Solaris 11 Samba / ZFS Configuration

I make no promises/warranties regarding any of this information. The following information contains my opinions from my own experience with Solaris/Samba/ZFS. The following documentation is provided for educational purposes only and should be used at your own risk.

By default Solaris 11 does not come with all the installed packages of its predecessors and instead it uses the new Image Packaging System (IPS). You will need to install the packages from the Solaris catalog. To do this, you can use the pfexec command as a normal user (pretty much like sudo) or run the install as root.

As root:

pkg install samba

As a normal user, using pfexec:

pfexec pkg install samba

As of Solaris 10 08/11 and Solaris 11, the Solaris kernel allows a user to be a member of 1024 groups. If you do not set this the default maximum will be 16 and if a user is over this amount he or she will be denied access to all share points. Unfortunately nesting groups does not cut down on this number since the system will still see the user as a member of each nested group. CAUTION – This will create NFS server incompatibilities.

Edit /etc/system and make sure there are no spaces after the = sign and everything is spelled correctly.

set ngroups_max=1024

Note -If you make a mistake and your system fails to boot just boot interactively and point to /dev/null when it asks for the location of your /etc/system file.

Create the ntp file

cd /etc/inet

cp ntp.client ntp.conf

Edit the file taking out the multicast option and setting up your DC as the server to sync with.

# ident "@(#)ntp.client 1.3     00/07/17 SMI"

#
# /etc/inet/ntp.client
#
# An example file that could be copied over to /etc/inet/ntp.conf; it
# provides a configuration for a host that passively waits for a server
# to provide NTP packets on the ntp multicast net.
#

server <INSERT YOUR PDC EMULATOR AD DC IP ADDRESS>

#multicastclient 224.0.1.1

Start the xntpd service

svcadm enable network/ntp

Edit the hosts file

vi /etc/inet/hosts

Setup host and alias entries for both of your DC’s and for your system. The host entries for your DC’s may not be completely necessary as long as you have DNS setup properly. I just always do this just in case.

#
# Internet host table
#
::1 fs0 localhost         
127.0.0.1 fs0 localhost loghost

192.168.5.50 fs0 fs0.domain.local

# Network Domain Controllers
192.168.5.10 dc0 dc0.domain.local
192.168.5.11 dc1 dc1.domain.local
192.168.6.10 child-dc0 child-dc0.child.domain.local

Make sure that /etc/resolv.conf contains nameserver entries for each of your Active Directory DNS servers as well as a domain and search field. This file is now auto generated from SMF, if you need to edit it use the appropriate svccfg -s dns/client commands to adjust your name server settings.

domain domain.local
search domain.local
nameserver 192.168.5.10
nameserver 192.168.5.11

NEW WEIRDNESS – Not sure why but as of Solaris 11 I needed to manually create a key tab file from my domain controller otherwise I was getting kerberos errors. This is strange as this is normally all handled in Samba.

To begin, create an active directory user account that we will use to create kerberos tickets (It may also be possible to just use a normal user account but I haven’t tested what happens when the account is deleted). For this example I created a user account named “host-fs0” and set it so that the user cannot change the password and the password never expires. The account should need no special privileges and is just a normal user account.

Next, on the domain controller click Start → All Programs → Accessories and then right click on the command prompt and choose run as Administrator (specific to 2008 servers). Once the command prompt opens use the following command to generate a keytab file.

> cd 
> ktpass -princ host/[email protected] -mapuser DOMAINhost-fs0 -crypto All -pass <PASSWORD ENTERED HERE> -ptype KRB5_NT_PRINCIPAL -out fs0.keytab

Copy the fs0.keytab file to your Solaris server and place it in the /etc/krb5 directory as krb5.keytab

cp fs0.keytab /etc/krb5/krb5.keytab

Setup your /etc/krb5/krb5.conf with your domain controllers

[libdefaults]
default_realm = DOMAIN.LOCAL
dns_lookup_realm = false
dns_lookup_kdc = false

[realms]
DOMAIN.LOCAL = {
kdc = dc0.domain.local:88
kdc = dc1.domain.local:88
default_domain = domain.local
        }

CHILD.DOMAIN.LOCAL = {
kdc = child-dc0.child.domain.local:88
default_domain = child.domain.local
}

[domain_realm]
        .domain.local = DOMAIN.LOCAL
        domain.local = DOMAIN.LOCAL
        .child.domain.local = CHILD.DOMAIN.LOCAL
        child.domain.local = CHILD.DOMAIN.LOCAL

[logging]
default = FILE:/var/krb5/kdc.log
kdc = FILE:/var/krb5/kdc.log

kdc_rotate = {
# How often to rotate kdc.log. Logs will get rotated no more
# often than the period, and less often if the KDC is not used
# frequently.
period = 1d
# how many versions of kdc.log to keep around (kdc.log.0, kdc.log.1, ...)
versions = 10
}

[appdefaults]
kinit = {
renewable = true
forwardable= true
}

Test your file using kinit. No response is a good response, otherwise you will receive an error

kinit [email protected]

Create a new file named /etc/samba/smb.conf.master with the following information:

[global]

# Logging
log level = 1
syslog only = no
max log size = 50 
log file = /var/samba/log/%m.log 

realm = domain.local
workgroup = DOMAIN
security = ADS
encrypt passwords = true
unix extensions = no
password server = dc0.domain.local dc1.domain.local
server string = Corporate File Server
wins server = 192.168.5.10 192.168.5.11
domain master = no
map untrusted to domain = Yes

socket options = TCP_NODELAY SO_KEEPALIVE
client schannel = no 
client use spnego = yes
client NTLMv2 auth = yes
unix extensions = No
client signing = Yes
map acl inherit = Yes
interfaces = net*,lo
bind interfaces only = yes

#Currently testing cross-platform oplocks this may need be re-enabled as all my production servers have always had veto'ed files.
#kernel oplocks = yes
#oplocks = yes
#veto oplock files = /*.doc/*.DOC/*.xls/*.XLS/*.ppt/*.PPT/*.pst/*.PST/*.mdb/*.MDB/*.ldb/*.LDB/*.vsd/*.VSD/*.mpp/*.MPP/*.qbw/*.QBW/*.qbb/*.QBB/*.qbI/*.qbl/
*.dxf/*.DXF/*.dwg/*.DWG/*.cdr/*.CDR/*.bak/*.BAK/*.ord/*.xlo/*.igs/*.ipt/*.ipj/*.slp/*.stp/*.opt/*.xli/*.stl/*.cur/*.sjb/*.log/*.LOG/*.sbs/*.iam/*.idv/
*.pcbdoc/*.PcbDoc/*.PCBDOC/

# DFS
# host msdfs = yes
# strict locking
# strict sync

# winbind
winbind separator = +
idmap uid = 11000-19000
idmap gid = 11000-19000
winbind enum users = yes
winbind enum groups = yes
winbind nested groups = yes
allow trusted domains = yes
template homedir = /export/Corporate/Users/%U

printcap name = /dev/null
load printers = no

[Corporate]
   comment = Corporate Share
   path = /export/Corporate
   read only = No
   inherit permissions = Yes
   inherit acls = Yes
   wide links = Yes
   map archive = No
   map readonly = no
   vfs objects = zfsacl
   nfs4:mode = special
   nfs4:acedup = merge
   nfs4:chown = yes
   zfsacl: acesort = dontcare

#[Dfs]
#   path = /mnt/share/dfsroot
#   msdfs root = Yes

In order to optimize the config and take out any comments we will use the testparm command to generate a smb.conf. This also has the added benefit of checking your config for any errors and displaying the errors on the screen.

testparm -s /etc/samba/smb.conf.master > /etc/samba/smb.conf

We are now ready to join this box to the domain. If successful you should see “Joined ‘FS0’ to realm ‘DOMAIN.LOCAL”

net ads join -U [email protected]

Here we are going to enable the use of winbind through PAM. This will give us the capability of using active directory users and groups when assigning permissions on files and directories. We could also use this for other authentication methods that use PAM such as apache web sites (but that is another discussion).

Enable winbind in pam.conf

cp /etc/pam.conf /etc/pam.conf-OLD
cp /etc/pam.conf-winbind /etc/pam.conf

Enable winbind in nsswitch.conf to set up the search order for all authentication. The system will now look at the local files followed by a check against winbind.

# svccfg -s name-service/switch 
> setprop config/password = "files winbind"
> setprop config/group = "files winbind"

> exit
# svcadm refresh name-service/switch

Make sure the entries were adjusted in nsswitch by:

cat /etc/nsswitch.conf

You should see the following entries in passwd and group:

passwd:     files winbind
group:      files winbind

Before starting anything we should do a reconfiguration reboot to ensure the kernel entries that were entered in the beginning are being seen.

touch /reconfigure
init 6

Before starting winbind we will perform a test so you can see what the nsswitch / pam changes did:

getent passwd
getent group

You should see a list of ONLY the users and groups in your Solaris /etc/passwd and /etc/groups files. So now lets enable services and run the commands again:

svcadm enable winbind
svcadm enable samba

getent passwd
getent group

If everything worked you should see all of your local users and groups plus all the users and groups from Active Directory. Winbind downloads this list from active directory maintaining a local cache in tdb files located /var/samba/locks on your system.

Since my first article much has changed with ZFS permissions and as of the latest releases it looks like I no longer need to specify explicit deny statements and so I have altered the config to reflect the new changes.

The following example illustrates how to setup root departmental shares along with user folders. The root departmental shares each have two groups associated with them:

1. corporate-<DEPARTMENT NAME> – Departmental group. Members of the department should be put here.
2. corporate-department-all – Access to ALL department folders (used for VP’s and privileged users).

I use the naming strategy shown above to help keep my groups organized. Notice that corporate is the share name and department is going to be the departmental folder name. This helps make it easy associating shares / folders / sub-folders to groups. You do not need to setup your groups this way but I provide this example to help the ACL‘s make sense.

Before we get started we need to create our ZFS file system. You may have already noticed that I am creating the file system in export. If you already have a file system loaded in export (Which looks like the default in Solaris 11) you will need to backup your existing files/directories, remove your vfstab entry for export and create your zpool with the -f option or you can create your file system elsewhere and redefine the paths in this example. The following zpool shows a smaller system with only six disks. Your configuration will probably be different.

zpool create export raidz2 c0t0d0 c1t0d0 c4t0d0 c6t0d0 c7t0d0 c0t1d0

Now that the pool is created I am going to create my top-level shared folders.

zfs create export/Corporate
zfs create export/Corporate/Users
zfs create export/Corporate/Users/jdoe
zfs create export/Corporate/Sales
zfs create export/Corporate/Accounting

Set ZFS ACL inheritance to control how ACL‘s are inherited between file systems.

zfs set aclmode=passthrough export/Corporate
zfs set aclinherit=passthrough export/Corporate

Ok now we are ready to lay down our ACL‘s on our Corporate folder. By looking at this ACL you should notice I am first deleting any existing ACL‘s (Important when testing ACL‘s), then I am setting trivial permissions for user and group as rwx and telling the user and group permissions to inherit. I am then adding Domain Users to the ACL and allowing them to read the directory and list its contents. I always setup the root directories so users cannot add or remove files. This way Administrators can maintain organization by creating new departmental shares.

chmod A- /export/Corporate
chmod 770 /export/Corporate
chmod A0=owner@:rwxpdDaARWc---:fd-n--:allow /export/Corporate
chmod A1=group@:rwxpdDaARWc---:fd-n--:allow /export/Corporate
chmod A2=everyone@::fdi---:allow /export/Corporate
chmod A+group:domain+domain users:rxcaR:fdn:allow /export/Corporate

Here we will define the permissions on the Sales and Accounting Folders. In this example I am defining the same permissions and inheritance for user and group, giving each rwx while disabling access for everyone. Then I am giving Domain Admins the ability to manage ACL‘s and the departmental groups rwx access to the directories and files created within it. As I am wiping my permissions, I am also resetting the inherited permissions for domain users on the folder.

chmod A- /export/Corporate/Accounting
chmod 770 /export/Corporate/Accounting
chmod A0=owner@:rwxpdDaARWc---:fd-n--:allow /export/Corporate/Accounting
chmod A1=group@:rwxpdDaARWc---:fd-n--:allow /export/Corporate/Accounting
chmod A2=everyone@::fdi---:allow /export/Corporate/Accounting
chmod A+group:domain+domain users:rcaR::allow /export/Corporate/Accounting
chmod A+group:domain+corporate-all:rwpdDxraRAwWc:fd:allow /export/Corporate/Accounting
chmod A+group:domain+corporate-accounting:rwpdDxraRAwWc:fd:allow /export/Corporate/Accounting
chmod A+group:domain+domain admins:rwxpdDaARWcCo:fd:allow /export/Corporate/Accounting 

chmod A- /export/Corporate/Sales
chmod 770 /export/Corporate/Sales
chmod A0=owner@:rwxpdDaARWc---:fd-n--:allow /export/Corporate/Sales
chmod A1=group@:rwxpdDaARWc---:fd-n--:allow /export/Corporate/Sales
chmod A2=everyone@::fdi---:allow /export/Corporate/Sales
chmod A+group:domain+domain users:rcaR::allow /export/Corporate/Sales
chmod A+group:domain+corporate-all:rwpdDxraRAwWc:fd:allow /export/Corporate/Sales
chmod A+group:domain+corporate-sales:rwpdDxraRAwWc:fd:allow /export/Corporate/Sales
chmod A+group:domain+domain admins:rwxpdDaARWcCo:fd:allow /export/Corporate/Sales

Here I create a folder to contain the user folders. The permissions are as such so that the users will be able to see the folders but will not be able to create files or folders in the Users directory.

chmod A- /export/Corporate/Users
chmod 770 /export/Corporate/Users
chmod A0=owner@:rwxpdDaARWc---:fd-n--:allow /export/Corporate/Users
chmod A1=group@:rwxpdDaARWc---:fd-n--:allow /export/Corporate/Users
chmod A2=everyone@::fdi---:allow /export/Corporate/Users
chmod A+group:domain+domain users:rxcaR:fdn:allow /export/Corporate/Users

Now that the root folder is created we can start crating user folders:

zfs create export/Corporate/Users/jdoe
chown corporate+jdoe /export/Corporate/Users/jdoe
chgrp corporate+domain users /export/Corporate/Users/jdoe
chmod A- /export/Corporate/Users/jdoe
chmod A0=owner@:rwxpAWCos:fd:allow /export/Corporate/Users/jdoe
chmod A1=group@::fd:allow /export/Corporate/Users/jdoe
chmod A2=everyone@:aRcs:fd:allow /export/Corporate/Users/jdoe