4.2.3.1. Установка Avanpost DS на контроллер домена Astra 1.7 и 2.12 из архива .tar

sudo apt update

sudo hostnamectl set-hostname [FQDN]
sudo sed -i "1i 127.0.0.1 [FQDN]" /etc/hosts

sudo hostnamectl set-hostname ds01.avanpost.local
sudo sed -i "1i 127.0.0.1 ds01.avanpost.local" /etc/hosts

sudo nano /etc/hosts

127.0.0.1 ds01.avanpost.local #127.0.0.1 [FQDN] 
127.0.0.1 localhost 
[::1] ds01.avanpost.local

sudo apt install openssl nginx xmlsec1 libxmlsec1-openssl dnsutils ssh sssd libsss-sudo krb5-user libsasl2-modules-gssapi-heimdal acl

sudo nano /etc/apt/sources.list.d/debian.list

deb  https://mirror.yandex.ru/debian/ bullseye main contrib non-free
deb-src  https://mirror.yandex.ru/debian/ bullseye main contrib non-free

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 605C66F00D6C9793
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 6ED0E7B82643E131
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 0E98404D386FA1D9

sudo nano /etc/apt/sources.list

# Astra Linux repository description https://wiki.astralinux.ru/x/0oLiC

#deb cdrom:[OS Astra Linux 1.7.5 1.7_x86-64 DVD ]/ 1.7_x86-64 contrib main non-free
#deb https://download.astralinux.ru/astra/stable/1.7_x86-64/repository-main/ 1.7_x86-64 main contrib non-free
#deb https://download.astralinux.ru/astra/stable/1.7_x86-64/repository-update/ 1.7_x86-64 main contrib non-free

#deb https://download.astralinux.ru/astra/stable/1.7_x86-64/repository-base/ 1.7_x86-64 main contrib non-free
#deb https://download.astralinux.ru/astra/stable/1.7_x86-64/repository-extended/ 1.7_x86-64 main contrib non-free
#deb https://download.astralinux.ru/astra/stable/1.7_x86-64/uu/last/repository-update/ 1.7_x86-64 main contrib non-free

sudo rm -rf /var/lib/apt/lists/*

sudo apt update

sudo apt install pdns-server pdns-backend-ldap pdns-recursor

useradd -d /opt/avanpost -s /sbin/nologin ads

sudo mkdir -p /opt/avanpost/ads
sudo mkdir -p /opt/avanpost/tools

sudo tar -xvzf /tmp/Avanpost.DS.Server.Linux.v*.tar.gz -C /opt/avanpost/ads
sudo tar -xvzf /tmp/Avanpost.DS.Server.Linux.Tools.v*.tar.gz -C /opt/avanpost/tools

sudo nano /opt/avanpost/ads/config/config.yaml

baseDN: dc=[Домен2ур],dc=[Домен1ур]#имя корня домена в формате DN
host_ip_addr: [IP-АДРЕС] #адрес контроллера домена
host_name_fqdn: [FQDN] #полное доменное имя (FQDN) контроллера домена
 
# ldaps:
#   cert: #сертификат для использования сервером ldaps
#   key: #ключ сертификата для использования сервером ldaps

repl:
  single_host: true #для первого контроллера в домене устанавливается "true", для всех последующих - "false"

baseDN: dc=avanpost,dc=local #имя корня домена в формате DN
host_ip_addr: 192.168.1.11 #адрес контроллера домена
host_name_fqdn: ds01.avanpost.local #полное доменное имя (FQDN) контроллера домена
 
# ldaps:
#   cert: #сертификат для использования сервером ldaps
#   key: #ключ сертификата для использования сервером ldaps

repl:
  single_host: true #для первого контроллера в домене устанавливается "true", для всех последующих - "false"

sudo nano /etc/systemd/system/ads.service

[Unit]
Description=Avanpost Directory Service
  
[Service]
WorkingDirectory=/opt/avanpost/ads
ExecStartPre=+/usr/sbin/setcap CAP_NET_BIND_SERVICE=+eip /opt/avanpost/ads/cmd/ads/ads
ExecStart=/opt/avanpost/ads/cmd/ads/ads
Restart=always
RestartSec=10
SyslogIdentifier=ads
User=ads
Environment="CONFIG=/opt/avanpost/ads/config/config.yaml"
  
[Install]
WantedBy=multi-user.target

sudo chown -R ads:ads /opt/avanpost

sudo setcap CAP_NET_BIND_SERVICE=+eip /opt/avanpost/ads/cmd/ads/ads

sudo systemctl daemon-reload
sudo systemctl enable --now ads

sudo systemctl status ads

[root@ds02 ~]# sudo systemctl status ads
● ads.service - Avanpost Directory Service
Loaded: loaded (/etc/systemd/system/ads.service; enabled; preset: disabled)
Active: active (running) since Wed 2025-01-29 11:03:58 MSK; 3s ago
Main PID: 10627 (ads)
Tasks: 6 (limit: 10673)
Memory: 47.8M
CPU: 252ms
CGroup: /system.slice/ads.service
└─10627 /opt/avanpost/ads/cmd/ads/ads

Jan 29 11:03:58 ds02.avanpost.local ads[10627]: 2025/01/29 11:03:58 License manager: Found 1 users, 19 objects
Jan 29 11:03:58 ds02.avanpost.local ads[10627]: 2025/01/29 11:03:58 start KDC UDP listening: [::]:88
Jan 29 11:03:58 ds02.avanpost.local ads[10627]: 2025/01/29 11:03:58 start KDC TCP listening: [::]:88
Jan 29 11:03:58 ds02.avanpost.local ads[10627]: 2025/01/29 11:03:58 start chpw UDP listening: [::]:464
Jan 29 11:03:58 ds02.avanpost.local ads[10627]: 2025/01/29 11:03:58 start chpw TCP listening: [::]:464
Jan 29 11:03:58 ds02.avanpost.local ads[10627]: 2025/01/29 11:03:58 Listening LDAP on 0.0.0.0:389
Jan 29 11:03:58 ds02.avanpost.local ads[10627]: 2025/01/29 11:03:58 Http listening on 0.0.0.0:4008
Jan 29 11:03:58 ds02.avanpost.local ads[10627]: 2025/01/29 11:03:58 Listening LDAP on 0.0.0.0:636
Jan 29 11:03:58 ds02.avanpost.local ads[10627]: 2025/01/29 11:03:58 Listening DSCliServer on 0.0.0.0:7890
Jan 29 11:03:58 ds02.avanpost.local ads[10627]: 2025/01/29 11:03:58 Client listening on 0.0.0.0:8080

/opt/avanpost/tools/cli/cli add-instance --host [IP2] --name [FQDN2] --endpoint [IP1]:48910 --user [ADMIN_USER] --password [ADMIN_PASSWORD]

/opt/avanpost/tools/cli/cli add-instance --host 192.168.1.12 --name ds02.avanpost.local --endpoint 192.168.1.11:48910 --user Administrator --password Avanp0st

sudo nano /etc/nginx/conf.d/ads.conf

server {
    listen        80;
    server_name   [FQDN];
    location / {
        proxy_pass       http://127.0.0.1:8080;
        proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

server {
    listen        80;
    server_name   ds01.avanpost.local;
    location / {
        proxy_pass       http://127.0.0.1:8080;
        proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

sudo nginx -t
# nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
# nginx: configuration file /etc/nginx/nginx.conf test is successful

sudo systemctl --now enable nginx
sudo systemctl status nginx

sudo systemctl stop pdns
sudo systemctl stop pdns-recursor

sudo nano /opt/avanpost/ads/config/config.yaml

service_control:
  dns_control: true

sudo visudo /etc/sudoers.d/ads

ads ALL=(ALL) NOPASSWD: /usr/bin/systemctl start ads.service
ads ALL=(ALL) NOPASSWD: /usr/bin/systemctl start pdns.service
ads ALL=(ALL) NOPASSWD: /usr/bin/systemctl start pdns-recursor.service
ads ALL=(ALL) NOPASSWD: /usr/bin/systemctl stop ads.service
ads ALL=(ALL) NOPASSWD: /usr/bin/systemctl stop pdns.service
ads ALL=(ALL) NOPASSWD: /usr/bin/systemctl stop pdns-recursor.service
ads ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart ads.service
ads ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart pdns.service
ads ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart pdns-recursor.service
ads ALL=(ALL) NOPASSWD: /opt/avanpost/tools/dscli/dscli joindc *

sudo visudo -c

#/etc/sudoers: parsed OK
#/etc/sudoers.d/ads: parsed OK

sudo mv /etc/krb5.conf /etc/krb5.conf.old

sudo nano /etc/krb5.conf

[libdefaults]
  default_realm = [ДОМЕН2УР].[ДОМЕН1УР]
  dns_lookup_realm = false
  dns_lookup_kdc = false
  dns_canonicalize_hostname = true

[realms]
  [ДОМЕН2УР].[ДОМЕН1УР] = {
    kdc = 127.0.0.1
    default_domain = [Домен2ур].[Домен1ур]
  }

[domain_realm]
  .[Домен2ур].[Домен1ур] = [ДОМЕН2УР].[ДОМЕН1УР]
  [Домен2ур].[Домен1ур] = [ДОМЕН2УР].[ДОМЕН1УР]

[libdefaults]
  default_realm = AVANPOST.LOCAL
  dns_lookup_realm = false
  dns_lookup_kdc = false
  dns_canonicalize_hostname = true

[realms]
  AVANPOST.LOCAL = {
    kdc = 127.0.0.1
    default_domain = avanpost.local
  }

[domain_realm]
  .avanpost.local = AVANPOST.LOCAL
  avanpost.local = AVANPOST.LOCAL

sudo setfacl -R -m u:ads:rwx /etc/powerdns
sudo mkdir -p /var/lib/pdns
sudo chown pdns:pdns /var/lib/pdns

sudo systemctl enable --now pdns
sudo systemctl enable --now pdns-recursor

sudo systemctl restart ads.service

dig srv _ldap._tcp.[Домен2ур].[Домен1ур]

dig srv _ldap._tcp.avanpost.local

dig srv _ldap._tcp.avanpost.local
;; ANSWER SECTION:
_ldap._tcp.avanpost.local. 1500    IN      SRV     0 0 389 ds01.avanpost.local.
_ldap._tcp.avanpost.local. 1500    IN      SRV     0 0 389 ds02.avanpost.local.

dig -x [IP PDNS сервера]

dig -x 192.168.1.11