Migration Script from Winbind to SSSD

#!/bin/bash

echo Disable winbind

authconfig --disablewinbindauth  --disablewinbind --disablekrb5 --updateall

service winbind stop

chkconfig winbind off

echo Setup Kerberos

rm -f /etc/krb5.conf 

cat > /etc/krb5.conf << "EOF"

[logging]

 default = FILE:/var/log/krb5libs.log

 kdc = FILE:/var/log/krb5kdc.log

 admin_server = FILE:/var/log/kadmind.log

[libdefaults]

 default_realm = EXAMPLE.COM

 dns_lookup_realm = true

 dns_lookup_kdc = true

 ticket_lifetime = 24h

 renew_lifetime = 7d

 forwardable = true

[realms]

 EXAMPLE.COM = {

  kdc = ad.example.com

  admin_server = ad.example.com

 }

[domain_realm]

 example.com = EXAMPLE.COM

 .example.com= EXAMPLE.COM

EOF

echo Samba Setup

rm -f /etc/samba/smb.conf 

cat > /etc/samba/smb.conf << "EOF"

[global]

        workgroup = EXAMPLE

        server string = Samba Server Version %v

# Max Log Size let you specify the max size log files should reach

        # logs split per machine

        log file = /var/log/samba/log.%m

        # max 50KB per log file, then rotate

        max log size = 50

# ----------------------- Standalone Server Options ------------------------

        security = ads

        passdb backend = tdbsam

        client signing = yes

        client use spnego =yes

        kerberos method = secrets and keytab

        realm = example.com

        server role = member server

EOF

echo Setup sudoers 

echo '%domain\ admins    ALL=(ALL)   ALL' >> /etc/sudoers

echo Pam Setup

rm -f /etc/pam.d/system-auth-ac

cat > /etc/pam.d/system-auth-ac << 'EOF'

#%PAM-1.0

# This file is auto-generated.

# User changes will be destroyed the next time authconfig is run.

auth        required      pam_env.so

auth        sufficient    pam_unix.so nullok try_first_pass

auth        requisite     pam_succeed_if.so uid >= 500 quiet

auth        sufficient    pam_sss.so use_first_pass

auth        required      pam_deny.so

account     required      pam_unix.so

account     sufficient    pam_localuser.so

account     sufficient    pam_succeed_if.so uid < 500 quiet

account     [default=bad success=ok user_unknown=ignore] pam_sss.so

account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=

password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok

password    sufficient    pam_sss.so use_authtok

password    required      pam_deny.so

session     optional      pam_keyinit.so revoke

session     required      pam_limits.so

session     optional      pam_oddjob_mkhomedir.so umask=0077

session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid

session     required      pam_unix.so

session     optional      pam_sss.so

EOF

rm -f /etc/pam.d/password-auth-ac

cp /etc/pam.d/system-auth-ac /etc/pam.d/password-auth-ac

chmod 644 /etc/pam.d/password-auth-ac

chmod 644 /etc/pam.d/system-auth-ac

echo Installing SSSD Packages

yum install sssd -y

authconfig --enablesssdauth --enablesssd --enablemkhomedir --updateall

echo Enable services

chkconfig oddjobd on

chkconfig sssd on

chmod 715 /home/example.com

echo setup ntpd

yum install ntpd -y
cat > /etc/ntp.conf <<"EOF"
# For more information about this file, see the man pages
# ntp.conf(5), ntp_acc(5), ntp_auth(5), ntp_clock(5), ntp_misc(5), ntp_mon(5).

driftfile /var/lib/ntp/drift

# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
restrict default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery

# Permit all access over the loopback interface.  This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
restrict 127.0.0.1
restrict -6 ::1

# Hosts on local network are less restricted.
#restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap

# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
server time01.example.com
server time02.example.com

#broadcast 192.168.1.255 autokey        # broadcast server
#broadcastclient                        # broadcast client
#broadcast 224.0.1.1 autokey            # multicast server
#multicastclient 224.0.1.1              # multicast client
#manycastserver 239.255.254.254         # manycast server
#manycastclient 239.255.254.254 autokey # manycast client

# Enable public key cryptography.
#crypto

includefile /etc/ntp/crypto/pw

# Key file containing the keys and key identifiers used when operating
# with symmetric key cryptography.
keys /etc/ntp/keys

# Specify the key identifiers which are trusted.
#trustedkey 4 8 42

# Specify the key identifier to use with the ntpdc utility.
#requestkey 8

# Specify the key identifier to use with the ntpq utility.
#controlkey 8

# Enable writing of statistics records.
#statistics clockstats cryptostats loopstats peerstats
EOF

service ntpd start

service ntpd stop

date

sleep5

ntpdate -s 172.25.176.37

service ntpd start

date

sleep 5

chkconfig ntpd on

echo Join to the Domain 

net ads join example.com -U Administrator%Password

echo SSD Configuration

cat > /etc/sssd/sssd.conf << 'EOF'

[sssd]

config_file_version = 2

debug_level = 0

domains = example.com

services = nss, pam, ssh, sudo

override_homedir = /home/%d/%u

default_shell = /bin/bash

[domain/example.com]

id_provider = ad

auth_provider = ad

access_provider = ad

chpass_provider = ad

#Permits offline logins:

#cache_credentials = true

# Use when service discovery not working:

ad_server = ad.example.com

# Enables use of POSIX UIDs and GIDs:

ldap_id_mapping = true

override_homedir = /home/%d/%u

default_shell = /bin/bash

[ssh]

id_provider = ad

auth_provider = ad

access_provider = ad

chpass_provider = ad

ad_server = ad.example.com

ldap_id_mapping = true

override_homedir = /home/%d/%u

default_shell = /bin/bash

[sudo]

id_provider = ad

auth_provider = ad

access_provider = ad

chpass_provider = ad

ad_server = ad.example.com

ldap_id_mapping = true

override_homedir = /home/%d/%u

default_shell = /bin/bash

ldap_id_mapping = true

EOF

chmod 600 /etc/sssd/sssd.conf

service sssd start

echo Make sure the NTP always sync after reboot

rm -f /etc/rc.d/rc.local

cat > /etc/rc.d/rc.local << 'EOF'

#!/bin/bash

touch /var/lock/subsys/local

service ntpd stop

ntpdate -s 172.25.176.37

service ntpd start

EOF

chmod 755 /etc/rc.d/rc.local