Lustre intel: Setting up a Windows client - Revision history

K mouza: /* Integrate Winbind */

2015-07-06T16:30:44Z

Integrate Winbind

K mouza: /* Integrate Winbind */

2015-07-06T16:22:12Z

Integrate Winbind

K mouza: /* Join Samba to the Active Directory Domain */

2015-07-06T16:08:10Z

Join Samba to the Active Directory Domain

K mouza: /* Active Directory Integration */

2015-07-01T08:54:25Z

Active Directory Integration

K mouza: /* Samba and Active Directory Integration Using Winbind */

2015-07-01T08:42:28Z

Samba and Active Directory Integration Using Winbind

K mouza: /* Samba and Active Directory Integration Using Winbind */

2015-07-01T08:36:46Z

Samba and Active Directory Integration Using Winbind

K mouza: /* Samba and Active Directory Integration Using Winbind */

2015-07-01T08:28:15Z

Samba and Active Directory Integration Using Winbind

K mouza: /* Samba and Active Directory Integration Using Winbind */

2015-07-01T08:27:44Z

Samba and Active Directory Integration Using Winbind

K mouza at 10:28, 30 June 2015

2015-06-30T10:28:13Z

K mouza: /* Create a Samba Share for Lustre */

2015-06-30T09:57:52Z

Create a Samba Share for Lustre

@@ Line 520: / Line 520: @@
 [root@ctdb-node2 ~]# wbinfo -p
 Ping to winbindd succeeded
 [root@ctdb-node2 ~]# wbinfo -t
 checking the trust secret for domain BOSTONLABS0 via RPC calls succeeded
 [root@ctdb-node2 ~]# wbinfo -u
 USEDFORWINDOWS\root
@@ Line 535: / Line 537: @@
 BOSTONLABS0\jh
 BOSTONLABS0\bs
 [root@ctdb-node2 ~]# wbinfo -g
 BOSTONLABS0\dhcp users

← Older revision		Revision as of 16:22, 6 July 2015
Line 471:		Line 471:

	=== Integrate Winbind ===		=== Integrate Winbind ===
		+
		+	'''1.''' Edit smb.conf and add the following in the [global] section:
		+	<syntaxhighlight>
		+	idmap config *:backend = tdb2
		+	idmap config *:range = 200000 - 300000
		+	</syntaxhighlight>
		+
		+	'''2.''' Make the Winbind service to be managed by CTDB by editing <tt>/etc/sysconfig/ctdb</tt> and setting the following variable:
		+	<syntaxhighlight>
		+	CTDB_MANAGES_WINBIND=yes
		+	</syntaxhighlight>
		+
		+	'''3.''' Make the following changes to the NSS configuration file, <tt>/etc/nsswitch.conf</tt>:
		+	<syntaxhighlight>
		+	passwd: files winbind
		+	group: files winbind
		+	</syntaxhighlight>
		+
		+	With this configuration, user and group lookups will be executed against the local /etc/passwd and /etc/group files, followed by the Winbind service if no match is found.
		+
		+	'''4.''' Edit the PAM files:
		+	*Edit the files /etc/pam.d/system-auth-ac and /etc/pam.d/password-auth-ac (the two files have identical content on CentOS 6). There are effectively four sections: auth, account, password, and session.
		+
		+	*In the auth section, add the following line directly after the entry for pam_unix.so and before the pam_deny.so line:
		+	<syntaxhighlight>
		+	auth sufficient pam_winbind.so use_first_pass
		+	</syntaxhighlight>
		+
		+	*In the account section, add the following line directly after the entry for am_succeed_if.so and before pam_permit.so:
		+	<syntaxhighlight>
		+	account sufficient pam_winbind.so use_first_pass
		+	</syntaxhighlight>
		+
		+	*In the password section, add the following line directly after the entry for pam_unix.so and before pam_deny.so:
		+	<syntaxhighlight>
		+	password sufficient pam_winbind.so use_first_pass
		+	</syntaxhighlight>
		+
		+	*In the session section, add the following directly after the entry for pam_unix.so (this should be the last line in the file):
		+	<syntaxhighlight>
		+	session required pam_winbind.so use_first_pass
		+	</syntaxhighlight>
		+
		+	'''Remember to edit both files.'''
		+
		+	'''5.''' In order to verify Winbind:
		+	<syntaxhighlight>
		+	[root@ctdb-node2 ~]# wbinfo -p
		+	Ping to winbindd succeeded
		+	[root@ctdb-node2 ~]# wbinfo -t
		+	checking the trust secret for domain BOSTONLABS0 via RPC calls succeeded
		+	[root@ctdb-node2 ~]# wbinfo -u
		+	USEDFORWINDOWS\root
		+	BOSTONLABS0\administrator
		+	BOSTONLABS0\guest
		+	BOSTONLABS0\krbtgt
		+	BOSTONLABS0\mh
		+	BOSTONLABS0\dj
		+	BOSTONLABS0\mhol
		+	BOSTONLABS0\md
		+	BOSTONLABS0\tm
		+	BOSTONLABS0\mouza
		+	BOSTONLABS0\jh
		+	BOSTONLABS0\bs
		+	[root@ctdb-node2 ~]# wbinfo -g
		+	BOSTONLABS0\dhcp users
		+	BOSTONLABS0\dhcp administrators
		+	BOSTONLABS0\domain computers
		+	BOSTONLABS0\domain controllers
		+	BOSTONLABS0\schema admins
		+	BOSTONLABS0\enterprise admins
		+	BOSTONLABS0\cert publishers
		+	BOSTONLABS0\domain admins
		+	BOSTONLABS0\domain users
		+	BOSTONLABS0\domain guests
		+	BOSTONLABS0\group policy creator owners
		+	BOSTONLABS0\ras and ias servers
		+	BOSTONLABS0\allowed rodc password replication group
		+	BOSTONLABS0\denied rodc password replication group
		+	BOSTONLABS0\read-only domain controllers
		+	BOSTONLABS0\enterprise read-only domain controllers
		+	BOSTONLABS0\dnsadmins
		+	BOSTONLABS0\dnsupdateproxy
		+	BOSTONLABS0\bostonlabs-administrators
		+	</syntaxhighlight>

	== Configuration on Windows Client ==		== Configuration on Windows Client ==

← Older revision		Revision as of 16:08, 6 July 2015
Line 442:		Line 442:

	=== Join Samba to the Active Directory Domain ===		=== Join Samba to the Active Directory Domain ===
		+
		+	'''1.''' Start or restart the CTDB cluster with the updated Samba configuration. CTDB must be running so that the machine trust account credentials are saved into Samba's private configuration:
		+	<syntaxhighlight>
		+	service ctdb restart
		+	</syntaxhighlight>
		+
		+	'''2.''' Join the Samba server to the Active Directory domain and create the machine trust account on the Active Directory server:
		+	<syntaxhighlight>
		+	sudo net join -U Administrator
		+	</syntaxhighlight>
		+
		+	The machine trust account is a special user account used to authenticate computers that wish to participate in an Active Directory network. Substitute Administrator for any valid account with the required authorization to add machines to the directory. The following example demonstrates a successful join to the AD domain SMBDOM:
		+	<syntaxhighlight>
		+	$ sudo net join -U Administrator
		+	Enter Administrator's password:
		+	Using short domain name -- BOSTONLABS
		+	Joined 'UsedForWindows' to dns domain 'bostonlabs.co.uk'
		+	Not doing automatic DNS update in a clustered setup.
		+	</syntaxhighlight>
		+
		+	This step need only be carried out once on a single node in the CTDB Samba cluster, provided that each cluster member has the same Samba global configuration (i.e.: the same NetBIOS name, Active Directory domain and Kerberos realm).
		+
		+	'''3.''' The machine account status can be checked at any time as follows:
		+	<syntaxhighlight>
		+	[root@ctdb-node2 ~] net ads testjoin
		+	Join is OK
		+	</syntaxhighlight>
		+
		+	=== Integrate Winbind ===

	== Configuration on Windows Client ==		== Configuration on Windows Client ==

@@ Line 355: / Line 355: @@
 == Samba and Active Directory Integration Using Winbind ==
-=== Active Directory Integration ===
+=== Update Samba and Configure Kerberos ===
 '''1.''' Make the following changes to the [global] section of the Samba configuration file, smb.conf:
@@ Line 416: / Line 416: @@
 _kerberos._tcp.bostonlabs.co.uk has SRV record 0 100 88 srv2.bostonlabs.co.uk.
 </syntaxhighlight>
 == Configuration on Windows Client ==

@@ Line 354: / Line 354: @@
 == Samba and Active Directory Integration Using Winbind ==
 '''1.''' Make the following changes to the [global] section of the Samba configuration file, smb.conf:
@@ Line 398: / Line 400: @@
 '''6.'''
 == Configuration on Windows Client ==

← Older revision		Revision as of 08:27, 1 July 2015
Line 354:		Line 354:

	== Samba and Active Directory Integration Using Winbind ==		== Samba and Active Directory Integration Using Winbind ==
		+
		+	* Make the following changes to the [global] section of the Samba configuration file, smb.conf:
		+	<syntaxhighlight>
		+	security = ads
		+	workgroup = <AD DOMAIN>
		+	realm = <KRB REALM>
		+	</syntaxhighlight>
		+
		+	The Kerberos realm is the DNS domain of the Active Directory network and must be recorded in uppercase. The workgroup is the AD domain, also in upper–case, and is the first section of the Kerberos realm: the text up to but not including the first separator character, "." (period). For example:
		+	<syntaxhighlight>
		+	security = ads
		+	workgroup = BOSTONLABS
		+	realm = BOSTONLABS.LFS.INT
		+	</syntaxhighlight>

	== Configuration on Windows Client ==		== Configuration on Windows Client ==

← Older revision		Revision as of 10:28, 30 June 2015
Line 352:		Line 352:

	After that you will be able to mount the share (lfs) from a Windows client, using any of the CTDB nodes IPs (see below).		After that you will be able to mount the share (lfs) from a Windows client, using any of the CTDB nodes IPs (see below).
		+
		+	== Samba and Active Directory Integration Using Winbind ==

	== Configuration on Windows Client ==		== Configuration on Windows Client ==

@@ Line 337: / Line 337: @@
 [lfs]
 path = /mnt/lfs
 available = yes
 writable = yes