Configuring a Samba file server on a corporate network

Continuing the cycle of articles about budget data backup in the corporate network, I want to offer you another article on setting up the Samba file server.
To restore data from a backup server, you had to go to the server via the web interface and download the necessary archive with files from there, it’s convenient when the necessary folder or file is not very large, but when you need to restore a folder that exceeds a couple of Gigabytes, for example, after crypto virus, it is not so convenient. In order for us to get direct access to copies of data, we will raise the Samba server on our backup server.

We also need Samba to set up MS SQL and Exchange backups to this server, but more on that in future articles. For now, let's configure the server itself (for which we use the already configured backup server from the article in the header, all the same CentOS6):

Install the necessary packages

yum install samba samba-client ntp acl krb5-workstation -y

Run the ntp client (the time is best to get from the domain controller so that it does not diverge much from our server)
```
 chkconfig ntpd on service ntpd start 
```
Correct the / etc / hosts file so that it looks something like this:
```
 # cat /etc/hosts 127.0.0.1 localhost.localdomain localhost 10.0.0.2 server-name.domain.local server-name 
```
where is 10.0.0.2 IP-address of our backup server

Configure kerberos to add a server to the domain

cat /etc/krb5.conf

 [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = DOMAIN.LOCAL ticket_lifetime = 24h forwardable = yes [realms] DOMAIN.LOCAL = { default_domain = domain.local kdc = dc1.domain.local #  admin_server = dc1.domain.local } [domain_realm] domain.local = DOMAIN.LOCAL .domain.local = DOMAIN.LOCAL

Configuring Samba. We bring the file /etc/samba/smb.conf to this form:

cat /etc/samba/smb.conf

 [global] load printers = no show add printer wizard = no printcap name = /dev/null disable spoolss = yes workgroup = DOMAIN password server = dc1.domain.local netbios name = server-name server string = Samba Server Version %v security = ads realm = DOMAIN.LOCAL domain master = no local master = no preferred master = no socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=131072 SO_SNDBUF=131072 use sendfile = true idmap config *:backend = tdb idmap config *:range = 11000-20000 idmap config DOMAIN:backend = rid idmap config DOMAIN:range = 100000-199000 template shell = /sbin/nologin winbind enum users = yes winbind enum groups = yes winbind use default domain = no winbind nested groups = yes winbind refresh tickets = yes client use spnego = yes client ntlmv2 auth = yes encrypt passwords = yes restrict anonymous = 2 log file = /var/log/samba/log.%m max log size = 50 #log level = 3 vfs objects = acl_xattr map acl inherit = Yes store dos attributes = Yes [disk1$] comment = disk1 path = /media/disk1 public = yes writable = yes

We configure nsswitch in order that it could use data of AD by means of winbind-service

 # cat /etc/nsswitch.conf ... passwd: files winbind shadow: files winbind group: files winbind ...

We start services

 chkconfig smb on chkconfig winbind on chkconfig nmb on service smb start service nmb start service winbind start

Now we can enter our server into the domain

 # net ads join -U administrator administrator's password: Using short domain name -- DOMAIN Joined 'SERVER-NAME' to realm 'DOMAIN.LOCAL'

If everything went well, then restart the winbind service and check the connection to the domain

 #service winbind restart # wbinfo -t checking the trust secret for domain DOMAIN via RPC calls succeeded

So that we can work with permissions from Windows, we need to remount our file system with ACL support.
for this we go to / etc / fstab and add the acl option for our disk
```
 # cat /etc/fstab ... /dev/VolGroup00/LogVol00 /media/disk1 ext4 defaults,acl 1 2 ... 
```
remount the partition and distribute the disk rights to the root, after which we will be able to manage folder rights directly from Windows
```
 # mount -o remount /media/disk1 # setfacl -mg:"DOMAIN\domain admins":rwx /media/disk1 # setfacl -d -mg:"DOMAIN\domain admins":rwx /media/disk1 
```

and, of course, do not forget about iptables

cat / etc / sysconfig / iptables

 # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT #   urbackup -A INPUT -m state --state NEW -m tcp -p tcp --dport 55414 -j ACCEPT #  samba -A INPUT -s 10.0.0.0/8 -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT -A INPUT -s 10.0.0.0/8 -m state --state NEW -m udp -p udp --dport 445 -j ACCEPT -A INPUT -s 10.0.0.0/8 -m state --state NEW -m udp -p udp --dport 137 -j ACCEPT -A INPUT -s 10.0.0.0/8 -m state --state NEW -m udp -p udp --dport 138 -j ACCEPT -A INPUT -s 10.0.0.0/8 -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT

 # service iptables restart

Is done. Now we can work with our backups from our favorite file manager in Windows.

Source: https://habr.com/ru/post/262581/

All Articles

Configuring a Samba file server on a corporate network

More articles: