Part six: Joining the TV recording computer to a domain
OK, so domain membership is quite a bit more involved. Here are the configuration files that are necessary for getting it working properly:
Code:
/usr/local/etc/smb4.conf
/etc/nsswitch.conf
/etc/krb5.conf
/etc/ntp.conf
This does not include files required to be edited to log in to FreeBSD as a domain user - I've decided that is beyond the scope of this article. If you would like to use domain users on your new FreeBSD install, here's a brief site that covers a lot of bases and is very easy to follow:
https://blog.iandreev.com/?p=2676
Note: The version he used in that guide is older than 4.6. There was a syntax change in
smb4.conf for v4.6 and newer that was requires re-writing part of the configuration for domain members - An example of the changes are things like
winbind nss info = rfc2307 instead of
unix_nss_info = yes
I'm about to show you all my configuration files for my working system for you to reference, but you will almost certainly need more in-depth info for attempting domain membership with Samba. Please familiarize yourself with the definitive guide at the official Samba wiki - either before or after trying the config examples (again - trust me, you'll need it):
https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member
OK, let's start with something easy and straightforward. Run
# getent hosts - does it return something like this?:
Code:
127.0.0.1 localhost
192.168.1.54 TVRECORDER.yourdomainname.com TVRECORDER
If it doesn't, make
/etc/hosts look just like that. IPV6 additions are presumably fine (I've had issues with them and given up, but theoretically they should work, grumble) - I would assume you would only want to have one for
::1 localhost and the IPV6 address of your computer with fully-qualified domain name first and hostname second (just like it is for IPV4). Repeat after me:
"Samba is picky."
Keep that in mind and you
might do just fine.
Now let's do time, which
must be synchronized using ntp. Before you do that, though, check your hardware clock time (in BIOS), OS system time (in FreeBSD it's
date, host time if you are running a VM (also known as 'hypervisor time') e.g. go look at your ESXi web client and make sure the time is right. The default maximum time difference fudge you can have is five minutes, so it's important to get all your swatches synchronized.
Once that's done, invoke
# pkg install ntp to get the package, and edit
/etc/ntp.conf to look something like this (source: samba wiki):
Code:
# Local clock. Note that is not the "localhost" address!
server 127.127.1.0
fudge 127.127.1.0 stratum 10
# Where to retrieve the time from
server 192.168.1.2 iburst prefer
server 192.168.1.3 iburst
driftfile /var/lib/ntp/ntp.drift
logfile /var/log/ntp
# Access control
# Default restriction: Disallow everything
restrict default ignore
# No restrictions for "localhost"
restrict 127.0.0.1
# Enable the time sources only to only provide time to this host
restrict 192.168.1.2 mask 255.255.255.255 nomodify notrap nopeer noquery
restrict 192.168.1.3 mask 255.255.255.255 nomodify notrap nopeer noquery
Where
192.168.1.2 and
192.168.1.3 are your domain controllers' IP addresses, respectively. If you only have one DC, you don't need two lines - just one for each one you have.
Run
# service ntpd start (and
# sysrc ntpd_enable=YES) and then check if it's working properly by invoking
# ntpq -np. Here's an example of my output:
Code:
remote refid st t when poll reach delay offset jitter
==============================================================================
127.127.1.0 .LOCL. 10 l 20h 64 0 0.000 0.000 0.000
*192.168.1.2 209.208.79.69 3 u 233 1024 377 0.835 -5.978 22.238
192.168.1.3 .LOCL. 1 u 36 1024 377 0.258 40386.2 109.796
You can see I need to tighten up my ship a bit but it's still working (thank god). NTP issues have been (one of) the bane(s) of my domain's existence. You'll ideally have one that looks better than mine. If you're having issues with NTP in Windows Server, this article can be helpful (get ready, it's pretty complicated):
https://support.microsoft.com/en-us...n-authoritative-time-server-in-windows-server
Then, I'd go on to kerberos. If you didn't install
krb5-115 (or newer version) earlier, grab it now through pkg and edit
/etc/krb5.conf to look like this (source: samba wiki):
Code:
[libdefaults]
default_realm = YOURDOMAINNAME.COM
dns_lookup_realm = false
dns_lookup_kdc = true
That's all you need, or want, to have in it. Be sure to capitalize the domain name, too.
OK. So, presuming the prior requisite configurations are done properly, let's try joining the domain. Invoke:
Code:
# kinit administrator
administrator@YOURDOMAINNAME.COM's Password:
and that's it. Note: If you see errors regarding clock skew, that means your time is not correctly configured somewhere among the ever-so-many places it could be.
Now check to see if the process worked by invoking:
Code:
# klist
Credentials cache: FILE:/tmp/krb5cc_0
Principal: administrator@WEBTOOL.SPACE
Issued Expires Principal
May 28 21:27:21 2018 May 29 07:26:41 2018 krbtgt/YOURDOMAINNAME.COM@YOURDOMAINNAME.COM
And that, my friend, is your keytab file. (If you want to delete it to start over, etc. the command is
kdestroy).
It allows you to authenticate
YOURDOMAINNAME\administrator on the domain by invoking:
Code:
# net ads join -k
Using short domain name -- YOURDOMAINNAME
Joined 'TVRECORDER' to dns domain 'yourdomainname.com'
Which should allow you to confirm that administrator is joined by invoking:
Which will return a slough of information, starting with something like this:
Code:
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
objectClass: computer
cn: FEBMARCH
distinguishedName: CN=TVRECORDER,CN=Computers,DC=yourdomainname,DC=com
instanceType: 4
whenCreated: 20180527091823.0Z
whenChanged: 20180529043207.0Z
uSNCreated: 29176
uSNChanged: 43014
-------------- Security Descriptor (revision: 1, type: 0x8c14)
owner SID: S-1-5-21-4216452045-2814096665-3585076981-512
group SID: S-1-5-21-4216452045-2814096665-3585076981-512
------- (system) ACL (revision: 4, size: 120, number of ACEs: 2)
------- ACE (type: 0x07, flags: 0x5a, size: 0x38, mask: 0x20, object flags: 0x3)
access SID: S-1-1-0
access type: AUDIT OBJECT
Object type: SEC_ACE_OBJECT_TYPE_PRESENT
Object GUID: f30e3bbe-9ff0-11d1-b603-0000f80367c1 (LDAP attribute: "gPLink")
Object type: SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT
Object GUID: bf967aa5-0de6-11d0-a285-00aa003049e2 (LDAP attribute: "organizationalUnit")
. . .
How about
/etc/nsswitch.conf now, huh? It's really easy, just change
groups: compat to
groups: files winbind and
passwd: compat to
passwd: files winbind - you can do this at any time, whether you're joined to the domain or not, no need to reset any services or anything. It's probably the easiest thing to configure this side of
/etc/hosts in this whole mess.
OK - so that's working. Now, on to the actual samba configuration. Easy stuff, right?
So here's my samba config - comments in samba are written with
; rather than
# - it's located at
/usr/local/etc/smb4.conf:
Code:
[global]
netbios name = TVRECORDER
security = ADS
workgroup = YOURDOMAINNAME
realm = YOURDOMAINNAME.COM
client use spnego = yes
client signing = yes
server signing = yes
client ntlmv2 auth = yes
encrypt passwords = yes
log file = /var/log/samba4/%m.log
log level = 1
idmap config * : backend = tdb
idmap config * : range = 3000-7999
idmap config YOURDOMAINNAME : backend = ad
idmap config YOURDOMAINNAME : schema_mode = rfc2307
idmap config YOURDOMAINNAME : range = 10000-999999
idmap config YOURDOMAINNAME : unix_nss_info = yes
idmap config YOURDOMAINNAME : unix_primary_group = yes
;winbind use default domain = yes
winbind enum users = yes
winbind enum groups = yes
winbind offline logon = yes
winbind nested groups = yes
winbind refresh tickets = yes
winbind nss info = rfc2307
;Some syntax from prior to Samba 4.6:
;winbind nss info = template
;template shell = /bin/bash
;template homedir = /home/%D/%U
[videos]
comment = a place for storing misc videos
path = /mnt/pool/videos
write list = @"YOURDOMAINNAME\domain admins"
read list = @"YOURDOMAINNAME\domain users"
writable = yes
browsable = yes
read only = no
guest ok = no
public = no
create mask = 0775
directory mask = 0775
[hdhomerun]
comment = recordings from HDHomeRun box(es)
path = /mnt/pool/hdhomerun
write list = @"YOURDOMAINNAME\domain admins"
read list = @"YOURDOMAINNAME\domain users"
writable = yes
browsable = yes
read only = no
guest ok = no
public = no
create mask = 0775
directory mask = 0775
You can omit that whole part under
realm = to the blank space - I included that for added security, it's the first thing I would scrutinize if you are having any trouble with connecting as a domain user. Well, maybe after checking
/etc/krb5.conf and
/etc/ntp.conf, restarting
ntpd and checking to make sure the times are all synchronized on your domain controllers, members, hosts, and hardware clock (this is very important and often overlooked).
Also, note that
rid backend is easier to get working properly than
ad. Read up on the different backend types on the samba wiki page I referenced earlier in this section.
Check your
winbind access to the domain by running:
Do you see stuff like:
Code:
WEBTOOL\guest
WEBTOOL\administrator
WEBTOOL\krbtgt
WEBTOOL\testnixuser
WEBTOOL\avery
?? if so, that's good. Now
/etc/nsswitch.conf controls the ability to query the domain controller for users (the passwd line) and groups (the group line) using winbind (which you added to the end of the line for each, respectively). So try:
And you should see a list of all the local users first (the files portion) and domain users at the end (the winbind portion):
Code:
.... truncated ....
dlna:*:933:933:DLNA Daemon:/nonexistent:/usr/sbin/nologin
git_daemon:*:964:964:git daemon:/nonexistent:/usr/sbin/nologin
cyrus:*:60:60:the cyrus mail server:/nonexistent:/usr/sbin/nologin
messagebus:*:556:556:D-BUS Daemon User:/nonexistent:/usr/sbin/nologin
plex:*:972:972:Plex Media Server:/nonexistent:/usr/sbin/nologin
YOURDOMAINNAME\avery:*:10000:0:Avery Freeman:/home/webtool/avery:/bin/bash
Same goes (presumably) for
# getent group - if it doesn't work, something is wrong. Try rid backend if you're using ad.
One caveat about the shares in my configuration: The unix permissions underneath these shares must be
777 for domain admins to manipulate them, which
in theory could be problematic since anyone can change them,
even guests -- IF they're logged into the server as a Unix user. BUT, domain guests are prevented from accessing the share from the network due to
guest browsing = no. Domain users are allowed to view the share (which you could easily change), and only domain admins are allowed to make changes.
This means, even if the underlying unix permissions are extremely permissive, it doesn't matter because connecting to the share through Samba as a unix user is not supported. Samba is for
Windows networking, it has no idea how to handle unix users. Therefore, the thinking goes, the unix permissions don't really matter (except for allowing changes to be made by domain admins).
There's a better way to get Windows ACLs and unix permissions settings working together in tandem, but nobody's going to be logging in directly to my FreeBSD VM, so this method works fine for me without being too complicated. I came across another other site which describes how to do it properly but I haven't had the patience to sit with it yet:
https://daniel.washburn.at/howtos/freebsd-samba4-zfs-recipe
OK. So that concludes the six-part series on how to set up an HDHomeRun TV recording computer! Hope you enjoyed it as much as I did.
