Installer FusionDirectory sur Ubuntu

En cours de rédaction
Testé sur Ubuntu 12.04

Ce how-to décrit la mise en place:

d'un annuaire LDAP

un contrôleur samba

un serveur DNS

un serveur DHCP

Tous les services (samba, dns, dchp) utilisent LDAP pour récupérer la configuration et les comptes. L'annuaire LDAP est contrôlé par l'interface FusionDirectory.

Dans cet exemple, tous ces services tournent sur la même machine, mais il est bien sûre possible de les faire tourner chacun sur une machine indépendante (du moment que chaque service peut se connecter à l'annuaire LDAP)

Installer OpenLDAP

sudo apt-get install slapd ldap-utils sudo /etc/init.d/slapd stop

Installez FusionDirectory

Ajout du dépôt FusionDirectory

echo "deb http://repos.fusiondirectory.org/debian stable main" | sudo tee /etc/apt/sources.list.d/fusiondirectory.list wget -O - http://repos.fusiondirectory.org/gpg/fusiondirectory_public.key | sudo apt-key add - sudo apt-get update

Installer les schémas de base de FusionDirectory

sudo apt-get install fusiondirectory-schema fusiondirectory-plugin-dns-schema fusiondirectory-plugin-dhcp-schema

Configurer LDAP

Préparation de quelques variables

Dans cette étape, on va créer quelques fichiers texte simples qui contiendront des variables dont on aura besoin plus tard. Cette étape n'est pas indispensable, mais permet d'automatiser la personnalisation des fichiers de configuration selon votre environnement

sudo mkdir /etc/install sudo chmod 700 /etc/install sudo -s echo 'p@ssw0rd' > /etc/install/ldap.pw echo 'Firewall Services' > /etc/install/ldap.org echo 'dc=firewall-services,dc=com' > /etc/install/ldap.base echo 'firewall-services' > /etc/install/ldap.topdc echo 'pdc' > /etc/install/samba.netbios echo 'FIREWALL.LOCAL' > /etc/install/samba.domain echo 'firewall-services.com' > /etc/install/dnsdomain openssl rand -base64 33 > /etc/install/samba.pw openssl rand -base64 33 > /etc/install/dhcp.pw openssl rand -base64 33 > /etc/install/unix.pw

Téléchargez ce fichier de configuration et placez-le dans /etc/ldap/slapd.conf (root:openldap et chmod 640)

include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/openldap.schema #include /etc/ldap/schema/nis.schema include /etc/ldap/schema/fusiondirectory/rfc2307bis.schema include /etc/ldap/schema/misc.schema #include /etc/ldap/schema/gosa/trust.schema include /etc/ldap/schema/fusiondirectory/samba.schema include /etc/ldap/schema/fusiondirectory/gosystem.schema include /etc/ldap/schema/fusiondirectory/gofon.schema include /etc/ldap/schema/fusiondirectory/goto.schema include /etc/ldap/schema/fusiondirectory/goto-mime.schema include /etc/ldap/schema/fusiondirectory/gosa-samba3.schema #include /etc/ldap/schema/fusiondirectory/gofax.schema #include /etc/ldap/schema/fusiondirectory/openssh.schema include /etc/ldap/schema/fusiondirectory/goserver.schema #include /etc/ldap/schema/fusiondirectory/fai.schema include /etc/ldap/schema/fusiondirectory/dnszone.schema #include /etc/ldap/schema/fusiondirectory/rfc2739.schema #include /etc/ldap/schema/fusiondirectory/kolab2.schema #include /etc/ldap/schema/fusiondirectory/apple.schema #include /etc/ldap/schema/fusiondirectory/nagios.schema #include /etc/ldap/schema/fusiondirectory/phpgwaccount.schema #include /etc/ldap/schema/fusiondirectory/pureftpd.schema #include /etc/ldap/schema/fusiondirectory/phpscheduleit.schema #include /etc/ldap/schema/fusiondirectory/pptp.schema #include /etc/ldap/schema/fusiondirectory/openxchange.schema include /etc/ldap/schema/fusiondirectory/dhcp.schema password-hash {CRYPT} password-crypt-salt-format "$1$%.8s" pidfile /var/run/slapd/slapd.pid loglevel 1024 modulepath /usr/lib/ldap moduleload back_hdb moduleload memberof.la database hdb overlay memberof memberof-group-oc groupOfNames memberof-member-ad member memberof-memberof-ad memberOf cachesize 10000 mode 0600 suffix "dc=firewall-services,dc=com" rootdn "cn=admin,dc=firewall-services,dc=com" rootpw __SECRET__ index uid,mail eq,sub index gosaMailAlternateAddress,gosaMailForwardingAddress eq index cn,sn,givenName,ou pres,eq,sub index objectClass pres,eq index uidNumber,gidNumber,memberuid,member eq index gosaSubtreeACL,gosaObject,gosaUser pres,eq index sambaSID eq,sub index sambaPrimaryGroupSID eq index sambaDomainName eq index sambaGroupType eq index sambaSIDList eq index zoneName eq index relativeDomainName eq index dhcpHWAddress eq index dhcpClassData eq index dhcpPrimaryDN eq index dhcpSecondaryDN eq index dhcpServerDN eq index dhcpFailOverPeerDN eq directory "/var/lib/ldap" # Accès aux mots de passe access to attrs=userPassword,sambaLmPassword,sambaNtPassword by dn=uid=samba,ou=DSA,dc=firewall-services,dc=com write by anonymous auth by self write by * none # Accès aux attributs samba access to attrs=sambaAcctFlags,sambaBadPasswordCount,sambaBadPasswordTime,sambaKickoffTime,sambaLogoffTime,sambaLogonHours,sambaPasswordHistory,sambaSID,sambaPrimaryGroupSID,sambaPwdCanChange,sambaPwdLastSet,sambaPwdMustChange,sambaUserWorkstations,sambaSIDList,sambaGroupType,sambaMungedDial,sambaLogonHours,sambaLogonTime,sambaDomainName,sambaHomePath,sambaHomeDrive by dn=uid=samba,ou=DSA,dc=firewall-services,dc=com write by self read by * none access to filter=(objectClass=sambaDomain) by dn=uid=samba,ou=DSA,dc=firewall-services,dc=com write by group.exact="cn=admins,ou=Groups,dc=firewall-services,dc=com" write by * none access to dn.subtree=ou=Computers,ou=systems,dc=firewall-services,dc=com by dn=uid=samba,ou=DSA,dc=firewall-services,dc=com write by group.exact="cn=admins,ou=Groups,dc=firewall-services,dc=com" write by * none # Accès aux attributs posix access to attrs=loginShell,gidNumber,homeDirectory,uidNumber,shadowExpire,shadowFlag,shadowInactive,shadowLastChange,shadowMax,shadowMin,shadowWarning by dn=uid=samba,ou=DSA,dc=firewall-services,dc=com write by self read by dn="uid=unix,ou=DSA,dc=firewall-services,dc=com" read # Accès aux container des comptes systèmes access to dn.subtree=ou=DSA,dc=firewall-services,dc=com by group.exact="cn=admins,ou=Groups,dc=firewall-services,dc=com" write by * none # Accès pour tous le monde à la base access to dn.base=dc=firewall-services,dc=com by * read # Accès anonyme obligatoire aux entrées DNS access to dn.subtree=ou=systems,dc=firewall-services,dc=com filter=(objectClass=dNSZone) by * read # Accès à des fins d'annuaires aux utilisateurs et aux groupes access to dn.regex="^.*,ou=(People|Groups),dc=firewall-services,dc=com" by * read # Accès au reste access to * by users read by anonymous auth

Télécharger ce fichier, et remplacez la base de l'arbre par le votre, ainsi que le mot de passe admin de la base

sudo sed -i -e "s/dc=firewall-services,dc=com/$(sudo cat /etc/install/ldap.base)/g" \ -e "s/__SECRET__/$(sudo cat /etc/install/ldap.pw)/g" /etc/ldap/slapd.conf

Supprimer le répertoire /etc/ldap/slapd.d (plus simple de configurer slapd à l'ancienne dans le fichier de config /etc/ldap/slapd.conf)

sudo rm -rf /etc/ldap/slapd.d/

Vider la base LDAP existante et l'initialiser avec des valeurs qui vont bien:

sudo rm -rf /var/lib/ldap/{*.bdb,__*,alock,log.*}
dn: dc=firewall-services,dc=com dc: firewall-services o: Firewall Services ou: firewall-services description: firewall-services objectClass: top objectClass: organization objectClass: dcObject objectClass: gosaDepartment dn: ou=systems,dc=firewall-services,dc=com objectClass: organizationalUnit ou: systems dn: ou=Computers,ou=systems,dc=firewall-services,dc=com objectClass: organizationalUnit ou: Computers dn: ou=Groups,dc=firewall-services,dc=com objectClass: top objectClass: organizationalUnit ou: Groups dn: ou=Users,dc=firewall-services,dc=com objectClass: top objectClass: organizationalUnit ou: Users dn: ou=DSA,dc=firewall-services,dc=com objectClass: organizationalUnit objectClass: top ou: DSA dn: uid=samba,ou=DSA,dc=firewall-services,dc=com objectClass: account objectClass: simpleSecurityObject objectClass: top userPassword:: e0NSWVBUfSQxJGxHQmxFT2FFJDdtMHowNUxBd29WYmN1eDF0S2NBTjE= uid: samba dn: uid=dhcp,ou=DSA,dc=firewall-services,dc=com objectClass: account objectClass: simpleSecurityObject objectClass: top userPassword:: e0NSWVBUfSQxJGxHQmxFT2FFJDdtMHowNUxBd29WYmN1eDF0S2NBTjE= uid: dhcp dn: uid=unix,ou=DSA,dc=firewall-services,dc=com objectClass: account objectClass: simpleSecurityObject objectClass: top userPassword:: e0NSWVBUfSQxJGxHQmxFT2FFJDdtMHowNUxBd29WYmN1eDF0S2NBTjE= uid: unix

Remplacez la base par la votre

sed -i -e "s/dc=firewall-services,dc=com/$(sudo cat /etc/install/ldap.base)/g" \ -e "s/firewall-services/$(sudo cat /etc/install/ldap.topdc)/g" ./init.ldif

Injectez ce fichier dans LDAP

sudo slapadd -l ./init.ldif sudo chown openldap:openldap /var/lib/ldap/* sudo /etc/init.d/slapd start

Configurer votre base de recherche et l'URI par défaut dans /etc/ldap/ldap.conf

cat<<'EOF' | sudo tee /etc/ldap/ldap.conf BASE dc=firewall-services,dc=com URI ldap://localhost/ # TLS certificates (needed for GnuTLS) TLS_CACERT /etc/ssl/certs/ca-certificates.crt EOF sudo sed -i -e "s/dc=firewall-services,dc=com/$(sudo cat /etc/install/ldap.base)/g" /etc/ldap/ldap.conf

Personnalisez les mots de passe des comptes samba et dhcp

ldappasswd -x -D cn=admin,$(sudo cat /etc/install/ldap.base) -w $(sudo cat /etc/install/ldap.pw) \ -s $(sudo cat /etc/install/samba.pw) uid=samba,ou=DSA,$(sudo cat /etc/install/ldap.base) ldappasswd -x -D cn=admin,$(sudo cat /etc/install/ldap.base) -w $(sudo cat /etc/install/ldap.pw) \ -s $(sudo cat /etc/install/dhcp.pw) uid=dhcp,ou=DSA,$(sudo cat /etc/install/ldap.base) ldappasswd -x -D cn=admin,$(sudo cat /etc/install/ldap.base) -w $(sudo cat /etc/install/ldap.pw) \ -s $(sudo cat /etc/install/unix.pw) uid=unix,ou=DSA,$(sudo cat /etc/install/ldap.base)

Configurer l'authentification nss_ldap

Pour que samba fonctionne normalement, il faut que les comptes UNIX du contrôleur soient basés sur l'annuaire LDAP:

Installer les paquet nécessaires:

sudo apt-get install ldap-auth-client auth-client-config

Inscrivez le mot de passe admin de l'annuaire LDAP dans /etc/ldap.secret

sudo cat /etc/install/ldap.pw | sudo tee /etc/ldap.secret sudo chmod 600 /etc/ldap.secret

Configurez nss-ldap:

cat<<'EOF' | sudo tee /etc/ldap.conf ssl no pam_password exop pam_filter objectclass=posixAccount pam_login_attribute uid host localhost base dc=firewall-services,dc=com nss_base_group ou=Groups,dc=firewall-services,dc=com?one nss_base_passwd ou=Users,dc=firewall-services,dc=com?one nss_base_passwd ou=Computers,ou=systems,dc=firewall-services,dc=com?one nss_base_shadow ou=Users,dc=firewall-services,dc=com?one nss_base_shadow ou=Computers,ou=systems,dc=firewall-services,dc=com?one rootbinddn cn=admin,dc=firewall-services,dc=com binddn uid=unix,ou=DSA,dc=firewall-services,dc=com bindpw __SECRET__ bind_policy soft nss_initgroups_ignoreusers Debian-exim,backup,bin,bind,daemon,dhcpd,games,gnats,irc,landscape,libuuid,list,lp,mail,man,messagebus,news,openldap,proxy,root,sshd,sync,sys,syslog,uucp,whoopsie,www-data EOF

Personnalisez ce fichier selon votre environnement

sudo sed -i -e "s/dc=firewall-services,dc=com/$(sudo cat /etc/install/ldap.base)/g" \ -e "s/__SECRET__/$(sudo cat /etc/install/unix.pw)/g" /etc/ldap.conf

Configurer le système pour utiliser nss-ldap

cat<<'EOF' | sudo tee /etc/auth-client-config/profile.d/ldap [ldap] nss_passwd= passwd: compat ldap nss_group= group: compat ldap nss_shadow= shadow: compat ldap nss_netgroup= netgroup: nis pam_auth= auth [success=3 default=ignore] pam_unix.so nullok_secure try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth [success=1 default=ignore] pam_ldap.so use_first_pass auth requisite pam_deny.so auth required pam_permit.so pam_account= account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so pam_password= password sufficient pam_unix.so obscure sha512 password sufficient pam_ldap.so use_authtok password required pam_deny.so pam_session= session required pam_mkhomedir.so skel=/etc/skel/ umask=0077 session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_ldap.so session required pam_unix.so EOF

Activez l'authentification nss-ldap:

sudo auth-client-config -a -p ldap

Configurez FusionDirectory

installez les paquets nécesssaires

sudo apt-get install fusioninventory

Aller sur http://<l'ip de votre serveur>/fusiondirectory , puis suivez les instructions

<fc #FF0000>INSÉRER SCREENSHOTS</fc>

Copier le fichier téléchargé dans /etc/fusiondirectory/fusiondirectory.conf et corriger les permissions sur ce fichier

echo Yes | sudo fusiondirectory-setup --check-config

Éditez ce fichier /etc/fusiondirectory/fusiondirectory.conf et ajoutez les directives suivantes dans la section <location name=“default” (à adapter en fonction des uid/gid min et max que vous voulez)

idAllocationMethod="pool"
uidNumberPoolMin="1000"
uidNumberPoolMax="10000"
gidNumberPoolMin="1000"
gidNumberPoolMax="10000"

Faites un lien de /etc/shells dans /etc/fusiondirectory/shells (pour que l'interface liste les shells disponibles)

sudo ln -s /etc/shells /etc/fusiondirectory/shells

Contrôleur samba

Ajouter le support d'un contrôleur de domaine samba

Installer les paquets nécessaires

Sur le serveur FusionDirectory:

sudo apt-get install fusiondirectory-plugin-samba

SUr le serveur samba

sudo apt-get install samba-client samba smbldap-tools smbclient

Configurez samba

Prenez ce fichier smb.conf comme modèle, ajustez le et remplacez le contenu de /etc/samba/smb.conf

[global] # Script pour créer automatiquement les comptes machines lors de la jonction au domaine NT add machine script = /usr/local/bin/addworkstation.sh "%u" # Désactive les profiles itinérants logon path = # Nom du domaine NT workgroup = __DOMAIN__ # nom et description de ce serveur sur le réseau netbios name = __NETBIOS__ server string = %h server (Samba, Ubuntu) # Contrôleur de domaine domain master = yes preferred master = yes local master = yes domain logons = yes security = user encrypt passwords = true # On active la résolution wins wins support = yes dns proxy = no # Log level pour debuguer pendant la mise en place # Cette directove peut être supprimée une fois que tout est fonctionnel log level = 2 # COnfiguration des journaux log file = /var/log/samba/log.%m max log size = 1000 syslog = 0 # En cas de crash, on envoi un core dump à l'admin panic action = /usr/share/samba/panic-action %d # Backend LDAP passdb backend = ldapsam:ldap://localhost ldap admin dn = uid=samba,ou=DSA,,dc=firewall-services,dc=com ldap suffix = dc=firewall-services,dc=com ldap group suffix = ou=Groups ldap user suffix = ou=Users ldap machine suffix = ou=Computers,ou=systems ldap idmap suffix = ou=Users ldap delete dn = no ldap passwd sync = yes ldap ssl = off obey pam restrictions = yes # Pas de synchro des mot de passes UNIX, tout est dans LDAP unix password sync = no pam password change = no # Pas de compte invité map to guest = bad user # Optimisations SOCKET socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 # Support des ACL nt acl support = yes inherit acls = yes map acl inherit = yes map archive = no map hidden = no map read only = no map system = no store dos attributes = yes inherit permissions = yes [homes] comment = Répertoire Personnel browseable = no guest ok = no read only = no writable = yes printable = no create mode = 0660 force create mode = 0660 directory mode = 0770 force directory mode = 0770 path = /home/__DOMAIN__/%S root preexec = /usr/local/bin/mkhomedir.sh %U [printers] comment = All Printers browseable = no path = /var/spool/samba printable = yes guest ok = no read only = yes create mask = 0700 [print$] comment = Printer Drivers path = /var/lib/samba/printers browseable = yes read only = yes guest ok = no [netlogon] comment = Network Logon Service path = /var/lib/samba/netlogon guest ok = yes writable = yes browseable = no [files] comment = Partage de fichiers path = /home/files guest ok = no read only = no writeable = yes admin users = @"__DOMAIN__\admins"

Créez le partage de fichier global

sudo mkdir -p /home/files sudo chown :admins /home/files sudo chmod g+w /home/files sudo chmod g+s /home/files

Personnalisez le fichier

sudo sed -i -e "s/__DOMAIN__/$(sudo cat /etc/install/samba.domain)/g" \ -e "s/__NETBIOS__/$(sudo cat /etc/install/samba.netbios)/g" /etc/samba/smb.conf

Créez le script /usr/local/bin/addworkstation.sh

#!/bin/bash -e NAME=$1 /usr/sbin/smbldap-useradd -w "$NAME" /usr/sbin/smbldap-usermod -Z cn=$(echo "$NAME" | perl -ne '/(.*)\$$/ && print $1') "$NAME"

Donnez les droits d'exécution

sudo chmod +x /usr/local/bin/addworkstation.sh

Créez le répertoire /var/lib/samba/netlogon

sudo mkdir -p /var/lib/samba/netlogon

Créez le script /usr/local/bin/mkhomedir.sh (il se chargera de créer le répertoire personnel à la connexion au partage s'il n'existe pas encore)

#!/bin/bash HOME=$(getent passwd $1 | cut -d':' -f6) if [ ! -e $HOME ]; then mkdir -p $HOME chown $1:$1 $HOME chmod 700 $HOME fi exit 0

Rendez ce script exécutable:

sudo chmod +x /usr/local/bin/mkhomedir.sh

Arrêter samba

sudo stop smbd sudo stop nmbd

Récupérez le SID de votre domaine:

net getlocalsid -s /dev/null

Inscrivez uniquement le SID dans le fichier /etc/install/samba.sid

echo $(sudo net getlocalsid -s /dev/null | perl -ne 'm/SID\ for\ domain.*(S-.*)/ && print $1') | sudo tee -a /etc/install/samba.sid

Récupérez ce fichier ldif

dn: sambaDomainName=FIREWALL,dc=firewall-services,dc=com sambaDomainName: FIREWALL sambaSID: S-1-5-21-914473772-2881700657-1641011455 sambaAlgorithmicRidBase: 1000 sambaNextUserRid: 1000 sambaMinPwdLength: 5 sambaMinPwdAge: 0 sambaLockoutDuration: 30 sambaLockoutObservationWindow: 30 sambaLockoutThreshold: 0 sambaForceLogoff: -1 sambaRefuseMachinePwdChange: 0 gidNumber: 2000 objectClass: sambaDomain objectClass: sambaUnixIdPool uidNumber: 2000 sambaLogonToChgPwd: 1 sambaMaxPwdAge: 7776000 sambaPwdHistoryLength: 4 dn: cn=admins,ou=groups,dc=firewall-services,dc=com cn: admins gidNumber: 512 sambaGroupType: 2 sambaSID: S-1-5-21-914473772-2881700657-1641011455-512 objectClass: top objectClass: posixGroup objectClass: groupOfNames objectClass: sambaGroupMapping objectClass: sambaIdmapEntry displayName: Domain Admins description: Domain Admins member: cn=admins,ou=groups,dc=firewall-services,dc=com dn: cn=invites,ou=groups,dc=firewall-services,dc=com cn: invites gidNumber: 514 member: cn=invites,ou=groups,dc=firewall-services,dc=com sambaGroupType: 2 sambaSID: S-1-5-21-914473772-2881700657-1641011455-514 objectClass: top objectClass: posixGroup objectClass: groupOfNames objectClass: sambaGroupMapping objectClass: sambaIdmapEntry dn: cn=utilisateurs,ou=groups,dc=firewall-services,dc=com cn: utilisateurs sambaGroupType: 2 sambaSID: S-1-5-21-914473772-2881700657-1641011455-513 objectClass: top objectClass: posixGroup objectClass: groupOfNames objectClass: sambaGroupMapping objectClass: sambaIdmapEntry gidNumber: 513 member: cn=utilisateurs,ou=groups,dc=firewall-services,dc=com dn: cn=machines,ou=groups,dc=firewall-services,dc=com cn: machines member: cn=machines,ou=groups,dc=firewall-services,dc=com sambaGroupType: 2 objectClass: top objectClass: posixGroup objectClass: groupOfNames objectClass: sambaGroupMapping objectClass: sambaIdmapEntry displayName: Domain Computers sambaSID: S-1-5-21-914473772-2881700657-1641011455-515 gidNumber: 515

Personnalisez ce fichier selon votre environnement:

sed -i -e "s/dc=firewall-services,dc=com/$(sudo cat /etc/install/ldap.base)/g" \ -e "s/S-1-5-21-914473772-2881700657-1641011455/$(sudo cat /etc/install/samba.sid)/g" samba.ldif

Puis injectez le fichier dans votre base LDAP:

ldapadd -x -D cn=admin,$(sudo cat /etc/install/ldap.base) -w $(sudo cat /etc/install/ldap.pw) -f ./samba.ldif -c

Stocker le mot de passe LDAP dans secrets.tdb

sudo smbpasswd -w $(sudo cat /etc/install/samba.pw)

Démarrer samba

sudo start smbd sudo start nmbd

Configurez smbldap-tools

Récupérez ces deux fichiers, et placez les dans /etc/smbldap-tools

# Remplacez par votre SID SID="S-1-5-21-914473772-2881700657-1641011455" # Rempalcez par votre domaine NT sambaDomain="__NT_DOMAIN__" masterLDAP="localhost" masterPort="389" ldapTLS="0" ldapSSL="0" # Remplacez par votre base LDAP suffix="dc=firewall-services,dc=com" usersdn="ou=Users,${suffix}" computersdn="ou=Computers,ou=systems,${suffix}" groupsdn="ou=Groups,${suffix}" idmapdn="ou=Users,${suffix}" sambaUnixIdPooldn="sambaDomainName=${sambaDomain},${suffix}" scope="sub" password_hash="exop" userLoginShell="/bin/bash" # Remplacez par votre domaine NT userHome="/home/__NT_DOMAIN__/%U" userHomeDirectoryMode="700" userGecos="System User" defaultUserGid="513" defaultComputerGid="515" skeletonDir="/etc/skel" shadowAccount="1" defaultMaxPasswordAge="45" # Remplacez par le nom netbios du serveur userSmbHome="\\__NETBIOS__\%U" # Remplacez par votre domaine de mails mailDomain="__DNS_DOMAIN__" with_smbpasswd="0" smbpasswd="/usr/bin/smbpasswd" with_slappasswd="0" slappasswd="/usr/sbin/slappasswd"
# Remplacez par le DN admin LDAP slaveDN="cn=admin,dc=firewall-services,dc=com" masterDN="cn=admin,dc=firewall-services,dc=com" # Remplacez par votre mot de passe admin LDAP slavePw="__SECRET__" masterPw="__SECRET__"

Personnalisez ces fichiers selon votre environnement:

sudo sed -i -e "s/dc=firewall-services,dc=com/$(sudo cat /etc/install/ldap.base)/g" \ -e "s/S-1-5-21-914473772-2881700657-1641011455/$(sudo cat /etc/install/samba.sid)/g" \ -e "s/firewall-services.com/$(sudo cat /etc/install/dnsdomain)/g" \ -e "s/__NETBIOS__/$(sudo cat /etc/install/samba.netbios)/g" \ -e "s/__NT_DOMAIN/$(sudo cat /etc/install/samba.domain)/g" \ -e "s/__DNS_DOMAIN__/$(sudo cat /etc/install/dnsdomain)/g" /etc/smbldap-tools/smbldap.conf sudo sed -i -e "s/dc=firewall-services,dc=com/$(sudo cat /etc/install/ldap.base)/g" \ -e "s/__SECRET__/$(sudo cat /etc/install/ldap.pw)/g" /etc/smbldap-tools/smbldap_bind.conf sudo chmod 600 /etc/smbldap-tools/smbldap_bind.conf

Gestion des machines

Installez le plugin fusiondirectory-plugin-systems

sudo apt-get install fusiondirectory-plugin-systems sudo /etc/init.d/apache2 restart

Récupérez le script net-resolver.sh (permet de récupérer les info des machines)

wget -P /usr/local/bin/ https://oss.gonicus.de/labs/gosa/export/21216/branches/2.5/contrib/scripts/net-resolver.sh chmod +x /usr/local/bin/net-resolver.sh

Éditez le fichier /etc/fusiondirectory/fusiondirectory.conf ???

Ajoutez la base des OUI (pour avoir les info de constructeurs à partir de l'adresse MAC:

sudo wget -P /etc/fusiondirectory/ http://standards.ieee.org/regauth/oui/oui.txt

Serveur DNS

Installez le support DNS pour fusiondirectory

sudo apt-get install fusiondirectory-plugin-dns

Dans l'interface de FusionDirectory, ajoutez un objet serveur (dans Systèmes), puis ajoutez un service DNS et créez votre zone

Installer bind9

sudo apt-get install bind9 ldap2zone

Éditez le fichier /etc/bind/named.conf et ajoutez

echo 'include "/etc/bind/named.conf.ldap2zone";' | sudo tee -a /etc/bind/named.conf

Créez ce fichier

sudo touch /etc/bind/named.conf.ldap2zone

Configurez l'outil ldap2bind

sudo mv /etc/default/ldap2zone/ /tmp cat<<'EOF' | sudo tee /etc/default/ldap2zone # Configuration file for automatic deployment of ldap2zone generated zones to bind # Should we run the cronjob # DEFAULT: "false" RUN_DEPLOY="false" # How the LDAP server can be accessed # DEFAULT: "ldap://localhost" LDAP_URI="ldap://localhost" # Where the bind config is stored # DEFAULT: "/etc/bind" BIND_DIR="/etc/bind" # Where the zonefiles are located # DEFAULT: "/var/cache/bind" BIND_DATA="/etc/bind/" # Time to live value for a and ptr records # DEFAULT: 500 Seconds TTL="500" # Prefix for zone definition files # DEFAULT: "db." # The zone definition file for 0.168.192.in-addr.arpa is stored as 'db.0.168.192.in-addr.arpa' PREFIX="db." # Allow Updates from these networks (semicolon separated and ended) # DEFAULT: Don't allow updates #ALLOW_UPDATE="192.168.0.0/24;" # Allow Transfer to zones (semicolon separated and ended) # DEFAULT: Dont allow zone transfer #ALLOW_TRANSFER="192.168.0.1;" # Allow notify to slaves (semicolon separated and ended) # DEFAULT: Dont allow notify #ALLOW_NOTIFY="notify yes;" EOF

Configurez une zone DNS comme il faut dans l'interface de FusionDirectory

Lancez la commande ldap2bind en root

Il ne doit pas y avoir d'erreur d'exécution

Le fichier /etc/bind/named.conf.ldap2zone doit être rempli

Un fichier /etc/bind/db.xxx doit être créé pour chaque zone directe et inverse

Si tout est OK,il ne reste plus qu'à ajouter un cron qui exécute ldap2bind de façon régulière (selon les besoins)

Service DHCP

Installez les composants fusiondirectory

sudo apt-get install fusiondirectory-plugin-dhcp sudo /etc/init.d/apache2 restart

Dans l'interface de FusionDirectory, ajoutez le service DHCP à un serveur, et créez un sous réseau

Installez le service dhcp

sudo apt-get install dhcp3-server-ldap

Configurez le service:

sudo mv /etc/dhcp/dhcpd.conf /etc/dhcp/dhcpd.conf.old cat<<'EOF' | sudo tee /etc/dhcp/dhcpd.conf ldap-server "localhost"; ldap-port 389; ldap-username "uid=dhcp,ou=DSA,dc=firewall-services,dc=com"; ldap-password "__SECRET__"; ldap-base-dn "ou=servers,ou=systems,dc=firewall-services,dc=com"; ldap-method dynamic; #ldap-debug-file "/var/log/dhcp-ldap-startup.log"; EOF

Personnalisez ce fichier:

sed -i -e "s/dc=firewall-services,dc=com/$(cat /etc/install/ldap.base)/g" \ -e "s/__SECRET__/$(cat /etc/install/dhcp.pw)/g" /etc/dhcp/dhcpd.conf

Restreindre les permissions sur ce fichier:

sudo chmod 640 /etc/dhcp/dhcpd.conf

Redémarrez le service

sudo restart isc-dhcp-server

Plugins FusionDirectory supplémentaires

Addressbook

Ce plugin fournit un carnet d'adresse simple:

sudo apt-get install fusiondirectory-plugin-addressbook sudo /etc/init.d/apache2 restart

Board

Ce plugin permet de donner des informations générales sur les utilisateurs (nombres, comptes arrivant à expiration etc...)

sudo apt-get install fusiondirectory-plugin-board sudo /etc/init.d/apache2 restart

Points à revoir

--- /usr/share/fusiondirectory/plugins/personal/samba/class_sambaAccount.inc.ws_name 2013-03-21 10:39:07.144812045 +0100 +++ /usr/share/fusiondirectory/plugins/personal/samba/class_sambaAccount.inc 2013-03-21 10:39:52.708812641 +0100 @@ -345,6 +345,7 @@ foreach($trusts['targets'] as $id){ $attrs = $headpage->getEntry($id); $we =$attrs['cn'][0]; + $we = preg_replace('/\$$/', '', $we); $this->multiple_sambaUserWorkstations[trim($we)] = array("Name" => trim($ws), "UsedByAllUsers" => TRUE); } }else{ @@ -353,6 +354,7 @@ foreach($trusts['targets'] as $id){ $attrs = $headpage->getEntry($id); $we =$attrs['cn'][0]; + $we = preg_replace('/\$$/', '', $we); $tmp.= ",$we"; } $tmp= preg_replace('/,+/', ',', $tmp);
diff --git a/samba/personal/samba/class_sambaAccount.inc b/samba/personal/samba/class_sambaAccount.inc index c372a9d..c0e2536 100644 --- a/samba/personal/samba/class_sambaAccount.inc +++ b/samba/personal/samba/class_sambaAccount.inc @@ -49,7 +49,6 @@ class sambaAccount extends plugin var $sambaLogoffTime= "2147483647"; var $sambaKickoffTime= ""; var $sambaPwdCanChange= "0"; - var $sambaPwdMustChange= "0"; // Flags (checkboxes) to restrict account settings. var $sambaAcctFlags= "[UX ]"; @@ -80,7 +79,7 @@ class sambaAccount extends plugin var $ctxattributes= array(); var $attributes= array("sambaSID", "sambaPwdLastSet", "sambaLogonTime", "sambaLogoffTime", "sambaKickoffTime", "sambaPwdCanChange", - "sambaPwdMustChange", "sambaAcctFlags", "uid", "sambaMungedDial", + "sambaAcctFlags", "uid", "sambaMungedDial", "sambaHomePath", "sambaHomeDrive", "sambaLogonScript", "sambaProfilePath", "sambaPrimaryGroupSID", "sambaDomainName", "sambaUserWorkstations", "sambaPasswordHistory", @@ -182,19 +181,10 @@ class sambaAccount extends plugin // sambaPwdLastSet // _______________ // The integer time in seconds since 1970 when the sambaLMPassword and sambaNTPassword attributes were last set. - - // sambaPwdMustChange - // _______________ - // Specifies the time (UNIX time format) when the user is forced to change his password. If this - // value is set to 0, the user will have to change his password at first login. If this attribute is not - // set, then the password will never expire. - - - // A password change is enforced by using a timestamp in sambaPwdMustChange. // We simple set it to '0' to enforce a change. // -------------------------------- // Normally it contains a timestamp, which specifies and expiration date. - $this->flag_enforcePasswordChange = (isset($attrs['sambaPwdMustChange']) && $attrs['sambaPwdMustChange'][0] == '0'); + $this->flag_enforcePasswordChange = (isset($attrs['sambaPwdLastSet']) && $attrs['sambaPwdLastSet'][0] == '0'); // A user cannot change his password until the given timestamp has reached. // We simply set it to max int to disallow a password change till the timestamp reaches 4294967295, @@ -507,7 +497,7 @@ class sambaAccount extends plugin $smarty->assign("tsloginstate",""); } - // Create additional info for sambaKickOffTime and sambaPwdMustChange. + // Create additional info for sambaKickOffTime and sambaPwdLastSet. // e.g. Display effective kickoff time. Domain policy + user settings. $additional_info_PwdMustChange = ""; @@ -587,7 +577,6 @@ class sambaAccount extends plugin $sambaKickoffTime = "unset"; $sambaPwdCanChange = "unset"; - $sambaPwdMustChange = "unset"; $sambaBadPasswordCount = "unset"; $sambaBadPasswordTime = "unset"; @@ -600,7 +589,7 @@ class sambaAccount extends plugin /* User attributes */ $user_attributes = array("sambaBadPasswordTime","sambaPwdLastSet","sambaLogonTime","sambaLogoffTime", - "sambaKickoffTime","sambaPwdCanChange","sambaPwdMustChange","sambaBadPasswordCount", "sambaSID"); + "sambaKickoffTime","sambaPwdCanChange","sambaBadPasswordCount", "sambaSID"); /* Get samba SID object and parse settings. */ @@ -622,8 +611,8 @@ class sambaAccount extends plugin $$attr = $this->attrs[$attr][0]; } } - if (is_numeric($sambaPwdMustChange)) { - $sambaPwdMustChange= date('d.m.Y', $sambaPwdMustChange); + if (is_numeric($sambaPwdLastSet) && is_numeric($attr['sambaPwdMaxAge'])) { + $sambaPwdMustChange=date('d.m.Y', $sambaPwdLastSet+$attr['sambaPwdMaxAge']); } if (is_numeric($sambaKickoffTime)) { $sambaKickoffTime= date('d.m.Y', $sambaKickoffTime); @@ -752,7 +741,7 @@ class sambaAccount extends plugin /* sambaPwdMustChange: Timestamp of when the password will expire */ - if($sambaPwdMustChange == "unset" || empty($sambaPwdMustChange)){ + if($sambaMustChange == "unset" || empty($sambaPwdMustChange)){ $sambaPwdMustChange = "<i>("._("unset").")</i>"; } @@ -1004,14 +993,15 @@ class sambaAccount extends plugin // Handle "enforce password change" flag. if($this->flag_enforcePasswordChange){ - $this->attrs['sambaPwdMustChange'] = 0; + $this->attrs['sambaPwdLastSet'] = 0; }else{ // Keep old values if given. - if ($this->sambaPwdMustChange != "0"){ - $this->attrs['sambaPwdMustChange']= $this->sambaPwdMustChange; + if ($this->sambaPwdLastSet != "0"){ + $this->attrs['sambaPwdLastSet']= $this->sambaPwdLastSet; } else { - $this->attrs['sambaPwdMustChange']= array(); + $sid = $this->get_domain_info(); + $this->attrs['sambaPwdLastSet']= time(); } }

Créer des comptes pour les services suivants et les utiliser (au lieu d'utiliser le DN admin ou une connexion anonyme)

http://documentation.fusiondirectory.org/en/documentation/plugin/rsyslog