etc/0042755000175300017540000000000010311427123011170 5ustar jillljeditoretc/samba/0042755000175300017540000000000010312423624012256 5ustar jillljeditoretc/samba/smb.conf0100644000175300017540000000207410312423624013704 0ustar jillljeditor# Samba config file created using SWAT # from 127.0.0.1 (127.0.0.1) # Date: 2005/04/19 16:59:49 # Global parameters [global] security = user log file = /var/log/samba/samba-%m.log #log level = 3 passdb:5 auth:10 workgroup = CI netbios name = CI-PDC server string = Example Primary Domain Controller private dir = /var/lib/samba/private passdb backend = ldapsam:ldap://ldap.example.com domain logons = Yes os level = 33 preferred master = Yes domain master = Yes enable privileges = Yes hosts allow = 128.135.152., localhost lanman auth = no ldap ssl = start tls ldap admin dn = uid=samba_server,ou=people,o=ci,dc=example,dc=com ldap suffix = o=ci,dc=example,dc=com ldap group suffix = ou=group ldap machine suffix = ou=hosts,ou=samba ldap user suffix = ou=people ldap idmap suffix = ou=idmap,ou=samba add machine script = /usr/bin/smb-new-machine.pl %u logon home = logon path = wins support = no idmap backend = ldap:ldap://ldap.example.com idmap uid = 15000-25000 idmap gid = 15000-25000 [netlogon] path = /var/lib/samba/netlogon browseable = No etc/openldap/0042755000175300017540000000000010311536245013000 5ustar jillljeditoretc/openldap/master-slapd.conf0100644000175300017540000001506110311427207016236 0ustar jillljeditor# # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/autofs.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/misc.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: # modulepath /usr/lib/openldap/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind security ssf=1 tls=128 update_tls=128 #disallow bind_simple allow bind_v2 bind_anon_dn TLSCipherSuite HIGH TLSCACertificatePath /etc/ssl/certs TLSCertificateFile /etc/openldap/ssl/slapd-cert.pem TLSCertificateKeyFile /etc/openldap/ssl/slapd-key.pem TLSVerifyClient allow sasl-secprops noplain,noanonymous,noactive,minssf=56 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy is: # Allow read by all # # rootdn can always write! # Map SASL authentication DNs to LDAP DNs # This leaves "username/admin" principals untouched sasl-regexp uid=([^/]*),cn=GSSAPI,cn=auth "uid=$1,ou=People,o=ci,dc=example,dc=com" # This should be a ^ plus, not a star, but slapd won't accept it #access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read #access to * # by self write # by users read # by anonymous auth # Samba accounts passwords access to attrs=sambaLMPassword,sambaNTPassword by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by dn.exact="uid=samba_server,ou=people,o=ci,dc=uchicago,dc=edu" write by self write by anonymous auth by * none # Passwords should not be in entered by anyone access to attrs=userPassword by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by dn.exact="uid=samba_server,ou=people,o=ci,dc=uchicago,dc=edu" write by self write by anonymous auth by * none # Users can change their shell, anyone else can see it access to attrs=loginShell by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by self write by * read # Only the user can see their employeeNumber access to attrs=employeeNumber by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by self read by * none # Allow everyone to get People information access to dn.children="ou=People,o=ci,dc=uchicago,dc=edu" by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by * read # Default read access for everything else access to * by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by dn.exact="uid=samba_server,ou=people,o=ci,dc=uchicago,dc=edu" write by peername=192.168.1.* read by anonymous none by * read # Limit number of search results to prevent trolling of directory # by spammers, etc. #sizelimit 10 # Alternatively, specify a large enough size limit to ensure we can dump # the entire directory sizelimit 5000 # Limit the number of threads # The default is 16 and that has been reported on the openldap mailing # list to be too many for a machine with < 1 GB of RAM threads 8 # Disconnect idle connections after 4 hours. Otherwise connections # from nss_ldap keep piling up and we eventually exceed our open file # handle limit. Increasing that limit above 1024 is difficult on Linux # because slapd uses select(2) and the FD_SETSIZE is hard-coded at 1024. # Presumably slapd will eventually be converted to use poll(2) instead # of select, which doesn't have that limit. But until then this is our # workaround. idletimeout 14400 # Turn off logging. We can always turn it back on when we need to see # what's going on. # 256 is the default. 256 logs connections, operations and results, # it would be nice to log only operations but there isn't a level just # for operations. #loglevel 0 #loglevel 2472 loglevel 256 ####################################################################### # ldbm database definitions ####################################################################### database bdb suffix "o=ci,dc=example,dc=com" #rootdn "cn=Manager,o=ci,dc=example,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/openldap-data mode 0600 # Indices to maintain index objectClass eq index cn pres,eq index uid,uidNumber pres,eq index gidNumber,memberUID pres,eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq # Increase the size of slapd's entry cache. Note that this is a # seperate cache from BDB's cache, who's size is configured in DB_CONFIG cachesize 10000 # BDB tuning # It would be preferable to do all BDB tuning in BDB's configuration # file, but there are some settings that aren't supported there. # BDB's config file is var/openldap-data/DB_CONFIG # Docs: http://www.openldap.org/faq/data/cache/893.html # # Turn on checkpointing, which is off by default. This reduces the # amount of time it takes db_recover to run on a restart. checkpoint 256 15 # Replication log replogfile /var/lib/openldap-data/slapd.replog replica host=kdc.example.com:389 suffix="o=ci,dc=example,dc=com" bindmethod=sasl saslmech=gssapi authcId=host/ldap.example.com@EXAMPLE.COM tls=yes usr/0042755000175300017540000000000010311425724011233 5ustar jillljeditorusr/bin/0042755000175300017540000000000010312423534012001 5ustar jillljeditorusr/bin/smb-create-password.pl0100755000175300017540000000115610312146362016222 0ustar jillljeditor#!/usr/bin/perl use strict; use Crypt::SmbHash qw( nthash ); use Term::ReadKey; ReadMode 2; print "Password: "; my $password1 = ReadLine( 0 ); print "\nAgain: "; my $password2 = ReadLine( 0 ); ReadMode 0; chomp $password1; chomp $password2; print "\n"; if ( $password1 ne $password2 ) { print "Passwords do not match\n"; undef $password1; undef $password2; exit 1; } # We generate a password for the machine my $ntpassword = nthash( $password1 ); undef $password1; undef $password2; print "$ntpassword"; undef $ntpassword; my @command = ( "chmod", "0400", "$ENV{'HOME'}/foohash" ); system( @command ); exit 0; usr/bin/smb-new-machine.pl0100755000175300017540000000555210312407656015324 0ustar jillljeditor#!/usr/bin/perl use Crypt::SmbHash; use Net::LDAP; use Net::LDAP::Entry; use Net::LDAP::LDIF; use File::Temp; use TDB_File; # The LDAP DN to bind to the directory as my $LDAP_DN="uid=samba_server,ou=people,o=ci,dc=example,dc=com"; # Where the Samba secrets file is kept my $secrets_file="/var/lib/samba/private/secrets.tdb"; # This is the SID for our domain my $SID="S-1-5-21-2162541494-3670296480-3949091320"; # LDAP server's hostname my $LDAP_hostname="ldap://ldap.example.com"; # Our LDAP search criteria my $base = "ou=hosts,ou=samba,o=ci,dc=example,dc=com"; my $filter = "(objectClass=posixAccount)"; my $attrs = ["uidNumber"]; # First we need to extract the DN's password from the secrets file my $tdb = TDB_File->open( $secrets_file ) or die $!; my $LDAP_password = $tdb->fetch( "SECRETS/LDAP_BIND_PW/$LDAP_DN" ); chop( $LDAP_password ); # Gather the host information. Strip the tailing '$' on the end as well my $host = $ARGV[0]; my $host_alias = $host; $host_alias =~ s/\$$//; # Connect, StartTLS, and bind to the LDAP dircetory my $ldap = Net::LDAP->new( $LDAP_hostname ) or die $@; my $mesg = $ldap->start_tls( verify => 'require', capath => '/etc/ssl/certs', ciphers => 'HIGH' ); $mesg->code && die $mesg->error_text; $mesg = $ldap->bind( "$LDAP_DN", password => $LDAP_password); $mesg->code && $ldap->disconnect( ) && die $mesg->error_text; my $result = $ldap->search( base => "$base", scope => "sub", filter => "$filter", attrs => "$attrs" ); $result->code && $ldap->unbind( ) && $ldap->disconnect( ) && die $result->error; # Next we push all the UID numbers we received into an array my @entries = $result->entries; my $entry, @uids; foreach $entry ( @entries ) { my $attr = $entry->get_value( 'uidNumber' ); push @uids, $attr; } # Next we sort the array and determine the next highest available UID number my @sorted_uids = sort { $a <=> $b } @uids; my $last_uid = pop @sorted_uids; my $next_uid = $last_uid + 1; # Next we need to calculate the RID for our machine my $RID = ( $next_uid * 2 ) + 1000; # We generate a password for the machine my ( $host_lmpasswd, $host_ntpasswd ) = ntlmgen( $host_alias ); # Now we define the entry we'll add to the directory $entry = Net::LDAP::Entry->new; $entry->dn( "uid=$host,$base" ); $entry->add ( 'objectClass' => "account", 'objectClass' => "posixAccount", 'objectClass' => "sambaSamAccount", 'cn' => "$host", 'uid' => "$host", 'uidNumber' => "$next_uid", 'gidNumber' => "65534", 'homeDirectory' => "/dev/null", 'loginShell' => "/bin/false", 'sambaSID' => "$SID-$RID", 'sambaLMPassword' => "$host_lmpasswd", 'sambaNTPassword' => "$host_ntpasswd", 'sambaPwdMustChange' => "2147483647", 'sambaAcctFlags' => "[W ]", 'sambaPwdCanChange' => "1115058233", 'sambaPwdLastSet' => "1115058233" ); # Last we write the contents to the directory $ldap->add( $entry ); # To be good citizens, unbind from the directory $ldap->unbind; samba.ldif0100644000175300017540000000274110312166243012343 0ustar jillljeditordn: ou=Samba,o=ci,dc=example,dc=com objectClass: organizationalUnit ou: Samba description: Samba Specifics dn: sambaDomainName=CI,ou=Samba,o=ci,dc=example,dc=com objectClass: top objectClass: sambaDomain sambaSID: S-1-5-21-2162541494-3670296480-3949091320 sambaDomainName: CI dn: ou=Hosts,ou=samba,o=ci,dc=example,dc=com objectClass: organizationalUnit ou: Hosts description: Samba Hosts # Idmap, samba, ci, uchicago.edu dn: ou=Idmap,ou=samba,o=ci,dc=example,dc=com objectClass: organizationalUnit objectClass: sambaUnixIdPool ou: Idmap description: Samba Idmapping at the Computation Institute uidNumber: 15000 gidNumber: 15000 dn: cn=Domain Admins,ou=group,o=ci,dc=example,dc=com objectClass: posixGroup objectClass: sambaGroupMapping cn: Domain Admins gidNumber: 512 sambaGroupType: 2 description: Windows Domain Administrators sambaSID: S-1-5-21-2162541494-3670296480-3949091320-512 displayName: Domain Admins dn: cn=Domain Users,ou=group,o=ci,dc=example,dc=com objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping cn: Domain Users gidNumber: 513 sambaGroupType: 2 description: Windows Domain Users sambaSID: S-1-5-21-2162541494-3670296480-3949091320-513 displayName: Domain Users dn: cn=Domain Guests,ou=group,o=ci,dc=example,dc=com objectClass: top objectClass: posixGroup objectClass: sambaGroupMapping cn: Domain Guests gidNumber: 514 sambaGroupType: 2 description: Windows Domain Guests sambaSID: S-1-5-21-2162541494-3670296480-3949091320-514 displayName: Domain Guests