accept the default. Otherwise, enter your path. adbindproxy.pl checks for a conflicting version of Samba. If it does not find one you get the message No conflicting Samba found If it finds one, it displays the message Warning: potentially conflicting Samba installations were found in [directory] Do you want to continue [N] and shows the directory. How to proceed depends upon whether or not you want to keep the existing Samba versions. See Deciding how to work with old Samba installations on page 14 to review the options. Enter N if you need to terminate the script. Enter Y if you want to proceed with two Sambas. 3 Do you want to create symbolic links from /usr to /opt/centrify/samba/? [Y] Answer Y and press Enter for the following conditions: if there are no older Samba installations on the computer, if you have removed older Samba installations, or if you intend to entirely replace any older Samba installations with the Centrifyenabled Samba installation. See Deciding how to work with old Samba installations on page 14 for details on these choices. Answer N and press Enter if you want the existing Samba installation and Centrifyenabled Samba to co-exist. See Co-existing with existing Samba installations on page 16 for details on this choice. As it proceeds adbindproxy.pl displays its progress as it replaces and backs up the existing files. 4 Do you want to leave and join to another domain? [N] How you respond prompt depends upon whether or not the computer is already joined to a Active Directory domain. If you are joined to a domain when you initiated the script, adbindproxy.pl displays the domain name and zone and asks you Do you want to leave or join to another domain? [N] To continue to join Centrify-enabled Samba to the current joined Active Directory domain press Enter and skip ahead to Step 7 on page 30 If you want to leave the current domain and join another OR change any advanced options (see list below) in your current domain enter Y and then proceed with Step 5. Samba Integration Guide 28

29 Running the adbindproxy.pl If your are not joined, the script displays the message Not joined to any domain.make sure you enter the correct domain and zone information in the next steps This initiates a set of prompts that ask you for the Active Directory domain name, the Centrify Zone and advanced options. Proceed with the next step. 5 Join new Active Directory domain Note You arrive at this step if you are not joined to an Active Directory Domain when you started adbindproxy.pl, you decided to leave that domain OR you decided to change advanced options in your current join. If none of these conditions apply to you, skip to Step 7. The first prompt asks you for the domain name. Enter the Active Directory domain to join : and then asks Check DNS health for [domain]? Note: this may take several minutes [Y] : Press Enter to ensure the domain exists. Next, the script prompts you to enter the following properties: Centrify Zone on the target Active Directory domain Note If you are running DirectControl in Express Mode or need to join the domain through Auto Zone, enter NULL_AUTO for the zone name. computer name on which Centrify-enabled Samba is installed Active Directory authorized user (default is Administrator) 6 Do you wish to specify advanced join options? [N] : The options are listed below. The defaults are in brackets. If do not need any advanced join options, enter N. Otherwise, enter Y and make your selections. Canonical name of Active Directory Computer Container Preferred Domain Server to use (press Enter for none) Update PAM and NSS Config [Y] Trust computer for delegation? [N] Use DES encryption only? [N] Run adjoin in verbose mode? [N] Addition computer alias (press Enter for none) The script then displays the selections you made and asks if you want to proceed. Enter Y to proceed or N to abort adbindproxy.pl. If you choose to proceed AND you are leaving the current Active Directory domain to join another, the script prompts you twice to enter your password. In response to the first prompt enter the current Active Directory domain account password to leave that domain; for the second prompt, enter the password for the Active Directory Domain, Chapter 3 Configuring Centrify-enabled Samba 29

30 Running the adbindproxy.pl computer and authorized user specified in the prompts to join that domain. If you were not joined to an Active Directory domain when you started the script, you are prompted to enter your password once. Enter the password for the Active Directory Domain, computer and authorized user specified in the prompts. 7 Keep Samba Settings? adbindproxy.pl creates a new smb.conf file and stores it in /etc/samba. It can create a skeletal version with minimal global settings and a samba-test share only (see Modifying the Samba configuration file (smb.conf) on page 30 for a sample), or it can update an existing smb.conf file. Note Regardless of whether you update an existing smb.conf or create a new one, you will need to modify the /etc/samba/smb.conf file to have the [global] section settings and the appropriate shares for your environment. See Modifying the Samba smb.conf configuration file on page 35 for instructions. The file created by adbindproxy.pl should be used for verifying the Centrify-enabled Samba integration only. After completing the join routines in the script, adbindproxy.pl searches for existing smb.conf files. If it does not find one, it automatically creates a new one and displays the message Updating smb.conf with Centrify recommended settings... and finishes the script - skip to Finishing Up on page 31 for the messages. If it does find one, adbindproxy.pl copies the file to /etc/samba asks Do you want to keep the original samba settings? [Y] : Note If adbindproxy.pl finds more than one smb.conf, it displays the list and asks you to select one. After you make the selection, it copies that one to /etc/samba and continues. Enter N to create the skeletal smb.conf. adbindproxy.pl makes a backup of your smb.conf in /etc/samba in the form, smb.conf.yyyy-mm-dd-hh-mm and creates the skeletal version. Enter Y to modify the existing file. adbindproxy.pl displays the prompt: Backup existing /etc/samba/smb.conf and add Centrify recommended settings? [Y] Enter Y to create a backup in the form, smb.conf.yyyy-mm-dd-hh-mm. Enter N to use the existing smb.conf without making a backup. Note If the existing smb.conf has Security = ADS and the workgroup and realm are set, the script does NOT modify the existing file; the original is left unchanged. 8 Reset the Samba User/Group ID Cache (Centrify Samba may create conflicting mappings) [Y] Samba Integration Guide 30

31 Running the adbindproxy.pl adbindproxy.pl creates new mapping in the Samba User/Group ID cache, which may result in conflicts if there are any mappings in place already. Unless you created custom mappings, use the default [Y]. This flushes the cache. This prompt is only pertinent to the small set of Samba administrators who created custom user and group ID mappings. If you do have custom mappings, use the default to flush the cache and prevent potential conflicts. After adbindproxy.pl completes, re-add your mappings as necessary. Finishing Up To complete the configuration, adbindproxy.pl stops any running versions of smbd, adbindd, winbindd and nmbd, starts the Centrify-enabled versions and displays a set of progress and configuration messages. You should see the following messages: Init Samba start script... Restarting Samba daemons... Stopping Samba smbd: [ OK ] Stopping Samba adbindd [ OK ] Stopping Samba winbindd: [ OK ] Stopping Samba nmbd: [ OK ] Starting CentrifyDC-Samba nmbd: [ OK ] Starting CentrifyDC-Samba winbindd: [ OK ] Starting CentrifyDC-Samba adbindd: [ OK ] Starting CentrifyDC-Samba smbd: [ OK ] adbindproxy.pl displays one last prompt Press ENTER to continue... To finish up, press Enter. Note If any service fails to start, you should run one of the following after the adbindproxy.pl script completes its execution. On Linux or Solaris computers, run: /etc/init.d/centrifydc-samba restart On HP-UX computers, run: /sbin/init.d/centrifydc-samba restart On AIX computers, run: stopsrc -g samba && startsrc -g samba As a quick test, log off as the root user and log on with an Active Directory user account that has been granted access to the local computer s zone. If this is the first time the you are logging on with this user account, check that the user s home directory is created, which is created automatically by Centrify DirectControl the first time you log on. Chapter 3 Configuring Centrify-enabled Samba 31

32 Verifying the Samba integration Verifying the Samba integration There are two key scenarios for testing whether Samba is configured properly for integration with Centrify DirectControl and Active Directory: Accessing Samba shares from a UNIX client session Accessing Samba shares from a Windows desktop session Accessing Samba from a UNIX client session To test access to Samba shares on a UNIX computer for Active Directory users: 1 Log on to the UNIX machine as an Active Directory user account that has been granted access to the local computer s zone. 2 Run the following: smbclient -k -L localhost The smbclient program displays information about Samba and the SMB shares that are available on the local computer. For example, you should see a listing similar to the following (where s.s.s is the Samba version and v.v.v is the DirectControl version: OS=[Unix] Server=[Samba s.s.s-cdc-v.v.v-xxx] Sharename Type Comment samba-test Disk IPC$ IPC IPC Service (Samba-CDC) sara Disk Home directories OS=[Unix] Server=[Samba s.s.s-cdc-v.v.v-xxx] Server Comment Workgroup Master ARCADE MAGNOLIA If you are able to see the Samba shares as an Active Directory user logged on to the UNIX computer acting as the Samba server, you should next test accessing the Samba shares from a Windows desktop. For information about performing this test, see Accessing Samba shares from a Windows desktop on page 33. Purging and reissuing Kerberos tickets If you see an error such as NT_STATUS_LOGIN_FAILURE instead of the expected results when you run the smbclient program, you may need to purge your existing Kerberos tickets and have them reissued. Try running the following command to remove all of your Kerberos tickets: /usr/share/centrifydc/kerberos/bin/kdestroy Samba Integration Guide 32

33 Verifying the Samba integration Then run the following command to reissue tickets after you provide your Active Directory password: /usr/share/centrifydc/kerberos/bin/kinit You can then run the following command to list the Kerberos tickets that have been issued to you: /usr/share/centrifydc/kerberos/bin/klist After verifying the Kerberos tickets you have been issued, try running the smbclient program again. Verifying the version of Samba you are using If purging and reissuing tickets does not resolve the problem, confirm the version of the smbstatus that is currently running using the following command: smbstatus grep version The command should display the Centrify-enabled Samba version you have installed. For example: Samba s.s.s-cdc-v.v.v-xxx (where s.s.s is the installed Samba version number and v.v.v is the DirectControl version number) The string, cdc-release (cdc-v.v.v.xxx), indicates that the installed Samba package is Centrify-enabled Samba intended for use with DirectControl. If the version of Samba is not the one provided by Centrify, completely remove this version and install the precompiled version from the Centrify-enabled Samba software package. If the correct version of Samba is installed, run smbstatus again and note the names of any *.tdb files that do not exist, and try restoring them from your backup, then try running the smbclient program again. Rejoining the domain If the smbclient program does not display the Samba shares you have defined in the configuration file, you should review the settings in the smb.conf file, then leave and rejoin the Active Directory domain. Accessing Samba shares from a Windows desktop To test access to Samba shares on a UNIX computer from a Windows desktop: 1 Log on to a Windows computer that is joined to the domain with an Active Directory user account. 2 Click Start > Windows Explorer, then navigate to the domain. For example, open My Network Places > Entire Network > Microsoft Windows Network > Arcade to view the Arcade.net domain. 3 Select the UNIX computer that is running Centrify-enabled Samba to view its Chapter 3 Configuring Centrify-enabled Samba 33

34 Verifying the Samba integration Samba shares. For example: The default Samba share (samba-test) and any other shares you have defined for the computer are displayed 4 Click samba-test or browse other available Samba shares to verify that you can open existing files and create new files. 5 Confirm from both Windows and UNIX that the files in the share directories are owned by the correct users. If you cannot browse the shares on the UNIX computer from the Windows desktop, you should: Verify that there is network connectivity between the two systems. Confirm that you do not have a firewall running on the UNIX system that is blocking access to the SMB ports. Make sure there are no stale Kerberos tickets on your Windows system by obtaining the Windows kerbtray program from the Microsoft Web site, installing it on the Windows computer, and using it to purge your Kerberos tickets. Log out and log in again to your Windows system and retest accessing the Samba shares from Windows. Samba Integration Guide 34