Форум системных администраторов

Код: Выделить всё

TYPE=Ethernet
BOOTPROTO=static
IPADDR=192.168.136.10
NETMASK=255.255.255.0
HWADDR=00:50:56:26:f0:ed
NM_CONTROLLED=no
NAME=ens32
UUID=31f39c83-6698-4ba7-affa-2db346f79ae5
DEVICE=ens32
ONBOOT=yes

Код: Выделить всё

TYPE=Ethernet
BOOTPROTO=static
IPADDR=192.168.142.10
NETMASK=255.255.255.0
GATEWAY=192.168.142.2
HWADDR=00:50:56:29:fe:41
NM_CONTROLLED=no
NAME=ens33
UUID=2f3a6b1d-31e3-456c-872d-3e914fee3c19
DEVICE=ens33
ONBOOT=yes

Код: Выделить всё

companypdc.company.ru

Код: Выделить всё

127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.136.10 companypdc.company.ru companypdc

Код: Выделить всё

# Created by anaconda
NETWORKING=yes
NETWORKING_IPV6=no

Код: Выделить всё

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
[b]SELINUX=disable[/b]
# SELINUXTYPE= can take one of three two values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected. 
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted 

Код: Выделить всё

 setenforce 0

Код: Выделить всё

systemctl disable firewalld
systemctl stop firewalld

Код: Выделить всё

systemctl disable NetworkManager
systemctl stop NetworkManager

Код: Выделить всё

 wget https://download.samba.org/pub/samba/stable/samba-4.8.4.tar.gz

Код: Выделить всё

tar -xzvf samba-4.8.4.tar.gz

Код: Выделить всё

 ./configure --enable-selftest --with-systemd

Код: Выделить всё

 make && make install

Код: Выделить всё

 echo 'pathmunge /usr/local/samba/bin/' > /etc/profile.d/custompath.sh
 chmod +x /etc/profile.d/custompath.sh
. /etc/profile
 

Код: Выделить всё

# /etc/profile

# System wide environment and startup programs, for login setup
# Functions and aliases go in /etc/bashrc

# It's NOT a good idea to change this file unless you know what you
# are doing. It's much better to create a custom.sh shell script in
# /etc/profile.d/ to make custom changes to your environment, as this
# will prevent the need for merging in future updates.

pathmunge () {
    case ":${PATH}:" in
        *:"$1":*)
            ;;
        *)
            if [ "$2" = "after" ] ; then
                PATH=$PATH:$1
            else
                PATH=$1:$PATH
            fi
    esac
}


if [ -x /usr/bin/id ]; then
    if [ -z "$EUID" ]; then
        # ksh workaround
        EUID=`/usr/bin/id -u`
        UID=`/usr/bin/id -ru`
    fi
    USER="`/usr/bin/id -un`"
    LOGNAME=$USER
    MAIL="/var/spool/mail/$USER"
fi

# Path manipulation
if [ "$EUID" = "0" ]; then
    pathmunge /usr/sbin
    pathmunge /usr/local/sbin
else
    pathmunge /usr/local/sbin after
    pathmunge /usr/sbin after
fi

HOSTNAME=`/usr/bin/hostname 2>/dev/null`
HISTSIZE=1000
if [ "$HISTCONTROL" = "ignorespace" ] ; then
    export HISTCONTROL=ignoreboth
else
    export HISTCONTROL=ignoredups
fi

export PATH USER LOGNAME MAIL HOSTNAME HISTSIZE HISTCONTROL

# By default, we want umask to get set. This sets it for login shell
# Current threshold for system reserved uid/gids is 200
# You could check uidgid reservation validity in
# /usr/share/doc/setup-*/uidgid file
if [ $UID -gt 199 ] && [ "`/usr/bin/id -gn`" = "`/usr/bin/id -un`" ]; then
    umask 002
else
    umask 022
fi

for i in /etc/profile.d/*.sh /etc/profile.d/sh.local ; do
    if [ -r "$i" ]; then
        if [ "${-#*i}" != "$-" ]; then 
            . "$i"
        else
            . "$i" >/dev/null
        fi
    fi
done

unset i
unset -f pathmunge

Код: Выделить всё

/usr/local/samba/bin/samba-tool domain provision --realm=company.ru --domain=COMPANY --adminpass 'kolin1214' --host-ip=192.168.136.10 --server-role=dc --dns-backend=BIND9_DLZ --use-rfc2307 --use-ntvfs --use-xattrs=yes

Код: Выделить всё

rndc-confgen -a -r /dev/urandom

Код: Выделить всё

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {
	listen-on port 53 { 192.168.136.10; 127.0.0.1; };
	# listen-on-v6 port 53 { ::1; };
	directory 	"/var/named";
	dump-file 	"/var/named/data/cache_dump.db";
	statistics-file "/var/named/data/named_stats.txt";
	memstatistics-file "/var/named/data/named_mem_stats.txt";
	   forwarders { 192.168.142.2; };
           notify no;
           allow-query { 192.168.136.0/24; 127.0.0.0/8; };
           allow-recursion {192.168.136.0/24; 127.0.0.0/8; };
           allow-update { 192.168.136.0/24; 127.0.0.0/8; };
           version none;
           hostname none;
           server-id none;
          tkey-gssapi-keytab "usr/local/samba/private/dns.keytab";
          tkey-domain "company.ru" ;
	/* 
	 - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
	 - If you are building a RECURSIVE (caching) DNS server, you need to enable 
	   recursion. 
	 - If your recursive DNS server has a public IP address, you MUST enable access 
	   control to limit queries to your legitimate users. Failing to do so will
	   cause your server to become part of large scale DNS amplification 
	   attacks. Implementing BCP38 within your network would greatly
	   reduce such attack surface 
	*/
	#recursion yes;

	dnssec-enable no;
	dnssec-validation no;
        dnssec-lookaside auto;

	/* Path to ISC DLV key */
	bindkeys-file "/etc/named.iscdlv.key";

	managed-keys-directory "/var/named/dynamic";

	pid-file "/run/named/named.pid";
	session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
	type hint;
	file "named.ca";
};
controls { inet 127.0.0.1 port 953 allow { 127.0.0.1; } keys { "rndc-key"; }; };
key "rndc-key" { algorithm hmac-md5; secret "7028ANZBDRIP/KXV9DNBVQ=="; };
include "/etc/named.root.key";
#include "/etc/named.rfc1912.zones";
include "/usr/local/samba/private/named.conf";

Код: Выделить всё

# Generated by NetworkManager
domain company.ru
nameserver 127.0.0.1

Код: Выделить всё

# Global parameters
[global]
	dcerpc endpoint servers = epmapper, wkssvc, rpcecho, samr, netlogon, lsarpc, drsuapi, dssetup, unixinfo, browser, eventlog6, backupkey, dnsserver, winreg, srvsvc
	netbios name = COMPANYPDC
	realm = COMPANY.RU
	server role = active directory domain controller
	server services = rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbindd, ntp_signd, kcc, dnsupdate, smb
	dcerpc endpoint servers = epmapper, wkssvc, rpcecho, samr, netlogon, lsarpc, spoolss, drsuapi, dssetup, unixinfo, browser, eventlog6, backupkey, dnsserver, winreg, srvsvc
        idmap_ldb:use rfc2307 = yes
        kerberos method = system keytab 
        client ldap sasl wrapping = sign
        allow dns updates = nonsecure and secure
        nsupdate command = /usr/local/samba/sbin/samba_dnsupdate-d 3 
        workgroup = COMPANY

[netlogon]
	path = /usr/local/samba/var/locks/sysvol/company.ru/scripts
	read only = No
        write ok = yes

[sysvol]
	path = /usr/local/samba/var/locks/sysvol
	read only = No
        write ok = yes

Код: Выделить всё

 systemctl restart network

Код: Выделить всё

systemctl restart named