From e8050b42a0d86211c0b30e8dae69028853e71b9c Mon Sep 17 00:00:00 2001 From: Anton Protopopov Date: Thu, 22 Jul 2021 19:35:04 +0400 Subject: [PATCH 1/5] Replace boxes with newest 9.1 releases --- Vagrantfile | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/Vagrantfile b/Vagrantfile index 630d0b8..7d187ea 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -14,21 +14,22 @@ if ARGV[0] == 'up' or ARGV[0] == 'provision' end Vagrant.configure("2") do |config| + config.vbguest.auto_update = false + (0..dcs).each_with_index do |n, ndx| config.vm.define "dc#{n}" do |dc| + dc.vm.network "private_network", ip: "10.64.6.%s" % [10+n], netmask: 24, virtualbox__intnet: "intnet" - dc.vm.box = "BaseALT/alt-server-8.2-x86_64" - dc.vm.box_version = "1.0.0" - dc.vm.box_download_checksum = "db0d0f26575bafd0bb4989dc00d85539e0fd9272c943b373ebbb6d978a3c15ee" - dc.vm.box_download_checksum_type = "sha256" - #dc.vm.box_url = "https://vagrantcloud.com/BaseALT/boxes/alt-server-8.2-x86_64/versions/1.0.0/providers/virtualbox.box" + dc.vm.box = "BaseALT/alt-server-9.1-amd64" + dc.vm.box_version = "2.0.0" + end end (0..cls).each_with_index do |n, ndx| config.vm.define "cl#{n}" do |cl| cl.vm.network "private_network", ip: "10.64.6.%s" % [100+n], netmask: 24, virtualbox__intnet: "intnet" - cl.vm.box = "BaseALT/alt-workstaion-8.2-x86_64" + cl.vm.box = "BaseALT/alt-workstation-9.1-amd64" cl.vm.box_version = "1.0.0" if ndx == cls From 36e88e41c0076ebad8b1b21e3cbbbf2cad59f491 Mon Sep 17 00:00:00 2001 From: Anton Protopopov Date: Thu, 22 Jul 2021 20:00:03 +0400 Subject: [PATCH 2/5] Run apt-get update before first install --- tasks/main.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tasks/main.yml b/tasks/main.yml index 2bb6689..dd9f1bf 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -27,6 +27,9 @@ service: name=altlinux-openresolv state=started when: altlinux_openresolv_exists|bool and openresolv_install.changed|bool + - name: update apt database + shell: "apt-get update" + - name: install samba DC common packages shell: "apt-get install -y {{ samba_dc_common_packages | join(' ') }}" when: (samba_dc_common_packages | length > 0) and samba_flavor != 'client' From be74de75e124e5c144c7cd3bd9828a03a71556fa Mon Sep 17 00:00:00 2001 From: Anton Protopopov Date: Fri, 30 Jul 2021 21:49:03 +0400 Subject: [PATCH 3/5] Add BIND9_DLZ dns backend support --- defaults/main.yml | 3 ++- handlers/main.yml | 5 +++++ tasks/bind.yml | 14 ++++++++++++++ tasks/master.yml | 10 ++++++++++ tasks/replica.yml | 22 +++++++++++++++++++++- templates/options.conf.j2 | 23 +++++++++++++++++++++++ templates/smb.conf.master.j2 | 2 ++ templates/smb.conf.replica.j2 | 2 ++ 8 files changed, 79 insertions(+), 2 deletions(-) create mode 100644 tasks/bind.yml create mode 100644 templates/options.conf.j2 diff --git a/defaults/main.yml b/defaults/main.yml index 8092c07..a4bd2f1 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -10,11 +10,12 @@ samba_dc_required_vars: samba_dc_master_required_vars: - samba_dns_forward - - samba_dns_backend # SAMBA_INTERNAL + - samba_dns_backend # SAMBA_INTERNAL | BIND9_DLZ samba_dc_replica_required_vars: [] samba_dc_common_packages: + - bind - bind-utils - krb5-kinit - ldb-tools diff --git a/handlers/main.yml b/handlers/main.yml index fd96223..1dc9a05 100644 --- a/handlers/main.yml +++ b/handlers/main.yml @@ -14,3 +14,8 @@ service: name: network state: restarted + +- name: restart bind + service: + name: bind + state: restarted diff --git a/tasks/bind.yml b/tasks/bind.yml new file mode 100644 index 0000000..3d6f168 --- /dev/null +++ b/tasks/bind.yml @@ -0,0 +1,14 @@ +--- +- name: Disable bind work in chroot + shell: control bind-chroot disabled + +- name: Disable KRB5RCACHETYPE for bind + shell: grep -q KRB5RCACHETYPE /etc/sysconfig/bind || echo 'KRB5RCACHETYPE="none"' >> /etc/sysconfig/bind + +- name: Add BIND9_DLZ plugin for bind + shell: grep -q 'bind-dns' /etc/bind/named.conf || echo 'include "/var/lib/samba/bind-dns/named.conf";' >> /etc/bind/named.conf + +- name: generate options.conf for bind + template: + src: options.conf.j2 + dest: /etc/bind/options.conf diff --git a/tasks/master.yml b/tasks/master.yml index b3366e5..b13a437 100644 --- a/tasks/master.yml +++ b/tasks/master.yml @@ -11,6 +11,9 @@ - name: prepare samba server include_tasks: prepare.yml +- name: prepare bind service + include_tasks: bind.yml + - name: install samba master packages shell: "apt-get install -y {{samba_dc_master_packages | join(' ')}}" when: samba_dc_master_packages | length > 0 @@ -73,6 +76,13 @@ enabled: true state: started +- name: configure bind service + service: + name: bind + enabled: true + state: started + when: samba_dns_backend != "SAMBA_INTERNAL" + - name: register node in localhost hostvars set_fact: samba_masters: "{{ hostvars['localhost']['samba_masters'] | default([]) }} + [ '{{ inventory_hostname_short }}' ]" diff --git a/tasks/replica.yml b/tasks/replica.yml index a1ecc42..7cd358a 100644 --- a/tasks/replica.yml +++ b/tasks/replica.yml @@ -11,6 +11,9 @@ - name: prepare samba server include_tasks: prepare.yml +- name: prepare bind service + include_tasks: bind.yml + - name: install samba replica packages shell: "apt-get install -y {{samba_dc_replica_packages | join(' ') }}" when: samba_dc_replica_packages | length > 0 @@ -47,7 +50,7 @@ samba-tool dns add {{samba_master_hostname}} {{samba_realm}} {{inventory_hostname_short}} A $SAMBA_ADDRESS -k yes fi if [[ ! -f /var/lib/samba/private/sam.ldb.d/DC={{(samba_realm|upper).replace('.', ',DC=')}}.ldb ]]; then - samba-tool domain join {{samba_realm}} DC -k yes 2>&1 | tee /var/log/samba/join.log + samba-tool domain join {{samba_realm}} DC --dns-backend={{samba_dns_backend}} -k yes 2>&1 | tee /var/log/samba/join.log echo replica_changed fi register: result @@ -62,6 +65,23 @@ master_nameserver: '127.0.0.1' notify: restart network + - name: samba upgrade dns + shell: samba_upgradedns --dns-backend={{samba_dns_backend}} + when: samba_dns_backend != "SAMBA_INTERNAL" + notify: restart bind + + - name: enable bind service + service: + name: bind + enabled: true + when: samba_dns_backend != "SAMBA_INTERNAL" + + - name: disable bind service + service: + name: bind + enabled: false + when: samba_dns_backend == "SAMBA_INTERNAL" + - name: register node in localhost hostvars set_fact: samba_replicas: "{{ hostvars['localhost']['samba_replicas'] | default([]) }} + [ '{{ inventory_hostname_short }}' ]" diff --git a/templates/options.conf.j2 b/templates/options.conf.j2 new file mode 100644 index 0000000..e5ba232 --- /dev/null +++ b/templates/options.conf.j2 @@ -0,0 +1,23 @@ +options { + version "unknown"; + directory "/etc/bind/zone"; + pid-file ""; + dump-file "/var/run/named_dump.db"; + statistics-file "/var/run/named.stats"; + recursing-file "/var/run/recursing"; + + tkey-gssapi-keytab "/var/lib/samba/bind-dns/dns.keytab"; + + //listen-on { localnets; {{ samba_network }}; }; + forwarders { {{ samba_dns_forward }}; }; + allow-query { localnets; {{ samba_network }}; }; + //allow-query-cache { localnets; {{ samba_network }}; }; + allow-recursion { localnets; {{ samba_network }}; }; + + max-cache-ttl 86400; + //interfaces-interval 0; +}; + +logging { + category lame-servers {null;}; +}; diff --git a/templates/smb.conf.master.j2 b/templates/smb.conf.master.j2 index 8930ecc..43a0516 100644 --- a/templates/smb.conf.master.j2 +++ b/templates/smb.conf.master.j2 @@ -10,6 +10,8 @@ interfaces = lo {{samba_master_address}} kerberos method = dedicated keytab dedicated keytab file = /etc/krb5.keytab + {% if samba_dns_backend != "SAMBA_INTERNAL" %}server services = -dns{% endif %} + [netlogon] path = /var/lib/samba/sysvol/{{samba_domain}}/scripts read only = No diff --git a/templates/smb.conf.replica.j2 b/templates/smb.conf.replica.j2 index 0e688bf..b3d0019 100644 --- a/templates/smb.conf.replica.j2 +++ b/templates/smb.conf.replica.j2 @@ -10,6 +10,8 @@ interfaces = lo {{samba_address}} kerberos method = dedicated keytab dedicated keytab file = /etc/krb5.keytab + {% if samba_dns_backend != "SAMBA_INTERNAL" %}server services = -dns{% endif %} + [netlogon] path = /var/lib/samba/sysvol/{{samba_domain}}/scripts read only = No From fe7db3c812a3c1b08022fe99e74222a311af5c0f Mon Sep 17 00:00:00 2001 From: Anton Protopopov Date: Mon, 9 Aug 2021 19:13:06 +0400 Subject: [PATCH 4/5] Turn off dns in template --- templates/smb.conf.master.j2 | 4 +++- templates/smb.conf.replica.j2 | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/templates/smb.conf.master.j2 b/templates/smb.conf.master.j2 index 43a0516..fce4c7e 100644 --- a/templates/smb.conf.master.j2 +++ b/templates/smb.conf.master.j2 @@ -10,7 +10,9 @@ interfaces = lo {{samba_master_address}} kerberos method = dedicated keytab dedicated keytab file = /etc/krb5.keytab - {% if samba_dns_backend != "SAMBA_INTERNAL" %}server services = -dns{% endif %} + {% if samba_dns_backend != "SAMBA_INTERNAL" %} + server services = -dns + {% endif %} [netlogon] path = /var/lib/samba/sysvol/{{samba_domain}}/scripts diff --git a/templates/smb.conf.replica.j2 b/templates/smb.conf.replica.j2 index b3d0019..911d1e0 100644 --- a/templates/smb.conf.replica.j2 +++ b/templates/smb.conf.replica.j2 @@ -10,7 +10,9 @@ interfaces = lo {{samba_address}} kerberos method = dedicated keytab dedicated keytab file = /etc/krb5.keytab - {% if samba_dns_backend != "SAMBA_INTERNAL" %}server services = -dns{% endif %} + {% if samba_dns_backend != "SAMBA_INTERNAL" %} + server services = -dns + {% endif %} [netlogon] path = /var/lib/samba/sysvol/{{samba_domain}}/scripts From 29316402265220823899d332fee9c9205094e7e9 Mon Sep 17 00:00:00 2001 From: Anton Protopopov Date: Tue, 31 Aug 2021 16:36:39 +0400 Subject: [PATCH 5/5] Add change backend_store --- Vagrantfile | 9 +++++---- defaults/main.yml | 1 + group_vars/all.yml.sample | 1 + provision.yml | 3 ++- tasks/master.yml | 2 +- tasks/replica.yml | 2 +- 6 files changed, 11 insertions(+), 7 deletions(-) diff --git a/Vagrantfile b/Vagrantfile index 7d187ea..d49fbd4 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -20,8 +20,8 @@ Vagrant.configure("2") do |config| config.vm.define "dc#{n}" do |dc| dc.vm.network "private_network", ip: "10.64.6.%s" % [10+n], netmask: 24, virtualbox__intnet: "intnet" - dc.vm.box = "BaseALT/alt-server-9.1-amd64" - dc.vm.box_version = "2.0.0" + dc.vm.box = "BaseALT/alt-server-9.2-amd64" + dc.vm.box_version = "1.0.0" end end @@ -29,7 +29,7 @@ Vagrant.configure("2") do |config| (0..cls).each_with_index do |n, ndx| config.vm.define "cl#{n}" do |cl| cl.vm.network "private_network", ip: "10.64.6.%s" % [100+n], netmask: 24, virtualbox__intnet: "intnet" - cl.vm.box = "BaseALT/alt-workstation-9.1-amd64" + cl.vm.box = "BaseALT/alt-workstation-9.2-amd64" cl.vm.box_version = "1.0.0" if ndx == cls @@ -60,7 +60,8 @@ Vagrant.configure("2") do |config| samba_domain: "domain", samba_admin_pass: "peebieY4", samba_dns_forward: "8.8.8.8", - samba_dns_backend: "SAMBA_INTERNAL", + samba_dns_backend: "BIND9_DLZ", + samba_backend_store: "tdb", samba_master_address: "10.64.6.10", samba_network: "10.64.6.0/24", samba_generate_domain_config: true, diff --git a/defaults/main.yml b/defaults/main.yml index a4bd2f1..4053db1 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -11,6 +11,7 @@ samba_dc_required_vars: samba_dc_master_required_vars: - samba_dns_forward - samba_dns_backend # SAMBA_INTERNAL | BIND9_DLZ + - samba_backend_store # tdb | mdb samba_dc_replica_required_vars: [] diff --git a/group_vars/all.yml.sample b/group_vars/all.yml.sample index f73540e..f9c7c8f 100644 --- a/group_vars/all.yml.sample +++ b/group_vars/all.yml.sample @@ -6,6 +6,7 @@ samba_admin_pass: peebieY4 samba_network: 192.168.122.0/24 samba_dns_forward: 192.168.122.1 samba_dns_backend: SAMBA_INTERNAL +samba backend_store: tdb samba_master_address: "{{ hostvars[groups['samba_master_dc'][0]].ansible_host }}" # 192.168.122.68 samba_master_hostname: "{{ hostvars[groups['samba_master_dc'][0]].inventory_hostname_short }}" diff --git a/provision.yml b/provision.yml index 77dc76f..f87335f 100644 --- a/provision.yml +++ b/provision.yml @@ -10,7 +10,8 @@ samba_domain: domain samba_admin_pass: peebieY4 samba_dns_forward: 8.8.8.8 - samba_dns_backend: SAMBA_INTERNAL + samba_dns_backend: BIND9_DLZ + samba_backend_store: tdb samba_master_address: 10.64.6.1 tags: [ "master" ] diff --git a/tasks/master.yml b/tasks/master.yml index b13a437..c50c4cc 100644 --- a/tasks/master.yml +++ b/tasks/master.yml @@ -51,7 +51,7 @@ service samba stop rm -rf /var/lib/samba mkdir /var/lib/samba - samba-tool domain provision --realm={{samba_realm|upper}} --domain={{samba_domain|upper}} --adminpass='{{samba_admin_pass}}' --dns-backend={{samba_dns_backend}} --server-role=dc --use-rfc2307 --host-ip={{samba_master_address}} + samba-tool domain provision --realm={{samba_realm|upper}} --domain={{samba_domain|upper}} --adminpass='{{samba_admin_pass}}' --dns-backend={{samba_dns_backend}} --backend-store={{samba_backend_store}} --server-role=dc --use-rfc2307 --host-ip={{samba_master_address}} notify: restart samba - name: set DNS forward lineinfile: diff --git a/tasks/replica.yml b/tasks/replica.yml index 7cd358a..b94062c 100644 --- a/tasks/replica.yml +++ b/tasks/replica.yml @@ -50,7 +50,7 @@ samba-tool dns add {{samba_master_hostname}} {{samba_realm}} {{inventory_hostname_short}} A $SAMBA_ADDRESS -k yes fi if [[ ! -f /var/lib/samba/private/sam.ldb.d/DC={{(samba_realm|upper).replace('.', ',DC=')}}.ldb ]]; then - samba-tool domain join {{samba_realm}} DC --dns-backend={{samba_dns_backend}} -k yes 2>&1 | tee /var/log/samba/join.log + samba-tool domain join {{samba_realm}} DC --dns-backend={{samba_dns_backend}} --backend_store={{samba_backend_store}} -k yes 2>&1 | tee /var/log/samba/join.log echo replica_changed fi register: result