Step by Step Installation & Configuration of LDAP+SAMBA on CentOS 5

I am defining here installation and configuration of LDAP server and integrate with SAMBA services. If you will work windows at client side, Samba integration is necessary with LDAP otherwise NT Password will not be accepted by LDAP server. Here we will go step by step to configure LDAP and samba server.

I am using Cent OS 5.5 64 bit Operating system with kernel 2.6.18-194.el5.

I will use LDAP domain example.com for installation procedure.

1.       My system IP address is 10.226.2.66 and hostname is ldapnoida.example.com. If you are not using name server, add hostname entry into /etc/hosts file.

# vim /etc/hosts

10.226.2.66     ldapnoida.example.com ldapnoida

2.  I will install all packages from yum repository so please configure yum before installation the packages on server. I am not covering yum in this document. Here I will install openldap on server.

# yum install *openldap*

This command will install following LDAP packages on your system.

nss_ldap.i386          

nss_ldap.x86_64        

openldap.i386          

openldap.x86_64        

openldap-clients.x86_64

openldap-servers.x86_64

Available Packages

nss_ldap.i386          

nss_ldap.x86_64        

3.  Create LDAP password using slappasswd command. It gave here password root123 and generate cypted password as per below screenshot.I will paste this encrypted password in /etc/openldap/slapd.conf file.

4 .       Open file /etc/openldap/slapd.conf and update the following fields on ldap server.

database        bdb

suffix          "dc=example,dc=com"

rootdn          "cn=Manager,dc=example,dc=com"



rootpw      {SSHA}+VQndTOziGTtICTQXuY8ExicsLjVlVxd

 5. Open file /etc/openldap/ldap.conf and update the following fields on ldap server.

 BASE dc=example,dc=com

URI  ldap://ldapnoida.example.com/ 

6. Open file /etc/ldap.conf and add the following lines into this.

base dc=example,dc=com

URI ldap://ldapnoida.example.com/ 

And comment the line 

#host 127.0.0.1

7.   Restart the LDAP service on server.

# /etc/init.d/ldap restart

8.     Copy the DB_CONFIG.example file for slapd DBS/HDB database into LDAP configuration file.

cp /etc/openldap/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

9.     Restart the Ldap service and make ldap service on system boot.

    # service ldap restart

# chkconfig ldap on

 10.    Update migrate_common.ph file for LDAP directory structure creation.

[root@ldapnoida ~]# cd /usr/share/openldap/migration/

[root@ldapnoida migration]# vim migrate_common.ph

$DEFAULT_MAIL_DOMAIN ="example.com";

$DEFAULT_BASE ="dc=example,dc=com";

11.      LDAP imports the directory structure into LDIF format so we are creating base structure LDIF file to import into LDAP directory.

[root@ldapnoida migration]#./migrate_base.pl > base.ldif

[root@ldapnoida migration]#ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f  base.ldif

It will ask LDAP password. Type ldap password as defined above “root123” and it will generate basic LDAP directory structure. 

12.     Create a system user so that we can export system user into LDAP server.

root@ldapnoida  migration]# useradd jitendrakumar

root@ldapnoida migration ]#  passwd jitendrakumar



13.Migrate system account having uid above 500 into LDPP server.

[root@ldapnoida migration]# grep "x:[5-9][0-9][0-9]" /etc/passwd >passwd

[root@ldapnoida migration]# grep "x:[5-9][0-9][0-9]" /etc/group > group

[root@ldapnoida migration]#./migrate_passwd.pl passwd > passwd.ldif

[root@ldapnoida migration]#./migrate_group.pl group > group.ldif

[root@ldapnoida migration]# ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f passwd.ldif

[root@ldapnoida migration]# ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f group.ldif

14.  Installing SAMBA packages on server.

[root@ldapnoida migration]# yum install *samba*






15.   Copy the Samba schema into LDAP schema repository.



cp /usr/share/doc/samba-3.0.33/LDAP/samba.schema /etc/openldap/schema/

16.  Edit the file /etc/openldap/slapd.conf and include samba.schema location into ldap configuration file.

[root@ldapnoida migration]# vim /etc/openldap/slapd.conf

include         /etc/openldap/schema/samba.schema

17.     Restart the LDAP Service on server.

[root@ldapnoida migration]# service ldap restart



Stopping slapd:                                            [  OK  ]

Starting slapd:                                            [  OK  ]

[root@ldapnoida migration]#

18.     Download EPEL RPM package and install it on server.

[root@ldapnoida migration]# wget http://dl.fedoraproject.org/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm

--2013-09-20 14:58:00-- 
http://dl.fedoraproject.org/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm

Resolving dl.fedoraproject.org...209.132.181.27, 209.132.181.23, 209.132.181.24, ...

Connecting to dl.fedoraproject.org|209.132.181.27|:80...connected.

HTTP request sent, awaiting response... 200 OK

Length: 12232 (12K) [application/x-rpm]

Saving to: `epel-release-5-4.noarch.rpm'

100%[==============================================================================================================>]
12,232      --.-K/s   in 0.02s

2013-09-20 14:58:01 (739 KB/s) -
`epel-release-5-4.noarch.rpm' saved [12232/12232]

[root@ldapnoida migration]  rpm –Uvh epel-release-5-4.noarch.rpm

19.     Install smbldap-tools and phpldapadmin on server.

[root@ldapnoida migration]# yum –y install smbldap-tools

[root@ldapnoida migration]# yum –enablerepo=epel –y install phpldapadmin

20.     Configure Phpldapadmin on server to manage LDAP DIT through graphically. 




[root@ldapnoida ~]# vi /etc/httpd/conf.d/phpldapadmin.conf 



Alias /phpldapadmin /usr/share/phpldapadmin/htdocs

Alias /ldapadmin/usr/share/phpldapadmin/htdocs


<Directory /usr/share/phpldapadmin/htdocs> 

Order Deny,Allow 

Deny from all 

Allow from 127.0.0.1 10.226.0.0/16 # IP address you allow



</Directory> 



[root@ldapnoida ~]#/etc/rc.d/init.d/httpd restart 

To access phpldapadmin use URL “http://(yourhostname or IP address)/ldapadmin “

21. To access phpldapadmin console user following credentials.

User Name: cn=Manager,dc=example,dc=com

Password: root123

Password is LDAP rootdn password as defined above in document.








22.     Take the backup of smb.conf and create a new

smb.conf file from ldap enabled configuration file on ldap server. 

mv /etc/samba/smb.conf  /etc/samba/smb.conf.backup

cp /usr/share/doc/smbldap-tools-0.9.6/smb.conf /etc/samba/smb.conf

23.    Change the /etc/samba/smb.conf configuration file for LDAP.

[root@ldapnoida migration]# vim /etc/samba/smb.conf

      
workgroup = example

 
netbios name = ldap

     
unix password sync = yes

     
ldap passwd sync = yes

      
passwd program = /usr/sbin/smbldap-passwd -u "%u"

      
passwd chat = "Changing *\nNew password*" %n\n "*Retype new password*" %n\n"

       
Dos charset = CP932

     
Unix charset = UTF-8




 passdb backend = ldapsam:ldap://10.226.2.66/

       
ldap admin dn = cn=Manager,dc=example,dc=com

      
ldap suffix = dc=example,dc=com

      
ldap group suffix = ou=Group

      
ldap user suffix = ou=People

      
admin users = admin

24.    Create following directory and set their permissions.

[root@ldapnoida  ~]#mkdir /home/netlogon

[root@ldapnoida  ~]# mkdir /home/profiles

[root@ldapnoida  ~]# chmod 777 /home/profiles.

25.      Restarted samba service and make it permanent.

[root@ldapnoida  ~]# service smb restart

[root@ldapnoida  ~]# chkconfig smb on

26.    Set the SAMBA Password.

[root@ldapnoida  ~]# smbpasswd –W

27.      Change to following directory and set the permission of configure.pl script.

[root@ldapnoida migration]# cd /usr/share/doc/smbldap-tools-0.9.6/

[root@ldapnoida smbldap-tools-0.9.6]# chmod 755 configure.pl

[root@ldapnoida smbldap-tools-0.9.6]#./configure.pl













You can check SID with “net getlocalsid” command. If it is same press enter.



Enter domain name to append to mail address [ ] > example.com

28.     Open file /usr/share/doc/smbldap-tools-0.9.6/smbldap.conf and change the required parameters into this file.

[root@ldapnoida smbldap-tools-0.9.6]# pwd

/usr/share/doc/smbldap-tools-0.9.6

[root@ldapnoida smbldap-tools-0.9.6]# net getlocalsid

[2013/09/20 15:50:03, 0] param/loadparm.c:map_parameter(2794)

Unknown parameter encountered: "min passwd length"

[2013/09/20 15:50:03, 0] param/loadparm.c:lp_do_parameter(3541)

Ignoring unknown parameter "min passwd length"

SID for domain LDAP is: S-1-5-21-3088606343-1201082996-3680957859

[root@ldapnoida smbldap-tools-0.9.6]# vi smbldap.conf

SID="S-1-5-21-3088606343-1201082996-3680957859"

slaveLDAP="ldapnoida.example.com"

masterLDAP="ldapnoida.example.com"

suffix="dc=example,dc=com"

sambaUnixIdPooldn="sambaDomainName=$example,${suffix}"

userSmbHome="\\ldap\%U"

userProfile=\\ldap\profiles\%U

mailDomain="example.com"

29.     Open file /usr/share/doc/smbldap-tools-0.9.6/smbldap.conf and change the required parameters into this file.

[root@ldapnoida smbldap-tools-0.9.6]# vim smbldap_bind.conf

# $Id: smbldap_bind.conf 35 2011-02-23
09:07:36Z fumiyas $

#

############################

# Credential Configuration #

############################

# Notes: you can specify two differents configuration if you use a

# master ldap for writing access and a slave ldap server for reading access

# By default, we will use the same DN (so it will work for standard Samba

# release)

slaveDN="cn=Manager,dc=example,dc=com"

slavePw="root123"

masterDN="cn=Manager,dc=example,dc=com"

masterPw="root123"

30.     Restart the samba service and populate the LDAP DIT  on server.

[root@ldapnoida smbldap-tools-0.9.6]# service smb restart



[root@ldapnoida smbldap-tools-0.9.6]#  smbldap-populate



31.     Now I will create admin account and group for domain administrative account.

root@ldapnoida smbldap-tools-0.9.6]#  smbldap-groupadd –a admin



root@ldapnoida smbldap-tools-0.9.6]#  smbldap-useradd –am –g admin admin

32.      We can reset password of admin user with following command.


root@ldapnoida smbldap-tools-0.9.6]#  smbldap-passwd admin

vmap allocation for size 9146368 failed: use vmalloc= to increase size.

We found following error logs in /var/log/message logfile.

Aug  5 14:30:10 snort kernel: vmap allocation for size 9146368 failed: use vmalloc=<size> to increase size.

Aug  5 14:30:10 snort kernel: vmap allocation for size 9146368 failed: use vmalloc=<size> to increase size.

Aug  5 14:30:10 snort kernel: vmap allocation for size 9146368 failed: use vmalloc=<size> to increase size.

Aug  5 14:30:10 snort kernel: vmap allocation for size 9146368 failed: use vmalloc=<size> to increase size.

Aug  5 14:30:10 snort kernel: vmap allocation for size 9146368 failed: use vmalloc=<size> to increase size.

When we checked vmalloc limit was set to 124 MB. Due to low kernel allocated memory, error was coming.

[root@snort ~]# cat /proc/meminfo | grep -i vmalloc

VmallocTotal:     124144 kB

VmallocUsed:         5536 kB

VmallocChunk:       1156 kB

Solution:

Add vmalloc=256M in /boot/grub/grub.conf file to increase the limit of vmalloc kernel parameter.

[root@snort ~]# cat /boot/grub/grub.conf

# grub.conf generated by anaconda

#

# Note that you do not have to rerun grub after making changes to this file

# NOTICE:  You have a /boot partition.  This means that

#          all kernel and initrd paths are relative to /boot/, eg.

#          root (hd0,0)

#          kernel /vmlinuz-version ro root=/dev/mapper/vg_snort-lv_root

#          initrd /initrd-[generic-]version.img

#boot=/dev/sda

default=0

timeout=5

splashimage=(hd0,0)/grub/splash.xpm.gz

hiddenmenu

title CentOS (2.6.32-358.14.1.el6.i686)

        root (hd0,0)

        kernel /vmlinuz-2.6.32-358.14.1.el6.i686 ro root=/dev/mapper/vg_snort-lv_root rd_NO_LUKS LANG=en_US.UTF-8 rd_LVM_LV=vg_snort/lv_root rd_NO_MD SYSFONT=latarcyrheb-sun16  KEYBOARDTYPE=pc KEYTABLE=us rd_LVM_LV=vg_snort/lv_swap rd_NO_DM rhgb quiet crashkernel=auto vmalloc=256M

        initrd /initramfs-2.6.32-358.14.1.el6.i686.img

title CentOS (2.6.32-279.el6.i686)

        root (hd0,0)

#       vmalloc=256MB

        kernel /vmlinuz-2.6.32-279.el6.i686 ro root=/dev/mapper/vg_snort-lv_root rd_NO_LUKS LANG=en_US.UTF-8 rd_LVM_LV=vg_snort/lv_root rd_NO_MD SYSFONT=latarcyrheb-sun16  KEYBOARDTYPE=pc KEYTABLE=us rd_LVM_LV=vg_snort/lv_swap rd_NO_DM rhgb quiet vmalloc=256M

        initrd /initramfs-2.6.32-279.el6.i686.img

Reboot the system and vmalloc size is increased upto 256MB.

[root@snort ~]# cat /proc/meminfo | grep -i vmall

VmallocTotal:     262144 kB

VmallocUsed:      115536 kB

VmallocChunk:      41156 kB

Error: Date not updated on Xen Linux Machine

I was trying to set date and time on  paravirtualized xen VM machine with OS centos 5.5 but server was not taking time update and it was showing old date and time. It was also giving following errors when setting time with date command and ntp server.

[root@app04 ~]# date -s "Tue Jul 30 13:32:44 IST 2013"

date: cannot set date: Operation not permitted

Tue Jul 30 13:32:44 IST 2013

[root@app04 ~]# hwclock

Cannot access the Hardware Clock via any known method.

Use the --debug option to see the details of our search for an access method.

Solution:

I checked independent_wallclock kernel parameter in VM machine which was off (value=0). Due to which machine was not taking update of time. So we set it to value 1.

[root@app04 ~]# cat /proc/sys/xen/independent_wallclock

0

[root@app04 ~]# echo 1 > /proc/sys/xen/independent_wallclock

[root@app04 ~]# cat /proc/sys/xen/independent_wallclock

1

Now restarted ntp service and system date was updated.

[root@app04 ~]# service ntpd restart

Shutting down ntpd:                                        [  OK  ]

ntpd: Synchronizing with time server:                      [  OK  ]

Starting ntpd:                                             [  OK  ]

[root@app04 ~]# date

Tue Jul 30 13:40:13 IST 2013

Visual Source Safe backup configuration Script & deletion of files older than 7 Days in Windows

On Windows Server I configured the “Visual Source Safe” Software Backup. Please find below scripts for Backup configuration.

1.       This script will take backup of VSS repository.

@ECHO OFF

@TITLE Backing up source safe databases

FOR /F "tokens=2-4 delims=/ " %%i IN ('date /t') DO SET DATE=%%i-%%j-%%k

C:\Program Files\Native Visual Safe\win32\ssarc -d-  e:\vss_backups\%DATE% General backup.ssa $/QMS “-sF:\vssqms” –y<username>,<Pasword>

@ECHO Finished backups

Where C:\Program Files\Native Visual Safe\win32\ssarc  is path of ssarc command.

            E:\vss_backups\%DATE% General backup.ssa is the destination path of backup.

“-sF:\vssqms” is the path of VSS Directory.

$/QMS is the name of repository in VSS which backup is required. If full backup needed we can use “$/” .

2.       This script will delete 7 days older files in E:\vss_backup directory in Windows.

forfiles /p "E:\vss_backup" /s /m *.*  /c "cmd /c  Del @path" /D -7

Append, Insert, Replace and Count File Lines into Linux using sed scripting.

Sometime Linux admin has to append, replace and insert the lines into Linux files without using editor. sed is strong scripting utility, through which we can perform these action using command line options. Here we will discuss one by one all option of append, replace, insert and count the file lines.

First of all we create a sample file which can be altered using sed command for file lines actions.

[jitendrakumar@paragtesting ~]$ cat jitendrakumaryogi.txt

This is first line.

My Name is Jitendra Kumar.

I am a Software Engineer.

Oracle is a database Software.

Tomcat and Jboss are application servers.

We love India.

India is a strong nation.

--------Hello------------------

Server1

Server2

Server3

Server4

____________END________________

1.      Append Lines Using Sed.

We use option “a” with sed command to append a line after every line with the address or pattern.

SYNTAX:

#sed ‘Address a\

                        Line which need to be appended’ filename

#sed ‘/PATTERN/ a\

                        Line which need to be appended’ filename

Example1:

Add a line “Software and Development” after 4^th line. Sed “a” option will insert line after 4^th line.

[jitendrakumar@paragtesting ~]$ sed '4 a\

> Software and Development' jitendrakumaryogi.txt

This is first line.

My Name is Jitendra Kumar.

I am a Software Engineer.

Oracle is a database Software.

Software and Development

Tomcat and Jboss are application servers.

We love India.

India is a strong nation.

--------Hello------------------

Server1

Server2

Server3

Server4

____________END________________

Example2:

Add a line “Shell Scripting” after pattern “Jitendra Kumar”.

[jitendrakumar@paragtesting ~]$ sed '/Jitendra Kumar/a \

Shell Scripting' jitendrakumaryogi.txt

This is first line.

My Name is Jitendra Kumar.

Shell Scripting

I am a Software Engineer.

Oracle is a database Software.

Tomcat and Jboss are application servers.

We love India.

India is a strong nation.

--------Hello------------------

Server1

Server2

Server3

Server4

____________END________________

Example3: Append a line after the End of file.

The following example will add “Testing” after end of line.

[jitendrakumar@paragtesting ~]$ sed '$ a\

> Testing' jitendrakumaryogi.txt

This is first line.

My Name is Jitendra Kumar.

I am a Software Engineer.

Oracle is a database Software.

Tomcat and Jboss are application servers.

We love India.

India is a strong nation.

--------Hello------------------

Server1

Server2

Server3

Server4

____________END____________

Testing

2.      Insert the Line using Sed command.

Sed command used “I” option for inserting line before particular line or pattern.

SYNTAX:

#sed ‘Address i\

                        New Line’ filename

#sed ‘/PATTERN/i \

                        New Line’ filename

Example1: Insert “Implementation of Script” before line 6.

[jitendrakumar@paragtesting ~]$ sed '6 i\

Implementation of Script' jitendrakumaryogi.txt

This is first line.

My Name is Jitendra Kumar.

I am a Software Engineer.

Oracle is a database Software.

Tomcat and Jboss are application servers.

Implementation of Script

We love India.

India is a strong nation.

--------Hello------------------

Server1

Server2

Server3

Server4

____________END____________

Example2:  Insert “Deployment of Application” before pattern “database”.

[jitendrakumar@paragtesting ~]$ sed '/database/i\

Deployment of Application' jitendrakumaryogi.txt

This is first line.

My Name is Jitendra Kumar.

I am a Software Engineer.

Deployment of Application

Oracle is a database Software.

Tomcat and Jboss are application servers.

We love India.

India is a strong nation.

--------Hello------------------

Server1

Server2

Server3

Server4

____________END____________

3.      Replace line using sed command.

“c” command in sed used to replace every line matches with the pattern or ranges with the new given line.

SYNTAX:

#sed ‘Address c\

                        Replace line’ filename

#sed ‘/PATTERN/c \

                        Replace Line’ filename

Example1: Replace a first line of file.

[jitendrakumar@paragtesting ~]$ sed '1 c \

First Line' jitendrakumaryogi.txt

First Line

My Name is Jitendra Kumar.

I am a Software Engineer.

Oracle is a database Software.

Tomcat and Jboss are application servers.

We love India.

India is a strong nation.

--------Hello------------------

Server1

Server2

Server3

Server4

____________END____________

Example2: Replace a line which matches patteen.

Replace the line which contain pattern “Server1” to “It is nice to have it.”

[jitendrakumar@paragtesting ~]$ sed '/Server1/c \

It is nice to have it' jitendrakumaryogi.txt

This is first line.

My Name is Jitendra Kumar.

I am a Software Engineer.

Oracle is a database Software.

Tomcat and Jboss are application servers.

We love India.

India is a strong nation.

--------Hello------------------

It is nice to have it

Server2

Server3

Server4

____________END____________

4.      Print Line Number using sed command.

“=” is a command to print the current line number to standard output.

SYNTAX:

#sed ‘=’ filename

The above send command syntax prints line number in the first line and the original line from the file in the next line.

SYNTAX:

Sed –n ‘/PATTERN/,/PATTERN/ {

=

P

}’ filename

Example1:

Print the line numbers for the lines matches from the pattern “Software” to “Server”

[jitendrakumar@paragtesting ~]$ sed -n '/Software/,/Server/ {

> =

> p

> }' jitendrakumaryogi.txt

3

I am a Software Engineer.

4

Oracle is a database Software.

5

Tomcat and Jboss are application servers.

6

We love India.

7

India is a strong nation.

8

--------Hello------------------

9

Server1

sed ‘=’ command accepts only one address, so if you want to print line number for a range of lines, you must use the curly braces

Example 2: Print the total number of lines in a file

[jitendrakumar@paragtesting ~]$ sed -n '$=' jitendrakumaryogi.txt

14

Detect LUN in Linux System in Running Environment

If SAN team provided LUN to Linux system, Linux administrator has to detect the LUN disk into Linux system. This LUN disks can be detected into system without rebooting. Please follow the following commands to detect the LUN on system.

# echo "- - -" > /sys/class/scsi_host/hostX/scan

hostX will be on system according HBA card. If you have 2 HBA cards on system there will be 2 host on system host0 and host1.

For Ex-

For 2 HBA cards please run the following command.

# echo "- - -" > /sys/class/scsi_host/host0/scan

# echo "- - -" > /sys/class/scsi_host/host1/scan

After running above command you can check LUN disk using “fdisk –l” command.

Updation of dynamic DNS zones with nsupdate utility

 This Document is mainly for updation of Dynamic DNS from DHCP Server. If DNS is being dynamically updated from DHCP Server, static entry in DNS Server by editing files will not be reflected properly. In this scenario we have to update Dynamic DNS from DHCP Server by using nsupdate utility.

Before starting update we should get the DHCP key defined in Dynamic DNS Server configuration. You can find dhcpupdate key in named.conf file in DNS Server.

key "dhcpupdate" {

algorithm hmac-md5;

secret "XXX"

}

I mentioned dhcpupdate key with “XXX”, this value will be different generated by system. So use secret key from configuration file of named.conf.

Now by using following step we can add dynamic forward and Reverse DNS entry from DHCP Server.

1.      Adding Forward Zone Entry:

[root@dhcp named]#  nsupdate

> key dhcpupdate  XXX

>update add jitendrakumar.example.com in 604800 A 10.226.1.201

>send

Here 6048400 is TTL in DNS.

2.      Adding Reverse Zone Entry:

[root@dhcp named]# nsupdate

> key dhcpupdate  XXX

> update add 201.1.226.10.in-addr.arpa  604800 PTR jitendrakumar.example.com

>send

Here 6048400 is TTL in DNS.

3.      If you have to delete any entry, use delete in place of add command.