samba - Sep 2017 - File server questions ( about the ntp question )

Hai Flavio, 

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Flávio Silveira via samba
> Verzonden: woensdag 13 september 2017 16:19
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] File server questions
> 
> 
> 
> Em 13/09/2017 10:36, L.P.H. van Belle via samba escreveu:
> > Hai, Flavio,
> >
> > Yes, it looks good, but i suggest, if you setting up a new 
> DC on debian..
> > Go here: https://github.com/thctlo/samba4/tree/master/howtos
> > And read the file: stretch-base-2-samba-minimal-ad.txt
> >
> >
> 
> Thank for your reply Louis!
> 
> I've been reading your howtos, but I didn't know how to 
> execute them, so 
> I decided to create a new file as below:
These are not executable yet. Thats why the are in .txt files. 
You can use it as guidance.
> 
> > # Local clock. Note that is not the "localhost" address!
> > server 127.127.1.0
> > fudge  127.127.1.0 stratum 10
> >
> > # Where to retrieve the time from
> > server a.st1.ntp.br iburst prefer
> > server b.st1.ntp.br iburst prefer
> > server c.st1.ntp.br iburst prefer
> > server d.st1.ntp.br iburst prefer
> >
> > driftfile       /var/lib/ntp/ntp.drift
> > logfile         /var/log/ntpstats
> > ntpsigndsocket  /var/lib/samba/ntp_signd/
> >
> > # Access control
> > # Default restriction: Allow clients only to query the time
> > restrict default kod nomodify notrap nopeer mssntp
> >
> > # No restrictions for "localhost"
> > restrict 127.0.0.1
> >
> > # Enable the time sources to only provide time to this host
> > restrict a.st1.ntp.br   mask 255.255.255.255    nomodify 
> notrap nopeer 
> > noquery
> > restrict b.st1.ntp.br   mask 255.255.255.255    nomodify 
> notrap nopeer 
> > noquery
> > restrict c.st1.ntp.br   mask 255.255.255.255    nomodify 
> notrap nopeer 
> > noquery
> > restrict d.st1.ntp.br   mask 255.255.255.255    nomodify 
> notrap nopeer 
> > noquery
> >
> > # Interfaces ntp daemon should listen
> >
> > interface listen lo
> > interface listen enp2s0
> >
> > # Ignore IPv6 wildcard
> >
> > interface ignore ipv6
> 
> As you can see, my "Access control" line doesn't have
"noquery" and
> "limited", but I don't know much about ntp, so I don't
know
> if I should add or not.
> 
> Your lines also have -4 and -6, which seems to be related to IPv4 and 
> IPv6, if I plan to use IPv4 only, can I stick with "default"?
> 
> Thanks
> 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
I suggest, use the interface ignore ipv6 ( you already did set it ) for the ipv6
ipnumbers, except localhost-ipv6. ( ::1 )
The other defaults are good to start with, then when everything is running
correct, only then go optimize the config.
And only one thing at a time, or you end up in a mess..  Just a tip. 

So below is a copy past of a original jessie ntp.conf ( from before my upgrade
to stretch)
And for you, i changed it to your setup. See what i did and compair it to yours.


####### NTP Begin ( Debian Jessie version ) 
# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help

driftfile /var/lib/ntp/ntp.drift

# Enable this if you want statistics to be logged.
#statsdir /var/log/ntpstats/

statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable


# You do need to talk to an NTP server or two (or three).
#server ntp.your-provider.example
server a.st1.ntp.br
server b.st1.ntp.br
server c.st1.ntp.br

# pool.ntp.org maps to about 1000 low-stratum NTP servers.  Your server will
# pick a different set every time it starts up.  Please consider joining the
# pool: <http://www.pool.ntp.org/join.html>
#pool 0.debian.pool.ntp.org iburst
#pool 1.debian.pool.ntp.org iburst
#pool 2.debian.pool.ntp.org iburst
#pool 3.debian.pool.ntp.org iburst


# Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html for
# details.  The web page
<http://support.ntp.org/bin/view/Support/AccessRestrictions>
# might also be helpful.
#
# Note that "restrict" applies to both servers and clients, so a
configuration
# that might be intended to block requests from certain clients could also end
# up blocking replies from your own upstream servers.

# By default, exchange time with everybody, but don't allow configuration.
restrict -4 default kod notrap nomodify nopeer noquery mssntp
restrict -6 default kod notrap nomodify nopeer noquery mssntp

# Local users may interrogate the ntp server more closely.
restrict 127.0.0.1
restrict ::1

# Needed for adding pool entries
restrict source notrap nomodify noquery

# Clients from this (example!) subnet have unlimited access, but only if
# cryptographically authenticated.
#restrict 192.168.123.0 mask 255.255.255.0 notrust

# If you want to provide time to your local subnet, change the next line.
# (Again, the address is an example only.)
#broadcast 192.168.123.255

# If you want to listen to time broadcasts on your local subnet, de-comment the
# next lines.  Please do this only if you trust everybody on the network!
#disable auth
#broadcastclient

interface listen lo
interface listen enp2s0
#interface ignore wildcard
interface ignore ipv6

######  Needed for Samba 4  ######
# in the restrict -4 or -6 added mssntp at the end
# Location of the samba ntp_signed directory
ntpsigndsocket /var/lib/samba/ntp_signd
####### NTP end

Greetz, 

Louis

Em 13/09/2017 11:48, L.P.H. van Belle via samba
escreveu:
> Hai Flavio,
> I suggest, use the interface ignore ipv6 ( you already did set it ) for the
ipv6 ipnumbers, except localhost-ipv6. ( ::1 )
> The other defaults are good to start with, then when everything is running
correct, only then go optimize the config.
> And only one thing at a time, or you end up in a mess..  Just a tip.
>
> So below is a copy past of a original jessie ntp.conf ( from before my
upgrade to stretch)
> And for you, i changed it to your setup. See what i did and compair it to
yours.
>
>
> ####### NTP Begin ( Debian Jessie version )
> # /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help
>
> driftfile /var/lib/ntp/ntp.drift
>
> # Enable this if you want statistics to be logged.
> #statsdir /var/log/ntpstats/
>
> statistics loopstats peerstats clockstats
> filegen loopstats file loopstats type day enable
> filegen peerstats file peerstats type day enable
> filegen clockstats file clockstats type day enable
>
>
> # You do need to talk to an NTP server or two (or three).
> #server ntp.your-provider.example
> server a.st1.ntp.br
> server b.st1.ntp.br
> server c.st1.ntp.br
>
> # pool.ntp.org maps to about 1000 low-stratum NTP servers.  Your server
will
> # pick a different set every time it starts up.  Please consider joining
the
> # pool: <http://www.pool.ntp.org/join.html>
> #pool 0.debian.pool.ntp.org iburst
> #pool 1.debian.pool.ntp.org iburst
> #pool 2.debian.pool.ntp.org iburst
> #pool 3.debian.pool.ntp.org iburst
>
>
> # Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html
for
> # details.  The web page
<http://support.ntp.org/bin/view/Support/AccessRestrictions>
> # might also be helpful.
> #
> # Note that "restrict" applies to both servers and clients, so a
configuration
> # that might be intended to block requests from certain clients could also
end
> # up blocking replies from your own upstream servers.
>
> # By default, exchange time with everybody, but don't allow
configuration.
> restrict -4 default kod notrap nomodify nopeer noquery mssntp
> restrict -6 default kod notrap nomodify nopeer noquery mssntp
>
> # Local users may interrogate the ntp server more closely.
> restrict 127.0.0.1
> restrict ::1
>
> # Needed for adding pool entries
> restrict source notrap nomodify noquery
>
> # Clients from this (example!) subnet have unlimited access, but only if
> # cryptographically authenticated.
> #restrict 192.168.123.0 mask 255.255.255.0 notrust
>
> # If you want to provide time to your local subnet, change the next line.
> # (Again, the address is an example only.)
> #broadcast 192.168.123.255
>
> # If you want to listen to time broadcasts on your local subnet, de-comment
the
> # next lines.  Please do this only if you trust everybody on the network!
> #disable auth
> #broadcastclient
>
> interface listen lo
> interface listen enp2s0
> #interface ignore wildcard
> interface ignore ipv6
>
> ######  Needed for Samba 4  ######
> # in the restrict -4 or -6 added mssntp at the end
> # Location of the samba ntp_signed directory
> ntpsigndsocket /var/lib/samba/ntp_signd
> ####### NTP end
>
> Greetz,
>
> Louis
>
Hi Louis,

The file seems similar to mine, so I guess I'm all set for the ntp, any 
way to test it?

Moving forward to Winbindd config as describe here: 
https://wiki.samba.org/index.php/Configuring_Winbindd_on_a_Samba_AD_DC

It seems I just need to edit nsswitch.conf and add winbind to passwd and 
group databases, right?

Because it says tipically no configuration is required in smb.conf for 
Winbindd to work.

I don't think I want to have every user home on my servers, my plan is 
to force them to use the shares

Thank you

Hi!

Just to confirm, I don't think there is a way to test if ntp is setup 
properly, right?

Moving forward to Winbindd config as describe here: 
https://wiki.samba.org/index.php/Configuring_Winbindd_on_a_Samba_AD_DC

It seems I just need to edit nsswitch.conf and add winbind to passwd and 
group databases, correct?

The guide says tipically no configuration is required in smb.conf for 
Winbindd to work.

I don't think I want to have every user home on my servers, my plan is 
to force them to use the shares, which is the last step in the guide, 
hopefully I won't bother soon :-)

Thank you

Hai, 

Sorry for the long responce on this one, had a few days off. 

Some importent extra info here.

If you run systemctl status ntp, you wil see if ntp is running correctly.  
The PC's, wil get there time through samba AD ( via /var/lib/samba/ntp_signd
)

Linux clients needs ntp, point to the AD server(s) 
Windows ( domain joined ) clients get time through AD. 
Windows standalone, you need to configure the ntp client in windows and point to
AD DC.

Run on linux : ntpq -qq Or ntpq -pn 127.0.0.1 or 

Other option is : apt-get install ntpstat
Run : ntpstat

If you see errors, first thing you should check if the following. 

On which interfaces and ipnumbers is ntp running. 
netstat -taupn|grep udp|grep ntp

And if you use the inteface lines, ( one or more )
#interface listen lo
#interface listen eth0
#interface ignore wildcard
#interface ignore ipv6

Disable these, and try again.

There is probely something going wrong then due to ntp trying to get time over
ipv6 which is disabled.

This command will tell you more about it. 
strace ntpq -pn ::1|& grep -i conn



Greetz, 

Louis



> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Flávio Silveira via samba
> Verzonden: woensdag 13 september 2017 19:44
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] File server questions
> 
> 
> 
> Em 13/09/2017 11:48, L.P.H. van Belle via samba escreveu:
> > Hai Flavio,
> > I suggest, use the interface ignore ipv6 ( you already did set it ) 
> > for the ipv6 ipnumbers, except localhost-ipv6. ( ::1 ) The 
> other defaults are good to start with, then when everything 
> is running correct, only then go optimize the config.
> > And only one thing at a time, or you end up in a mess..  Just a tip.
> >
> > So below is a copy past of a original jessie ntp.conf ( 
> from before my 
> > upgrade to stretch) And for you, i changed it to your 
> setup. See what i did and compair it to yours.
> >
> >
> > ####### NTP Begin ( Debian Jessie version ) # /etc/ntp.conf, 
> > configuration for ntpd; see ntp.conf(5) for help
> >
> > driftfile /var/lib/ntp/ntp.drift
> >
> > # Enable this if you want statistics to be logged.
> > #statsdir /var/log/ntpstats/
> >
> > statistics loopstats peerstats clockstats filegen loopstats file 
> > loopstats type day enable filegen peerstats file peerstats type day 
> > enable filegen clockstats file clockstats type day enable
> >
> >
> > # You do need to talk to an NTP server or two (or three).
> > #server ntp.your-provider.example
> > server a.st1.ntp.br
> > server b.st1.ntp.br
> > server c.st1.ntp.br
> >
> > # pool.ntp.org maps to about 1000 low-stratum NTP servers.  Your 
> > server will # pick a different set every time it starts up.  Please 
> > consider joining the # pool: <http://www.pool.ntp.org/join.html>
> > #pool 0.debian.pool.ntp.org iburst
> > #pool 1.debian.pool.ntp.org iburst
> > #pool 2.debian.pool.ntp.org iburst
> > #pool 3.debian.pool.ntp.org iburst
> >
> >
> > # Access control configuration; see 
> > /usr/share/doc/ntp-doc/html/accopt.html for # details.  The 
> web page 
> > <http://support.ntp.org/bin/view/Support/AccessRestrictions>
> > # might also be helpful.
> > #
> > # Note that "restrict" applies to both servers and clients,
so a
> > configuration # that might be intended to block requests 
> from certain 
> > clients could also end # up blocking replies from your own 
> upstream servers.
> >
> > # By default, exchange time with everybody, but don't allow 
> configuration.
> > restrict -4 default kod notrap nomodify nopeer noquery 
> mssntp restrict 
> > -6 default kod notrap nomodify nopeer noquery mssntp
> >
> > # Local users may interrogate the ntp server more closely.
> > restrict 127.0.0.1
> > restrict ::1
> >
> > # Needed for adding pool entries
> > restrict source notrap nomodify noquery
> >
> > # Clients from this (example!) subnet have unlimited 
> access, but only 
> > if # cryptographically authenticated.
> > #restrict 192.168.123.0 mask 255.255.255.0 notrust
> >
> > # If you want to provide time to your local subnet, change 
> the next line.
> > # (Again, the address is an example only.) #broadcast 
> 192.168.123.255
> >
> > # If you want to listen to time broadcasts on your local subnet, 
> > de-comment the # next lines.  Please do this only if you 
> trust everybody on the network!
> > #disable auth
> > #broadcastclient
> >
> > interface listen lo
> > interface listen enp2s0
> > #interface ignore wildcard
> > interface ignore ipv6
> >
> > ######  Needed for Samba 4  ######
> > # in the restrict -4 or -6 added mssntp at the end # 
> Location of the 
> > samba ntp_signed directory ntpsigndsocket /var/lib/samba/ntp_signd 
> > ####### NTP end
> >
> > Greetz,
> >
> > Louis
> >
> 
> Hi Louis,
> 
> The file seems similar to mine, so I guess I'm all set for 
> the ntp, any way to test it?
> 
> Moving forward to Winbindd config as describe here: 
> https://wiki.samba.org/index.php/Configuring_Winbindd_on_a_Samba_AD_DC
> 
> It seems I just need to edit nsswitch.conf and add winbind to 
> passwd and group databases, right?
> 
> Because it says tipically no configuration is required in 
> smb.conf for Winbindd to work.
> 
> I don't think I want to have every user home on my servers, 
> my plan is to force them to use the shares
> 
> Thank you
> 
> 
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

On 18/09/2017 05:25, L.P.H. van Belle via samba wrote:
> Hai,
>
> Sorry for the long responce on this one, had a few days off.
>
> Some importent extra info here.
>
> If you run systemctl status ntp, you wil see if ntp is running correctly.
> The PC's, wil get there time through samba AD ( via
/var/lib/samba/ntp_signd )
>
> Linux clients needs ntp, point to the AD server(s)
> Windows ( domain joined ) clients get time through AD.
> Windows standalone, you need to configure the ntp client in windows and
point to AD DC.
>
> Run on linux : ntpq -qq Or ntpq -pn 127.0.0.1 or
>
> Other option is : apt-get install ntpstat
> Run : ntpstat
>
> If you see errors, first thing you should check if the following.
>
> On which interfaces and ipnumbers is ntp running.
> netstat -taupn|grep udp|grep ntp
>
> And if you use the inteface lines, ( one or more )
> #interface listen lo
> #interface listen eth0
> #interface ignore wildcard
> #interface ignore ipv6
>
> Disable these, and try again.
>
> There is probely something going wrong then due to ntp trying to get time
over ipv6 which is disabled.
>
> This command will tell you more about it.
> strace ntpq -pn ::1|& grep -i conn
>
>
>
> Greetz,
>
> Louis
Hi Louis,

   Thank you for your great explanation! I will do some tests today as 
soon as I understand Rowland's last instructions.

Regards,
   Flavio Silveira