HOME

Return to the Samba-AD

https://samba.tranquil.it/doc/en/samba_advanced_methods/samba_active_directory_higher_security_tips.html

Add in smb.conf.
vi /etc/samba/smb.conf

[global]  
# Restrict null session  
  restrict anonymous = 2  

Add in smb.conf.
vi /etc/samba/smb.conf

[global]  
       # Disable Netbios  
        disable netbios = yes  
        smb ports = 445  

Add in smb.conf.
vi /etc/samba/smb.conf

[global]  
# Disable printer support  
printcap name = /dev/null  
load printers = no  
disable spoolss = yes  
printing = bsd  

Add in smb.conf.
vi /etc/samba/smb.conf

[global]  
# Disable NTLMv1  
ntlm auth = mschapv2-and-ntlmv2-only  

For this example:
Samba server : thot.dw.lean.lan 192.168.40.47
File server : aoles.dw.learn.lan 192.168.60.49
Dns name: dns.dw.learn.lan cname thot.dw.learn.lan
Domain name: dw.learn.lan

All servers in the domain have the same CA.
You must download CA-ecc.crt and CA-ecc.key from the thot server to the aoles server.

Thot server : 192.168.40.47
Aoles server : 192.168.60.49

Thot server :
Disable firewall.
ufw disable

Aoles server :
Permit root from thot server.
Disable PubkeyAuthentication.
vi /etc/ssh/sshdconfig

AllowUsers <your user>  [email protected]  
PubkeyAuthentication no
PasswordAuthentication yes

Restart ssh.
systemctl restart sshd

Thot server :
scp /etc/pki/tls/certs/CA-ecc.crt [email protected]:/etc/pki/tls/certs/CA-ecc.crt
scp /etc/pki/tls/private/CA-ecc.key [email protected]:/etc/pki/tls/private/CA-ecc.crt
Enable firewall.
ufw enable

Aoles server:
Disable root from thot server.
Enable PubkeyAuthentication.
vi /etc/ssh/sshdconfig

AllowUsers <your user>   
PubkeyAuthentication yes
PasswordAuthentication no

Restart ssh.
systemctl restart sshd

I need:
/etc/ssl/private/CA-ecc.key (already created from thot server).
/etc/ssl/certs/CA-ecc.crt (already created from thot server).
/etc/ssl/private/aoles-ecc.key (to be created).
/etc/ssl/certs/aoles-ecc.crt (to be created).

Server Self-signed certificate.
Generate private key.
openssl ecparam -genkey -name prime256v1 -noout -out /etc/ssl/private/aoles-ecc.key
Generate Certificate Signing Request.
openssl req -new -days 365 -key /etc/ssl/private/aoles-ecc.key -out /etc/ssl/certs/aoles-ecc.csr

Country Name (2 letter code) [XX]:FR  
State or Province Name (full name) []:France  
Locality Name (eg, city) [Default City]:Versailles  
Organization Name (eg, company) [Default Company Ltd]:dw.learn  
Organizational Unit Name (eg, section) []:office  
Common Name (eg, your name or your server's hostname) []:aoles.dw.learn.lan  
Email Address []:[email protected]  

Generate SSL certificate with self signed CA.
See chapter 6.2.2.2: Server configuration for future CSR requests for the settings of the openssl.cnf file.

cp /etc/pki/tls/openssl.cnf_ecc /etc/pki/tls/openssl.cnf

openssl ca -config /etc/ssl/openssl.cnf -out /etc/ssl/certs/aoles-ecc.crt -in /etc/ssl/certs/aoles-ecc.csr

chmod 600 /etc/ssl/private/aoles-ecc.key  
chmod 400 /etc/ssl/certs/aoles-ecc.crt  

Add in smb.conf.
vi /etc/samba/smb.conf

[global]  
# Certificats  
tls enabled = yes  
tls keyfile = /etc/pki/tls/private/aoles-ecc.key  
tls certfile = /etc/pki/tls/certs/aoles-ecc.crt  
tls cafile = /etc/pki/tls/certs/CA-ecc.crt  

Add in smb.conf.
vi /etc/samba/smb.conf

[global]  
# Generate additional password hashes  
password hash userPassword schemes = CryptSHA256 CryptSHA512  

Edit krb5.conf.
vi /etc/krb5.conf
Add these lines in tle end.

[libdefaults]  
allow_weak_crypto = false  
permitted_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 camellia256-cts-cmac camellia128-cts-cmac  

systemctl restart samba

Check administrator password.
kinit administrator
klist
kdestroy