HOME

Return to the Samba-AD

RedHat10/RodcServer.

01- Network	02- RodcServer	03- Settings
05- Software	06- UsersShare
	10- GnomeShell	11- TroubleShoots	12- Selinux

5. Software sharing folder.

The purpose of this share is to:

• store the Java installation Powershell script,
• deploy Java to all computers via GPO.

This offline software will be installed or updated when starting computers.

Powershell scripts are created from a domain administrator session computer.
Only the domain administrator can modify or delete the script.
The others execute or read the script.

This shared drive contains the offline sofware installations :
The letter is (S).

(S)-software share  
        |- data  folder  
                 java64b.exe  
        |- java folder
                 install_java.ps1
                 uninstall_java.ps1
 install_logiciel.ps1
 variables.psm1

Software share is installed on another hard disk.
The format of the disc will be ext4.
Software share need a 10G disk space.
In the setting of the Aoles VM, you will have 2 discs.

• Disk1 40G ( Ex TemplateVM) Provisonned.
• Disk2 10G (software) Preallocated.

5.1 Install Disk 10G.

Reminder: Gnome is installed.
This hypervisor is Proxmox.

Server Aoles.
Log in to a user session with Gnomeshell.
Go to Utilities and run Disk.
Format the new 10GB disk as EXT4 and name it "software".

Partition: GPT  
Format: Ext4  
Name and label: software  
Information: Note Uuid  
Example Uuid = c6b47006-d28c-411f-850a-83c865370eb7  

blkid

dev/vdb1: LABEL="software" UUID="c6b47006-d28c-411f-850a-83c865370eb7" BLOCK_SIZE="4096" TYPE="ext4" PARTUUID="d594d18d-8af4-4ea2-805e-3275ab22390c"  

Mount and fstab.
Need /home/software
mkdir /home/software
Fstab.
vi /etc/fstab
Add these lines and modify your disk's UUID.

## external software  
UUID=c6b47006-d28c-411f-850a-83c865370eb7 /home/software  ext4   defaults,acl,user_xattr,barrier=1   1 2  

systemctl daemon-reload
mount /dev/vdb1
mount

/dev/vdb1 on /home/software  type ext4 (rw,relatime,seclabel)  

Restart the server.
reboot or init 6

5.2 Create a software sharing folder.

Example: /home/software for our sharing.

Add privileges for « Domain Admins ».
net rpc rights grant "DW.LEARN\Domain Admins" SeDiskOperatorPrivilege -U "DW.LEARN\administrator"

Edit smb.conf.
vi /etc/samba/smb.conf
Add these line before [sysvol].

[software]  
        path = /home/software  
        inherit owner = yes  
        inherit permissions = yes  
        read only = No  
        browseable = no  
        guest ok = no  

Permissions on the "software" share will be the same as those on the "sysvol" shares.

Give the right ACL for the Software folder.
These ACLS come from samba ad thot server /var/lib/samba/sysvol.
Read from thot server : getfacl /var/lib/samba/sysvol

cd /home

myfolder=software  
setfacl -m u:root:rwx $myfolder  
setfacl -m u:"BUILTIN\administrators":rwx  $myfolder  
setfacl -m g::rwx $myfolder  
setfacl -m g:"BUILTIN\administrators":rwx $myfolder  
setfacl -m g:"BUILTIN\server operators":rx $myfolder  
setfacl -m g:"NT Authority\system":rwx $myfolder  
setfacl -m g:"NT Authority\authenticated users":rx $myfolder  
setfacl -m mask::rx $myfolder  
setfacl -m o::rx  $myfolder  
setfacl -d -m u::rwx  $myfolder  
setfacl -d -m u:root:rwx $myfolder  
setfacl -d -m u:"BUILTIN\administrators":rwx $myfolder  
setfacl -d -m g::--- $myfolder  
setfacl -d -m g:"BUILTIN\administrators":rwx $myfolder  
setfacl -d -m g:"BUILTIN\server operators":rx $myfolder  
setfacl -d -m g:"NT Authority\system":rwx $myfolder  
setfacl -d -m g:"NT Authority\authenticated users":rx $myfolder  
setfacl -d -m mask::rwx $myfolder  
setfacl -d -m o::--- $myfolder  

Information :

• read ACLs,
  getfacl software
• delete one ACLs,
  setfacl -x -m .... <Folder or file>
• delete all ACLs.
  setfacl -b <folder or file>

Give good right for /home/software
chown root /home/software
chgrp "BUILTIN\administrators" /home/software
chmod 750 /home/software

Restart samba service.
systemctl restart samba

5.2.1 Give good right on software sharing folder.

Be careful, you will make the parameters on RedHat and also on Windows.

Log in to the Windows computer as dw.learn\administrator.

Check share software.
On the Windows Administrator computer.
Open administrator console.
net use S: \\aoles.dw.learn.lan\software

Open File Explorer.
Right click on the network with letter S.

Properties  
Security  
Do not edit to change the permissions  
Advanced  
Desactivate the inheritance  (You should see "Enable inheritance").  
Change owner to "Authenticated Users"  
Apply  

edit  

Allow	 "Administrator"             "Full control"       "This folder,subfolders and files"  
Allow   "System"                    "Full control"       "This folder,subfolders and files"  

Add
Allow   "Authenticated Users"       "Read & execute"     "This folder,subfolders and files"  

Don't forget to have "APPLY" and "OK" before leaving.

5.3 Software shared folder content.

From computer with a domain administrator session.
Locate on the disk (S)Software.
Create data and java folder.

5.3.1 "software(S)\data folder".

Download the Java files for offline use.

https://www.java.com/en/download/manual.jsp  

Copy this java file to "software(S)\data" and rename as java64b.exe.

5.3.2 Java Powershell script.

Content of PowerShell scripts.
This file is located in software(S)\java.
1- Edit uninstall_java.ps1 with notepad.

#uninstall Java  
# Folder locate java  
# Version version to keep  
$versionjava1 = '8.0.1520.16'  
$versionjava2 = '6.0.450'  
$dir_reseau="\\aoles.dw.learn.lan\software"  
# Uninstalling all Java versions except the versions to keep  
gwmi Win32_Product -filter "name like 'Java%' AND vendor like 'Oracle%' AND not version = '$versionjava1'  AND not version = '$versionjava2' " | % { $_.Uninstall() }  
#  

This file is located in (S)software:\java.
2- Edit install_java.ps1 with notepad.

# install_java.ps1 
# Locate Java folder
# Add Network \\aoles.dw.learn.lan\software\ in the  path  
$app_ini = $env:path  
$app_ori = $env:path + ";"  
$app_data = "\\aoles.dw.learn.lan\software\data;"  
$env:path = $app_ori + $app_data  
#Installing  java  
#$command1 = @'  
#cmd.exe /C  java-32.exe  /s  
#'@  
#Invoke-Expression -Command:$command1  
Start-Sleep -s 10  
start-process -FilePath  java64b.exe -ArgumentList /s  -wait  
$env:path = $app_ini  

5.4 Install Powershell Scripts.

These files are located in (S)software.

1- Edit variables.psm1 with notepad.

#### ----------- Declaration variables -----------------------  
#  
# Date oct 9, 2026  
#  
#  
### Java - to update in data  
# java last update  
$Global:currentversionjava = '8.0.5030.1'  
##  

This file is located in (S)software

2- Edit install_logiciel.ps1 with notepad.

# february 22, 2024  
# This script checks if the application exists  
# If application exists, depending on the declaration of variables, I update or not  
#if application does not exist, I install the application  
#  
####- Start of the program --  
#  
#  
#### -- Declaration variables ---  
#  
# where the files are located  
$dir_reseau="\\aoles.dw.learn.lan\software"  
#  
####- Importing variables --  
#  
set-executionPolicy -ExecutionPolicy Bypass -scope Process -Force  
Import-Module -Name $dir_reseau\variables.psm1  
#  
#### - uninstall  java  --  
#  
##    Java  value to be set by the administrator  
if ((Get-WmiObject -Query "SELECT * FROM Win32_Product Where Name like '%Java 8%'"|foreach-object { $_.Version}) -ge "$currentversionjava" ) { } else {(powershell.exe -executionpolicy bypass -file  "$dir_reseau\java\uninstall_java.ps1")}  
  
#### Uninstall java  DONE --  
#  
#  
###-  Installing java 64 bit --  
if ((Get-WmiObject -Query "SELECT * FROM Win32_Product Where Name like '%Java 8%'"|foreach-object { $_.Version}) -ge "$currentversionjava" ) { } else {(powershell.exe -executionpolicy bypass -file "$dir_reseau\java\install_java.ps1")}  
set-location "c:\"  
#  
####- Install java DONE  --  
#  
####- end of program--  
remove-module variables  
Remove-Variable * -ErrorAction SilentlyContinue  
#  

5.5 Create gpo for software installation.

Reminder:
The domain is dw.learn.lan.
The Samba server is thot.
From a computer and a domain administrator account.

5.5.1 Edit a script to run powershell.

Right click on start button
and click on run.
\\thot.dw.learn.lan\netlogon
or
\\dw.learn.lan\netlogon

Right click.
New Text Document.

Edit "New Text Document.txt" with notepad.
write this line.
powershell -executionpolicy bypass -file \\aoles.dw.learn.lan\software\install_logiciel.ps1
Save as installing-or-updating-software.bat

Delete "New Text Document.txt".

5.5.2 Create GPO.

Start button.
Windows tools
Group Policy Management

Forest:dw.learn.lan  
Domains  
  dw.learn.lan  
     Group Policy Objects.  
       New.  
           Name : Installing or updating software  

Edit

Computer configuration  
      Policies  
          Windows settings  
               Scripts(Startup/Shudown)  
                   Startup  
                      Add  
                      \\dw.learn.lan\netlogon\installing-or-updating-software.bat  
          Administrative templates  
                   Network  
                         Lanman Workstation  
                             enable insecure guest logons       disabled  
                   System  
                         logon  
                               Always wait for the network at computer startup and logon    enabled  

5.5.3 Apply GPO.

Groupe Policy Management.  
Locate an Organizational Unit with the computers.  
Right Click.  
Link an Existing GPO.   
Select `installing-or-updating-software.bat`  

Open Console cmd 
Tape `gpupdate /force`  

Restart Computers.