Domains and directory services¶

Practical 6.6 domains-and-directory-services-annex.pdf · PDF

At school you log in with the same user name on any PC of any classroom. Your password is the same everywhere, and when you change it, it changes everywhere. Nobody walked round the building to create your account on two hundred machines. How?

Tramuntana Apps has 12 people and 12 PCs. Today every PC keeps its own list of accounts, like your VMs. Marta must be able to sit at any PC, so there are 12 accounts called marta. For all twelve people: 144 accounts. Marta changes her password: 12 changes. Pau leaves on Friday: 12 accounts to delete, and the one somebody forgets is a door left open. This page replaces those 144 accounts with 12.

Workgroup vs domain¶

A workgroup is a set of computers where each one keeps its own list of accounts.

A domain is a set of computers that trust one central server to know every user, group and computer, and to check every password.

In a domain each PC is told: "do not check passwords yourself, ask that server". Three new words:

• The central list is the directory: a database of objects (users, groups, computers) arranged in a tree.
• The server that holds it and answers the logins is the domain controller (DC).
• The domain has a DNS-style name, tramuntana.internal, and a short old-style name of up to 15 characters, the NetBIOS name: TRAMUNTANA. Kerberos calls the domain a realm and writes it in capitals: TRAMUNTANA.INTERNAL.

flowchart TB
    subgraph WG ["Workgroup: every PC has its own list"]
        direction LR
        P1["<b>PC 1</b><br>12 accounts"]
        P2["<b>PC 2</b><br>12 accounts"]
        P3["<b>PC 3</b><br>12 accounts"]
    end
    subgraph DOM ["Domain: one list, on the DC"]
        DC["<b>dc1</b><br>domain controller<br>the directory: 12 users"]
        D1["PC 1"] -->|"ask the DC"| DC
        D2["PC 2"] -->|"ask the DC"| DC
        D3["PC 3"] -->|"ask the DC"| DC
    end

Three jobs, three protocols¶

A domain is not one magic program. It is three protocols working together, and you already know two of them.

An SRV record is a DNS record that answers "which host offers this service, on which port?" — not just "which address has this name?".

The wristband: how Kerberos works¶

Picture a music festival. At the entrance you show your ID once and get a wristband valid for the day. At every bar you show the wristband, never your ID. The bar staff do not know you; they trust the wristband because only the entrance can make one. And a wristband has an end time.

That is Kerberos. The entrance is the KDC (Key Distribution Centre), a service running on the domain controller.

sequenceDiagram
    participant M as Marta's PC
    participant K as KDC on dc1 (the entrance)
    participant F as File server (a bar)
    M->>K: I am marta, here is proof I know my password
    K-->>M: TGT (the wristband), valid until a set time
    M->>K: My TGT. I want the file server, please
    K-->>M: Service ticket for the file server
    M->>F: Service ticket
    F-->>M: Folder opened

1. Marta proves to the KDC that she knows her password. She gets a ticket-granting ticket (TGT): the wristband.
2. To use the file server she shows the TGT to the KDC (no password this time) and gets a service ticket for that server.
3. She gives the service ticket to the file server, which checks it was made by the KDC and opens the folder.

How many times did Marta type her password? Once. Did the file server ever see it? Never.

Three old protocols and two products¶

A domain is built from parts older than you.

• Kerberos comes from MIT in the 1980s. Project Athena put student workstations on a network where anybody could listen, so its engineers designed a login for an untrusted network and presented it in 1988. The name is the three-headed dog that guards the underworld in Greek myth: user, service, KDC. Version 5 became an Internet standard in 1993 (RFC 1510; today RFC 4120, from 2005).
• LDAP comes from the University of Michigan, 1993. Tim Howes, with Wengyik Yeong and Steve Kille, wanted the campus directory reachable from an ordinary PC. The existing standard, X.500, was too heavy, so they wrote a Lightweight Directory Access Protocol (RFC 1487; version 3 in 1997; today RFC 4511, from 2006).
• Active Directory (AD), Microsoft's directory, shipped with Windows 2000 Server on 17 February 2000: DNS, Kerberos and LDAP joined into one product. It is still what most companies with Windows PCs use.
• Samba 4.0, released on 11 December 2012 after about ten years of work, was the first free implementation of an Active Directory domain controller. A Windows PC joins it just as it would join a Microsoft one.

Why Samba for Tramuntana¶

Windows Server is the usual case in companies, but it is proprietary (evaluation versions expire) and needs a full Windows Server VM. A Samba AD DC is free software and fits in a small Linux VM with 2 GB of RAM and no desktop, next to win11 on a classroom PC. Everything you learn here — domain, DC, join, users, groups, OUs, policies — has the same names on Windows Server.

One Samba package can be a file server or a domain controller, but not both with one configuration. That is why the controller is a new VM, dc1 at 192.168.122.20, and ubu-srv (192.168.122.10) stays the file, print and application server.

Build the domain controller¶

This is Practical 6.6, part 1: the steps are on the Practical sheet. Here is what each one does.

1. A name and a fixed address¶

Samba asks for three things before anything is installed: a host name shorter than 15 characters, a static address, and a host name that resolves to that address and not to 127.0.x.x.

sudo hostnamectl set-hostname dc1
sudo nano /etc/netplan/60-static.yaml         # 192.168.122.20/24, gateway and DNS 192.168.122.1
sudo chmod 600 /etc/netplan/60-static.yaml
sudo netplan apply
sudo nano /etc/hosts                          # replace the 127.0.1.1 line: 192.168.122.20 dc1.tramuntana.internal dc1
hostname -f
sudo grep -n '^%admin' /etc/sudoers           # must print nothing

hostname -f must print dc1.tramuntana.internal. The last line is the sudoers audit on a new machine: a fresh Ubuntu makes the group admin root, and this domain is about to get a group called admin.

2. Packages and services¶

sudo apt update
sudo apt install -y samba-ad-dc krb5-user bind9-dnsutils
sudo systemctl disable --now smbd nmbd winbind
sudo systemctl mask smbd nmbd winbind
sudo systemctl unmask samba-ad-dc
sudo systemctl enable samba-ad-dc
sudo mv /etc/samba/smb.conf /etc/samba/smb.conf.orig

smbd, nmbd and winbind are the file-server programs. On a DC one program, samba, starts what it needs, so the others are switched off and masked (forbidden to start). The old smb.conf is moved away because the next step writes a new one.

3. Provision the domain¶

Provisioning means creating the domain: the directory database, the DNS zone, the Kerberos keys and the first administrator.

sudo samba-tool domain provision --use-rfc2307 --interactive

The forwarder is where the DC sends questions about names it does not own, such as debian.org: the network's normal DNS. Capital letters matter in the realm, and a domain cannot be renamed later.

4. The DC becomes its own DNS client¶

sudo systemctl disable --now systemd-resolved
sudo unlink /etc/resolv.conf
printf 'nameserver 127.0.0.1\nsearch tramuntana.internal\n' | sudo tee /etc/resolv.conf
sudo cp -f /var/lib/samba/private/krb5.conf /etc/krb5.conf
sudo systemctl start samba-ad-dc

Ubuntu's small resolver occupies port 53, and Samba's DNS server needs that port. So the resolver is switched off and the DC asks itself (127.0.0.1). The Kerberos client configuration that provisioning generated is copied into place. Then systemctl status samba-ad-dc must say active (running).

5. Verify: find, prove, look up¶

host -t SRV _ldap._tcp.tramuntana.internal.
host -t SRV _kerberos._udp.tramuntana.internal.
host -t A dc1.tramuntana.internal.
dig +short debian.org
kinit Administrator
klist
smbclient -L localhost -N

A Windows PC that wants to join the domain asks exactly the SRV question of the first line.

6. The domain's password policy¶

sudo samba-tool domain passwordsettings show

On Samba 4.23 it prints, among others: Password complexity: on, Minimum password length: 7, Maximum password age (days): 42. The password policy you once set on one machine is now set once, for the whole domain. Finish with a snapshot of dc1 called dc-ready.

Key takeaways¶

• In a workgroup every PC keeps its own accounts; in a domain one directory on the domain controller knows every user, group and computer.
• Our domain: tramuntana.internal, realm TRAMUNTANA.INTERNAL, NetBIOS name TRAMUNTANA, on dc1 (192.168.122.20).
• DNS finds the controller (SRV records), Kerberos proves identity with tickets, LDAP looks things up in the directory.
• Kerberos checks your password once, at the KDC, and gives you a TGT; services only see tickets. Clocks must agree within 5 minutes.
• Active Directory (2000) joined the three protocols into one product; Samba has implemented a compatible DC since version 4.0 (2012).
• A controller is not finished until it has been verified: SRV records, a klist ticket, a working forwarder.

Quick check¶

You own a domain with one computer in it: the controller itself. Next, other machines join it and Marta logs in where she has no local account — Joining a domain.