Manual to Create ZFS with SMB Share with Samba, Shadow-Copy and Active Directory

manual_zfs-smb-ad.md

Manual to Install Samba AD ZFS

Important

• Only tested on the following systems:
  • Ubuntu 24.04
  • Debian Trixie

Install some Packages

On Ubuntu

# Disable system-resolved ports
sudo sh -c 'mkdir -p /etc/systemd/resolved.conf.d && printf "[Resolve]\nDNSStubListener=no\n" | tee /etc/systemd/resolved.conf.d/no-stub.conf'
sudo sh -c 'rm -f /etc/resolv.conf && ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf'
systemctl restart systemd-resolved

# Install Packages
apt install \
  samba winbind libpam-winbind libnss-winbind krb5-config samba-vfs-modules \
  zfsutils-linux zfs-auto-snapshot

On Debian

Source: https://wiki.debian.org/ZFS

# Add Backports lists
codename=$(lsb_release -cs);echo "deb http://deb.debian.org/debian $codename-backports main contrib non-free"|tee -a /etc/apt/sources.list.d/debian-backports.list
apt update

# Install ZFS Package
apt install linux-headers-amd64
apt install -t stable-backports zfsutils-linux

# Install Packages
apt install \
  samba winbind libpam-winbind libnss-winbind krb5-config samba-vfs-modules \
  zfs-auto-snapshot

Create zpool

Get Disk

fdisk -l

Create part-table

printf "o\nn\np\n1\n\n\nw\n" | fdisk /dev/sda

Get Disk IDs

ls -lha /dev/disk/by-id/

Create pool

## as mirror with 2 disks
# zpool create files mirror /dev/disk/by-id/[ID1] /dev/disk/by-id/[ID2]
## as strip with 2 disks
# zpool create files /dev/disk/by-id/[ID1] /dev/disk/by-id/[ID2]
zpool create files /dev/disk/by-id/ata-VBOX_HARDDISK_VB398dd1e3-efbda4d6

Create Datasets

zfs create -o nbmand=on files/office
zfs create -o nbmand=on files/dev
zfs create -o nbmand=on files/prod
zfs create -o nbmand=on files/home

Setup Samba

Source: https://www.kalinin.dev/posts/debian-smb-file-shares/

Open conf with nano

nano /etc/samba/smb.conf

Change or add the following content

[global]
   workgroup = testdom
   password server = srv-dc.testdom.internal
   realm = testdom.internal
   security = ads
   idmap config * : range = 16777216-33554431
   template homedir = /home/%D/%U
   template shell = /bin/bash
   winbind use default domain = true
   winbind offline logon = false

Open nsswitch.conf with nano

nano /etc/nsswitch.conf

Change or add the following content

The next step is to modify the name service config file (/etc/nsswitch.conf) to use winbind for authentication checking. The main things to change here are the lines for passwd, group, and shadow. These lines should say files winbind sss. Below is an example of what my configuration file looked like after the changes.

# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         files winbind sss
group:          files winbind sss
shadow:         files winbind sss
gshadow:        files 

hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

Join Domain

Source: https://www.kalinin.dev/posts/debian-smb-file-shares/

Configure hosts file

# Change IP, FQDN and Hostname to your use case
echo "192.168.0.21  srv-data.testdom.internal  srv-data" >> /etc/hosts
echo "192.168.0.31  srv-dc.testdom.internal    srv-dc"   >> /etc/hosts
sed -i '/^127\.0\.1\.1\s\+/d' /etc/hosts

Use the Command

net ads join -U Administrator

If see a dns update error, use the following command:

net ads join -U Administrator --no-dns-updates

Restart Services

systemctl restart winbind smbd nmbd

Create Shares

Change umask and groups

bash -c "chmod -R 0770 /files/{office,dev,prod,home}"
bash -c "chgrp -R 'domain users' /files/{office,dev,prod,home}"

Setup ZFS Auto Snapshot

Source: https://blog.grufo.com/2022/12/01/zfs-snapshots-und-samba-shadow-copy/

Remove default cron settings for ZFS Auto Snapshot

rm /etc/cron*/zfs-auto-snapshot

Add Cron Entrys

cat > /etc/cron.d/zfs-auto-snapshot <<EOF
*/5 * * * * root /usr/local/sbin/zfs-auto-snapshot -q -g -p zfsautosnap --label=frequent --keep=24 //
00 * * * *  root /usr/local/sbin/zfs-auto-snapshot -q -g -p zfsautosnap --label=hourly   --keep=24 //
00 4 * * *  root /usr/local/sbin/zfs-auto-snapshot -q -g -p zfsautosnap --label=daily    --keep=14 //
00 4 * * 0  root /usr/local/sbin/zfs-auto-snapshot -q -g -p zfsautosnap --label=weekly   --keep=4  //
00 4 1 * *  root /usr/local/sbin/zfs-auto-snapshot -q -g -p zfsautosnap --label=monthly  --keep=18 //
EOF

Setup ZFS Auto Snapshot script

cp -a /usr/sbin/zfs-auto-snapshot /usr/local/sbin/zfs-auto-snapshot
sed -i "s/^opt_sep=.*$/opt_sep=''/g" /usr/local/sbin/zfs-auto-snapshot
sed -i 's/^DATE=.*$/DATE=$(date +%Y%m%d%H%M%S)/g' /usr/local/sbin/zfs-auto-snapshot
sed -i 's/^SNAPNAME=.*$/SNAPNAME="$opt_prefix${opt_label:+$opt_sep$opt_label}_$DATE"/g' /usr/local/sbin/zfs-auto-snapshot

Open conf with nano

nano /etc/samba/smb.conf

Change or add the following content

[global]
#...
   vfs objects = shadow_copy2
   shadow:snapdir = .zfs/snapshot
   shadow:sort = desc
   shadow:format = _%Y%m%d%H%M%S
   shadow:snapprefix = ^zfsautosnap\(daily\)\{0,1\}\(hourly\)\{0,1\}\(frequent\)\{0,1\}\(monthly\)\{0,1\}\(weekly\)\{0,1\}
   shadow:delimiter = _
   shadow:localtime = no

Add Shares to smb.conf

Open conf with nano

nano /etc/samba/smb.conf

Change or add the following content

Once the folder is created and permissions set, we just need to add an entry to /etc/samba/smb.conf so that it is shared. The config section to add will look like the following:

[prod]
    comment = Produktion
    path = /files/prod
    valid users = "@TESTDOM\Domain Users"
    force group = "domain users"
    writable = yes
    read only = no
    force create mode = 0660
    create mask = 0777
    directory mask = 0777    
    force directory mode = 0770
    access based share enum = yes
    hide unreadable = yes

[home]
    comment = Homeverzeichnis
    path = /files/home/%U
    valid users = "@TESTDOM\Domain Users"
    force group = "domain users"
    writable = yes
    read only = no
    force create mode = 0660
    create mask = 0777
    directory mask = 0777
    force directory mode = 0770
    access based share enum = yes
    hide unreadable = yes

Restart Service

systemctl restart smbd

Add Re-set umask Cron Entry

cat > /usr/local/bin/re-set-umask-for-smb-shares <<EOF
#!/bin/bash
bash -c "chmod -R 0770           /files/{office,dev,prod,home}"
bash -c "chgrp -R 'domain users' /files/{office,dev,prod,home}"
EOF
chmod +x /usr/local/bin/re-set-umask-for-smb-shares

cat > /etc/cron.d/re-set-umask-for-smb-shares <<EOF
@reboot     root /usr/local/bin/re-set-umask-for-smb-shares
*/1 * * * * root /usr/local/bin/re-set-umask-for-smb-shares
EOF

Recent Infos

https://wiki.debian.org/ZFS

https://ubuntu.com/tutorials/setup-zfs-storage-pool#3-creating-a-zfs-pool

https://docs.oracle.com/en/operating-systems/solaris/oracle-solaris/11.4/manage-smb/how-create-smb-share-zfs.html

https://gist.github.com/meetnick/fb5587d25d4174d7adbc8a1ded642d3c

https://www.kalinin.dev/posts/debian-smb-file-shares/

https://wiki.samba.org/index.php/Configuring_Logging_on_a_Samba_Server#Setting_a_Universal_Log_Level

https://blog.grufo.com/2022/12/01/zfs-snapshots-und-samba-shadow-copy/

https://docs.oracle.com/cd/E19253-01/820-2313/gbiqe/index.html

https://medium.com/@Dylan.Wang/how-to-use-zfs-zfs-auto-snapshot-package-samba-to-support-windows-shadow-copy-on-ubuntu-18-04-15001c9580fc