• 1 Preface
  • 2 About the Author
  • 3 Introduction
    • 3.1 What’s the difference between Group Policy and a Group Policy Object?
    • 3.2 Server Side Extensions
      • 3.2.1 Enabling Group Policy Server Side Extensions on the Server
    • 3.3 Client Side Extensions
      • 3.3.1 Enabling Group Policy Client Side Extensions on the Linux Client
      • 3.3.2 Resultant Set of Policy
    • 3.4 Policies Introduced in this Book
      • 3.4.1 smb.conf Policies
      • 3.4.2 Password and Kerberos Policies
      • 3.4.3 Script Policies
      • 3.4.4 Startup Script Policies
      • 3.4.5 Files Policy
      • 3.4.6 Symlink Policies
      • 3.4.7 Sudoers Policies
      • 3.4.8 Message Policies
      • 3.4.9 PAM Access Policies
      • 3.4.10 Certificate Auto Enrollment
      • 3.4.11 Firefox Policy
      • 3.4.12 Chromium/Chrome Policy
      • 3.4.13 GNOME Settings
      • 3.4.14 OpenSSH Policy
      • 3.4.15 Firewalld Policy
  • 4 Managing Group Policies
    • 4.1 Opening a Group Policy Object in the Group Policy Management Console
    • 4.2 Creating a Group Policy Object
      • 4.2.1 samba-tool
      • 4.2.2 GPMC
    • 4.3 Deleting a Group Policy Object
      • 4.3.1 samba-tool
      • 4.3.2 GPMC
    • 4.4 Listing a Group Policy
    • 4.5 Modifying a Group Policy
  • 5 smb.conf Policies
    • 5.1 Server Side Extension
      • 5.1.1 Managing smb.conf Policies via the GPME
      • 5.1.2 Managing smb.conf Policies via samba-tool
    • 5.2 Client Side Extension
  • 6 Password and Kerberos Policies
    • 6.1 Server Side Extension
      • 6.1.1 Managing Password and Kerberos Policies via the GPME
      • 6.1.2 Managing Password and Kerberos Policies via samba-tool
    • 6.2 Client Side Extension
  • 7 Script Policies
    • 7.1 Server Side Extension
      • 7.1.1 Managing Machine Scripts Policies via the GPME
      • 7.1.2 Managing User Scripts Policies via the GPME
    • 7.2 Client Side Extension
  • 8 Startup Script Policies
    • 8.1 Server Side Extension
      • 8.1.1 Managing Startup Script Policies via samba-tool
    • 8.2 Client Side Extension
  • 9 Files Policy
    • 9.1 Server Side Extension
      • 9.1.1 Managing the Files Policy via samba-tool
    • 9.2 Client Side Extension
  • 10 Symlink Policies
    • 10.1 Server Side Extension
      • 10.1.1 Managing the Symlink Policy via samba-tool
    • 10.2 Client Side Extension
  • 11 Sudoers Policies
    • 11.1 Server Side Extension
      • 11.1.1 Managing Sudoers Policy via the GPME
      • 11.1.2 Managing Sudoers Policy via samba-tool
    • 11.2 Client Side Extension
  • 12 Message Policies
    • 12.1 Server Side Extension
      • 12.1.1 Managing Message Policy via the GPME
      • 12.1.2 Managing Message Policy via samba-tool
    • 12.2 Client Side Extension
  • 13 PAM Access Policies
    • 13.1 Server Side Extension
      • 13.1.1 Managing PAM Access Policies via samba-tool
    • 13.2 Client Side Extension
  • 14 Certificate Auto Enrollment Policy
    • 14.1 Server Side Extension
      • 14.1.1 Managing Certificate Auto Enrollment via the GPME
      • 14.1.2 Certificate Templates
    • 14.2 Client Side Extension
      • 14.2.1 Trouble Shooting Certificates
  • 15 Firefox Policy
    • 15.1 Server Side Extension
    • 15.2 Managing Firefox Policy via the GPME
    • 15.3 Client Side Extension
  • 16 Chromium/Chrome Policy
    • 16.1 Server Side Extension
      • 16.1.1 Managing Chromium Policy via the GPME
    • 16.2 Client Side Extension
  • 17 GNOME Settings Policy
    • 17.1 Server Side Extension
      • 17.1.1 Managing GNOME Settings Policy via the GPME
    • 17.2 Client Side Extension
  • 18 OpenSSH Policy
    • 18.1 Server Side Extension
      • 18.1.1 Managing OpenSSH Policy via samba-tool
    • 18.2 Client Side Extension
  • 19 Firewalld Policy
    • 19.1 Server Side Extension
      • 19.1.1 Managing Firewalld Policy via the GPME
    • 19.2 Client Side Extension
  • 20 Writing Group Policy Extensions
    • 20.1 Creating the Server Side Extension
      • 20.1.1 Administrative Templates
      • 20.1.2 samba-tool gpo manage
    • 20.2 Creating the Client Side Extension
      • 20.2.1 The gp_ext and gp_applier Python Classes
      • 20.2.2 Process Group Policy
      • 20.2.3 Resultant Set of Policy
      • 20.2.4 Registering/Unregistering a Client Side Extension
  • 21 Modifying a Registry.pol File
    • 21.1 Using samba-tool
    • 21.2 Scripting with python
  • 22 Installing Administrative Templates
    • 22.1 Install Samba ADMX Templates
    • 22.2 Installing Firefox ADMX Templates
    • 22.3 Installing Chromium ADMX Templates
    • 22.4 Installing Windows ADMX Templates
  • 23 Automatic Policy Refresh
    • 23.1 The samba-gpupdate command
    • 23.2 Automatic Policy Refresh via winbind
    • 23.3 Automatic Policy Refresh via SSSD
      • 23.3.1 Setting up SSSD
      • 23.3.2 Configuring policy refresh

Group Policy on Linux

10 Symlink Policies

The purpose of this policy is to create a symbolic link on a Linux client. Only Machine policy is supported. This policy could be useful in conjunction with the Files Policy found in chapter 9.

This policy is physically stored on the SYSVOL in the MACHINE/VGP /VTLA/Unix/Symlink/manifest.xml file in the subdirectory of the Group Policy Object. It is stored in an xml format, and is easily modified manually using a text editor.

10.1 Server Side Extension

The Symlink Policy has no GPME Server Side Extension (SSE), so this policy may only be administered using samba-tool gpo manage symlink. This is because this SSE is stored on the SYSVOL as an xml file, not in the Registry.pol from an ADMX template.

10.1.1 Managing the Symlink Policy via samba-tool

The Symlink samba-tool command has 3 subcommands; add, list, and remove.

> samba-tool gpo manage symlink --help
Usage: samba-tool gpo manage symlink <subcommand>

Manage symlink Group Policy Objects


Options:
  -h, --help  show this help message and exit


Available subcommands:
  add     - Adds a VGP Symbolic Link Group Policy to the sysvol
  list    - List VGP Symbolic Link Group Policy from the sysvol
  remove  - Removes a VGP Symbolic Link Group Policy from the
            sysvol

To add a new Symlink policy to the SYSVOL, call the samba-tool gpo manage symlink add command.

samba-tool gpo manage symlink add <gpo> <source> <target>

This command will add a policy instructing the client to create a symbolic link pointing to source named target.

Let’s add a simple policy, which uploads a configuration file using the Files Policy (see chapter 9), then symlinks that configuration file to somewhere useful on the system.

> cat servlist.conf
N=Libera.Chat
L=1
E=UTF-8 (Unicode)
F=23
D=0
S=irc.libera.chat/6697
J=#samba-technical
> samba-tool gpo manage files add \
 {31B2F340-016D-11D2-945F-00C04FB984F9} servlist.conf \
 /usr/share/servlist.conf 'LIZARDO\tux' \
 'LIZARDO\domain users' 600 -UAdministrator
> samba-tool gpo manage files list \
 {31B2F340-016D-11D2-945F-00C04FB984F9} -UAdministrator
-rw------- LIZARDO\tux LIZARDO\domain users
 /usr/share/servlist.conf -> servlist.conf
> samba-tool gpo manage symlink add \
 {31B2F340-016D-11D2-945F-00C04FB984F9} /usr/share/servlist.conf \
 /home/LIZARDO/tux/.config/hexchat/servlist.conf -UAdministrator
> samba-tool gpo manage symlink list \
 {31B2F340-016D-11D2-945F-00C04FB984F9} -UAdministrator
ln -s /usr/share/servlist.conf
 /home/LIZARDO/tux/.config/hexchat/servlist.conf

Here we are uploading a configuration file for hexchat, then symlinking it to a user’s profile. The samba-tool gpo manage symlink list command displays the link operations that will be performed on the client.

Later when we choose to remove this policy, we will do so with the samba-tool gpo manage symlink remove command.

> samba-tool gpo manage symlink remove \
 {31B2F340-016D-11D2-945F-00C04FB984F9} /usr/share/servlist.conf \
 /home/LIZARDO/tux/.config/hexchat/servlist.conf -UAdministrator

10.2 Client Side Extension

The Symlink Client Side Extension (CSE) creates a symlink between the source and target. Startup Scripts only apply for Machine policy.

Let’s list the Resultant Set of Policy to view the symbolic link policy we created in the previous section.

> sudo /usr/sbin/samba-gpupdate --rsop
Resultant Set of Policy
Computer Policy

GPO: Default Domain Policy
=================================================================
  CSE: vgp_symlink_ext
  -----------------------------------------------------------
    Policy Type: VGP/Unix Settings/Symbolic Links
    -----------------------------------------------------------
    [ ln -s /usr/share/servlist.conf
      /home/LIZARDO/tux/.config/hexchat/servlist.conf ]
    -----------------------------------------------------------
  -----------------------------------------------------------
  CSE: vgp_files_ext
  -----------------------------------------------------------
    Policy Type: VGP/Unix Settings/Files
    -----------------------------------------------------------
    [ -rw------- LIZARDO\tux LIZARDO\domain users
      /usr/share/servlist.conf -> servlist.conf ]
    -----------------------------------------------------------
  -----------------------------------------------------------
=================================================================

In addition to our Symlink policy, we also see the Files policy which we added in conjunction with this.

Let’s now force our policy to apply and see how the CSE behaves.

> sudo /usr/sbin/samba-gpupdate --force
> sudo tdbdump /var/lib/samba/gpo.tdb -k "TESTSYSDM$" \
> | sed -r "s/\\\22/\"/g" | sed -r "s/\\\5C/\\\\/g" \
 | xmllint --xpath "//gp_ext[@name='VGP/Unix Settings/Files' or
                             @name='VGP/Unix Settings/Symbolic
                                    Links']" - \
 | xmllint --format -
<gp_ext name="VGP/Unix Settings/Files">
  <attribute name="/usr/share/servlist.conf">
    d5b5...820c:LIZARDO\5Ctux:LIZARDO\5Cdomain users:384
  </attribute>
</gp_ext>
<gp_ext name="VGP/Unix Settings/Symbolic Links">
  <attribute name="/usr/share/servlist.conf:
             /home/LIZARDO/tux/.config/hexchat/servlist.conf">
    /home/LIZARDO/tux/.config/hexchat/servlist.conf
  </attribute>
</gp_ext>
> l /usr/share/servlist.conf
-rw------- 1 LIZARDO\tux LIZARDO\domain users 87 Nov 15 13:51
 /usr/share/servlist.conf
> sudo l /home/LIZARDO/tux/.config/hexchat/servlist.conf
lrwxrwxrwx 1 root root 24 Nov 15 13:51 /home/LIZARDO/tux/.config/
 hexchat/servlist.conf -> /usr/share/servlist.conf

Our Group Policy Cache at /var/lib/samba/gpo.tdb shows the two policies have been applied. Listing the target, we also see that the symlink now exists. If we output the contents of our symlink, we can see that it is indeed pointing to our configuration file that we uploaded to the SYSVOL earlier. 

> sudo cat /home/LIZARDO/tux/.config/hexchat/servlist.conf
N=Libera.Chat
L=1
E=UTF-8 (Unicode)
F=23
D=0
S=irc.libera.chat/6697
J=#samba-technical