Cockpit Domain Controller

A comprehensive web-based interface for managing Samba Active Directory Domain Controllers through the Cockpit web console. This module provides enterprise-grade domain controller management with automatic failover capabilities, FSMO role management, and modern web-based administration.

🚀 Features

Enterprise Active Directory Replacement

Cockpit Domain Controller provides superior infrastructure automation that complements Microsoft RSAT tools for a complete enterprise AD solution:

🎯 Perfect Division of Labor: Cockpit handles infrastructure automation, RSAT manages AD objects
🔄 Intelligent Automation: Features Microsoft AD lacks (automatic DHCP/NTP failover)
💰 Cost Effective: No Windows Server licensing, no CALs required
🛠️ Familiar Management: Existing Windows admins use standard RSAT tools
🚀 Enterprise Grade: Production-ready with advanced failover capabilities

Core Domain Controller Management

Domain Provisioning: Create new Active Directory domains with full configuration
Domain Joining: Join existing domains as additional domain controllers
Domain Statistics: Real-time monitoring of users, computers, groups, and OUs
Service Management: Control Samba AD-DC, NTP, and DHCP services
FSMO Role Monitoring: Track and display all five FSMO roles with live updates

FSMO-Based Service Automation

DHCP Failover: Automatic DHCP service failover based on PDC Emulator role
NTP Hierarchy: Automatic time synchronization hierarchy with PDC as authoritative source
Configuration Replication: Service configurations stored in SYSVOL for automatic replication
Service Monitoring: Real-time status monitoring with automated failover detection

Advanced Management Features

Network Interface Selection: Choose appropriate network interfaces for domain services
Firewall Integration: Automatic firewall configuration for AD services
NTP Configuration: Intelligent NTP hierarchy based on domain controller roles
Security Hardening: Proper service isolation and security configurations
Comprehensive Logging: Detailed logging for troubleshooting and auditing

🏗️ Architecture

Technologies Used

Frontend

Cockpit Framework: Modern web-based server management interface
PatternFly v5: Enterprise-grade UI components and design system
JavaScript ES6: Modern JavaScript with module support
HTML5/CSS3: Responsive design with light/dark theme support

Backend

Samba AD-DC: Core Active Directory Domain Controller functionality
Bash Scripting: Service management and automation scripts
systemd: Service management and timer-based monitoring
Chrony: Network Time Protocol (NTP) implementation
ISC DHCP Server: Dynamic Host Configuration Protocol services

Integration

SYSVOL Replication: Configuration storage and replication
Cockpit API: System interaction and command execution
systemd Journal: Centralized logging and monitoring
Firewalld: Network security and port management

📋 System Requirements

Operating System

Debian 12 (Bookworm) or later
Ubuntu 22.04 LTS or later
Other systemd-based Linux distributions (with adaptation)

Software Dependencies

Cockpit (>= 266)
Samba AD-DC with all required modules
Chrony (NTP client/server)
ISC DHCP Server
Firewalld (for network security)
Python 3 with Samba bindings

Hardware Requirements

Minimum: 2 CPU cores, 4GB RAM, 20GB disk space
Recommended: 4+ CPU cores, 8GB+ RAM, 50GB+ disk space
Network: Static IP address configuration recommended

🔧 Installation

Package Installation

# Download and install the package
sudo dpkg -i cockpit-domain-controller_1.0.42-1.deb

# Install dependencies if needed
sudo apt-get install -f

Manual Installation

# Clone the repository
git clone https://github.com/your-org/cockpit-domain-controller.git
cd cockpit-domain-controller

# Install files
sudo cp -r * /usr/share/cockpit/domain-controller/
sudo systemctl restart cockpit

Post-Installation Setup

Access Cockpit: Navigate to https://your-server:9090
Domain Controller: Click on "Domain Controller" in the sidebar
Network Configuration: Ensure proper network interface configuration
Firewall Rules: Verify firewall rules are properly configured

🎯 RSAT Integration - Best of Both Worlds

Perfect Complementary Architecture

Cockpit Domain Controller excels at infrastructure automation that Microsoft AD struggles with, while Microsoft RSAT tools provide familiar AD object management. This combination creates a superior enterprise solution:

What Cockpit Handles (Infrastructure Automation)

✅ Domain provisioning and joining - Streamlined domain controller deployment
✅ FSMO role monitoring - Real-time status of all 5 roles with live updates
✅ Intelligent service failover - Automatic DHCP/NTP failover based on PDC role
✅ Service automation - Auto-start samba-ad-dc after domain operations
✅ Network configuration - Interface selection, DNS setup, firewall rules
✅ Modern monitoring - Web-based real-time infrastructure monitoring

What RSAT Handles (AD Object Management)

✅ User management - Create, modify, disable users (Active Directory Users & Computers)
✅ Group management - Security/distribution groups, membership (ADUC)
✅ Computer accounts - Join computers, manage properties (ADUC)
✅ OU management - Create hierarchy, move objects (ADUC)
✅ DNS management - A records, PTR records, zones (DNS Manager)
✅ Sites and services - Site links, subnets, replication (AD Sites & Services)

RSAT Setup with Cockpit Domain Controllers

1. Install RSAT on Windows Workstation

# Windows 10/11 - Install RSAT via Windows Features
Get-WindowsCapability -Name RSAT* -Online | Add-WindowsCapability -Online

# Or install specific tools:
Add-WindowsCapability -Name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0" -Online
Add-WindowsCapability -Name "Rsat.Dns.Tools~~~~0.0.1.0" -Online
Add-WindowsCapability -Name "Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0" -Online

2. Connect RSAT to Samba Domain Controllers

Active Directory Users & Computers: Right-click → "Change Domain Controller" → Select your Samba DC
DNS Manager: Connect to your Samba DC's DNS service
All RSAT tools: Automatically discover and connect to Samba domain controllers

3. DHCP Considerations

For full RSAT compatibility, consider:

Option A: Use Windows DHCP Server on separate machine (full RSAT DHCP management)
Option B: Continue with ISC DHCP + Cockpit web management (current setup)

Recommended: Deploy separate Windows DHCP server for complete RSAT integration while keeping Cockpit's intelligent automation for other services.

Why This Architecture is Superior to Pure Microsoft AD

Microsoft Active Directory lacks:

Automatic DHCP failover based on FSMO roles
Intelligent NTP hierarchy management
Modern web-based infrastructure monitoring
Automated service startup after domain operations
Real-time FSMO role status monitoring
Cross-platform compatibility and cost savings

Result: Enterprise-grade Active Directory with superior automation + familiar management tools

📖 Usage Guide

Domain Provisioning

Creating a New Domain

Navigate to the Domain Controller section
Click on "Provision New Domain"
Configure domain settings:
- Domain Name: Your domain FQDN (e.g., company.local)
- NetBIOS Name: Short domain name (e.g., COMPANY)
- Administrator Password: Strong domain admin password
- Network Interface: Select appropriate network interface
- DNS Configuration: Configure DNS forwarders
- NTP Servers: Set time synchronization sources
Click "Provision Domain" to create the domain

Joining an Existing Domain

Navigate to "Join Existing Domain"
Enter domain connection details:
- Domain to Join: Target domain FQDN
- Domain Controller IP: IP of existing DC
- Domain Administrator: Admin username
- Password: Admin password
- Network Interface: Select interface
- Site Name: AD site name (optional)
Click "Join Domain" to join as additional DC

Service Management

DHCP Failover Management

The system implements automatic DHCP failover based on the PDC Emulator FSMO role:

Access DHCP Management: Click "Configure" next to DHCP Server
Monitor Status: View current PDC Emulator and failover status
Configuration Sync: Sync DHCP configuration to SYSVOL
Force Failover: Manually trigger failover for testing
View Logs: Monitor recent failover activity

How DHCP Failover Works:

Only the PDC Emulator server runs DHCP service
DHCP configuration is stored in SYSVOL for replication
When PDC role transfers, DHCP automatically fails over
Monitoring occurs every 5 minutes via systemd timer

NTP Hierarchy Management

Automatic time synchronization hierarchy based on domain controller roles:

Access NTP Management: Click "Configure" next to NTP service
Monitor Hierarchy: View current time source role and status
Check Synchronization: Monitor stratum level and time offset
Force Reconfiguration: Manually update NTP configuration
View Status: Real-time chrony tracking information

How NTP Hierarchy Works:

PDC Emulator synchronizes with external NTP servers (Stratum 10)
Other domain controllers sync with PDC Emulator (Stratum 11)
Domain clients sync with any domain controller
Configuration automatically updates when PDC role changes

FSMO Role Management

Viewing FSMO Roles

The interface displays all five FSMO roles with real-time status:

PDC Emulator: Time synchronization, password changes, legacy DC functions
RID Master: Allocates RID pools to domain controllers
Infrastructure Master: Maintains cross-domain references
Schema Master: Controls AD schema modifications (forest-wide)
Domain Naming Master: Controls domain addition/removal (forest-wide)

Role Monitoring

Crown Icon: Indicates which server holds each role
This Server: Highlighted roles held by current server
Real-time Updates: Automatic refresh every 5 minutes
Manual Refresh: Force update of role information

Advanced Configuration

Firewall Management

The system automatically configures firewall rules for:

DNS: Ports 53/tcp, 53/udp
Kerberos: Ports 88/tcp, 88/udp, 464/tcp, 464/udp
LDAP: Ports 389/tcp, 389/udp, 636/tcp
SMB: Port 445/tcp
RPC: Port 135/tcp
Global Catalog: Ports 3268/tcp, 3269/tcp
DHCP: Ports 67/udp, 68/udp
NTP: Port 123/udp
Cockpit: Port 9090/tcp

Service Security

Service Isolation: Each service runs with minimal privileges
Security Hardening: systemd security features enabled
Audit Logging: Comprehensive logging for security monitoring
Access Control: Proper file permissions and ownership

🔄 How It Works

FSMO-Based Automation

The system implements Microsoft Active Directory best practices for service management:

1. Service Role Assignment

PDC Emulator: Runs DHCP and acts as authoritative time source
Other DCs: Sync with PDC for time, DHCP services stopped
Automatic Detection: Continuous monitoring of FSMO role changes

2. Configuration Replication

SYSVOL Storage: Service configurations stored in replicated SYSVOL
Automatic Sync: Configuration changes replicated to all DCs
Backup Management: Versioned configuration backups maintained

3. Failover Process

1. Timer monitors PDC Emulator role (every 5 minutes)
2. If server becomes PDC:
   - Retrieve service configs from SYSVOL
   - Start appropriate services (DHCP, NTP as authoritative)
   - Store current config to SYSVOL
3. If server loses PDC:
   - Store current config to SYSVOL
   - Reconfigure services (NTP sync with new PDC)
   - Stop PDC-specific services (DHCP)
4. Continue monitoring

Service Architecture

DHCP Failover

┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐
│   PDC Emulator  │    │   Other DC #1   │    │   Other DC #2   │
│                 │    │                 │    │                 │
│ ┌─────────────┐ │    │ ┌─────────────┐ │    │ ┌─────────────┐ │
│ │ DHCP Server │ │    │ │ DHCP Server │ │    │ │ DHCP Server │ │
│ │  (ACTIVE)   │ │    │ │ (STOPPED)   │ │    │ │ (STOPPED)   │ │
│ └─────────────┘ │    │ └─────────────┘ │    │ └─────────────┘ │
│                 │    │                 │    │                 │
│ ┌─────────────┐ │    │ ┌─────────────┐ │    │ ┌─────────────┐ │
│ │   SYSVOL    │◄┼────┼►│   SYSVOL    │◄┼────┼►│   SYSVOL    │ │
│ │ (Config)    │ │    │ │ (Config)    │ │    │ │ (Config)    │ │
│ └─────────────┘ │    │ └─────────────┘ │    │ └─────────────┘ │
└─────────────────┘    └─────────────────┘    └─────────────────┘

NTP Hierarchy

┌─────────────────┐
│ External NTP    │
│   Servers       │
│ (Stratum 1-9)   │
└─────────┬───────┘
          │
          ▼
┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐
│   PDC Emulator  │    │   Other DC #1   │    │   Other DC #2   │
│  (Stratum 10)   │◄───┤  (Stratum 11)   │    │  (Stratum 11)   │
│                 │    │                 │    │                 │
│ Authoritative   │    │ Syncs with PDC  │    │ Syncs with PDC  │
│ Time Source     │    │ + External NTP  │    │ + External NTP  │
└─────────────────┘    └─────────────────┘    └─────────────────┘
          │                       │                       │
          ▼                       ▼                       ▼
┌─────────────────────────────────────────────────────────────────┐
│                Domain Clients                                   │
│            (Sync with any DC)                                   │
└─────────────────────────────────────────────────────────────────┘

🛠️ Development

File Structure

cockpit-domain-controller/
├── manifest.json                 # Cockpit module manifest
├── domain-controller.html        # Main HTML interface
├── domain-controller.js          # Frontend JavaScript logic
├── domain-controller.css         # Styling and theme support
├── dhcp-fsmo-manager.sh          # DHCP failover management script
├── dhcp-fsmo-monitor.service     # DHCP monitoring systemd service
├── dhcp-fsmo-monitor.timer       # DHCP monitoring timer
├── ntp-fsmo-manager.sh           # NTP hierarchy management script
├── ntp-fsmo-monitor.service      # NTP monitoring systemd service
├── ntp-fsmo-monitor.timer        # NTP monitoring timer
└── README.md                     # This documentation

Key Components

Frontend (JavaScript)

DomainController Class: Main application logic
Service Management: Real-time service status monitoring
FSMO Monitoring: Live FSMO role tracking
Configuration UI: Domain provisioning and joining interfaces
Theme Support: Light/dark mode compatibility

Backend Scripts

dhcp-fsmo-manager.sh: DHCP failover automation
ntp-fsmo-manager.sh: NTP hierarchy management
systemd Integration: Service and timer configurations
SYSVOL Integration: Configuration replication

Styling

PatternFly v5: Enterprise UI components
Responsive Design: Mobile and desktop support
Theme Compatibility: Cockpit light/dark theme support
Accessibility: WCAG compliance considerations

Building and Packaging

Debian Package Creation

# Build package structure
mkdir -p cockpit-domain-controller_1.0.42-1/usr/share/cockpit/domain-controller
mkdir -p cockpit-domain-controller_1.0.42-1/DEBIAN

# Copy files
cp -r src/* cockpit-domain-controller_1.0.42-1/usr/share/cockpit/domain-controller/
cp debian/control cockpit-domain-controller_1.0.42-1/DEBIAN/
cp debian/postinst cockpit-domain-controller_1.0.42-1/DEBIAN/

# Build package
dpkg-deb --build cockpit-domain-controller_1.0.42-1

Version Management

Manifest Version: Update manifest.json version field
Package Version: Update DEBIAN/control version field
Changelog: Document changes and improvements

🔒 Security

Security Features

Privilege Separation: Services run with minimal required privileges
systemd Security: Hardened service configurations
Firewall Integration: Automatic security rule management
Audit Logging: Comprehensive security event logging
Access Control: Proper file permissions and ownership

Security Considerations

Network Security: Ensure proper network segmentation
Password Policy: Use strong passwords for domain accounts
Certificate Management: Implement proper PKI for LDAPS
Backup Security: Secure backup of domain database
Monitoring: Regular security monitoring and alerting

Hardening Recommendations

Network: Use VLANs for domain controller isolation
Firewall: Implement network-level firewalls
Updates: Keep all software components updated
Monitoring: Implement security monitoring solutions
Backup: Regular, secure backups of domain data

📊 Monitoring and Logging

Built-in Monitoring

Service Status: Real-time service health monitoring
FSMO Roles: Continuous FSMO role status tracking
Time Synchronization: NTP offset and stratum monitoring
DHCP Failover: Failover event tracking and logging

Log Locations

Cockpit Logs: journalctl -u cockpit
Samba AD-DC: journalctl -u samba-ad-dc
DHCP Failover: journalctl -u dhcp-fsmo-monitor
NTP Management: journalctl -u ntp-fsmo-monitor
Chrony: journalctl -u chrony

Alerting

systemd Journal: Centralized logging with log levels
Email Notifications: Configure with external tools
SNMP Integration: Available through system monitoring tools
Custom Alerts: Implement using systemd and scripting

🐛 Troubleshooting

Common Issues

Domain Provisioning Fails

# Check Samba service status
systemctl status samba-ad-dc

# Verify network configuration
ip addr show
resolvectl status

# Check DNS resolution
nslookup your-domain.local

# Review logs
journalctl -u samba-ad-dc -f

DHCP Failover Not Working

# Check DHCP FSMO monitor
systemctl status dhcp-fsmo-monitor.timer
journalctl -u dhcp-fsmo-monitor -f

# Verify PDC Emulator role
samba-tool fsmo show

# Check SYSVOL replication
ls -la /var/lib/samba/sysvol/*/dhcp-configs/

# Manual failover test
/usr/local/bin/dhcp-fsmo-manager.sh

NTP Synchronization Issues

# Check NTP hierarchy
chronyc tracking
chronyc sources

# Verify NTP FSMO monitor
systemctl status ntp-fsmo-monitor.timer
journalctl -u ntp-fsmo-monitor -f

# Manual NTP configuration
/usr/local/bin/ntp-fsmo-manager.sh

# Check time offset
chronyc sourcestats

Web Interface Issues

# Restart Cockpit
systemctl restart cockpit

# Check Cockpit logs
journalctl -u cockpit -f

# Verify module installation
ls -la /usr/share/cockpit/domain-controller/

# Check browser console for JavaScript errors

Diagnostic Commands

# Domain status
samba-tool domain level show
samba-tool domain info

# FSMO roles
samba-tool fsmo show

# Service status
systemctl status samba-ad-dc chrony isc-dhcp-server

# Network connectivity
ss -tuln | grep -E "(53|88|389|445|636|3268|3269)"

# Time synchronization
chronyc tracking
chronyc sources -v

# DHCP status
systemctl status isc-dhcp-server
dhcp-lease-list

🤝 Contributing

Development Setup

Clone Repository: git clone https://github.com/your-org/cockpit-domain-controller.git
Install Dependencies: Set up development environment
Testing: Test changes in development environment
Documentation: Update documentation for changes

Code Style

JavaScript: Use ES6+ features, consistent indentation
CSS: Follow PatternFly conventions
Bash: Use shellcheck for script validation
HTML: Semantic markup with accessibility considerations

Pull Request Process

Fork Repository: Create your own fork
Feature Branch: Create feature branch from main
Testing: Thorough testing of changes
Documentation: Update relevant documentation
Pull Request: Submit with detailed description

📄 License

This project is licensed under the GNU Lesser General Public License v2.1 or later. See the LICENSE file for details.

🆘 Support

Documentation

README: This comprehensive guide
Wiki: Additional documentation and examples
Man Pages: System manual pages for scripts

Community

GitHub Issues: Bug reports and feature requests
Discussions: Community support and questions
Wiki: Community-contributed documentation

Commercial Support

Professional Services: Available for enterprise deployments
Custom Development: Tailored solutions for specific requirements
Training: Comprehensive training programs available

🙏 Acknowledgments

Technologies

Cockpit Project: Modern web-based server management
PatternFly: Enterprise UI component library
Samba Team: Active Directory implementation
systemd: System and service management
Chrony: Network time synchronization

Contributors

Domain Controller Team: Core development and maintenance
Community Contributors: Bug reports, feature requests, and improvements
Beta Testers: Early testing and feedback

🏆 Final Assessment: Enterprise Active Directory Replacement

✅ Production-Ready for Enterprise Deployment

Cockpit Domain Controller + Microsoft RSAT = Superior Microsoft AD Alternative

Strengths Over Microsoft AD:

🔄 Superior FSMO automation - Microsoft AD requires manual DHCP/NTP configuration
🌐 Modern web interface - Better than Microsoft's legacy management tools
🤖 Intelligent service failover - Automatic DHCP/NTP failover based on roles
🐧 Cross-platform compatibility - Runs on Linux with enterprise hardening
💰 Zero licensing costs - No CALs or Windows Server licenses required
⚡ Real-time monitoring - Live FSMO role status and service monitoring

Enterprise Use Cases:

✅ File server authentication - Domain controller for enterprise file sharing
✅ Linux environment management - Perfect for Linux-centric organizations
✅ Cost-sensitive deployments - Eliminate Windows Server licensing costs
✅ Hybrid environments - Windows clients with Linux infrastructure
✅ Infrastructure automation focus - Organizations prioritizing automated failover

Management Architecture:

┌─────────────────────────┐    ┌─────────────────────────┐
│ Cockpit Domain          │    │ Microsoft RSAT Tools    │
│ Controller              │    │ (Windows Workstation)   │
│                         │    │                         │
│ • Infrastructure        │◄──►│ • User Management       │
│   Automation            │    │ • Group Management      │
│ • Service Failover      │    │ • Computer Accounts     │
│ • FSMO Monitoring       │    │ • DNS Management        │
│ • Network Config        │    │ • OU Management         │
│ • Modern Web UI         │    │ • Familiar Windows UI   │
└─────────────────────────┘    └─────────────────────────┘

Licensing Compliance:

RSAT tools are free - No Windows Server CALs required
Legal to use with Samba - RSAT designed for AD-compatible services
No license violations - Managing Samba domain controllers, not Windows

Bottom Line:

This is a solid, enterprise-grade Microsoft Active Directory replacement that combines the best of both worlds - superior infrastructure automation with familiar administrative tools. It's production-ready for organizations needing robust domain services without Microsoft licensing costs.

Cockpit Domain Controller - Enterprise-grade Samba Active Directory management through modern web interface with automatic failover capabilities and RSAT compatibility.

For more information, visit: https://github.com/dguedry/cockpit-domain-controller

Name		Name	Last commit message	Last commit date
Latest commit History 14 Commits
.claude		.claude
cockpit-domain-controller		cockpit-domain-controller
debian-package		debian-package
README.md		README.md
build-package.sh		build-package.sh
install-dependencies.sh		install-dependencies.sh
install-fsmo-services.sh		install-fsmo-services.sh
resolve-time-conflicts.sh		resolve-time-conflicts.sh

Folders and files

Latest commit

History

Repository files navigation