Eida.cz - Enterprise transfer rovnou z balíku

UUID=XYZ01 /               ext4    acl,user_xattr,barrier=1,errors=remount-ro 0       1
UUID=XYZ02 /boot           ext4    defaults        0       2
UUID=XYZ03 none            swap    sw              0       0

root@dc2:/home/eida# apt install acl samba winbind ntp krb5-user bind9 dnsutils freeradius netfilter-persistent

root@dc2:/home/eida# apt install sudo
Načítají se seznamy balíků… Hotovo
Vytváří se strom závislostí… Hotovo
Načítají se stavové informace… Hotovo
Následující NOVÉ balíky budou nainstalovány:
  sudo
0 aktualizováno, 1 nově instalováno, 0 k odstranění a 0 neaktualizováno.
Nutno stáhnout 1 057 kB archivů.
Po této operaci bude na disku použito dalších 4 695 kB.
Stahuje se:1 http://deb.debian.org/debian bullseye/main amd64 sudo amd64 1.9.5p2-2 [1 057 kB]
Staženo 1 057 kB za 0s (4 007 kB/s)
Vybírá se dosud nevybraný balík sudo.
(Načítá se databáze … nyní je nainstalováno 33242 souborů a adresářů.)
Připravuje se nahrazení …/sudo_1.9.5p2-2_amd64.deb …
Rozbaluje se sudo (1.9.5p2-2) …
Nastavuje se balík sudo (1.9.5p2-2) …
Zpracovávají se spouštěče pro balík man-db (2.9.4-2) …

root@dc2:/home/eida# /usr/sbin/usermod -a -G sudo eida

root@dc2:/home/eida# cat /etc/network/interfaces

source /etc/network/interfaces.d/*

auto lo
iface lo inet loopback

# IPv4
allow-hotplug ens3
iface ens3 inet static
	address 10.5.5.102/24
	gateway 10.5.5.1
	dns-nameservers 10.5.5.100
	dns-search eida.lan

# IPv6
iface ens3 inet6 static
	address 2001:ab:cd:df::dc2
	netmask 64
	gateway 2001:ab:cd:df::1
	dns-nameservers 2001:ab:cd:df::a
	up /sbin/ip -6 route add default via 2001:ab:cd:df::1 dev ens3 onlink || true

root@dc2:/home/eida# cat /etc/resolv.conf
domain eida.lan
search eida.lan
nameserver 10.5.5.100
nameserver 2001:ab:cd:ef::a

root@dc2:/home/eida# rm /etc/ssh/host_key_rsa_key*
root@dc2:/home/eida# rm /etc/ssh/host_key_ecdsa_key*

root@dc2:/home/eida# cat /etc/ssh/sshd_config | grep -v ^# | grep -v ^$
Include /etc/ssh/sshd_config.d/*.conf
HostKey /etc/ssh/ssh_host_ed25519_key
PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
UsePAM yes
AllowTcpForwarding no
X11Forwarding no
PrintMotd no
AcceptEnv LANG LC_*
Subsystem	sftp	/usr/lib/openssh/sftp-server

root@dc2:/home/eida# /etc/init.d/ssh restart

root@dc2:/home/eida# systemctl stop smbd nmbd winbind

root@dc2:/home/eida# systemctl disable smbd nmbd winbind
Synchronizing state of smbd.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install disable smbd
Synchronizing state of nmbd.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install disable nmbd
Synchronizing state of nmbd.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install disable winbind
Removed /etc/systemd/system/multi-user.target.wants/nmbd.service.
Removed /etc/systemd/system/multi-user.target.wants/smbd.service.
Removed /etc/systemd/system/multi-user.target.wants/winbind.service.

root@dc2:/home/eida# systemctl unmask samba-ad-dc
Removed /etc/systemd/system/samba-ad-dc.service.

root@dc2:/home/eida# systemctl enable samba-ad-dc
Synchronizing state of samba-ad-dc.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable samba-ad-dc
Created symlink /etc/systemd/system/multi-user.target.wants/samba-ad-dc.service → /lib/systemd/system/samba-ad-dc.service.

[global]
        netbios name = DC2
        realm = EIDA.LAN
        server role = active directory domain controller
        server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbindd, ntp_signd, kcc, dnsupdate
        workgroup = EIDA
        idmap_ldb:use rfc2307 = yes

        username map = /etc/samba/user.map
        ntlm auth = mschapv2-and-ntlmv2-only
        allow dns updates = secure
        dsdb:schema update allowed = true

[netlogon]
        path = /var/lib/samba/sysvol/eida.lan/scripts
        read only = No

[sysvol]
        path = /var/lib/samba/sysvol
        read only = No

root@dc2:/home/eida# samba-tool domain join eida.lan DC -U eida --dns-backend=BIND9_DLZ
INFO 2021-03-06 23:24:56,464 pid:723 /usr/lib/python3/dist-packages/samba/join.py #107: Finding a writeable DC for domain 'eida.lan'
INFO 2021-03-06 23:24:56,479 pid:723 /usr/lib/python3/dist-packages/samba/join.py #109: Found DC dc1.eida.lan
Password for [EIDA\eida]:
...
INFO 2021-03-06 23:25:18,637 pid:723 /usr/lib/python3/dist-packages/samba/join.py #1559: Joined domain EIDA (SID S-1-5-21-X-Y-Z) as a DC

root@dc2:/home/eida# cp /var/lib/samba/private/krb5.conf /etc

root@dc2:/home/eida# chmod 0644 /etc/krb5.conf

root@dc2:/home/eida# cat /etc/krb5.conf
[libdefaults]
	default_realm = EIDA.LAN
	dns_lookup_realm = false
	dns_lookup_kdc = true

[realms]
EIDA.LAN = {
	default_domain = eida.lan
}

[domain_realm]
	DC2 = EIDA.LAN

root@dc2:/home/eida# samba-tool drs showrepl
Default-First-Site-Name\DC2
DSA Options: 0x00000001
DSA object GUID: f9e268d7-X-Y-Z-3787aad77574
DSA invocationId: b1c9ce40-X-Y-Z-4a3d8fd9033d

==== INBOUND NEIGHBORS ====

CN=Configuration,DC=eida,DC=lan
	Default-First-Site-Name\DC1 via RPC
		DSA object GUID: d2bd2987-A-B-C-5ba7691aadef
		Last attempt @ Sat Mar  6 23:39:36 2021 CET was successful
		0 consecutive failure(s).
		Last success @ Sat Mar  6 23:39:36 2021 CET
		...

==== OUTBOUND NEIGHBORS ====

CN=Configuration,DC=eida,DC=lan
	Default-First-Site-Name\DC1 via RPC
		DSA object GUID: d2bd2987-A-B-C-5ba7691aadef
		Last attempt @ NTTIME(0) was successful
		0 consecutive failure(s).
		Last success @ NTTIME(0)
		...

==== KCC CONNECTION OBJECTS ====

Connection --
	Connection name: 5a4b78fa-A-B-C-eca1e621c4de
	Enabled        : TRUE
	Server DNS name : dc1.eida.lan
	Server DN name  : CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=eida,DC=lan
		TransportType: RPC
		options: 0x00000001
Warning: No NC replicated for Connection!

root@dc2:/home/eida# cat /etc/ntp.conf
driftfile /var/lib/ntp/ntp.drift
leapfile /usr/share/zoneinfo/leap-seconds.list
statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable
pool [SERVER].eida.lan # jako pool - hlavní NTP v síti
server time.euro.apple.com # fallback
restrict -4 default kod limited nomodify notrap nopeer mssntp
restrict -6 default kod limited nomodify notrap nopeer mssntp
restrict 127.0.0.1
restrict ::1
restrict default kod nomodify notrap nopeer mssntp
restrict source notrap nomodify noquery mssntp
ntpsigndsocket /var/lib/samba/ntp_signd/

root@dc2:/home/eida# setfacl -m u:ntp:rwx /var/lib/samba/ntp_signd/

root@dc2:/home/eida# cat /etc/bind/named.conf

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";

include "/var/lib/samba/bind-dns/named.conf";

root@dc2:/home/eida# cat /etc/bind/named.conf.options
acl "trusted" {
	10.5.0.0/16;
	2001:ab:cd:ef::/64;
	localhost;
	localnets;
};

acl "server" {
	10.5.5.102/32; // DC2
	10.5.5.100/32; // primární DNS
	2001:ab:cd:ef::dc2; // DC2
	2001:ab:cd:ef::a; // primární DNS
};

options {
	directory "/var/cache/bind";

	tkey-gssapi-keytab "/var/lib/samba/private/dns.keytab";

	forwarders {
		10.5.5.100;
		2001:ab:cd:ef::a;
	};

	dnssec-validation auto;

	auth-nxdomain no;
	listen-on { 10.5.5.102; };
	listen-on-v6 { 2001:ab:cd:ef::dc2; };
};

root@dc2:/home/eida# setfacl -m u:bind:rw /var/lib/samba/private/dns.keytab
root@dc2:/home/eida# setfacl -R -m u:bind:rwx /var/lib/samba/bind-dns/

root@dc2:/var/lib/samba# samba-tool fsmo transfer --role=all
...

root@dc1:/home/eida# samba-tool domain demote -U eida --server=dc2.eida.lan
...

root@dc1:/home/eida# tar cJf /tmp/radius-conf.tar.xz /etc/freeradius/3.0/
tar: Odstraňuje se úvodní „/“ z názvů prvků

root@dc1:/home/eida# chown eida:eida /tmp/radius-conf.tar.xz

root@dc1:/home/eida# md5sum /tmp/radius-conf.tar.xz
a2cb575ea3c8b51b6ab2bd1becf8d6b2  /tmp/radius-conf.tar.xz

eida@dc2:~# scp dc1:/tmp/radius-conf.tar.xz /tmp/
radius-conf.tar.xz	100%  164KB  35.3MB/s   00:00

eida@dc2:~$ sudo su
[sudo] heslo pro eida:
root@dc2:/home/eida# md5sum /tmp/radius-conf.tar.xz
a2cb575ea3c8b51b6ab2bd1becf8d6b2  /tmp/radius-conf.tar.xz

root@dc2:/home/eida# service freeradius stop

root@dc2:/home/eida# tar xf /tmp/radius-conf.tar.xz --directory /

root@dc2:/home/eida# usermod -a -G winbindd_priv freerad

root@dc2:/home/eida# service freeradius start

root@dc2:/home/eida# cat /etc/iptables/rules.v4
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A INPUT -f -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -d 10.5.5.102/32 -p icmp -m icmp --icmp-type 8 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -d 10.5.5.100/32 -p icmp -m icmp --icmp-type 8 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -s 10.5.5.100/32 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 10.5.5.1/32 -p udp -m udp --dport 1812 -j ACCEPT
-A INPUT -s 10.5.5.1/32 -p udp -m udp --dport 1813 -j ACCEPT
-A INPUT -s 10.5.5.1/32 -p udp -m udp --dport 1814 -j ACCEPT
-A INPUT -s 10.5.5.100/32 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -s 10.5.5.100/32 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -s 10.5.5.100/32 -p tcp -m tcp --dport 953 -j ACCEPT
-A INPUT -s 10.5.0.0/16 -p udp -m udp --dport 88 -j ACCEPT
-A INPUT -s 10.5.0.0/16 -p tcp -m tcp --dport 88 -j ACCEPT
-A INPUT -s 10.5.0.0/16 -p udp -m udp --dport 123 -j ACCEPT
-A INPUT -s 10.5.0.0/16 -p tcp -m tcp --dport 445 -j ACCEPT
-A INPUT -s 10.5.0.0/16 -p tcp -m tcp --dport 135 -j ACCEPT
-A INPUT -s 10.5.0.0/16 -p tcp -m tcp --dport 139 -j ACCEPT
-A INPUT -s 10.5.0.0/16 -p udp -m udp --dport 137 -j ACCEPT
-A INPUT -s 10.5.0.0/16 -p udp -m udp --dport 138 -j ACCEPT
-A INPUT -s 10.5.0.0/16 -p tcp -m tcp --dport 389 -j ACCEPT
-A INPUT -s 10.5.0.0/16 -p udp -m udp --dport 389 -j ACCEPT
-A INPUT -s 10.5.0.0/16 -p tcp -m tcp --dport 464 -j ACCEPT
-A INPUT -s 10.5.0.0/16 -p udp -m udp --dport 464 -j ACCEPT
-A INPUT -s 10.5.0.0/16 -p tcp -m tcp --dport 636 -j ACCEPT
-A INPUT -s 10.5.0.0/16 -p tcp -m tcp --dport 3268 -j ACCEPT
-A INPUT -s 10.5.0.0/16 -p tcp -m tcp --dport 3269 -j ACCEPT
-A INPUT -s 10.5.0.0/16 -p tcp -m multiport --dports 1024:1300,49152:65535 -j ACCEPT
COMMIT

root@dc2:/home/eida# cat /etc/iptables/rules.v6
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -s fe80::/10 -p ipv6-icmp -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::/64 -p ipv6-icmp -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::a/128 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::1/128 -p udp -m udp --dport 1812 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::1/128 -p udp -m udp --dport 1813 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::1/128 -p udp -m udp --dport 1814 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::a/128 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::a/128 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::/64 -p tcp -m multiport --dports 1024:1300,49152:65535 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::a/128 -p tcp -m tcp --dport 953 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::/64 -p udp -m udp --dport 88 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::/64 -p tcp -m tcp --dport 88 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::/64 -p udp -m udp --dport 123 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::/64 -p tcp -m tcp --dport 445 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::/64 -p tcp -m tcp --dport 135 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::/64 -p tcp -m tcp --dport 139 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::/64 -p udp -m udp --dport 137 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::/64 -p udp -m udp --dport 138 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::/64 -p tcp -m tcp --dport 389 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::/64 -p udp -m udp --dport 389 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::/64 -p tcp -m tcp --dport 464 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::/64 -p udp -m udp --dport 464 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::/64 -p tcp -m tcp --dport 636 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::/64 -p tcp -m tcp --dport 3268 -j ACCEPT
-A INPUT -s 2001:ab:cd:ef::/64 -p tcp -m tcp --dport 3269 -j ACCEPT
-A INPUT ! -s 2001:ab:cd:ef::/64 -j DROP
COMMIT

root@dc2:/home/eida# iptables-nft-restore < /etc/iptables/rules.v4

root@dc2:/home/eida# ip6tables-nft-restore < /etc/iptables/rules.v6