Prev: local admin rights for roaming profiles
Next: [Samba] AD to Kerberos + LDAP + NFS migration
From: Daniel Müller on 9 Aug 2010 10:20

centOs5.5/samba4/named here is a short guide setting it up to work.
First of all do not install the bind package coming with centos 5.5!!

Install needs for samba

yum install libacl* gnutls* readline* python* gdb* autoconf*

Named installation:
Here is a description on what to do:
http://jason.roysdon.net/2009/10/16/building-bind-9-6-on-rhel5-centos5-for-d
nssec-nsec3-support/
The steps,

yum -y install make gcc rpm-build libtool autoconf openssl-devel libcap-devel libidn-devel libxml2-devel openldap-devel postgresql-devel sqlite-devel mysql-devel krb5-devel xmlto

For named to compile correctly you need this 2 packages too:

yum -y install curl*

download.fedora.redhat.com/pub/fedora/epel/5/i386/python-dns-1.7.1-1.el5.noa
rch.rpm

cd /usr/src/redhat/SRPMS
wget -c
ftp://mirrors.kernel.org/pub/fedora/updates/11/SRPMS/bind-9.6.*.src.rpm
wget -c
ftp://mirrors.kernel.org/pub/fedora/updates/11/SRPMS/dnssec-conf-*.src.rpm


cd /usr/src/redhat/SRPMS
wget -c
ftp://mirrors.kernel.org/pub/fedora/updates/12/SRPMS/bind-9.6.*.src.rpm
wget -c
ftp://mirrors.kernel.org/pub/fedora/releases/12/Fedora/source/SRPMS/dnssec-c
onf-*.src.rpm

rpm -ivh --nomd5 bind-9.6.*.src.rpm dnssec-conf-*.src.rpm

cd /usr/src/redhat/SPECS
rpmbuild -ba ./bind.spec

The built bind RPM is now in /usr/src/redhat/RPMS/i386/ or /usr/src/redhat/RPMS/x86_64/ depending on your Arch.

rpmbuild --ba ./dnssec-conf.spec

The built dnssec-conf RPM is now in /usr/src/redhat/RPMS/noarch/

cd /usr/src/redhat/RPMS/*86*
rpm -Uvh bind-9.6.*.rpm bind-utils-9.6.*.rpm bind-libs-9.6.*.rpm ../noarch/dnssec-conf-1.21-*.noarch.rpm

Now bind is installed Config-File in /etc/named.conf I disabled in options:
//dnssec-enable yes;
//dnssec-validation yes;
//dnssec-lookaside . trust-anchor dlv.isc.org.;

To make bind work you have to add user named to the group named.
Set the rights to make named work correctly
chmod 770 /etc/named.conf
chmod 770 /etc/named.rfc1912.zones
chown root:named /etc/named.conf
chown named:named /etc/named.rfc1912.zones
chmod -R 770 /var/named
chown -R named:named /var/named
chown named:named /etc/rndc.key
chown named:named /var/run/named/


Now download and install samba:
url: http://wiki.samba.org/index.php/Samba4/HOWTO

mkdir samba4
cd samba4

rsync -avz samba.org::ftp/unpacked/samba_4_0_test/ .

cd /source4
./autogen.sh
./configure.devloper
make
make install
Samba4 is now installed in /usr/local/samba


Provision it:
Cd /samba4/source4

./setup/provision --realm=samdom.example.com --domain=SAMDOM --adminpass=SOMEPASSWORD --server-role='domain controller'
In my case:

./setup/provision --realm=tuebingen.tst.loc --domain=TUEBINGEN--adminpass=SOMEPASSWORD --server-role='domain controller'


Now you nedd to add the PATH to roots .bash_profile in /root
--> PATH=$PATH:$HOME/bin:/usr/local/samba/bin:/usr/local/samba/sbin
ldconfig
which samba must answer: /usr/local/samba/sbin/samba
Now you must set the lib paths:
echo "/usr/local/samba/lib" > /etc/ld.so.conf.d/samba4.conf
The next things to do( named should have read and write) :
Cd /usr/local/samba/private
Chown named:named krb5.conf
Chown -R named:named /usr/local/samba/private/dns
Chown named:named named.conf
Chown named:named named.conf.update
Chown named:named dns.keytab
Cp krb5.conf /etc # this will overwrite the org. krb5.conf
cd /etc/sysconfig
Vi named There add a line at the bootom:
KEYTAB_FILE="/usr/local/samba/private/dns.keytab"
export KEYTAB_FILE

Now you must update your /etc/named.conf , Be sure to have em listen on a IP not only 127.0.0.1:
Here is mine

options {
listen-on port 53 { 127.0.0.1;192.168.134.27; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost;allyoursubnetshere; };
recursion yes;
forwarders { 192.168.134.253; };##put here your first dns if you have };

logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};

zone "." IN {
type hint;
file "named.ca";
};
include "/usr/local/samba/private/named.conf";####samba4 link include "/etc/named.rfc1912.zones";

In your /etc/resolv.conf you have one single entry: → nameserver localhost

Now you have to put in your globals /usr/local/smba/etc/smb.conf

Interfaces=eth0

Now samba -I -M single
And you are done!!!
Samba_dnsupdate --verbose will give you:



[root(a)node1 etc]# samba_dnsupdate --verbose Looking for DNS entry A tuebingen.tst.loc 192.168.134.27 as tuebingen.tst.loc.
Looking for DNS entry A node1.tuebingen.tst.loc 192.168.134.27 as node1.tuebingen.tst.loc.
Looking for DNS entry CNAME
365d2a9f-bfe6-462d-965e-8622bfefc190._msdcs.tuebingen.tst.loc
node1.tuebingen.tst.loc as
365d2a9f-bfe6-462d-965e-8622bfefc190._msdcs.tuebingen.tst.loc.
Looking for DNS entry SRV
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.tuebingen.tst.loc
node1.tuebingen.tst.loc 88 as
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.tuebingen.tst.loc.
Checking 0 100 88 node1.tuebingen.tst.loc. against SRV _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.tuebingen.tst.loc
node1.tuebingen.tst.loc 88
Looking for DNS entry SRV
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.tuebingen.tst.loc
node1.tuebingen.tst.loc 389 as
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.tuebingen.tst.loc.

The next step setting up the second samba4 on a centOs 5.5 and do replication:
links:http://wiki.samba.org/index.php/Samba4_joining_a_domain

First of all do all the same as for the first centOS samba4 but do not
provision, no smb.conf in /usr/local/samba/etc. Important things: both servers must new each other.
So if named is installed on the second (node2)you need to tell em in his named.conf
that the first server(node1) is a forwarder to search for example “tuebingen.tst.loc”:
Example my named.conf on node2 - 192.168.135.27 is node1,


options {
listen-on port 53 { 127.0.0.1;192.168.134.28; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; 192.168.135.0/24; 192.168.134.0/24; };
recursion yes;
forwarders { 192.168.134.253;192.168.134.27; };

};

logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};

zone "." IN {
type hint;
file "named.ca";
};

include "/etc/named.rfc1912.zones";

On node2 your /etc/hosts have entries like this:

# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1 localhost.localdomain localhost
::1 localhost6.localdomain6 localhost6
192.168.134.28 node2.local node2
192.168.134.27 node1.tuebingen.tst.loc node1





Now you try ping tuebingen.tst.loc. If it is possible you are on the right way:
ping tuebingen.tst.loc
PING tuebingen.tst.loc (192.168.134.27) 56(84) bytes of data.
64 bytes from node1.tuebingen.tst.loc (192.168.134.27): icmp_seq=1 ttl=64 time=0.138 ms

Now you have to copy your /etc/krb5.conf from node1 to node2 /etc/krb5.conf
scp krb5.conf root(a)node2:/etc

edit krb5.conf. Make it look like that:

[root(a)node2 ~]# cat /etc/krb5.conf
[libdefaults]
default_realm = TUEBINGEN.TST.LOC
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
forwardable = yes

[realms]
TUEBINGEN.TST.LOC = {
kdc = node1.tuebingen.tst.loc:88
admin_server = node1.tuebingen.tst.loc:749
default_domain = tuebingen.tst.loc
}

[domain_realm]
.tuebingen.tst.loc = TUEBINGEN.TST.LOC
tuebingen.tst.loc = TUEBINGEN.TST.LOC

Important is setting dns_lookup_realm=true; dns_lookup_kdc=true

Now a very important thing. On both servers the time must be equal.
So do on both servers: date -s hhmm, ex: date-s 1952.
Then try :
kinit administrator
Password for administrator(a)TUEBINGEN.TST.LOC:
Must give you this:
Warning: Your password will expire in 34 days on Fri Sep 3 11:11:06 2010


Now change to join domain:
The place to join as dc to your domain is /samba4/source4. There type:

bin/net vampire tuebingen.tst.loc -Uadministrator --realm=tuebingen.tst.loc

If this is successful start samba .


Now return no node1 the first server.
Change to /samba4/source4

Now type: bin/ldbsearch -H /usr/local/samba/private/sam.ldb objectclass=ntdsdsa objectguid --cross-ncs
This must be the result of two dcs:
[root(a)node1 source4]# bin/ldbsearch -H /usr/local/samba/private/sam.ldb objectclass=ntdsdsa objectguid --cross-ncs
# record 1
dn: CN=NTDS Settings,CN=NODE1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=tuebingen,DC=tst,DC=loc
objectGUID: 365d2a9f-bfe6-462d-965e-8622bfefc190

# record 2
dn: CN=NTDS Settings,CN=NODE2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=tuebingen,DC=tst,DC=loc
objectGUID: d6160c39-0810-4026-aa24-91c91797d892

# returned 2 records
# 2 entries
# 0 referrals

So record 2 is the new dc in the forest.
Now you must update your /usr/local/samba/private/dns/yourzone.list .

Mine after change:


; -*- zone -*-
; generated by provision.pl
$ORIGIN tuebingen.tst.loc.
$TTL 1W
@ IN SOA @ hostmaster (
2010072311 ; serial
2D ; refresh
4H ; retry
6W ; expiry
1W ) ; minimum
IN NS node1

IN A 192.168.134.27
;

node1 IN A 192.168.134.27
node2 IN A 192.168.134.28 #<----new dc entry
gc._msdcs IN A 192.168.134.27

365d2a9f-bfe6-462d-965e-8622bfefc190._msdcs IN CNAME node1
d6160c39-0810-4026-aa24-91c91797d892._msdcs IN CNAME node2 <---new dc entry
;
; global catalog servers
_gc._tcp IN SRV 0 100 3268 node1
_gc._tcp.Default-First-Site-Name._sites IN SRV 0 100 3268 node1
_ldap._tcp.gc._msdcs IN SRV 0 100 3268 node1
_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs IN SRV 0 100 3268 node1
;
; ldap servers
_ldap._tcp IN SRV 0 100 389 node1
_ldap._tcp.dc._msdcs IN SRV 0 100 389 node1
_ldap._tcp.pdc._msdcs IN SRV 0 100 389 node1
_ldap._tcp.e67cd6da-dbd0-492d-96e2-2dc778abaebe.domains._msdcs IN SRV 0 100 389 node1
_ldap._tcp.Default-First-Site-Name._sites IN SRV 0 100 389 node1
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 389 node1
;
; krb5 servers
_kerberos._tcp IN SRV 0 100 88 node1
_kerberos._tcp.dc._msdcs IN SRV 0 100 88 node1
_kerberos._tcp.Default-First-Site-Name._sites IN SRV 0 100 88 node1
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 88 node1
_kerberos._udp IN SRV 0 100 88 node1
; MIT kpasswd likes to lookup this name on password change
_kerberos-master._tcp IN SRV 0 100 88 node1
_kerberos-master._udp IN SRV 0 100 88 node1
;
; kpasswd
_kpasswd._tcp IN SRV 0 100 464 node1
_kpasswd._udp IN SRV 0 100 464 node1
;
; heimdal 'find realm for host' hack
_kerberos IN TXT TUEBINGEN.TST.LOC
(END)

Now you have to put two new entries on node1 /usr/local/samba/etc/smb.conf in the global section:
dreplsrv:periodic_interval = 10 .
dreplsrv:periodic_startup_interval = 5.

Then ssh in node2 to /usr/local/samba/etc. net vampire has placed there a
smb.conf. There in the global section set this above entries too:
dreplsrv:periodic_interval = 10 .
dreplsrv:periodic_startup_interval = 5.

My globals on node1:

[globals]
netbios name = NODE1
workgroup = TUEBINGEN
realm = TUEBINGEN.TST.LOC
server role = domain controller
interfaces = 192.168.134.27
dreplsrv:periodic_interval = 10
dreplsrv:periodic_startup_interval = 5

My globals on node2:


[globals]
netbios name = NODE2
workgroup = TUEBINGEN
realm = TUEBINGEN.TST.LOC
server role = domain controller
dreplsrv:periodic_interval=10
dreplsrv:periodic_startup_interval=5


Then on Both Servers:
Restart samba
service named restart.
rndc flush.

A litle bit testing:
I put the a user Sammler to my domain using the win7 Domain-Tools:

On second server node2 cd /samba4/source4
then:

bin/ldbsearch -H ldap://node2 -Uadministrator%tornado_11 name='sam*' dn
# record 1
dn: CN=Sammler sm. Sammler,OU=Keine Systemsteuerung,DC=tuebingen,DC=tst,DC=loc

# Referral
ref: ldap://tuebingen.tst.loc/CN=Configuration,DC=tuebingen,DC=tst,DC=loc

# returned 2 records
# 1 entries
# 1 referrals


Step 3: Configure home shares of the users.
This was the greatest try and error. Since samba3 this changed. And it is not the same in samba4!!!
A simple:

[homes]
path= /home
read only=no

This is all.
All other ACLS is setting from the tool Active Directory Users and Groups
within windows.
Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
In the Details pane, right-click the applicable user account, and then click Properties.
In the Properties dialog box, click the Profile tab.
Under Home folder, type the directory information: In my case 
\\tuebingen.tst.loc\homes and the tool will make the users directory setting
the correct rights.

Shares: The same for shares you do in your smb.conf
[test]
path= /windows/test
read only= no
Then login as administrator on your win-client. Head to your \\server\test and give the rights you want for groups or users. This is all.



Step 4. Want some more: make the DATA accessible from both samba PDCs. In case one is down. This will be real failover while dns is running
#########
We need a second nic for cluster device and drbd.
On node1 this will be: 192.168.130.6.
On nide2 this will be: 192.168.130.5.
You need a second hardisk in my case it will be /dev/hdc.
Set on both node1 und node2.

mkdir /windows.

Fdisk /dev/hdc
Chose n, then p, then 1, then always enter.

Leave with w.



You nedd to install drbd83-8.3.8-1.el5.centos. and kmod-drbd83-8.3.8-1.el5.centos

yum install *drbd83*

And
yum install cman lvm2-cluster gfs-utils gfs2-utils kmod-gfs

Set up your /etc/drbd.conf:


#drbd.conf dm
global {

usage-count yes;
}

common {
syncer { rate 20M;
al-extents 257;
}
}

resource r0 {

protocol C;

startup {
become-primary-on both;
degr-wfc-timeout 120; # 1 minute.
#wfc-timeout 30;
}

disk {

on-io-error detach;

}

net {

allow-two-primaries;
cram-hmac-alg "sha1";
shared-secret "yourpasswd";
after-sb-0pri discard-least-changes;
#after-sb-0pri discard-zero-changes;
after-sb-1pri violently-as0p;
after-sb-2pri violently-as0p;
#rr-conflict violently;

}

on node2.local {
device /dev/drbd0;
disk /dev/hdc1;
address 192.168.130.5:7788;
flexible-meta-disk internal;

}

on node1.local {
device /dev/drbd0;
disk /dev/hdc1;
address 192.168.130.6:7788;
flexible-meta-disk internal;
}
}


The drbd.conf need to be the same on both hosts!!
Imortant!—with “on” in your drbd.conf you name your hosts, ex: on node1.local.
After on you must set there the name that gives you “uname –n” on your machine.
“r0” ist the resource we are using
According to the /etc/drbd.conf you need to initiate your resource first before you can use it like: drbdadm create-md r0.

Example:
[root(a)node2 etc]# drbdadm create-md r0
md_offset 500105211904
al_offset 500105179136
bm_offset 500089913344

Found some data

==> This might destroy existing data! <==

Do you want to proceed?
[need to type 'yes' to confirm] yes

You want me to create a v08 style flexible-size internal meta data block.
There appears to be a v08 flexible-size internal meta data block
already in place on /dev/hdc1 at byte offset 500105211904
Do you really want to overwrite the existing v08 meta-data?
[need to type 'yes' to confirm] yes

Writing meta data...
initializing activity log
NOT initialized bitmap
New drbd meta data block successfully created.

On both nodes: service drbd start
Then: cat /proc/drbd.
[root(a)node1 ~]# cat /proc/drbd
version: 8.3.8 (api:88/proto:86-94)
GIT-hash: d78846e52224fd00562f7c225bcc25b2d422321d build by mockbuild(a)builder10.centos.org, 2010-06-04 08:04:31
0: cs:Connected ro:Secondary/Secondary ds:Inconsistent/Inconsistent C r----
ns:0 nr:0 dw:0 dr:0 al:0 bm:0 lo:0 pe:0 ua:0 ap:0 ep:1 wo:b oos:488369056

Then on node1:
drbdadm -- --overwrite-data-of-peer primary all

/cat/proc/drbd will show you:

[root(a)node1 ~]# cat /proc/drbd
version: 8.3.8 (api:88/proto:86-94)
GIT-hash: d78846e52224fd00562f7c225bcc25b2d422321d build by mockbuild(a)builder10.centos.org, 2010-06-04 08:04:31
0: cs:SyncSource ro:Primary/Secondary ds:UpToDate/Inconsistent C r----
ns:121460 nr:0 dw:0 dr:129632 al:0 bm:7 lo:1 pe:62 ua:256 ap:0 ep:1 wo:b oos:488249568
[>....................] sync'ed: 0.1% (476804/476920)M delay_probe: 8
finish: 22:36:14 speed: 5,632 (11,948) K/sec

Now you must wait until both devices synced the first time.
You can “watch cat /proc/drbd” to see it progress.
After the first sync has finished you will see:
cat /proc/drbd
version: 8.3.8 (api:88/proto:86-94)
GIT-hash: d78846e52224fd00562f7c225bcc25b2d422321d build by mockbuild(a)builder10.centos.org, 2010-06-04 08:04:31
0: cs:Connected ro:Primary/Secondary ds:UpToDate/UpToDate C r----
ns:488369056 nr:0 dw:0 dr:488369056 al:0 bm:29808 lo:0 pe:0 ua:0 ap:0 ep:1 wo:b oos:0

Now we can configure cluster. This is needed to run both drbd-nodes in primary mode.
First of all we have to write our /etc/cluster/cluster.conf


<?xml version="1.0" ?>
<cluster config_version="3" name="samba-cluster">
<fence_daemon post_fail_delay="0" post_join_delay="3"/>
<clusternodes>
<clusternode name="node2" nodeid="1" votes="1">
<fence>
<method name="single">
<device name="human" ipaddr="192.168.130.4"/>
</method>
</fence>
</clusternode>
<clusternode name="node1" nodeid="2" votes="1">
<fence>
<method name="single">
<device name="human" ipaddr="192.168.130.6"/>
</method>
</fence>

</clusternode>
</clusternodes>
<cman expected_votes="1" two_node="1"/>
<fencedevices>
<fenve_device name="human" agent="fence_manual"/>
</fencedevices>
<rm>
<failoverdomains/>
<resources/>
</rm>
</cluster>

This cluster.conf must be the same on both node1 and node2. So copy it over:
Ex: scp /etc/cluster/cluster.conf root(a)node1:/etc/cluster.
Now start cam on both nodes:
cman start.
Now expect this:

[root(a)node1 cluster]# service cman start
Starting cluster:
Enabling workaround for Xend bridged networking... done
Loading modules... done
Mounting configfs... done
Starting ccsd... done
Starting cman... done
Starting daemons... done
Starting fencing... done
[ OK ]
Now check if all is running well:
Check nodes like this: cman_tool nodes
[root(a)node1 cluster]# cman_tool nodes
Node Sts Inc Joined Name
1 M 12 2010-08-05 08:37:22 node2
2 M 4 2010-08-05 08:37:22 node1

Now we make our clustered filesystem.
Do it exactly like that:
Now first on node1:
For this we need the name of our cluster in cluster.conf, “samba-cluster”, and ‘/dev/drbd0’.
mkfs.gfs2 -t samba-cluster:gfs2 -p lock_dlm -j 2 /dev/drbd0.

[root(a)node1 cluster]# mkfs.gfs2 -t samba-cluster:gfs2 -p lock_dlm -j 2 /dev/drbd0
This will destroy any data on /dev/drbd0.

Are you sure you want to proceed? [y/n]
Device: /dev/drbd0
Blocksize: 4096
Device Size 465.75 GB (122092264 blocks)
Filesystem Size: 465.75 GB (122092262 blocks)
Journals: 2
Resource Groups: 1863
Locking Protocol: "lock_dlm"
Lock Table: "samba-cluster:gfs2"
UUID: BBAF2EC1-B0B8-0F82-DB5C-CA9273859610

Then service gfs start.
Then change on node2. Remember this node runs in drbd “secondary”. So we have to put it on primary.
On node2:
drbdadm primary r0.
A cat /proc/drbd must show us:
cat /proc/drbd
version: 8.3.8 (api:88/proto:86-94)
GIT-hash: d78846e52224fd00562f7c225bcc25b2d422321d build by mockbuild(a)builder10.centos.org, 2010-06-04 08:04:31
0: cs:Connected ro:Primary/Primary ds:UpToDate/UpToDate C r----
ns:0 nr:488671336 dw:488671336 dr:0 al:0 bm:29808 lo:0 pe:0 ua:0 ap:0 ep:1 wo:b oos:0

Now we can make on node2 our clustered filesystem:

[root(a)node2 ~]# mkfs.gfs2 -t samba-cluster:gfs2 -p lock_dlm -j 2 /dev/drbd0

This will destroy any data on /dev/drbd0.
It appears to contain a gfs2 filesystem.

Are you sure you want to proceed? [y/n]
Device: /dev/drbd0
Blocksize: 4096
Device Size 465.75 GB (122092264 blocks)
Filesystem Size: 465.75 GB (122092262 blocks)
Journals: 2
Resource Groups: 1863
Locking Protocol: "lock_dlm"
Lock Table: "samba-cluster:gfs2"
UUID: 885E2E87-90CE-B916-8A73-D66336CD98C0

Now start on node2 gfs: service gfs start.
No make on both nodes in / the directory windows: mkdir windows.
Then mount on both nodes the gfs filesystem to windows:
mount -t gfs2 /dev/drbd0 /windows.
Now lets do testing, on nod1:
cd /windows.
touch test.txt
[root(a)node1 windows]# ls
test.txt
On node2 you must see in /windows:
[root(a)node2 windows]# ls
test.txt.
On node2: vim test.txt, i, this is a test from node2,:, wq.

On node1: /cat/windows/test.txt

[root(a)node1 windows]# cat /windows/test.txt
this is a test from node2
So you did it. Everything is synchronized.
So you point hour home-directories and your shares in /usr/local/samba/etc/smb.conf to a directory in windows and you have a failover Data for your both samba4 controllers.

The next thing to do is to add entries into fstab on both nodes :
vim /etc/fstab
Enter: /dev/drbd0 /windows gfs2 _netdev 0 0
At the end.

This is my fstab:
/dev/VolGroup00/LogVol00 / ext3 defaults 1 1
LABEL=/boot /boot ext3 defaults 1 2
tmpfs /dev/shm tmpfs defaults 0 0
devpts /dev/pts devpts gid=5,mode=620 0 0
sysfs /sys sysfs defaults 0 0
proc /proc proc defaults 0 0
/dev/VolGroup00/LogVol01 swap swap defaults 0 0
/dev/drbd0 /windows gfs2 _netdev 0 0


The next step is to make shure DRBD is started on boot before GFS2. In my case I tried several hours befor I succeeded. You must do this on both nodes.
You find the startup scripts in /etc/rc.d/init.d.
First drbd: vim drbd. You find the start and stop option at #chkconfig_ - start stop.
The original line here: #chkconfig: - 70 08. I changed it to: # chkconfig: - 55 08

#!/bin/bash
#
# chkconfig: - 55 08
# description: Loads and unloads the drbd module
#
# Copyright 2001-2010 LINBIT
#
# Philipp Reisner, Lars Ellenberg
#
### BEGIN INIT INFO
# Provides: drbd
# Required-Start: $local_fs $network $syslog
# Required-Stop: $local_fs $network $syslog
# Should-Start: sshd multipathd
# Should-Stop: sshd multipathd
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# X-Start-Before: heartbeat corosync
# X-Stop-After: heartbeat corosync
# Short-Description: Control drbd resources.
### END INIT INFO

Now vim gfs2:
The original line here: #chkconfig: - 26 74. I changed it to: # chkconfig: - 70 07


#!/bin/bash
#
#
#
# chkconfig: - 70 07
# description: mount/unmount gfs2 filesystems configured in /etc/fstab
#
#
### BEGIN INIT INFO
# Provides:
### END INIT INFO
:q
:

Now cd /etc/rc.d/rc5.d.

mv S26gfs2 S70gfs2
mv S70drbd S55drbd
in all other rc0.d-rc4.d and rc.6.d, mv K74gfs2 K07gfs2

Now restart both nodes.
Mkdir /windows/homes on both nodes.Point your [homes] in /usr/local/samba/etc/smb.conf to path= /windows/homes:

[homes]
path= /windows/homes
read only=no

Make as described in Step3: Add home derictories and rights. You will find your files synchronized on both node1 und node2


Now important to make your simple failover work you have to tune your named server on node1:
This are the entries for your /usr/local/samba/private/dns/yourdomianzone

EX mine : /usr/local/samba/private/dns/tuebingen.tst.loc.zone
Change it according your settings:

; -*- zone -*-
; generated by provision.pl
$ORIGIN tuebingen.tst.loc.
$TTL 1W
@ IN SOA @ hostmaster (
2010080911 ; serial
2D ; refresh
4H ; retry
6W ; expiry
1W ) ; minimum
IN NS node1

IN A 192.168.134.27
IN A 192.168.134.28
;192.168.134.28 eingefuegt
;

node1 IN A 192.168.134.27
node2 IN A 192.168.134.28
gc._msdcs IN A 192.168.134.27

13ff0be8-50f6-45b8-858e-9a38872906e0._msdcs IN CNAME node1
aaf6380d-162e-4263-86b2-c4119457342c._mscds IN CNAME node2
;
; global catalog servers
_gc._tcp IN SRV 0 100 3268 node1
_gc._tcp.Default-First-Site-Name._sites IN SRV 0 100 3268 node1
_ldap._tcp.gc._msdcs IN SRV 0 100 3268 node1
_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs IN SRV 0 100 3268 node1
;
; ldap servers
_ldap._tcp IN SRV 0 100 389 node1
_ldap._tcp IN SRV 0 100 389 node2

_ldap._tcp.dc._msdcs IN SRV 0 100 389 node1
_ldap._tcp.dc._msdcs IN SRV 0 100 389 node2

_ldap._tcp.pdc._msdcs IN SRV 0 100 389 node1
;von mir eingefuegt
_ldap._tcp.pdc._msdcs IN SRV 0 100 389 node2
;ende

_ldap._tcp.fac1d707-a9a9-44a2-8b02-4ab6dda8cec7.domains._msdcs IN SRV 0 100 389 node1
_ldap._tcp.fac1d707-a9a9-44a2-8b02-4ab6dda8cec7.domains._msdcs IN SRV 0 100 389 node2

_ldap._tcp.Default-First-Site-Name._sites IN SRV 0 100 389 node1
_ldap._tcp.Default-First-Site-Name._sites IN SRV 0 100 389 node2

_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 389 node1
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 389 node2

;
; krb5 servers
_kerberos._tcp IN SRV 0 100 88 node1
_kerberos._tcp IN SRV 0 100 88 node2

_kerberos._tcp.dc._msdcs IN SRV 0 100 88 node1
_kerberos._tcp.dc._msdcs IN SRV 0 100 88 node2



_kerberos._tcp.Default-First-Site-Name._sites IN SRV 0 100 88 node1
_kerberos._tcp.Default-First-Site-Name._sites IN SRV 0 100 88 node2

_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 88 node1
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 88 node2

_kerberos._udp IN SRV 0 100 88 node1
_kerberos._udp IN SRV 0 100 88 node2

; MIT kpasswd likes to lookup this name on password change
_kerberos-master._tcp IN SRV 0 100 88 node1
_kerberos-master._tcp IN SRV 0 100 88 node2

_kerberos-master._udp IN SRV 0 100 88 node1
_kerberos-master._udp IN SRV 0 100 88 node2

;
; kpasswd
_kpasswd._tcp IN SRV 0 100 464 node1
_kpasswd._tcp IN SRV 0 100 464 node2

_kpasswd._udp IN SRV 0 100 464 node1
_kpasswd._udp IN SRV 0 100 464 node2

;
; heimdal 'find realm for host' hack
_kerberos IN TXT TUEBINGEN.TST.LOC





























-----------------------------------------------
EDV Daniel Müller

Leitung EDV
Tropenklinik Paul-Lechler-Krankenhaus
Paul-Lechler-Str. 24
72076 Tübingen

Tel.: 07071/206-463, Fax: 07071/206-499
eMail: mueller(a)tropenklinik.de
Internet: www.tropenklinik.de
-----------------------------------------------

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
 | 
Pages: 1
Prev: local admin rights for roaming profiles
Next: [Samba] AD to Kerberos + LDAP + NFS migration