Chapter 7. Integrating Red Hat Gluster Storage with Windows Active Directory
Chapter 7. Integrating Red Hat Gluster Storage with Windows Active Directory In this chapter, the tasks necessary for integrating Red Hat Gluster Storage nodes into an existing Windows Active Directory domain are described. The following diagram describes the architecture of integrating Red Hat Gluster Storage with Windows Active Directory. Figure 7.1. Active Directory Integration This section assumes that you have an active directory domain installed. Before we go ahead with the configuration details, following is a list of data along with examples that will be used in the sections ahead. Table 7.1. Active Directory Integration information Information Example Value DNS domain name / realm addom.example.com NetBIOS domain name ADDOM Name of administrative account administrator Red Hat Gluster Storage nodes rhs-srv1.addom.example.com, 192.168.56.10 rhs-srv2.addom.example.com, 192.168.56.11 rhs-srv3.addom.example.com, 192.168.56.12 Netbios name of the cluster RHS-SMB 7.1. Prerequisites Before integration, the following steps have to be completed on an existing Red Hat Gluster Storage environment: Name Resolution The Red Hat Gluster Storage nodes must be able to resolve names from the AD domain via DNS. To verify the same you can use the following command: where, addom.example.com is the AD domain and dc1 is the name of a domain controller. For example, the /etc/resolv.conf file in a static network configuration could look like this: This example assumes that both the domain controllers are also the DNS servers of the domain. Kerberos Packages If you want to use the kerberos client utilities, like kinit and klist, then manually install the krb5-workstation using the following command: Synchronize Time Service It is essential that the time service on each Red Hat Gluster Storage node and the Windows Active Directory server are synchronized, else the Kerberos authentication may fail due to clock skew. In environments where time services are not reliable, the best practice is to configure the Red Hat Gluster Storage nodes to synchronize time from the Windows Server. On each Red Hat Storage node, edit the file /etc/ntp.conf for RHEL 7 or /etc/chrony.conf for RHEL 8 so the time is synchronized from a known, reliable time service: Activate the change on each Red Hat Gluster Storage node by stopping the NTP or chrony daemon, updating the time, then starting the chrony daemon. Verify the change on both servers using the following commands: For RHEL 7 and RHEL 8, run: For RHEL 6, run: For more information on using chrony with RHEL 8, see https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_basic_system_settings/using-chrony-to-configure-ntp Samba Packages Ensure to install the following Samba packages along with its dependencies: CTDB samba samba-client samba-winbind samba-winbind-modules
host dc1.addom.example.com domain addom.example.com search addom.example.com nameserver 10.11.12.1 # dc1.addom.example.com nameserver 10.11.12.2 # dc2.addom.example.com yum -y install krb5-workstation Enable writing of statistics records. #statistics clockstats cryptostats loopstats peerstats server 0.rhel.pool.ntp.org iburst server 1.rhel.pool.ntp.org iburst driftfile /var/lib/chrony/drift makestep 1.0 3 rtcsync logdir /var/log/chrony systemctl stop ntpd systemctl start ntpd systemctl stop chrony systemctl start chrony service ntpd stop service ntpd start service chrony stop service chrony stop