Samba : Samba AD DC : サーバーの設定2019/07/30 |
|
Samba による Active Directory Domain Controller を構築します。
当例では、以下のようなドメイン環境を設定します。
|
|||||||
| [1] | 必要なパッケージをインストールします。 |
|
root@smb:~#
apt -y install samba krb5-config winbind smbclient # DHCPから IP 取得中の場合は [Yes], 固定 IP なら [No]
+----------------------+ Samba server and utilities +-----------------------+
| |
| If your computer gets IP address information from a DHCP server on the |
| network, the DHCP server may also provide information about WINS servers |
| ("NetBIOS name servers") present on the network. This requires a change |
| to your smb.conf file so that DHCP-provided WINS settings will |
| automatically be read from /var/lib/samba/dhcp.conf. |
| |
| The dhcp-client package must be installed to take advantage of this |
| feature. |
| |
| Modify smb.conf to use WINS settings from DHCP? |
| |
| <Yes> <No> |
| |
+---------------------------------------------------------------------------+
# レルム名を設定 +------------------+ Configuring Kerberos Authentication +------------------+ | When users attempt to use Kerberos and specify a principal or user name | | without specifying what administrative Kerberos realm that principal | | belongs to, the system appends the default realm. The default realm may | | also be used as the realm of a Kerberos service running on the local | | machine. Often, the default realm is the uppercase version of the local | | DNS domain. | | | | Default Kerberos version 5 realm: | | | | SRV.WORLD________________________________________________________________ | | | | <Ok> | | | +---------------------------------------------------------------------------+ # 自身のホスト名を指定 +------------------+ Configuring Kerberos Authentication +------------------+ | Enter the hostnames of Kerberos servers in the SRV.WORLD Kerberos | | realm separated by spaces. | | | | Kerberos servers for your realm: | | | | smb.srv.world____________________________________________________________ | | | | <Ok> | | | +---------------------------------------------------------------------------+ # 自身のホスト名を指定 +------------------+ Configuring Kerberos Authentication +------------------+ | Enter the hostname of the administrative (password changing) server for | | the SRV.WORLD Kerberos realm. | | | | Administrative server for your Kerberos realm: | | | | smb.srv.world____________________________________________________________ | | | | <Ok> | | | +---------------------------------------------------------------------------+ |
| [2] | Samba の設定です。 |
|
# デフォルトの設定ファイルはリネームまたは削除 root@smb:~# mv /etc/samba/smb.conf /etc/samba/smb.conf.org root@smb:~# samba-tool domain provision # レルム名を指定 (通常はそのままEnterでOK) Realm [SRV.WORLD]: # ドメイン名を指定 Domain [SRV]: SMB01 # DC にするのでそのまま Enter Server Role (dc, member, standalone) [dc]: # Samba の内蔵 DNS を使うのでそのまま Enter DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]: # DNS フォワーダーを設定する場合は入力, 設定しない場合は [none] を指定 DNS forwarder IP address (write 'none' to disable forwarding) [10.0.0.10]: 10.0.0.10 # 管理者パスワードを設定 # 単純なパスワードはエラーとなるため、6文字以上且つ英数字と大文字小文字を交えた複雑なパスワードにする Administrator password: Retype password: Looking up IPv4 addresses Looking up IPv6 addresses No IPv6 address will be assigned Setting up share.ldb Setting up secrets.ldb Setting up the registry Setting up the privileges database Setting up idmap db Setting up SAM db Setting up sam.ldb partitions and settings Setting up sam.ldb rootDSE Pre-loading the Samba 4 and AD schema Unable to determine the DomainSID, can not enforce uniqueness constraint on local domainSIDs Adding DomainDN: DC=srv,DC=world Adding configuration container Setting up sam.ldb schema Setting up sam.ldb configuration data Setting up display specifiers Modifying display specifiers and extended rights Adding users container Modifying users container Adding computers container Modifying computers container Setting up sam.ldb data Setting up well known security principals Setting up sam.ldb users and groups Setting up self join Adding DNS accounts Creating CN=MicrosoftDNS,CN=System,DC=srv,DC=world Creating DomainDnsZones and ForestDnsZones partitions Populating DomainDnsZones and ForestDnsZones partitions Setting up sam.ldb rootDSE marking as synchronized Fixing provision GUIDs A Kerberos configuration suitable for Samba AD has been generated at /var/lib/samba/private/krb5.conf Merge the contents of this file with your system krb5.conf or replace it with this one. Do not create a symlink! Once the above files are installed, your Samba AD server will be ready to use Server Role: active directory domain controller Hostname: smb NetBIOS Domain: SMB01 DNS Domain: srv.world DOMAIN SID: S-1-5-21-3772837808-1505251784-1375148484
root@smb:~#
root@smb:~# cp /var/lib/samba/private/krb5.conf /etc/ root@smb:~# systemctl stop smbd nmbd winbind root@smb:~# systemctl disable smbd nmbd winbind root@smb:~# systemctl unmask samba-ad-dc systemctl start samba-ad-dc root@smb:~# systemctl enable samba-ad-dc # 動作確認 root@smb:~# smbclient -L localhost -U%
Sharename Type Comment
--------- ---- -------
netlogon Disk
sysvol Disk
IPC$ IPC IPC Service (Samba 4.9.5-Debian)
Reconnecting with SMB1 for workgroup listing.
Server Comment
--------- -------
Workgroup Master
--------- -------
WORKGROUP NAS
|
| [3] | ドメインの機能レベルの確認とユーザー登録をしておきます。 |
|
# ドメインの機能レベル確認 root@smb:~# samba-tool domain level show Domain and forest function level for domain 'DC=srv,DC=world' Forest function level: (Windows) 2008 R2 Domain function level: (Windows) 2008 R2 Lowest function level of a DC: (Windows) 2008 R2 # ドメインにユーザー登録 root@smb:~# samba-tool user create debian New Password: # パスワード設定 Retype Password: User 'debian' created successfully |
| Sponsored Link |