Samba AD DC : Configure DC2018/11/09 |
|
Configute Samba Active Directory Domain Controller.
For Samba 4.7, MIT Kerberos implementation has been just supported and also provided Samba DC frunction on RedHat Samba RPM package.
(implemeted from Fedora 27 Samba package) (For Samba 4.6 and earlier, only Heimdal Kerberos was supported, Fedora 29 has Samba 4.9)
This example configures on the environment bellow.
|
|||||||
| [1] | Install Samba DC package. |
|
[root@smb ~]# dnf -y install samba samba-dc
|
| [2] | Configure Samba. |
|
# rename or remove the default config file [root@smb ~]# mv /etc/samba/smb.conf /etc/samba/smb.conf.org [root@smb ~]# samba-tool domain provision # specify Realm Realm [SRV.WORLD]: # specify Domain name Domain [SRV]: SMB01 # select server role (select dc on here) Server Role (dc, member, standalone) [dc]: # select DNS backend (select Samba Built-in DNS on here) DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]: # confirm DNS setting and Enter if it's OK DNS forwarder IP address (write 'none' to disable forwarding) [10.0.0.10]: # set admin password # Do not set trivial password, if you input it, configuration wizard shows error and stops Administrator password: Retype password: Looking up IPv4 addresses Looking up IPv6 addresses No IPv6 address will be assigned Setting up share.ldb Setting up secrets.ldb Setting up the registry Setting up the privileges database Setting up idmap db Setting up SAM db Setting up sam.ldb partitions and settings Setting up sam.ldb rootDSE Pre-loading the Samba 4 and AD schema Adding DomainDN: DC=srv,DC=world Adding configuration container Setting up sam.ldb schema Setting up sam.ldb configuration data Setting up display specifiers Modifying display specifiers Adding users container Modifying users container Adding computers container Modifying computers container Setting up sam.ldb data Setting up well known security principals Setting up sam.ldb users and groups Setting up self join Adding DNS accounts Creating CN=MicrosoftDNS,CN=System,DC=srv,DC=world Creating DomainDnsZones and ForestDnsZones partitions Populating DomainDnsZones and ForestDnsZones partitions Setting up sam.ldb rootDSE marking as synchronized Fixing provision GUIDs The Kerberos KDC configuration for Samba AD is located at /var/lib/samba/private/kdc.conf A Kerberos configuration suitable for Samba AD has been generated at /var/lib/samba/private/krb5.conf Merge the contents of this file with your system krb5.conf or replace it with this one. Do not create a symlink! Once the above files are installed, your Samba AD server will be ready to use Server Role: active directory domain controller Hostname: smb NetBIOS Domain: SMB01 DNS Domain: srv.world DOMAIN SID: S-1-5-21-3373207434-3922058056-4055715039[root@smb ~]# cp /var/lib/samba/private/krb5.conf /etc/ [root@smb ~]# systemctl start samba [root@smb ~]# systemctl enable samba |
| [3] | Confirm Doman function level and add a Domain user. |
|
# confirm domain function level [root@smb ~]# samba-tool domain level show Domain and forest function level for domain 'DC=srv,DC=world' Forest function level: (Windows) 2008 R2 Domain function level: (Windows) 2008 R2 Lowest function level of a DC: (Windows) 2008 R2 # add a domain user [root@smb ~]# samba-tool user create fedora New Password: # set password Retype Password: User 'fedora' created successfully |
| [4] | If Firewalld is running, allow related ports. |
|
[root@smb ~]# firewall-cmd --add-service={dns,kerberos,kpasswd,ldap,ldaps,samba} --permanent success [root@smb ~]# firewall-cmd --add-port={135/tcp,137-138/udp,139/tcp,3268-3269/tcp,49152-65535/tcp} --permanent success [root@smb ~]# firewall-cmd --reload success |
| Sponsored Link |