Comments from Taiga #129

Richard England 08 Dec 2021 11:37
*dklima Any change in status on your article?

Richard Englan d13 Nov 2021 10:53
*dklima Do you have an update on your article?

Richard England 08 Sep 2021 10:41
*dklima It's been some time since this card was assigned and I'm checking to see if you have an update on it or if there is anything we can do to help you along.

Gregory Lee Bartholomew 17 Jun 2021 13:03
*dklima, you weren't added to the system as a writer yet. It should be fixed now.

Daniel Kühl Lima 17 Jun 2021 11:07
How can I assign to myself? Following the documentation I didn't find the option.

| Assign the card you’ve chosen to yourself by opening the card and clicking on Assign to myself on the right hand side.

@dklima Are you still work (or planning to work on) this article? No hurry. We just want to check. Thanks!

@dklima since you haven't responded with any status updates in a while, we are going to move this card to "stalled" status. When/if you comment to let us know you are working on it again, we will move the card back to "in progress".

Hi!

The article is ready, I've finished it.

I do have one question, may I post it in wordpress as a draft for review?

@dklima Yes, we would appreciate it if you would add the article to WordPress. Login here: https://fedoramagazine.org/wp-admin/
using your Fedora account.

Select " + New " at the top of the window and then "Post".
There are some writing guidelines available here.

Let us know if you have question of any kind, and thanks!

@rlengland Thank you for the quick guide.

I've transcript to WordPress, however I need help on the review, mainly on how to conclude it.

Also, I have no idea what to put on SEO fields.

Would you mind helping me out?

https://fedoramagazine.org/?p=36175&preview=true&preview_id=36175

Hi!

I managed to get SEO and readability green!

Is the title OK?

Also, I've created the featured image, which is a tree that represent the LDAP tree, I am attaching here for your review (I've followed Paul's YouTube video).

Hi Daniel. The cover image looks great. Be sure to include the attribution in the caption and I think it should be fine.

If possible, I would really like to see instructions added for how to properly configure SELinux to allow Samba to work without having to completely turn off the security. I think it should be be as simple as running a few semanage commands. I found several configuration flags that looked promising when I ran semanage boolean --list | grep -i samba.

cdrecord_read_content          (off  ,  off)  Determine whether cdrecord can read various content. nfs, samba, removable devices, user temp and untrusted content files
ksmtuned_use_cifs              (off  ,  off)  Allow ksmtuned to use cifs/Samba file systems
samba_create_home_dirs         (off  ,  off)  Allow samba to create new home directories (e.g. via PAM)
samba_domain_controller        (off  ,  off)  Allow samba to act as the domain controller, add users, groups and change passwords.
samba_enable_home_dirs         (off  ,  off)  Allow samba to share users home directories.
samba_export_all_ro            (off  ,  off)  Allow samba to share any file/directory read only.
samba_export_all_rw            (off  ,  off)  Allow samba to share any file/directory read/write.
samba_load_libgfapi            (off  ,  off)  Allow smbd to load libgfapi from gluster.
samba_portmapper               (off  ,  off)  Allow samba to act as a portmapper
samba_run_unconfined           (off  ,  off)  Allow samba to run unconfined scripts
samba_share_fusefs             (off  ,  off)  Allow samba to export ntfs/fusefs volumes.
samba_share_nfs                (off  ,  off)  Allow samba to export NFS volumes.
sanlock_use_samba              (off  ,  off)  Allow sanlock to manage cifs files
smbd_anon_write                (off  ,  off)  Allow samba to modify public files used for public file transfer services.  Files/Directories must be labeled public_content_rw_t.
tmpreaper_use_samba            (off  ,  off)  Determine whether tmpreaper can use samba_share files
use_samba_home_dirs            (off  ,  off)  Support SAMBA home directories
virt_use_samba                 (off  ,  off)  Allow confined virtual guests to manage cifs files

All right, will work on SELinux.

Other things should I consider?

Thanks for the feedback.

It's not the end of the world, but I don't think disabling the default DNS service should be necessary. I understand that two services cannot use the same port at the same time. But did you try putting something like the following in /etc/systemd/resolved.conf.d/custom.conf?

[Resolve]                    
DNSStubListener=no
Domains=onda.org
DNS=10.1.1.10

@glb it worked.

I'll change that section from the guide.

Thank you!

Hi!

I would like to ask for your review again, I've addressed the SELinux and systemd-resolved suggestions.

Thanks

Hi @dklima:

Thanks for addressing those suggestions. I just noticed one more thing that you might consider revising.

It looks like you are overwriting the /etc/krb5.conf file. But that file has support for "drop-in" configuration snippets under the /etc/krb5.conf.d directory. By overwriting the global file, you might be inadvertently breaking some other tools on the system or reducing the default security settings. I think the default_ccache_name setting might be one example of the latter. By default, the kerberos credential cache is stored in files saved to the /tmp directory. However, Fedora Linux has support for a slightly more secure storage area in protected kernel memory called the kernel keyring. Unfortunately, by overwriting the default /etc/krb5.conf file, you have reverted the setting to its less-secure default value. Again, it isn't something you must do for this article, but I think it would be better if you could copy your config file under /etc/krb5.conf.d to amend the global settings rather than overwriting them. Of course, you would need to re-test things to make sure that none of Fedora Linux 35's global defaults conflict with what is needed for Samba to work.

Thanks.

I absolutely agree that I should have not copied over the /etc/krb5.conf.

I will check it, test it and return with the results.

Thank you for the heads-up.

Hi

I've tested and it worked just fine.

Updated the article as well.

I've tested and it worked just fine.

OK. I haven't tested this personally but I'll take your word for it. :-)

I guess the next thing to address is maybe a few small grammar tweaks. What constitutes "proper" grammar can be a little debatable. So the following should only be taken as suggestions, not requirements for publication.

Having a server with Samba providing AD and Domain Controller functionality will set you with a very mature and professional way to have a centralized place with all users and groups information,

"... will set you with ..." is not a common phrase that I am familiar with. I think "... will provide you with ..." would be more familiar to native English speakers. Also, that is a full sentence. You can end it with a period there and the first letter of the next word can be capitalized to start a new sentence.

This step-by-step tutorial on Samba as AD and Domain Controller teach you how to have the solution for your network, servers and applications.

How about the following instead (without the emphasis)?

This step-by-step tutorial about setting up Samba as an AD and Domain Controller will demonstrate to you how you can achieve this solution for your network, servers and applications.

A fresh Fedora 35 server installation.

Try to use "Fedora Linux" when referring to the operating system.

A fresh Fedora Linux 35 server installation.

At /etc/hosts file

For DNS server

You appear to have a tendency to drop the definite article.

In the /etc/hosts file

For the DNS server

so you can avoid a lot of problems having the server and clients with the same time

I think you mean the following.

so you can avoid a lot of problems from not having the server and clients synchronized with the same time

Let’s install required software to get through this guide, they provide all applications we need.

The phrases on either side of the comma express unique thoughts/meanings. They should be separate sentences. Also, "software" is a mass noun.

Let’s install the required software to get through this guide. It will provide all the applications you will need.

For setting a Samba as AD and Domain Controller, we have to prepare the environment with a functional configuration before start using it.

Fedora Magazine has a policy that we prefer articles to be written in the second-person.

For setting up Samba as an AD and Domain Controller, you will have to prepare the environment with a functional configuration before you start using it.

We need to allow some ports for UDP and TCP, as a result clients can connect
to the Domain Controller.

How about the following.

You will need to allow some UDP and TCP ports through the firewall so that clients will be able to connect to the Domain Controller.

Choose the one that suits better for you.

The verb "suits" should immediately proceed the pronoun "you".

Choose the one that suits you best.

For supporting Samba DC and running with SELinux in enforcing mode, it is necessary to set some samba boolean for SELinux to on, as a result there is no need to disable SELinux.

How about the following?

To run a Samba DC with SELinux in enforcing mode, it is necessary to set some SELinux booleans for Samba to on. After these booleans are set, it should not be necessary to disable SELinux.

if not exist

That's great computer code. But not so great English. :-)

if it does not exist

Again, the above comments should just be taken as suggestions. You are free to use your own writing "style" and disregard my suggestions.

Also, I see there is a "Wrap up and conclusion" section header at the end of the article with no content underneath. Are you still working on this article?

Thank you for your kind review and considerations, I've applied them all.

Also, I see there is a "Wrap up and conclusion" section header at the end of the article with no content underneath. Are you still working on this article?

Yes, I am working on the conclusion for the article.

That's great computer code. But not so great English. :-)

😅

Hi!

I finished writing the conclusion and I consider the article done.

Would you kindly review the conclusion and provide suggestions for improving it?

Thank you for all of your support.

I'd change "consider using the approach" to "consider using this approach".

Other than that, it looks good to me.

One recommendation would be to link to the comments section of your post somewhere in the sentence at the end where you invite people to comment. The following address should work for the link after the article is published.

https://fedoramagazine.org/samba-as-ad-and-domain-controller/#comments

The reason to put the link in the text is so that people will have an easy way to get to the comments section if they are reading the article from some other feed viewer (e.g. fedoraplanet.org).

One thing that wasn't mentioned in the article which might be a common question would be "Does it work with Windows 10/11?" I'm guessing that it does not. And if not, it might be good to point that out up front in the article so as not to disappoint anyone.

I'd change "consider using the approach" to "consider using this approach".

Done.

One recommendation would be to link to the comments section of your post somewhere in the sentence at the end where you invite people to comment.

Done.

One thing that wasn't mentioned in the article which might be a common question would be "Does it work with Windows 10/11?" I'm guessing that it does not. And if not, it might be good to point that out up front in the article so as not to disappoint anyone.

Yes, it works, it is even possible to manage the Samba Domain through Microsoft RSAT, I haven't mentioned that because I was uncertain if I could comment that.

How do you suggest that I mention it?

Yes, it works, it is even possible to manage the Samba Domain through Microsoft RSAT, I haven't mentioned that because I was not sure if I could mention that.

For a while it was possible only if special Windows registry keys were edited to disable or reduce security settings. It is indeed impressive if none of that is necessary anymore.

I think it's OK to mention that it should work with Windows 10 if you know that it does. My recommendations would be to use wording something along the lines of, "If one wanted to, one could even join a Windows 10 client to this Samba domain (tested with Windows 10 Enterprise version 21H1)."

Thanks!

"If one wanted to, one could even join a Windows 10 client to this Samba domain (tested with Windows 10 Enterprise version 21H1)."

Thank you for your suggestion. I added it at the conclusion section.

Does it work that way?

Off-topic: That is odd, sometimes when I comment it resets some issue attributes :pensive:

Thank you for your suggestion. I added it at the conclusion section.

Does it work that way?

I like it. Thanks. 🙂 Do you want to run this tomorrow (Friday) at 08:00 UTC?

Off-topic: That is odd, sometimes when I comment it resets some issue attributes 😔

That is strange. But it is not a serious problem. So don't worry about it. 🙂

I like it. Thanks. 🙂 Do you want to run this tomorrow (Friday) at 08:00 UTC?

It is your call, I am good whatever your decision is.

Thank you for your support on this journey, it was remarkable.

I've tweaked the excerpt, added some tags, and scheduled this to go out at 08:00 UTC. Changes can still be made if you find any problems or things you'd like tweaked. Just let me know.

Thanks!

If at least one person find it useful, it will make my day!

I owe you big time, Gregory!

@dklima: A user appears to have discovered that if the FQDN isn't specified in /etc/hostname, then the Samba server will not work. Would you like an addendum added to your guide with that information?

@dklima: A user appears to have discovered that if the FQDN isn't specified in /etc/hostname, then the Samba server will not work. Would you like an addendum added to your guide with that information?

Absolutely. How do I do that?

Last time I seen, edit wasn't available.

I'd have to take it offline for you to edit it directly. Can you instead specify what should be added here in the comments of this card?

Would you also like heimdal-workstation changed to krb5-workstation as suggested by one of the other readers?

One other thing I noticed just now is that you have dc1.onda.org = ONDA.ORG in the samba-dc file. It seems to me that that should be .onda.org = ONDA.ORG so that other (future) members of the domain will also get mapped correctly. Do you think that should be updated as well?

I'd have to take it offline for you to edit it directly.

I don't like this idea, the article was published in LinuxToday today and there be many visits now.

Can you instead specify what should be added here in the comments of this card?

Yes, at the beginning, on Host: dc1, change to dc1.onda.org, also, in the Configuration section, I would add something like: Ensure the server's hostname is set as FQDN with the command:

sudo hostnamectl hostname dc1.onda.org

One other thing I noticed just now is that you have dc1.onda.org = ONDA.ORG in the samba-dc file. It seems to me that that should be .onda.org = ONDA.ORG so that other (future) members of the domain will also get mapped correctly. Do you think that should be updated as well?

I don't know, the krb5.conf file was generated by samba-tool, I would have to test it to make sure it still works. Maybe it should work fine as well because of the # EXAMPLE in the /etc/krb5.conf file.

OK. I've added the section about the hostname. Just let me know if you want anything else changed.

I don't know, the krb5.conf file was generated by samba-tool, I would have to test it to make sure it still works. Maybe it should work fine as well because of the # EXAMPLE in the /etc/krb5.conf file.

Yeah, the example in /etc/krb5.conf specifies the domain name, not just the hostname. I think using the hostname also works, but you would have to add every host as you add members to the domain (dc2.onda.org, pc1.onda.org, etc.). If you specify just the domain name with the leading dot as the example in /etc/krb5.conf does, then it will match any hostname whose domain name part is "onda.org". See man krb5.conf for the details. But yeah, you should test it before making that change if you want to make it.

Would you also like heimdal-workstation changed to krb5-workstation as suggested by one of the other readers?

Forgot to reply it, yes please.

OK. I've added the section about the hostname. Just let me know if you want anything else changed.

Thank you!

But yeah, you should test it before making that change if you want to make it.

I'm still testing it, will reply here when finish it.

Maybe test the krb5-workstation part too and I'll change them both at the same time. Also, if you want to redo the gif, I think you should be able to upload a new version straight to the media library and then I can just update the link in the article.

Thanks.

Edit: I think if you use krb5-workstation, then you won't need to use the full path to the binaries. You should just be able to enter kinit and klist and it should find the krb5-workstation ones.

Edit2: Also, I wouldn't put just the domain (without the leading dot) in the samba-dc file. Some sites have special configurations where they "transparently" map the domain to a server. But that is a broken configuration IMO. It is better to use a redirect when you need that.

Hi @dklima:

I just googled a bit about the domain_realm mapping algorithm and I found this good reference:

https://vda.li/en/posts/2019/03/24/Kerberos-host-to-realm-translation/

Hey glb,

I've tested the .onda.org in [default_realm] and it worked fine.

Also, tested krb5-workstation and it went ok.

I can't redo the GIF right now because I have to redo the entire setup, tomorrow I can remake the GIF. For the other changes, it is fine, clients still can join the Domain and authenticate.

I'll wait until you have the gif done and update it all at the same time.

Thanks.

@dklima:

After reading that article more closely, it looks like it is saying that the server should fallback to the default_realm setting in this case. So maybe it doesn't matter that only the one server is mapped in the domain_realm section. Also, I think it is saying it would only matter on the client side. Presumably people wouldn't be running many client applications directly on the Samba server.

If you have a single Kerberos realm, it might not be an issue; by setting default_realm option in the krb5.conf we can make sure a client always assumes the only realm we have. However, if there are multiple Kerberos realms, it is important to map the target service principal to the target realm at a client side, before a request is issued to a KDC.

Sorry about the confusion. I think you are good after all and that setting does not need to be modified. I'll still update the krb5-workstation part though if you supply an updated gif.

Thanks.

Sorry about the confusion.

No worries, Gregory. You've been great, doing an outstanding support for the article.

I'll wait until you have the gif done and update it all at the same time.

Uploaded to Media.

https://fedoramagazine.org/wp-content/uploads/2022/04/samba-install-with-krb5.gif

Also, I created a GIF for hostnamectl section, if you find that useful, you can add too.

https://fedoramagazine.org/wp-content/uploads/2022/04/samba-hostnamectl.gif

Thanks.

OK. I've updated the images and the text on the sudo dnf install ... line and the two lines in the "Kerberos test" section. The gif in the kerberos test section is slightly out of sync with the code, but that is a very minor issue. I'll leave this card open for a bit longer just in case you find anything else that needs tweaked.

Thanks.

That was great that you let this issue open, I was about to mention that the kinit thing was outdated, I updated it:

https://fedoramagazine.org/wp-content/uploads/2022/04/samba-kerberos-with-krb5.gif

Also, I made a minor tweak in the dns forwarder GIF because samba won't start yet, so I removed the systemctl restart samba command:

https://fedoramagazine.org/wp-content/uploads/2022/04/samba-dns-forwarder-wout-samba-restart.gif

And I would like to ask you to delete the text after the GIF:

After changing the dns forwarder value, restart samba service:

sudo systemctl restart samba

No problem. Done.

Let me know if I missed anything.