Skip to content

Commit 6f619ab

Browse files
LizenzFass78851LizenzFass78851
committed
refactor(ubuntu-setup-ad): add script to add rodc
1 parent 1a78aa6 commit 6f619ab

File tree

4 files changed

+167
-6
lines changed

4 files changed

+167
-6
lines changed

‎setup_ubuntu-active-directory/2-join_additional_dc.sh‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -158,8 +158,4 @@ systemctl enable samba-ad-dc
158158
systemctl start samba-ad-dc
159159
systemctl restart chrony
160160

161-
# 15. Create reverse DNS record
162-
echo "Creating reverse DNS record..."
163-
samba-tool dns add ${SECONDARY_DC_HOSTNAME}.${REALM} ${PTR_ADDRESS} $(echo ${SECONDARY_DC_IP} | awk --field-separator=. '{ print $4 }') PTR ${SECONDARY_DC_HOSTNAME}.${REALM} -Uadministrator%${ADMIN_PASSWORD}
164-
165161
echo "Additional DC setup complete. Please review the configuration and reboot the system."

‎setup_ubuntu-active-directory/2-join_additional_rodc.sh‎

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
#!/bin/bash
2+
3+
# Load environment variables
4+
if [ -f .env ]; then
5+
source .env
6+
else
7+
echo "Error: .env file not found!"
8+
exit 1
9+
fi
10+
11+
# Samba Additional DC Join Script
12+
# Based on the original AD DC installation script
13+
14+
# 1. Disable IPv6
15+
echo "Disabling IPv6..."
16+
cat > /etc/default/grub.d/disable-ipv6.cfg << EOF
17+
GRUB_CMDLINE_LINUX_DEFAULT="ipv6.disable=1"
18+
EOF
19+
update-grub
20+
21+
# 2. Configure static IP
22+
echo "Configuring static IP..."
23+
cat > /etc/netplan/99-${SECONDARY_DC_INTERFACE}-static-${SECONDARY_DC_IP}.yaml << EOF
24+
network:
25+
version: 2
26+
renderer: networkd
27+
ethernets:
28+
${SECONDARY_DC_INTERFACE}:
29+
addresses:
30+
- ${SECONDARY_DC_IP}/24
31+
dhcp4: no
32+
routes:
33+
- to: default
34+
via: ${GATEWAY_IP}
35+
nameservers:
36+
search: [${REALM}]
37+
addresses: [${PRIMARY_DC_IP}] # Point to primary DC for initial setup
38+
EOF
39+
chmod 600 /etc/netplan/99-${SECONDARY_DC_INTERFACE}-static-${SECONDARY_DC_IP}.yaml
40+
netplan apply
41+
42+
# 3. Disable systemd-resolved stub listener
43+
echo "Disabling systemd-resolved stub listener..."
44+
mkdir -p /etc/systemd/resolved.conf.d/
45+
cat > /etc/systemd/resolved.conf.d/disable-stub-listener.conf << EOF
46+
[Resolve]
47+
DNSStubListener=no
48+
EOF
49+
50+
rm -f /etc/resolv.conf
51+
ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
52+
53+
systemctl daemon-reload
54+
systemctl restart systemd-resolved
55+
56+
# 4. Set hostname
57+
echo "Setting hostname..."
58+
hostnamectl set-hostname ${SECONDARY_DC_HOSTNAME}
59+
60+
# 5. Configure hosts file
61+
cat > /etc/hosts << EOF
62+
127.0.0.1 localhost
63+
${SECONDARY_DC_IP} ${SECONDARY_DC_HOSTNAME}.${REALM} ${SECONDARY_DC_HOSTNAME}
64+
${PRIMARY_DC_IP} ${PRIMARY_DC_IP_HOSTNAME}.${REALM} ${PRIMARY_DC_IP_HOSTNAME}
65+
EOF
66+
67+
# 6. Install required packages
68+
echo "Installing required packages..."
69+
apt-get update
70+
DEBIAN_FRONTEND=noninteractive apt-get install -y samba heimdal-clients smbclient winbind chrony ldb-tools python3-setproctitle
71+
72+
# 7. Backup original config files
73+
echo "Backing up original configuration files..."
74+
mv /etc/samba/smb.conf{,.bu.orig}
75+
mv /etc/krb5.conf{,.bu.orig}
76+
mv /etc/default/chrony{,.bu.orig}
77+
mv /etc/chrony/chrony.conf{,.bu.orig}
78+
79+
# 8. Stop and mask standard Samba services
80+
echo "Stopping and masking standard Samba services..."
81+
systemctl stop smbd nmbd winbind
82+
systemctl disable smbd nmbd winbind
83+
systemctl mask smbd nmbd winbind
84+
85+
# 9. Clean up Samba databases
86+
echo "Cleaning up Samba databases..."
87+
rm -f /run/samba/*.tdb
88+
rm -f /var/lib/samba/*.tdb
89+
rm -f /var/cache/samba/*.tdb
90+
rm -f /var/lib/samba/private/*.tdb
91+
92+
# 10. Join Domain
93+
echo "Joining domain as additional DC..."
94+
samba-tool domain join ${REALM} RODC -U"administrator%${ADMIN_PASSWORD}" \
95+
--option="interfaces=127.0.0.1 ${SECONDARY_DC_IP}" \
96+
--option="bind interfaces only=yes" \
97+
--dns-backend=SAMBA_INTERNAL
98+
99+
# 11. Copy Kerberos configuration
100+
echo "Configuring Kerberos..."
101+
cp /var/lib/samba/private/krb5.conf /etc/
102+
103+
# 12. Reconfigure static IP to use self as DNS
104+
echo "Reconfiguring static IP..."
105+
cat > /etc/netplan/99-${SECONDARY_DC_INTERFACE}-static-${SECONDARY_DC_IP}.yaml << EOF
106+
network:
107+
version: 2
108+
renderer: networkd
109+
ethernets:
110+
${SECONDARY_DC_INTERFACE}:
111+
addresses:
112+
- ${SECONDARY_DC_IP}/24
113+
dhcp4: no
114+
routes:
115+
- to: default
116+
via: ${GATEWAY_IP}
117+
nameservers:
118+
search: [${REALM}]
119+
addresses: [${SECONDARY_DC_IP}, ${PRIMARY_DC_IP}]
120+
EOF
121+
chmod 600 /etc/netplan/99-${SECONDARY_DC_INTERFACE}-static-${SECONDARY_DC_IP}.yaml
122+
netplan apply
123+
124+
# 13. Configure chrony
125+
echo "Configuring chrony..."
126+
cat > /etc/chrony/chrony.conf << EOF
127+
server 0.pool.ntp.org iburst
128+
server 1.pool.ntp.org iburst
129+
server 2.pool.ntp.org iburst
130+
server 3.pool.ntp.org iburst
131+
keyfile /etc/chrony/chrony.keys
132+
driftfile /var/lib/chrony/chrony.drift
133+
logdir /var/log/chrony
134+
maxupdateskew 100.0
135+
rtcsync
136+
makestep 1 3
137+
leapsectz right/UTC
138+
bindcmdaddress 127.0.0.1
139+
bindaddress ${SECONDARY_DC_IP}
140+
allow ${NETWORK}
141+
ntpsigndsocket /var/lib/samba/ntp_signd
142+
EOF
143+
144+
# Configure chrony for IPv4 only
145+
cat > /etc/default/chrony << EOF
146+
DAEMON_OPTS="-F 1 -4"
147+
SYNC_IN_CONTAINER="no"
148+
EOF
149+
150+
# Set correct permissions for NTP signd socket
151+
chgrp _chrony /var/lib/samba/ntp_signd
152+
chmod g+rx /var/lib/samba/ntp_signd
153+
154+
# 14. Start and enable services
155+
echo "Starting services..."
156+
systemctl unmask samba-ad-dc
157+
systemctl enable samba-ad-dc
158+
systemctl start samba-ad-dc
159+
systemctl restart chrony
160+
161+
echo "Additional DC setup complete. Please review the configuration and reboot the system."

setup_ubuntu-active-directory/3-post-setup_after_join_additional_dc.sh renamed to setup_ubuntu-active-directory/3-post-setup_after_join_additional_dc_or_rodc.sh

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,4 +40,8 @@ EOF
4040
chmod 600 /etc/netplan/99-${PRIMARY_DC_INTERFACE}-static-${PRIMARY_DC_IP}.yaml
4141
netplan apply
4242

43+
# 3. Create reverse DNS record for secondary DC
44+
echo "Creating reverse DNS record for secondary DC..."
45+
samba-tool dns add ${SECONDARY_DC_HOSTNAME}.${REALM} ${PTR_ADDRESS} $(echo ${SECONDARY_DC_IP} | awk --field-separator=. '{ print $4 }') PTR ${SECONDARY_DC_HOSTNAME}.${REALM} -Uadministrator%${ADMIN_PASSWORD}
46+
4347
echo "Installation complete. Please review the configuration and reboot the system."

‎setup_ubuntu-active-directory/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@
55
- Fill out the `.env` file and leave it in the same directory as the scripts.
66

77
- Run the `1-install_samba_ad.sh` on the desired DC1 and you're done.
8-
- If a second DC is desired, run the `2-join_additional_dc.sh` on the desired DC2
9-
- then run the `3-post-setup_after_join_additional_dc.sh` on DC1 to complete the changes.
8+
- If a second DC is desired, run the `2-join_additional_dc.sh` on the desired DC2 or run the `2-join_additional_rodc.sh` on the desired read only DC2
9+
- then run the `3-post-setup_after_join_additional_dc_or_rodc.sh` on DC1 to complete the changes.
1010

1111
> [!NOTE]
1212
> the `PTR_ADDRESS` env are the 3 of 4 parts of the ipv4 address backwards

0 commit comments

Comments
 (0)