Từ Windows Active Directory sang hạ tầng Linux

# Ubuntu 24.04 — thêm repo ISC Kea rồi cài dhcp4
curl -1sLf 'https://dl.cloudsmith.io/public/isc/kea-3-2/setup.deb.sh' | sudo -E bash
sudo apt install -y isc-kea-dhcp4-server

# RHEL/Rocky 9
# curl -1sLf 'https://dl.cloudsmith.io/public/isc/kea-3-2/setup.rpm.sh' | sudo -E bash
# sudo dnf install -y isc-kea-dhcp4

{
  "Dhcp4": {
    "interfaces-config": { "interfaces": [ "eth0" ] },
    "lease-database": {
      "type": "memfile", "persist": true,
      "name": "/var/lib/kea/dhcp4.leases"
    },
    "valid-lifetime": 28800,
    "renew-timer": 14400,
    "rebind-timer": 21600,
    "option-data": [
      { "name": "domain-name-servers", "data": "192.168.1.10, 192.168.1.11" },
      { "name": "domain-name",         "data": "company.local" },
      { "name": "routers",             "data": "192.168.1.254" }
    ],
    "subnet4": [
      {
        "id": 1,
        "subnet": "192.168.1.0/24",
        "pools": [ { "pool": "192.168.1.100 - 192.168.1.200" } ],
        "reservations": [
          {
            "hw-address": "aa:bb:cc:dd:ee:ff",
            "ip-address": "192.168.1.50",
            "hostname": "printer.company.local"
          }
        ]
      }
    ],
    "loggers": [
      { "name": "kea-dhcp4",
        "output-options": [ { "output": "/var/log/kea/kea-dhcp4.log" } ],
        "severity": "INFO" }
    ]
  }
}

# Kiểm tra cú pháp config trước
sudo kea-dhcp4 -t /etc/kea/kea-dhcp4.conf

sudo systemctl enable --now isc-kea-dhcp4-server
sudo systemctl status isc-kea-dhcp4-server
journalctl -u isc-kea-dhcp4-server -f     # theo dõi cấp lease

# Cài đặt
sudo apt install -y bind9 bind9-utils      # RHEL: dnf install bind bind-utils

acl trusted_clients { localhost; 192.168.1.0/24; };

options {
    directory "/var/cache/bind";
    listen-on port 53 { any; };
    allow-query     { trusted_clients; };
    allow-recursion { trusted_clients; };
    recursion yes;
    forwarders { 8.8.8.8; 8.8.4.4; };
    forward first;
    dnssec-validation auto;
};

zone "company.local" IN {
    type primary;
    file "/etc/bind/zones/db.company.local";
    allow-update { none; };
};

zone "1.168.192.in-addr.arpa" IN {
    type primary;
    file "/etc/bind/zones/db.1.168.192";
    allow-update { none; };
};

$TTL 3600
@   IN  SOA ns1.company.local. admin.company.local. (
        2026070701 ; serial (YYYYMMDDnn — tăng mỗi lần sửa)
        12h 15m 4d 2h )
    IN  NS  ns1.company.local.
ns1 IN  A   192.168.1.10
dc1 IN  A   192.168.1.5
www IN  A   192.168.1.20

# /etc/bind/zones/db.1.168.192 (PTR)
# 5   IN PTR dc1.company.local.
# 20  IN PTR www.company.local.

# Validate cú pháp + zone
sudo named-checkconf
sudo named-checkzone company.local /etc/bind/zones/db.company.local
sudo systemctl restart bind9        # RHEL: named

# Test
dig @localhost www.company.local +short
dig @localhost -x 192.168.1.20 +short

sudo apt install -y realmd samba samba-common-bin samba-dsdb-modules \
  samba-vfs-modules winbind krb5-user

sudo hostnamectl hostname fileserver.company.local

# Join làm MEMBER (winbind), không phải DC
sudo realm join -v --membership-software=samba --client-software=winbind \
  company.local -U Administrator

sudo systemctl enable --now winbind smbd nmbd

[global]
   workgroup = COMPANY
   security = ads
   realm = COMPANY.LOCAL
   kerberos method = secrets and keytab
   winbind use default domain = no
   idmap config * : backend = tdb
   idmap config * : range = 10000-999999
   idmap config COMPANY : backend = rid
   idmap config COMPANY : range = 2000000-2999999
   template shell = /bin/bash
   usershare max shares = 0          # CẤM user tự tạo share (xem V.9)

[data]
   path = /srv/data
   read only = no
   valid users = +"COMPANY\Finance Team"   # nhóm AD dùng dấu '+'
   vfs objects = acl_xattr recycle
   acl_xattr:ignore system acls = yes

sudo apt install -y cups
sudo systemctl enable --now cups

# Bật quản trị từ xa + chia sẻ máy in
sudo cupsctl --remote-admin --share-printers

# Thêm máy in mạng (driverless IPP)
sudo lpadmin -p HP_M404 -E -v ipp://192.168.1.50/ipp/print -m everywhere -o media=A4
sudo lpadmin -d HP_M404          # đặt làm mặc định
lpstat -p -v                     # kiểm tra
sudo ufw allow 631/tcp           # Web UI: http://<server>:631

[global]
   printing = cups
   printcap name = cups
   load printers = yes

[printers]
   path = /var/spool/samba
   printable = yes
   browsable = yes
   guest ok = no

sudo apt install -y freeradius freeradius-utils samba winbind
sudo realm join company.local -U Administrator     # nếu chưa join

# /etc/freeradius/3/mods-available/mschap — trỏ ntlm_auth về winbind
mschap {
    use_mppe = yes
    require_encryption = yes
    ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 \
      --username=%{mschap:User-Name} --domain=COMPANY \
      --challenge=%{mschap:Challenge:-00} \
      --nt-response=%{mschap:NT-Response:-00}"
}

# /etc/freeradius/3/mods-available/eap — chọn PEAP → inner MSCHAPv2
eap { default_eap_type = peap
      peap { default_eap_type = mschapv2
             virtual_server = inner-tunnel } }