sambaXP 2023 - SINK Demo 2

[phlogistonjohn]

The SINK Team's 2023 sambaXP presentation contains two demonstrations. This year the theme was how SINK projects are more then just for use on Kubernetes and that samba-container images can be used without a Kubernetes cluster.

The goal of this demo is to show that the samba-container images are flexible enough to be used in a simple container orchestration system like docker-compose, while at the same time demonstrating the ability of containers
to isolate resources such that an AD DC container can be run on the same node as a domain member file server without putting each Samba instance in it's own Virtual Machine.

Video Recording

The original demo recording

Introduction Text

Running an AD DC and A Member File Server on the same host
(without dedicated virtual machines)
Using Docker and Docker Compose

Docker Compose will provide a simple "orchestration" system.

We're hosting the containers on a single node running Debian "Bookworm".
Already configured / installed:

• Packages: "docker.io" and "docker-compose"
• Passwordless sudo access for our demo user

Reference Links

SINK:

• samba-container: https://github.com/samba-in-kubernetes/samba-container
• sambacc: https://github.com/samba-in-kubernetes/sambacc

Debian: https://www.debian.org/

Docker:

• Docker: https://docs.docker.com/
• docker-compose: https://docs.docker.com/compose/
• ipvlan: https://docs.docker.com/network/ipvlan/

Configuration Files and Commands Used

Prerequisites

This demo requires a system (VM or hardware) running Debian Bookworm on the x86_64 architecture.

Install "docker-compose".

Ensure that the user can run docker commands and others via sudo.

Note that this demo assumes particular network addresses and subnet. In particular it assumes the test node is connected to 192.168.122.0/24. You can alter the IP addresses in the docker compose YAML file and the docker network create command to fit your local network. You'll probably want to change the domain to one that you control or something like sambaxp.test.

Copy Configuration Files

Create a directory to host the compose YAML file. I simply use compose.
Copy the following YAML to compose/compose.yaml:

services:
  dc:
    image: quay.io/samba.org/samba-ad-server:latest
    hostname: dc1
    restart: always
    privileged: true
    environment:
      SAMBACC_CONFIG: /etc/samba-container/demo2.yaml
      SAMBA_CONTAINER_ID: addc
    volumes:
      - /var/lib/samba-container/etc:/etc/samba-container
      - dc_state:/var/lib/samba
      - dc_etc:/etc/samba
    networks:
      smbnet:
        ipv4_address: 192.168.122.45
    extra_hosts:
      - "dc1:192.168.122.45"

  init_fs:
    image: quay.io/samba.org/samba-server:latest
    command: init
    environment:
      SAMBACC_CONFIG: /etc/samba-container/demo2.yaml
      SAMBA_CONTAINER_ID: fileserver
    volumes:
      - /var/lib/samba-container/etc:/etc/samba-container
      - fs_state:/var/lib/samba

  join_fs:
    image: quay.io/samba.org/samba-server:latest
    command: must-join
    environment:
      SAMBACC_CONFIG: /etc/samba-container/demo2.yaml
      SAMBA_CONTAINER_ID: fileserver
    volumes:
      - /var/lib/samba-container/etc:/etc/samba-container
      - /var/lib/samba-container/etc/fileserver-resolv.conf:/etc/resolv.conf:ro
      - fs_state:/var/lib/samba
    networks:
      smbnet:
        ipv4_address: 192.168.122.30
    depends_on:
      dc:
        condition: "service_started"
      init_fs:
        condition: "service_completed_successfully"

  fs_winbind:
    image: quay.io/samba.org/samba-server:latest
    command: run winbindd
    environment:
      SAMBACC_CONFIG: /etc/samba-container/demo2.yaml
      SAMBA_CONTAINER_ID: fileserver
    volumes:
      - /var/lib/samba-container/etc:/etc/samba-container
      - /var/lib/samba-container/etc/fileserver-resolv.conf:/etc/resolv.conf:ro
      - fs_state:/var/lib/samba
      - fs_sockets:/run/samba/winbindd
    ipc: "shareable"
    networks:
      smbnet:
        ipv4_address: 192.168.122.30
    depends_on:
      join_fs:
        condition: "service_completed_successfully"

  fs_smbd:
    image: quay.io/samba.org/samba-server:latest
    command: run --setup=nsswitch --setup=share_paths  smbd
    environment:
      SAMBACC_CONFIG: /etc/samba-container/demo2.yaml
      SAMBA_CONTAINER_ID: fileserver
    volumes:
      - /var/lib/samba-container/etc:/etc/samba-container
      - /var/lib/samba-container/etc/fileserver-resolv.conf:/etc/resolv.conf:ro
      - fs_state:/var/lib/samba
      - fs_sockets:/run/samba/winbindd
      - fs_content:/share
    network_mode: "service:fs_winbind"
    pid: "service:fs_winbind"
    ipc: "service:fs_winbind"
    depends_on:
      join_fs:
        condition: "service_completed_successfully"
      fs_winbind:
        condition: "service_started"

volumes:
  fs_content:
  fs_state:
  fs_sockets:
  dc_state:
  dc_etc:

networks:
  smbnet:
    external: true
    name: mv1

Create a file called demo2.yaml. This is the sambacc configuration file.
Copy the following to demo2.yaml:

samba-container-config: v0

configs:
  addc:
    instance_name: dc1
    instance_features:
      - addc
    domain_settings: addc1
  fileserver:
    shares:
      - "share"
    globals:
      - "noprinting"
      - "domain_member"
    instance_name: "DEMO2"
shares:
  share:
    options:
      path: /share
      "read only": "no"
    permissions:
      method: initialize-share-perms
      mode: "0777"
globals:
  noprinting:
    options:
      "load printers": "no"
      "printing": "bsd"
      "printcap name": "/dev/null"
      "disable spoolss": "yes"
  domain_member:
    options:
      security: ads
      workgroup: SAMBAXP
      realm: SAMBAXP.CX.FDOPEN.NET
      "idmap config * : backend": "autorid"
      "idmap config * : range": "2000-9999999"
      "log level": "1"
domain_settings:
  addc1:
    realm: SAMBAXP.CX.FDOPEN.NET
    admin_password: Passw0rd
domain_groups:
  addc1:
    - name: test
    - name: demonstration
    - name: conference
domain_users:
  addc1:
    - name: "bwayne"
      password: 1115Rose.
      given_name: Bruce
      surname: Wayne
      member_of: ["test", "demonstration", "conference"]
    - name: "ckent"
      password: 1115Rose.
      given_name: Clark
      surname: Kent
      member_of: ["test", "demonstration", "conference"]
    - name: "foobar"
      password: 1115Rose.
      given_name: Foo
      surname: Barson
      member_of: ["test"]

Connect to the Debian test node and run:

# create the dir for the container configuration
sudo mkdir -p /var/lib/samba-container/etc
# proactively pull the container images
sudo docker pull quay.io/samba.org/samba-ad-server:latest
sudo docker pull quay.io/samba.org/samba-server:latest

# create a custom resolv.conf for the filerserver so it is guaranteed to find the AD DC
cat >fileserver-resolv.conf <<EOF
nameserver 192.168.122.45
search domain1.sink.test
EOF

# copy config files to their final locations
sudo cp demo2.yaml  /var/lib/samba-container/etc/demo2.yaml
sudo cp fileserver-resolv.conf  /var/lib/samba-container/etc/fileserver-resolv.conf

# prepare an ipvlan (with layer2 mode) for network isolation w/ public availability
sudo docker network create -d ipvlan --subnet=192.168.122.0/24 --gateway=192.168.122.1  -o ipvlan_mode=l2 -o parent=enp1s0  mv1

# run the compose file, starting the containers
cd compose
sudo docker-compose up

While docker-compose is bringing up the containers it will pause while the "must-join"
container is running. In another shell connect to the Debian node and run:

sudo docker exec -it compose_join_fs_1 samba-container join

This should prompt you for a password. Provide the admin password for the testdomain as defined in the YAML file above.

A few moments after the password is provided the docker-compose command should continue progressing and, if everything goes as planned, the AD DC will be running as well as an smbd with users from the domain.

Once the containers are running we can add the filer server's IP to the AD DC DNS so client can refer to it by a name.
On the Debian node, run:

sudo docker exec -it compose_dc_1 samba-tool dns add localhost -P sambaxp.cx.fdopen.net smbfs1 A 192.168.122.30

(There are other ways to accomplish this, but this demonstrates the use of samba-tool commands run manually within this system).

Try adding the AD DC server IP address as your DNS host, or if you have a more proper DNS configuration in your office/home/lab, delegate your domain to it in DNS and then join a Windows host to your domain and then access the share using Single-Sign-On!