|
Samba AD DC : Configure DC
2017/12/18 |
|
Configute Samba Active Directory Domain Controller.
For Samba 4.7, MIT Kerberos implementation has been just supported and also provided Samba DC frunction on RedHat Samba RPM package.
(For Samba 4.6 and earlier, only Heimdal Kerberos was supported)
This example configures on the environment bellow.
|
|||||||
| [1] | Install Samba DC package. |
|
[root@smb ~]# dnf -y install samba samba-dc
|
| [2] | Configure Samba. |
|
# rename or remove the default config file [root@smb ~]# mv /etc/samba/smb.conf /etc/samba/smb.conf.org [root@smb ~]# samba-tool domain provision # specify Realm Realm [SRV.WORLD]: # specify Domain name Domain [SRV]: SMB01 # select server role (select dc on here) Server Role (dc, member, standalone) [dc]: # select DNS backend (select Samba Built-in DNS on here) DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]: # confirm DNS setting and Enter if it's OK DNS forwarder IP address (write 'none' to disable forwarding) [10.0.0.10]: # set admin password # Do not set trivial password, if you input it, configuration wizard shows error and stops
Administrator password:
Retype password:
Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up share.ldb
Setting up secrets.ldb
Setting up the registry
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
Adding DomainDN: DC=srv,DC=world
Adding configuration container
Setting up sam.ldb schema
Setting up sam.ldb configuration data
Setting up display specifiers
Modifying display specifiers
Adding users container
Modifying users container
Adding computers container
Modifying computers container
Setting up sam.ldb data
Setting up well known security principals
Setting up sam.ldb users and groups
Setting up self join
Adding DNS accounts
Creating CN=MicrosoftDNS,CN=System,DC=srv,DC=world
Creating DomainDnsZones and ForestDnsZones partitions
Populating DomainDnsZones and ForestDnsZones partitions
Setting up sam.ldb rootDSE marking as synchronized
Fixing provision GUIDs
The Kerberos KDC configuration for Samba AD is located at /var/lib/samba/private/kdc.conf
A Kerberos configuration suitable for Samba AD has been generated
at /var/lib/samba/private/krb5.conf
Merge the contents of this file with your system krb5.conf or replace it with this one.
Do not create a symlink!
Once the above files are installed, your Samba AD server will be ready to use
Server Role: active directory domain controller
Hostname: smb
NetBIOS Domain: SMB01
DNS Domain: srv.world
DOMAIN SID: S-1-5-21-2168605001-1331326997-39821735
[root@smb ~]# cp /var/lib/samba/private/krb5.conf /etc/ [root@smb ~]# systemctl start samba [root@smb ~]# systemctl enable samba |
| [3] | Confirm doman level and add a Domain user. |
|
# confirm doman level [root@smb ~]# samba-tool domain level show Domain and forest function level for domain 'DC=srv,DC=world' Forest function level: (Windows) 2008 R2 Domain function level: (Windows) 2008 R2 Lowest function level of a DC: (Windows) 2008 R2 # add a donain user [root@smb ~]# samba-tool user create redhat New Password: # set password Retype Password: User 'redhat' created successfully |
| [4] | If Firewalld is running, allow related ports. |
|
[root@smb ~]# firewall-cmd --add-service={dns,kerberos,kpasswd,ldap,ldaps,samba} --permanent success [root@smb ~]# firewall-cmd --add-port={135/tcp,137-138/udp,139/tcp,3268-3269/tcp,49152-65535/tcp} --permanent success [root@smb ~]# firewall-cmd --reload success |