Zentyal is the first-ever native Microsoft Active Directory implementation on Linux that is easy to use. Zentyal Server incorporates all the network services required in a small and medium business environment: Directory & Domain Server, Mail Server, Gateway and Infrastructure Server.
Once a Quick Instance of Zentyal is fired up, it can be access via the console as usual, or via a web interface at https://<ip_of_the_vm>:8443 eg. https://10.108.154.44:8443
The browser will give a warning about the SSL certificate being self-signed, and login is using the default credentials combination we use for most VMs in the department.
Note: NEVER use Zentyal to start a DHCP server anywhere in DkIT. Feel free to use all other features.
The below is taken from the Zentyal Wiki.
Configuring a Domain Server with Zentyal
This first section describes the functionality and information available in Zentyal’s LDAP directory using any of the domain operation modes. The next sections will describe how to configure and make use of the features of those modes.
Going to Users and Computers ‣ Configure mode you can check the operation mode of your LDAP server before enabling the module. If you have already enabled Users, Computers and File Sharing, your server will operate as a Stand-alone server by default.
Once you have enabled the module, you can access Users and Computers –> LDAP settings, where you can see some general LDAP information on the upper block
From the bottom block, you can configure some PAM Settings
Managing Users, Groups and Computers
Going to Users and Computers ‣ manage you will see the LDAP tree. From this interface you can also create and delete nodes, manage the LDAP attributes and adjust the permissions for other LDAP-connected services.
- Computers: Hosts joined to the domain, both servers and desktops, this section is useful for inventory reasons and also to apply host-based rules.
- Groups: Generic OU container node for the groups in your organization.
- Users: Generic OU container node for the users in your organization.
- Domain Controllers: Servers that replicate this directory information, they can also take on the different FSMO roles of a Samba4/Active Directory domain.
An Organizational Unit is a container for other objects, like groups, users or even other nested OUs. It’s a concept closely related to the tree data structure and the different policies associated with each node. If you are not using Samba4/Active Directory capabilities, you probably don’t need to create new Organizational Units in your domain.
You can delete any node using the trash can icon or you can create a new one clicking on a container and then on the green plus icon.
The Contacts are personal information objects not related with the authorization mechanism. In other words, contacts will not be able to login on the domain services.
On the right side you can see and modify the LDAP attributes of the currently selected node, for example, the last name of an user.
Clicking on a user, you can also modify user’s membership to the different groups, and make use of the user plugins. At the right bottom of the interface, you will see a section named Modules Configuration, this section has a variable number of subsections, depending on the Zentyal modules installed and enabled. From here, you can modify the specific parameters of that module regarding this user. The default configuration of the user plugins depends on the User Template explained below.
Going to Users and Computers –> User Template you can modify the default service settings for the new user, for example, the default domain for their mail account. It’s important to note that any modifications will only be applied to the users created after changing the template. The number of sections is variable, depending on the user-related Zentyal modules present on your system.
Configuring Zentyal as a Standalone Domain server
Enabling the Users, Computers and File Sharing module has to be done carefully. The reason is that during module activation the Domain is provisioned. This means that the LDAP, DNS and Kerberos data is initialized, creating all the LDAP objects, Kerberos security principals, DNS zones and so on. The operation can be reverted but it’s certainly more difficult than disabling and re-enabling other modules.
Before enabling the Users, Computers and File Sharing module for the first time make sure that:
- You have configured the operation mode (by default Domain Controller), but you can also configure your server
to be an additional controller joined to another node. In the latter case, configure the server role and credentials to join the domain before enabling the module and look at the other instructions below. If this server is the first (or the only) Domain Controller, you don’t have to modify anything. Check the operation mode from Domain ‣ Settings
- Your local domain and host name parameters are correct. You can check this from System ‣ General,
Hostname and Domain section. If you want to change these, save changes and reboot the machine before enabling the module.
- In the DNS module configuration, you will have a DNS “local” domain that matches the one you have configured in
System ‣ General, this domain has to contain the server Hostname as an A register (inside the Hostnames section) and this hostname has to have at least one local IP address. You have to associate all the internal IPs addresses where you want to provide Domain services to the server’s DNS hostname.
- NTP module is installed and enabled, and your clients are receiving NTP information from the server, generally though DHCP.
Once you have enabled Users, Computers and File Sharing you can provide File Sharing functionality, join Windows Clients to your Zentyal server, Configure and Link the Group Policy Objects and accept connections from additional controllers, either Windows Server® or Zentyal.
Probably, one of the first operations you need to perform in your domain is to create a user in the directory and join it to the *Domain Admins* group, this will give the user all the effective permissions over the domain.
Joining a Windows client to the domain
The process of joining a Windows Client to your domain is identical to joining with a Windows Server®.
First of all, you need to use the Domain Admin user that you created.
Now, accessing the Windows client:
- Make sure Zentyal server and the Windows client can reach each other though a local network
- Make sure the Windows client has Zentyal as its DNS server
- Make sure both Server and client are perfectly time sync’ed using NTP
After checking the preconditions, you can join the domain the usual way
After the process is complete, the Windows host will appear under the Computers OU and will apply the configured GPOs and obtain Kerberos tickets automatically (See sections below).
Kerberos Authentication System
Kerberos is an automatic authentication service that integrates with Samba4/Active Directory and all the compatible services across your domain.
The client only needs to provide his/her credentials once to obtain the “main” ticket, Ticket Granting Ticket.
This is done automatically with a Windows client joined to the domain, login credentials are sent to the Domain Controller (any of them), and if the LDAP user is correct, the controller automatically provides the TGT along with other tickets needed for file sharing to the client.
You can list the tickets currently active in your client using the command ‘klist’
Once the client has obtained the Kerberos TGT, all the other Kerberos-compatible services in your domain will accept Kerberos tickets, that are automatically issued on demand to authenticate the users.
This mechanism has two main advantages:
- Security: Passwords are secured while they travel through the local networks, the system is robust against sniffing or replay.
- Convenience: User just needs to provide credentials once, the other auth tickets are obtained transparently.
Zentyal Services currently compatible with Kerberos authorization:
- Samba File Sharing (SMB/CIFS)
- Electronic mail
Changing the user password
Zentyal’s administrator can change the password of any user from the web interface. In most cases, however, it is more convenient that the user have the means to change his/her password without having to notify the administrator.
If you are using a Windows client joined to the samba domain, you can directly change the password after logging in as a domain user, and this change will be reflected on the server.
From a linux client, you need to install the package heimdal-clients and then run:
$ kinit <user>@DOMAIN $ kpasswdFor example:
$ kinit user1@ZENTYAL-DOMAIN.LAN user1@ZENTYAL-DOMAIN.LAN’s Password: $ kpasswd user1@ZENTYAL-DOMAIN.LAN’s Password: New password: Verify password – New password: Success : Password changed
Group Policy Objects
The Group Policy Objects are policies associated to containers of the Domain.
Using GPOs, you can autoconfigure and enforce policies, global policies for all the domain or specific policies for Organizational Units or Sites.
Typical uses of the GPOs include:
- Installing and upgrading software packages without user intervention
- Configuring a HTTP Proxy in the browsers or the Certification Authority of the domain
- Deploying scripts to be executed in the client at login or logoff time
- Restricting part of the configuration of the Windows client to the user
It’s possible to create and enforce any GPO using a Windows client joined to the domain. Installing Microsoft RSAT tools and logging into the client using the Domain Admin LDAP account, you will use RSAT interface to design the desired GPO.
The GPOs will be automatically added to the domain SYSVOL and enforced by the Zentyal server.
Joining Zentyal server to an existing domain
Integrating Samba4 technologies, Zentyal is able to become an Additional Controller of an existing domain, joining a Windows Server® or any Samba4-based controller, like another Zentyal server.
After domain join, LDAP, the DNS domain associated with samba (local domain), Kerberos and SYSVOL information will be transparently replicated.
There are some points to verify before joining another controller:
- Zentyal’s local LDAP data will be destroyed, since it will be overwritten with the domain LDAP information
- All the controllers have to be perfectly time synced, preferably using NTP
- When the users are synchronized from the other controller, Zentyal will create their associated /home/<username>
directories, check that these will not collide with pre-existing home directories
- All the controllers have to belong to the same domain
- DNS configuration is critical, other domain controllers will try to push the information to the IP provided by your DNS system
If you have external IPs associated to your hostname (i.e. zentyal.zentyal-domain.lan), you may have synchronization problems if any of the controllers tries to use that IP to push data. Even if you have several internal IPs, you may have the same problem, because the DNS system performs round-robin when answering DNS queries. If that’s your case, you may want to uncomment sortlist = yes on the /etc/zentyal/dns.conf file and restart the DNS server. This way, the DNS system will always put the IP that matches the query netmask first.
Once you have checked all the points, you can join the domain from Domain ‣ Settings
Exploring the LDAP tree from the Windows Server will also show the new domain controller
From now on, DNS, LDAP and Kerberos information will be synchronized both ways. You can manipulate the LDAP information (users, groups, OUs) in any of the controllers and the information will be replicated to the others.
The process of joining to another Zentyal server is exactly the same.