ajout samba-ad-dc pour debian 12

samba-ad-dc/playbook.yml

@@ -0,0 +1,186 @@
+---
+- hosts: all
+  become: true
+
+  vars:
+    samba_dc_dns_domain: "ad.sio.lan"
+    samba_dc_hostname: "dc1.ad.sio.lan"
+    samba_dc_hostname_short: "dc1"
+    samba_dc_ip: "192.168.56.10"
+    samba_dc_net: "192.168.56.0/24"
+    samba_dc_realm: "AD.SIO.LAN"
+    samba_dc_workgroup: "AD"
+    samba_dc_domain: "AD"
+    samba_dc_admin_password: "Azerty1+"
+    samba_dc_dns_backend: "SAMBA_INTERNAL" # ou bien "BIND9_DLZ" 
+
+  pre_tasks:
+    - name: Set timezone to Europe/Paris
+      timezone:
+        name: Europe/Paris
+
+    - name: Update apt cache if needed.
+      apt:
+        update_cache: true
+        cache_valid_time: 3600
+  
+  tasks:
+    - name: Pre - set hostname {{ samba_dc_hostname }}
+      copy:
+        content: |
+          {{ samba_dc_hostname }}
+        dest: /etc/hostname
+
+    - name: Pre - set /etc/hosts
+      copy:
+        content: |
+          127.0.0.1 localhost
+          {{ samba_dc_ip }} {{ samba_dc_hostname }} {{ samba_dc_hostname_short }}
+        dest: /etc/hosts
+
+    - name: Pre - "Installe paquets de base"
+      ansible.builtin.apt:
+        state: present
+        name:
+          - acl
+          - git
+          - curl
+          - wget
+          - sudo
+          - unzip
+          - vim
+          - gnupg
+          - tmux
+          - dnsutils
+          - apt-transport-https
+          - chrony
+
+    - name: Samba - "Installe paquets Samba"
+      ansible.builtin.apt:
+        state: present
+        name:
+          - samba
+          - winbind
+          - libnss-winbind
+          - krb5-user
+          - smbclient
+          - ldb-tools
+          - python3-cryptography
+
+    - name: Samba - Configuration Kerberos
+      copy:
+        content: |
+          [libdefaults]
+            default_realm = {{ samba_dc_realm }}
+            dns_lookup_kdc = true
+            dns_lookup_realm = false
+        dest: /etc/krb5.conf
+
+    - name: Samba - Nettoie smb.conf
+      file:
+        path: "/etc/samba/smb.conf"
+        state: absent
+
+    - name: Samba - Configure DC
+      command: samba-tool domain provision --realm={{ samba_dc_realm }} --domain {{ samba_dc_domain }} --server-role=dc
+
+    - name: Samba - Mdp Administrator
+      command:  samba-tool user setpassword administrator --newpassword={{ samba_dc_admin_password }}
+
+    - name: Samba - Set dns forwarder .
+      lineinfile:
+        dest: "/etc/samba/smb.conf"
+        regexp: "dns forwarder =.*"
+        line: "dns forwarder = 9.9.9.9"
+        state: present
+
+    - name: Samba - set resolv.conf
+      copy:
+        content: |
+          search {{ samba_dc_dns_domain }}
+          nameserver 127.0.0.1
+        dest: /etc/resolv.conf
+
+    - name: Samba - rm krb5.conf dans samba
+      file:
+        path: /var/lib/samba/private/krb5.conf
+        state: absent
+
+    - name: Samba - ln krb5.conf de samba vers standard
+      file:
+        src: /etc/krb5.conf
+        dest: /var/lib/samba/private/krb5.conf
+        force: true
+        state: link
+
+    - name: SAmba - unmask and enable samba-ad-dc
+      ansible.builtin.systemd:
+        name: samba-ad-dc
+        masked: false
+        enabled: true
+
+    - name: Samba - mask samba
+      ansible.builtin.systemd:
+        name: samba
+        masked: true
+        enabled: false
+
+    - name: Samba - mask winbind
+      ansible.builtin.systemd:
+        name: winbind
+        masked: true
+        enabled: false
+
+    - name: Samba - mask smbd
+      ansible.builtin.systemd:
+        name: smbd
+        masked: true
+        enabled: false
+
+    - name: Samba - mask nmbd
+      ansible.builtin.systemd:
+        name: nmbd
+        masked: true
+        enabled: false
+
+    - name: Samba - reboot
+      reboot:
+
+    - name: Samba - set resolv.conf
+      copy:
+        content: |
+          search {{ samba_dc_dns_domain }}
+          nameserver 127.0.0.1
+        dest: /etc/resolv.conf
+
+
+    - name: Samba - Test smbclient
+      command: smbclient -L localhost -N
+
+    - name: SAmba - test DNS SRV _ldap sur TCP 
+      command: host -t SRV _ldap._tcp.{{ samba_dc_dns_domain }}
+
+    - name: Samba - test DNS SRV _kerberos sur UDP
+      command: host -t SRV _kerberos._udp.{{ samba_dc_dns_domain }}
+
+    - name: Samba - test DNS A pour dc
+      command:  host -t A {{ samba_dc_hostname }}
+  
+    - name: Chrony - configuration 
+      ansible.builtin.blockinfile:
+        path: /etc/chrony/chrony.conf
+        block: |
+          bindcmdaddress {{ samba_dc_ip }}
+
+          # The source, where we are receiving the time from
+          server 0.pool.ntp.org     iburst
+          server 1.pool.ntp.org     iburst
+          server 2.pool.ntp.org     iburst
+
+          allow {{ samba_dc_net }}
+     
+    - name: Chrony - redemarrage
+      service:
+        name: chrony
+        state: restarted
+