Skip to content

Commit 0a52d36

Browse files
LizenzFass78851LizenzFass78851
authored
feat(setup-ubuntu-ad): add scripts
1 parent 3f3472c commit 0a52d36

File tree

5 files changed

+407
-0
lines changed

5 files changed

+407
-0
lines changed

‎setup-ubuntu-active-directory/1-install_samba_ad.sh‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
#!/bin/bash
2+
3+
# Load environment variables
4+
if [ -f .env ]; then
5+
source .env
6+
else
7+
echo "Error: .env file not found!"
8+
exit 1
9+
fi
10+
11+
# Samba AD DC Installation Script
12+
# Based on: https://wiki.ubuntuusers.de/HowTo/Samba-AD-Server_unter_Ubuntu_20.04_installieren/
13+
14+
# 1. Disable IPv6
15+
echo "Disabling IPv6..."
16+
cat > /etc/default/grub.d/disable-ipv6.cfg << EOF
17+
GRUB_CMDLINE_LINUX_DEFAULT="ipv6.disable=1"
18+
EOF
19+
update-grub
20+
21+
# 2. Configure static IP
22+
echo "Configuring static IP..."
23+
cat > /etc/netplan/99-${PRIMARY_DC_INTERFACE}-static-${PRIMARY_DC_IP}.yaml << EOF
24+
network:
25+
version: 2
26+
renderer: networkd
27+
ethernets:
28+
${PRIMARY_DC_INTERFACE}:
29+
addresses:
30+
- ${PRIMARY_DC_IP}/24
31+
dhcp4: no
32+
routes:
33+
- to: default
34+
via: ${GATEWAY_IP}
35+
nameservers:
36+
search: [${REALM}]
37+
addresses: [${GATEWAY_IP}]
38+
EOF
39+
chmod 600 /etc/netplan/99-${PRIMARY_DC_INTERFACE}-static-${PRIMARY_DC_IP}.yaml
40+
netplan apply
41+
42+
# 3. Disable systemd-resolved stub listener
43+
echo "Disabling systemd-resolved stub listener..."
44+
mkdir -p /etc/systemd/resolved.conf.d/
45+
cat > /etc/systemd/resolved.conf.d/disable-stub-listener.conf << EOF
46+
[Resolve]
47+
DNSStubListener=no
48+
EOF
49+
50+
rm -f /etc/resolv.conf
51+
ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
52+
53+
systemctl daemon-reload
54+
systemctl restart systemd-resolved
55+
56+
# 4. Set hostname
57+
echo "Setting hostname..."
58+
hostnamectl set-hostname ${PRIMARY_DC_HOSTNAME}
59+
60+
# 5. Configure hosts file
61+
cat > /etc/hosts << EOF
62+
127.0.0.1 localhost
63+
${PRIMARY_DC_IP} ${PRIMARY_DC_HOSTNAME}.${REALM} ${PRIMARY_DC_HOSTNAME}
64+
EOF
65+
66+
# 6. Install required packages
67+
echo "Installing required packages..."
68+
apt-get update
69+
DEBIAN_FRONTEND=noninteractive apt-get install -y samba heimdal-clients smbclient winbind chrony ldb-tools python3-setproctitle
70+
71+
# 7. Backup original config files
72+
echo "Backing up original configuration files..."
73+
mv /etc/samba/smb.conf{,.bu.orig}
74+
mv /etc/krb5.conf{,.bu.orig}
75+
mv /etc/default/chrony{,.bu.orig}
76+
mv /etc/chrony/chrony.conf{,.bu.orig}
77+
78+
# 8. Stop and mask standard Samba services
79+
echo "Stopping and masking standard Samba services..."
80+
systemctl stop smbd nmbd winbind
81+
systemctl disable smbd nmbd winbind
82+
systemctl mask smbd nmbd winbind
83+
84+
# 9. Clean up Samba databases
85+
echo "Cleaning up Samba databases..."
86+
rm -f /run/samba/*.tdb
87+
rm -f /var/lib/samba/*.tdb
88+
rm -f /var/cache/samba/*.tdb
89+
rm -f /var/lib/samba/private/*.tdb
90+
91+
# 10. Provision Samba AD
92+
echo "Provisioning Samba AD..."
93+
samba-tool domain provision --use-rfc2307 --realm="${REALM}" --domain="${DOMAIN}" \
94+
--server-role=dc --dns-backend=SAMBA_INTERNAL --adminpass="${ADMIN_PASSWORD}" \
95+
--option="interfaces=127.0.0.1 ${PRIMARY_DC_IP}" --option="bind interfaces only=yes"
96+
97+
# 11. Copy Kerberos configuration
98+
echo "Configuring Kerberos..."
99+
cp /var/lib/samba/private/krb5.conf /etc/
100+
101+
102+
# 12. Reconfigure static IP
103+
echo "Reconfiguring static IP..."
104+
cat > /etc/netplan/99-${PRIMARY_DC_INTERFACE}-static-${PRIMARY_DC_IP}.yaml << EOF
105+
network:
106+
version: 2
107+
renderer: networkd
108+
ethernets:
109+
${PRIMARY_DC_INTERFACE}:
110+
addresses:
111+
- ${PRIMARY_DC_IP}/24
112+
dhcp4: no
113+
routes:
114+
- to: default
115+
via: ${GATEWAY_IP}
116+
nameservers:
117+
search: [${REALM}]
118+
addresses: [${PRIMARY_DC_IP}]
119+
EOF
120+
chmod 600 /etc/netplan/99-${PRIMARY_DC_INTERFACE}-static-${PRIMARY_DC_IP}.yaml
121+
netplan apply
122+
123+
# 13. Configure chrony
124+
echo "Configuring chrony..."
125+
cat > /etc/chrony/chrony.conf << EOF
126+
server 0.de.pool.ntp.org iburst
127+
server 1.de.pool.ntp.org iburst
128+
server 2.de.pool.ntp.org iburst
129+
server 3.de.pool.ntp.org iburst
130+
keyfile /etc/chrony/chrony.keys
131+
driftfile /var/lib/chrony/chrony.drift
132+
logdir /var/log/chrony
133+
maxupdateskew 100.0
134+
rtcsync
135+
makestep 1 3
136+
leapsectz right/UTC
137+
bindcmdaddress 127.0.0.1
138+
bindaddress ${PRIMARY_DC_IP}
139+
allow ${NETWORK}
140+
ntpsigndsocket /var/lib/samba/ntp_signd
141+
EOF
142+
143+
# Configure chrony for IPv4 only
144+
cat > /etc/default/chrony << EOF
145+
DAEMON_OPTS="-F 1 -4"
146+
SYNC_IN_CONTAINER="no"
147+
EOF
148+
149+
# Set correct permissions for NTP signd socket
150+
chgrp _chrony /var/lib/samba/ntp_signd
151+
chmod g+rx /var/lib/samba/ntp_signd
152+
153+
# 14. Start and enable services
154+
echo "Starting services..."
155+
systemctl unmask samba-ad-dc
156+
systemctl enable samba-ad-dc
157+
systemctl start samba-ad-dc
158+
systemctl restart chrony
159+
160+
# 15. Create reverse DNS zone
161+
echo "Creating reverse DNS zone..."
162+
samba-tool dns zonecreate ${PRIMARY_DC_HOSTNAME} ${PTR_ADDRESS} -Uadministrator%${ADMIN_PASSWORD}
163+
samba-tool dns add ${PRIMARY_DC_HOSTNAME}.${REALM} ${PTR_ADDRESS} 220 PTR ${PRIMARY_DC_HOSTNAME}.${REALM} -Uadministrator%${ADMIN_PASSWORD}
164+
165+
echo "Installation complete. Please review the configuration and reboot the system."

‎setup-ubuntu-active-directory/2-join_additional_dc.sh‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
#!/bin/bash
2+
3+
# Load environment variables
4+
if [ -f .env ]; then
5+
source .env
6+
else
7+
echo "Error: .env file not found!"
8+
exit 1
9+
fi
10+
11+
# Samba Additional DC Join Script
12+
# Based on the original AD DC installation script
13+
14+
# 1. Disable IPv6
15+
echo "Disabling IPv6..."
16+
cat > /etc/default/grub.d/disable-ipv6.cfg << EOF
17+
GRUB_CMDLINE_LINUX_DEFAULT="ipv6.disable=1"
18+
EOF
19+
update-grub
20+
21+
# 2. Configure static IP
22+
echo "Configuring static IP..."
23+
cat > /etc/netplan/99-${SECONDARY_DC_INTERFACE}-static-${SECONDARY_DC_IP}.yaml << EOF
24+
network:
25+
version: 2
26+
renderer: networkd
27+
ethernets:
28+
${SECONDARY_DC_INTERFACE}:
29+
addresses:
30+
- ${SECONDARY_DC_IP}/24
31+
dhcp4: no
32+
routes:
33+
- to: default
34+
via: ${GATEWAY_IP}
35+
nameservers:
36+
search: [${REALM}]
37+
addresses: [${PRIMARY_DC_IP}] # Point to primary DC for initial setup
38+
EOF
39+
chmod 600 /etc/netplan/99-${SECONDARY_DC_INTERFACE}-static-${SECONDARY_DC_IP}.yaml
40+
netplan apply
41+
42+
# 3. Disable systemd-resolved stub listener
43+
echo "Disabling systemd-resolved stub listener..."
44+
mkdir -p /etc/systemd/resolved.conf.d/
45+
cat > /etc/systemd/resolved.conf.d/disable-stub-listener.conf << EOF
46+
[Resolve]
47+
DNSStubListener=no
48+
EOF
49+
50+
rm -f /etc/resolv.conf
51+
ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
52+
53+
systemctl daemon-reload
54+
systemctl restart systemd-resolved
55+
56+
# 4. Set hostname
57+
echo "Setting hostname..."
58+
hostnamectl set-hostname ${SECONDARY_DC_HOSTNAME}
59+
60+
# 5. Configure hosts file
61+
cat > /etc/hosts << EOF
62+
127.0.0.1 localhost
63+
${SECONDARY_DC_IP} ${SECONDARY_DC_HOSTNAME}.${REALM} ${SECONDARY_DC_HOSTNAME}
64+
${PRIMARY_DC_IP} ${PRIMARY_DC_IP_HOSTNAME}.${REALM} ${PRIMARY_DC_IP_HOSTNAME}
65+
EOF
66+
67+
# 6. Install required packages
68+
echo "Installing required packages..."
69+
apt-get update
70+
DEBIAN_FRONTEND=noninteractive apt-get install -y samba heimdal-clients smbclient winbind chrony ldb-tools python3-setproctitle
71+
72+
# 7. Backup original config files
73+
echo "Backing up original configuration files..."
74+
mv /etc/samba/smb.conf{,.bu.orig}
75+
mv /etc/krb5.conf{,.bu.orig}
76+
mv /etc/default/chrony{,.bu.orig}
77+
mv /etc/chrony/chrony.conf{,.bu.orig}
78+
79+
# 8. Stop and mask standard Samba services
80+
echo "Stopping and masking standard Samba services..."
81+
systemctl stop smbd nmbd winbind
82+
systemctl disable smbd nmbd winbind
83+
systemctl mask smbd nmbd winbind
84+
85+
# 9. Clean up Samba databases
86+
echo "Cleaning up Samba databases..."
87+
rm -f /run/samba/*.tdb
88+
rm -f /var/lib/samba/*.tdb
89+
rm -f /var/cache/samba/*.tdb
90+
rm -f /var/lib/samba/private/*.tdb
91+
92+
# 10. Join Domain
93+
echo "Joining domain as additional DC..."
94+
samba-tool domain join ${REALM} DC -U"administrator%${ADMIN_PASSWORD}" \
95+
--option="interfaces=127.0.0.1 ${SECONDARY_DC_IP}" \
96+
--option="bind interfaces only=yes" \
97+
--dns-backend=SAMBA_INTERNAL
98+
99+
# 11. Copy Kerberos configuration
100+
echo "Configuring Kerberos..."
101+
cp /var/lib/samba/private/krb5.conf /etc/
102+
103+
# 12. Reconfigure static IP to use self as DNS
104+
echo "Reconfiguring static IP..."
105+
cat > /etc/netplan/99-${SECONDARY_DC_INTERFACE}-static-${SECONDARY_DC_IP}.yaml << EOF
106+
network:
107+
version: 2
108+
renderer: networkd
109+
ethernets:
110+
${SECONDARY_DC_INTERFACE}:
111+
addresses:
112+
- ${SECONDARY_DC_IP}/24
113+
dhcp4: no
114+
routes:
115+
- to: default
116+
via: ${GATEWAY_IP}
117+
nameservers:
118+
search: [${REALM}]
119+
addresses: [${SECONDARY_DC_IP}, ${PRIMARY_DC_IP}]
120+
EOF
121+
chmod 600 /etc/netplan/99-${SECONDARY_DC_INTERFACE}-static-${SECONDARY_DC_IP}.yaml
122+
netplan apply
123+
124+
# 13. Configure chrony
125+
echo "Configuring chrony..."
126+
cat > /etc/chrony/chrony.conf << EOF
127+
server 0.de.pool.ntp.org iburst
128+
server 1.de.pool.ntp.org iburst
129+
server 2.de.pool.ntp.org iburst
130+
server 3.de.pool.ntp.org iburst
131+
keyfile /etc/chrony/chrony.keys
132+
driftfile /var/lib/chrony/chrony.drift
133+
logdir /var/log/chrony
134+
maxupdateskew 100.0
135+
rtcsync
136+
makestep 1 3
137+
leapsectz right/UTC
138+
bindcmdaddress 127.0.0.1
139+
bindaddress ${SECONDARY_DC_IP}
140+
allow ${NETWORK}
141+
ntpsigndsocket /var/lib/samba/ntp_signd
142+
EOF
143+
144+
# Configure chrony for IPv4 only
145+
cat > /etc/default/chrony << EOF
146+
DAEMON_OPTS="-F 1 -4"
147+
SYNC_IN_CONTAINER="no"
148+
EOF
149+
150+
# Set correct permissions for NTP signd socket
151+
chgrp _chrony /var/lib/samba/ntp_signd
152+
chmod g+rx /var/lib/samba/ntp_signd
153+
154+
# 14. Start and enable services
155+
echo "Starting services..."
156+
systemctl unmask samba-ad-dc
157+
systemctl enable samba-ad-dc
158+
systemctl start samba-ad-dc
159+
systemctl restart chrony
160+
161+
# 15. Create reverse DNS record
162+
echo "Creating reverse DNS record..."
163+
samba-tool dns add ${SECONDARY_DC_HOSTNAME}.${REALM} ${PTR_ADDRESS} 220 PTR ${SECONDARY_DC_HOSTNAME}.${REALM} -Uadministrator%${ADMIN_PASSWORD}
164+
165+
echo "Additional DC setup complete. Please review the configuration and reboot the system."

‎setup-ubuntu-active-directory/3-post-setup_after_join_additional_dc.sh‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
#!/bin/bash
2+
3+
# Load environment variables
4+
if [ -f .env ]; then
5+
source .env
6+
else
7+
echo "Error: .env file not found!"
8+
exit 1
9+
fi
10+
11+
# Samba Post-Setup Additional DC Join Script for primary DC
12+
# Run this script on the primary DC after the initial of secondary DC setup is complete.
13+
# Based on the original AD DC installation script
14+
15+
# 1. Configure hosts file
16+
cat > /etc/hosts << EOF
17+
127.0.0.1 localhost
18+
${PRIMARY_DC_IP} ${PRIMARY_DC_HOSTNAME}.${REALM} ${PRIMARY_DC_HOSTNAME}
19+
${SECONDARY_DC_IP} ${SECONDARY_DC_HOSTNAME}.${REALM} ${SECONDARY_DC_HOSTNAME}
20+
EOF
21+
22+
# 2. Reconfigure static IP to use self as DNS
23+
echo "Reconfiguring static IP..."
24+
cat > /etc/netplan/99-${PRIMARY_DC_INTERFACE}-static-${PRIMARY_DC_IP}.yaml << EOF
25+
network:
26+
version: 2
27+
renderer: networkd
28+
ethernets:
29+
${PRIMARY_DC_INTERFACE}:
30+
addresses:
31+
- ${PRIMARY_DC_IP}/24
32+
dhcp4: no
33+
routes:
34+
- to: default
35+
via: ${GATEWAY_IP}
36+
nameservers:
37+
search: [${REALM}]
38+
addresses: [${PRIMARY_DC_IP}, ${SECONDARY_DC_IP}]
39+
EOF
40+
chmod 600 /etc/netplan/99-${PRIMARY_DC_INTERFACE}-static-${PRIMARY_DC_IP}.yaml
41+
netplan apply
42+
43+
echo "Installation complete. Please review the configuration and reboot the system."

‎setup-ubuntu-active-directory/README.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
## Setup Ubuntu Active Directory
2+
- Scripts based on the instructions from https://wiki.ubuntuusers.de/HowTo/Samba-AD-Server_unter_Ubuntu_20.04_installieren/
3+
4+
- copy the `env.example` to `.env`
5+
- Fill out the `.env` file and leave it in the same directory as the scripts.
6+
7+
- Run the `1-install_samba_ad.sh` on the desired DC1 and you're done.
8+
- If a second DC is desired, run the `2-join_additional_dc.sh` on the desired DC2
9+
- then run the `3-post-setup_after_join_additional_dc.sh` on DC1 to complete the changes.
10+
11+
> [!NOTE]
12+
> the `PTR_ADDRESS` env are the 3 of 4 parts of the ipv4 address backwards
13+
> e.g. `192.168.178.0/24` = `178.168.192.in-addr.arpa`

0 commit comments

Comments
 (0)