palw3ey/ye3samba repository overview

# create the nas folder on your host
mkdir ~/nas

# create and start
podman run -dt --name="mynas" \
    -v ~/nas:/nas \
    -p 137:137/udp -p 138:138/udp -p 139:139/tcp -p 445:445/tcp \
    -e Y_SHARE_NAME="nas" -e Y_SHARE_PATH="/nas" -e Y_SHARE_CHMOD="777" \
    -e Y_SHARE_OPTION="writable = yes | read only = no | hide dot files = no | vfs objects = recycle" \
    registry.gitlab.com/palw3ey/ye3samba

# logs
podman logs -f mynas

# add user
podman exec -it mynas adduser caroline 
podman exec -it mynas smbpasswd -a caroline

podman network create --ipv6 --subnet=10.1.192.0/24 --subnet=fd00::a01:c000/120 mynet46

podman run -dt --name="dc1" --cap-add="NET_RAW,SYS_TIME,SYS_NICE"  \
    --hostname="dc1" --network="mynet46" --ip="10.1.192.11" --ip6="fd00::a01:c00b" \
    -e Y_RESOLV_OPTION="search samba.lan | nameserver 10.1.192.11" \
    -e Y_HOSTS_ENTRY="127.0.0.1 localhost | 10.1.192.11  dc1.samba.lan dc1" \
    -e Y_SERVER_ROLE="dc" -e Y_PROVISION_REALM="samba.lan" -e Y_PROVISION_DOMAIN="samba" -e Y_PROVISION_ADMINPASS="My_Str0ng_Dc_Passw0rd" \
    -e Y_NETBIOS_NAME="dc1" -e Y_RFC2307="yes" \
    -e Y_IDMAP_LOWERBOUND="45534" -e Y_IDMAP_UPPERBOUND="65533" \
    -e Y_PAM_KRB_MINIMUM_UID="45534" -e Y_PAM_MKHOMEDIR="yes" \
    -e Y_GENERAL_OPTION="dns forwarder = 1.1.1.1 | vfs objects = dfs_samba4 acl_xattr xattr_tdb | apply group policies = yes" \
    -e Y_REVERSE_ZONE="192.1.10.in-addr.arpa" -e Y_REVERSE_ZONE_CREATE="yes" -e Y_REVERSE_SERVER="dc1.samba.lan" \
    -e Y_REVERSE_PTR_NAME="11" -e Y_REVERSE_PTR_DATA="dc1.samba.lan" \
    -e Y_CHRONYD="yes" -e Y_CHRONYD_OPTION="bindcmdaddress 10.1.192.11 | allow 10.1.192.0/24 | server 0.pool.ntp.org iburst" \
    -e Y_RSYNCD="yes" -e Y_RSYNCD_USER="samba-replication" -e Y_RSYNCD_PASSWORD="My_Str0ng_Rsync_Passw0rd" \
    registry.gitlab.com/palw3ey/ye3samba

podman logs -f dc1

podman exec -it dc1 samba-tool user add caroline My_Str0ng_User_Passw0rd

podman exec -it dc1 bash

wget "https://download.microsoft.com/download/9/5/b/95be347e-c49e-4ede-a205-467c85eb1674/Administrative%20Templates%20(.admx)%20for%20Windows%2011%20Sep%202024%20Update.msi"

mkdir extracted_msi 

msiextract --directory /extracted_msi  "Administrative Templates (.admx) for Windows 11 Sep 2024 Update.msi"

samba-tool gpo admxload --username=administrator --password="My_Str0ng_Dc_Passw0rd"
samba-tool gpo admxload --username=administrator --password="My_Str0ng_Dc_Passw0rd" --admx-dir="/extracted_msi/Program Files/Microsoft Group Policy/Windows 11 Sep 2024 Update (24H2)/PolicyDefinitions/"

ls -l /var/lib/samba/sysvol/samba.lan/Policies/PolicyDefinitions

# with unidirectional SysVol replication via cron and rsync

podman run -dt --name="dc2" --cap-add="NET_RAW,SYS_TIME,SYS_NICE"  \
    --hostname="dc2" --network="mynet46" --ip="10.1.192.12" --ip6="fd00::a01:c00c" \
    -e Y_RESOLV_OPTION="search samba.lan | nameserver 10.1.192.12" \
    -e Y_HOSTS_ENTRY="127.0.0.1 localhost | 10.1.192.12  dc2.samba.lan dc2" \
    -e Y_SERVER_ROLE="dc" -e Y_JOIN_DOMAIN="samba.lan" -e Y_JOIN_SERVER="10.1.192.11" -e Y_JOIN_USER="Administrator" -e Y_JOIN_PASSWORD="My_Str0ng_Dc_Passw0rd" \
    -e Y_NETBIOS_NAME="dc2" -e Y_RFC2307="yes" \
    -e Y_IDMAP_LOWERBOUND="45534" -e Y_IDMAP_UPPERBOUND="65533" \
    -e Y_PAM_KRB_MINIMUM_UID="45534" -e Y_PAM_MKHOMEDIR="yes" \
    -e Y_GENERAL_OPTION="dns forwarder = 1.1.1.1 | vfs objects = dfs_samba4 acl_xattr xattr_tdb | apply group policies = yes" \
    -e Y_REVERSE_ZONE="192.1.10.in-addr.arpa" -e Y_REVERSE_SERVER="dc1.samba.lan" \
    -e Y_REVERSE_PTR_NAME="12" -e Y_REVERSE_PTR_DATA="dc2.samba.lan" \
    -e Y_CHRONYD="yes" -e Y_CHRONYD_OPTION="bindcmdaddress 10.1.192.12 | allow 10.1.192.0/24 | server 0.pool.ntp.org iburst" \
    -e Y_RSYNCD="yes" -e Y_RSYNCD_USER="samba-replication" -e Y_RSYNCD_PASSWORD="My_Str0ng_Rsync_Passw0rd" \
    -e Y_RSYNCD_SYSVOL_UPON_JOIN="yes" -e Y_RSYNCD_SYSVOL_SERVER="10.1.192.11" -e Y_RSYNCD_SYSVOL_CRON="*/5 * * * *" \
    registry.gitlab.com/palw3ey/ye3samba

podman logs -f dc2

podman exec -it dc2 samba-tool drs showrepl -U administrator --password=My_Str0ng_Dc_Passw0rd

podman run -dt --name="nas1" --cap-add="NET_RAW"  \
    --hostname="nas1" --network="mynet46" --ip="10.1.192.13" --ip6="fd00::a01:c00d" \
    -e Y_RESOLV_OPTION="search samba.lan | nameserver 10.1.192.11" \
    -e Y_HOSTS_ENTRY="127.0.0.1 localhost | 10.1.192.13  nas1.samba.lan nas1" \
    -e Y_SERVER_ROLE="member" -e Y_JOIN_DOMAIN="samba.lan" -e Y_JOIN_SERVER="10.1.192.11" -e Y_JOIN_USER="[email protected]" -e Y_JOIN_PASSWORD="My_Str0ng_Dc_Passw0rd" \
    -e Y_NETBIOS_NAME="nas1" \
    -e Y_IDMAP_LOWERBOUND="15533" -e Y_IDMAP_UPPERBOUND="65533" \
    -e Y_PAM_KRB_MINIMUM_UID="15533" -e Y_PAM_MKHOMEDIR="yes" \
    -e Y_GENERAL_OPTION="template homedir = /home/%D/%U | template shell = /bin/sh | winbind use default domain = Yes | idmap config * : backend  = tdb | idmap config * : range = 15533-25533 | vfs objects =  acl_xattr xattr_tdb  preopen readahead recycle | idmap config samba: backend = rid | idmap config samba: range = 45534-65533 | winbind enum users = Yes | winbind enum groups = Yes" \
    -e Y_REVERSE_ZONE="192.1.10.in-addr.arpa" -e Y_REVERSE_SERVER="dc1.samba.lan" \
    -e Y_REVERSE_PTR_NAME="13" -e Y_REVERSE_PTR_DATA="nas1.samba.lan" \
    -e Y_SHARE_HOMES="yes" -e Y_SHARE_NAME="nas" -e Y_SHARE_CHMOD="777" -e Y_SHARE_PATH="/nas" -e Y_SHARE_OPTION="writable = yes | read only = no | hide dot files = no" -e Y_SHARE_SDDL="O:BAG:DUD:AI(A;OICI;0x1201bf;;;DU)(A;OICI;0x1301bf;;;DU)(A;OICIID;FA;;;DA)(A;OICIID;FA;;;SY)" \
    registry.gitlab.com/palw3ey/ye3samba

podman logs -f nas1

podman exec -it nas1 getfacl /nas

podman exec -it nas1 wbinfo --ping-dc

# show dns zone
podman exec -it nas1 samba-tool dns zonelist dc1 --username=administrator --password=My_Str0ng_Dc_Passw0rd

# test dns resolve : ldap, kerberos, internal, external
podman exec -it nas1 host -t SRV _ldap._tcp.samba.lan.
podman exec -it nas1 host -t SRV _kerberos._udp.samba.lan.
podman exec -it nas1 host -t A nas1.samba.lan.
podman exec -it nas1 host -t A doc.ubuntu-fr.org

# test dns reverse
podman exec -it nas1 host -t PTR 10.1.192.13

# test file server
podman exec -it nas1 smbclient -L localhost -N

# test winbind
podman exec -it nas1 getent passwd administrator
podman exec -it nas1 getent group "Domain Users"

# test kerberos 
podman exec -it nas1 kinit administrator
podman exec -it nas1 klist

# test acl and extended attributes user and security (failed in rootless container, require root)
podman exec -it nas1 bash -c "touch test.txt ; setfacl -m g:adm:rwx test.txt ;  getfacl test.txt"
podman exec -it nas1 bash -c "touch test.txt ; setfattr -n user.userName -v userValue test.txt ; getfattr -d test.txt"
podman exec -it nas1 bash -c "touch test.txt ; setfattr -n security.secName -v secValue test.txt ; getfattr -n security.secName -d test.txt"

# test gpo
podman exec -it nas1 samba-tool gpo listall --username=administrator --password="My_Str0ng_Dc_Passw0rd"
podman exec -it nas1 samba-tool gpo getlink "DC=samba,DC=lan" --username=administrator --password="My_Str0ng_Dc_Passw0rd"

# test ldap query
podman exec -it nas1 ldapsearch \
    -x -H ldaps://dc1.samba.lan -o tls_reqcert=never \
    -D "CN=Administrator,CN=Users,DC=samba,DC=lan" \
    -w "My_Str0ng_Dc_Passw0rd" \
    -b "DC=samba,DC=lan" \
    "(&(objectCategory=person)(objectClass=user)(sAMAccountName=caroline))"

# show SDDL ACL
podman exec -it nas1 mkdir /nas/newdir
podman exec -it nas1 samba-tool ntacl get --as-sddl /nas/newdir

# verify port
podman exec -it nas1 netstat -tulnp

podman exec -it nas1 nano /etc/samba/smb.conf

# test
podman exec -it nas1 testparm

# reload to apply
podman exec -it nas1 smbcontrol all reload-config

# log
podman exec -it nas1 tail -f /var/log/samba/log.smbd

# for a DC server : 
-p 53:53/tcp -p 53:53/udp -p 88:88/tcp -p 88:88/udp -p 135:135/tcp -p 137:137/udp -p 138:138/udp -p 139:139/tcp -p 389:389/tcp -p 389:389/udp -p 445:445/tcp -p 464:464/tcp -p 464:464/udp -p 636:636/tcp -p 3268:3268/tcp -p 3269:3269/tcp -p 49152-65535:49152-65535/tcp -p 123:123/udp 

# for a share server : 
-p 137:137/udp -p 138:138/udp -p 139:139/tcp -p 445:445/tcp 

# open cmd.exe in local administrator, type this line and hit Enter :
notepad C:\Windows\System32\drivers\etc\hosts

# append this line, and close the file :
10.1.192.11    samba.lan

# from the cmd, type this line and hit Enter, this will open "Active directory users and computer" :
runas /netonly /user:samba.lan\Administrator "mmc.exe \"%SystemRoot%\system32\dsa.msc\" /domain=samba.lan"

# RSAT is required

# connect to share with letter S
net use S: \\samba.lan\nas My_Str0ng_User_Passw0rd /user:samba\caroline

# list connections
net use

# show SDDL ACL
icacls \\samba.lan\nas
powershell -c "(Get-Acl '\\samba.lan\nas').Sddl"

# remove connections
net use \\samba\nas /delete

# remove saved password 
rundll32.exe keymgr.dll, KRShowKeyMgr
control.exe /name Microsoft.CredentialManager

# e.g. on Ubuntu 24.04.2 LTS, with crun and pasta
sudo apt update; sudo apt install podman crun passt

# e.g. on Ubuntu 24.04.2 LTS
sudo apt update; sudo apt install docker.io

# configuration
sudo groupadd docker
sudo usermod -aG docker $USER
newgrp docker
sudo systemctl enable --now docker

git clone https://gitlab.com/palw3ey/ye3samba.git
cd ye3samba

# Make all your modifications, then :
podman build --no-cache --network=host -t ye3samba-dev .
podman run -dt --name mysamba-dev ye3samba-dev

# Verify
podman logs -f mysamba-dev
podman exec -it mysamba-dev ps -ef
podman exec -it mysamba-dev bash