Netwok design, install and configuration

Netwok design, install and configuration

I have decided to share with you my experiences and I will show you most things about networks.

I am going to start from scratch and write posts on how to:

• How to Install Windows 2008
• Setup network
• Active Directory
• DNS
• DHCP
• etc
• How to Install Redhat 6
• Setup the Network
• Integrate Linux to Active directory
• Setup most config files under /etc
• NFS
• SAMBA
• How to Set up Citrix
• How to Setup Juniper SRX Security gateway
• How to Setup NetApp Ontap 8.1

I am going to give you ideas on how to plan your AD, your DNS naming, your IP address scheme, how to position your clients on the network.
I will discuss DMZ, VLANs, Security, SSH, Locking down Linux.

I will have recommendations on security, patch management, for Windows. Design considerations for your network.
Resiliency and redundancy will be discussed also.

If you want to benefit from this blog, just keep visiting it, it will be your stop shop for most Network systems.

My plan is to every day write a new post about some topic.

I have already few posts and I will make the link between each post, so you can easily follow up.

If you have suggestions, please let me know I will try my best to accomodate your suggestions and also write about them.

I hope you will enjoy and learn all this exciting stuff related to IT.

Many thanks

Renato Oliveira

Join Redhat 6.2 Server to Active Directory 2008

Join Redhat 6.2 Server to Active Directory 2008

Windows 2008 Domain Controller
Domain: linad.lan
Name: dc01
IP: 10.10.10.50
User On domain: user1
Linux Client
Server Name: linux01
IP Address: 10.10.10.60

Files need to e modified
/etc/hosts
/etc/resolv.conf
/etc/samba/smb.conf
/etc/krb5.conf
/etc/nsswitch.conf
/etc/openldap/ldap.conf
/etc/openldap/slapd.conf
/etc/nslcd.conf
/etc/ntp.conf
/etc/pam.d/su
/etc/pam.d/password-auth-ac

#################################################################################################
Hosts File
# vi /etc/hosts
10.10.10.50  dc01 dc01.linad.lan
10.10.10.60  linux01.linad.lan
#################################################################################################
Resolv.conf File
# vi /etc/resolv.conf
domain linad.lan
search linad.lan
nameserver 10.10.10.50
##################################################################################################
Smb.conf File
# vi /etc/samba/smb.conf
workgroup = LINAD
realm = LINAD.LAN
security = ADS
#idmap backend = rid:LIAND=10000-500000
idmap backend = ldap:ldap://dc01.linad.lan
ldap admin dn = CN=user1,OU=Users,OU=Company,DC=Linad,DC=lan
idmap uid = 10000-500000
idmap gid = 10000-500000
template shell = /bin/bash
winbind use default domain = true
winbind offline logon = false
winbind nested groups = yes
encrypt passwords = yes
template homedir = /home/%U
winbind enum groups = yes
winbind enum users = yes
log level = 1
syslog = 0
log file=/var/log/samba/%m
####################################################################################################
krb5.conf File
# vi /etc/krb5.conf
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log
[libdefaults]
 default_realm = LINAD.LAN
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
[realms]
LINAD.LAN = {
 kdc = dc01.linad.lan
 admin_server = dc01.linad.lan
}
[domain_realm]
 .linad.lan = LINAD.LAN
 linad.lan = LINAD.LAN
######################################################################################################
Nsswitch.conf File
# vi /etc/nsswitch.conf
passwd:     files ldap
shadow:     files
group:      files ldap
######################################################################################################
ldap.conf File
# vi /etc/openldap/ldap.conf
URI     ldap://dc01.linad.lan
host 10.10.10.50
BASE    dc=Linad,dc=lan
binddn  CN=user1,OU=Users,OU=Company,DC=Linad,DC=lan
bindpw <password>
rootbinddn  CN=user1,OU=Users,OU=Company,DC=Linad,DC=lan
#SIZELIMIT      12
#TIMELIMIT      15
#DEREF          never
TLS_CACERTDIR /etc/openldap/cacerts
scope sub
bind_policy soft
nss_base_passwd        OU=Users,OU=Company,DC=Linad,DC=lan
nss_base_shadow        OU=Users,OU=Company,DC=Linad,DC=lan
nss_base_group        OU=Groups,OU=Company,DC=Linad,DC=lan?sub?&(objectCategory=group)(gidnumber=*)
nss_map_objectclass posixAccount user
nss_map_objectclass shadowAccount user
nss_map_objectclass posixGroup group
nss_map_attribute uid sAMAccountName
nss_map_attribute uidNumber uidNumber
nss_map_attribute gidNumber gidNumber
nss_map_attribute givenname givenname
nss_map_attribute ou description
nss_map_attribute gecos displayName
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_attribute loginShell loginShell
nss_map_attribute shadowLastChange pwdLastSet
########################################################################################################
slapd.conf File
# vi /etc/openldap/slapd.conf
include         /etc/openldap/schema/samba.schema
index sambaSID                          eq
index sambaPrimaryGroupSID              eq
index sambaDomainName                   eq
#########################################################################################################
nslcd.conf File
# vi /etc/nslcd.conf
uri ldap://10.10.10.50/
base dc=linad,dc=lan
binddn  CN=user1,OU=Users,OU=Company,DC=Linad,DC=lan
bindpw Password123
base   group  OU=Groups,OU=Company,DC=Linad,DC=lan
base   passwd OU=Users,OU=Company,DC=Linad,DC=lan
# Mappings for Active Directory
pagesize 1000
referrals off
filter passwd (&(objectClass=user)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*))
map    passwd uid              sAMAccountName
map    passwd homeDirectory    unixHomeDirectory
map    passwd gecos            displayName
filter shadow (&(objectClass=user)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*))
map    shadow uid              sAMAccountName
map    shadow shadowLastChange pwdLastSet
filter group  (objectClass=group)
map    group  uniqueMember     member
###########################################################################################################
ntp.conf File
# vi /etc/ntp.conf
#restrict 127.0.0.1 (comment it out)
server dc01.linad.lan
###########################################################################################################
su File
# vi /etc/pam.d/su
#%PAM-1.0
auth            sufficient      pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth           sufficient      pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
#auth           required        pam_wheel.so use_uid
auth            include         password-auth
account         sufficient      pam_succeed_if.so uid = 0 use_uid quiet
account         include         password-auth
password        include         password-auth
session         include         password-auth
session         optional        pam_xauth.so
############################################################################################################
password-auth-ac File
# vi /etc/pam.d/password-auth-ac
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet

#auth        sufficient    pam_winbind.so  use_first_pass
auth        sufficient    pam_krb5.so  use_first_pass
auth        required      pam_deny.so
account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet

#account   [default=bad success=ok user_unknown=ignore] pam_winbind.so
account   [default=bad success=ok user_unknown=ignore] pam_krb5.so
account     required      pam_permit.so
password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
#password   sufficient     pam_winbind.so use_authtok
password   sufficient     pam_krb5.so use_authtok
password    required      pam_deny.so
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
#session            required      pam_oddjob_mkhomedir.so skel=/etc/skel umask=0077
session    required      pam_mkhomedir.so skel=/etc/skel umask=0022
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so

Services which must to be running
nslcd
smb

# chkconfig --level 35 nslcd on
# chkconfig --level 35 smb on

Crontab
# crontab -e
0 2 * * * /usr/sbin/ntpdate -s -p 8 -u 10.10.10.50


I hope you enjoy it. This gave me a few head aches. I will tidy it up later and also post the Windows 2008 side.

By Renato de Oliveira