История страницы

...

Описание применяемых параметров

При настроке настройке применим следующие параметры:
Interactive Mode Setting Non-interactive Mode Parameter Explanation

...

...

...

...

...

...

...

Другие параметры, часто используемые в команде Sets the domain administrator password. If the password does not match the complexity requirements, the provisioning fails. For details, see Microsoft TechNet: Passwords must meet complexity requirements.Other parameters frequently used with the samba-tool domain provision command:

--option="interfaces=lo eth0" --option="bind interfaces only=yes": If your server has multiple network interfaces, use these options to bind Samba to the specified interfaces. This enables the samba-tool command to register the correct LAN IP address in the directory during the join.  Если сервер имеет несколько сетевых интерфейсов, используйте эти параметры для привязки Samba к нужным интерфейсам. Это позволить команде samba-tool зарегистрировать корректный сетевой адрес  при настройке.

Настройка Samba AD в интерактивном режиме

Для настройки Samba AD в интерактивном режиме выполните команду:

The interactive provisioning mode supports passing further parameters to the samba-tool domain provision command. This enables you to modify parameters that are not part of the interactive setup.

Provisioning Samba AD in Non-interactive Mode

For example, to provision a Samba AD non-interactively with the following settings:

Server role: dc
NIS extensions enabled
Internal DNS back end
Kerberos realm and AD DNS zone: samdom.example.com
NetBIOS domain name: SAMDOM
Domain administrator password: Passw0rd

# samba-tool domain provision --server-role=dc --use-rfc2307 --dns-backend=SAMBA_INTERNAL --realm=SAMDOM.EXAMPLE.COM --domain=SAMDOM --adminpass=Passw0rd

Setting up the AD DNS back end

Skip this step if you provisioned the DC using the SAMBA_INTERNAL DNS back end.

Set up the BIND DNS server and the BIND9_DLZ module. For details, see Setting up a BIND DNS Server.

Start the BIND DNS server. For example:

# systemctl start named

For details how to start services, see you distribution's documentation.

Configuring the DNS Resolver

Domain members in an AD use DNS to locate services, such as LDAP and Kerberos. For that, they need to use a DNS server that is able to resolve the AD DNS zone.

On your DC, set the AD DNS domain in the domain and the IP of your DC in the nameserver parameter of the /etc/resolv.conf file. For example:

search samdom.example.com
nameserver 10.99.0.1

Create a reverse zone

You can optionally add a reverse lookup zone.

# samba-tool dns zonecreate <Your-AD-DNS-Server-IP-or-hostname> 0.99.10.in-addr.arpa
Password for [administrator@SAMDOM.EXAMPLE.COM]:
Zone 0.99.10.in-addr.arpa created successfully

If you need more than one reverse zone (multiple subnets), just run the above command again but with the data for the other subnet.

The reverse zone is directly live without restarting Samba or BIND.

Configuring Kerberos

In an AD, Kerberos is used to authenticate users, machines, and services.

During the provisioning, Samba created a Kerberos configuration file for your DC. Copy this file to your operating system's Kerberos configuration. For example:

# cp /usr/local/samba/private/krb5.conf /etc/krb5.conf

Do not create a symbolic link to the the generated krb5.conf file. In Samba 4.7 and later, the /usr/local/samba/private/ directory is no longer accessible by other users than the root user. If the file is a symbolic link, other users are not able to read the file and, for example, dynamic DNS updates fail if you use the BIND_DLZ DNS back end.

The pre-created Kerberos configuration uses DNS service (SRV) resource records to locate the KDC.

Testing your Samba AD DC

To start the samba service manually, enter:

# samba

Samba does not provide System V init scripts, systemd, upstart, or other services configuration files.

If you installed Samba using packages, use the script or service configuration file included in the package to start Samba.
If you built Samba, see Managing the Samba AD DC Service.

Verifying the File Server

To list all shares provided by the DC:

$ smbclient -L localhost -U%
Domain=[SAMDOM] OS=[Unix] Server=[Samba x.y.z]

Sharename Type Comment
--------- ---- -------
netlogon Disk
sysvol Disk
IPC$ IPC IPC Service (Samba x.y.z)
Domain=[SAMDOM] OS=[Unix] Server=[Samba x.y.z]

Server Comment
--------- -------

Workgroup Master
--------- -------

The netlogon and sysvol shares were auto-created during the provisioning and must exist on a DC.

To verify authentication, connect to the netlogon share using the domain administrator account:

$ smbclient //localhost/netlogon -UAdministrator -c 'ls'
Enter Administrator's password:
Domain=[SAMDOM] OS=[Unix] Server=[Samba x.y.z]
. D 0 Tue Nov 1 08:40:00 2016
.. D 0 Tue Nov 1 08:40:00 2016

49386 blocks of size 524288. 42093 blocks available

If one or more tests fail, see Troubleshooting.

Verifying DNS

To verify that your AD DNS configuration works correctly, query some DNS records:

The tcp-based _ldap SRV record in the domain:

$ host -t SRV _ldap._tcp.samdom.example.com.
_ldap._tcp.samdom.example.com has SRV record 0 100 389 dc1.samdom.example.com.

The udp-based _kerberos SRV resource record in the domain:

$ host -t SRV _kerberos._udp.samdom.example.com.
_kerberos._udp.samdom.example.com has SRV record 0 100 88 dc1.samdom.example.com.

The A record of the domain controller:

$ host -t A dc1.samdom.example.com.
dc1.samdom.example.com has address 10.99.0.1

If one or more tests fail, see Troubleshooting.

Verifying Kerberos

Request a Kerberos ticket for the domain administrator account:

$ kinit administrator
Password for administrator@SAMDOM.EXAMPLE.COM:

The Kerberos realm is automatically appended, if you do not pass the principal in the user@REALM format to the kinit command.
Set Kerberos realms always in uppercase.

List the cached Kerberos tickets:

$ klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: administrator@SAMDOM.EXAMPLE.COM

Valid starting Expires Service principal
01.11.2016 08:45:00 12.11.2016 18:45:00 krbtgt/SAMDOM.EXAMPLE.COM@SAMDOM.EXAMPLE.COM
renew until 02.11.2016 08:44:59

If one or more tests fail, see Troubleshooting.

Configuring Time Synchronisation

Kerberos requires a synchronised time on all domain members. For further details and how to set up the ntpd service, see Time Synchronisation.

Using the Domain Controller as a File Server

Whilst the Samba AD DC is able to provide file shares, just like all other installation modes, the Samba team does not recommend using a DC as a file server for the following reasons:

For anything but the smallest organisations, having more than one DC is a really good backup measure, and makes upgrades safer
It encourages upgrades of the DC to also be upgrades of the host OS every year or two, because there isn't complex data to transition or other services involved.
This means upgrades can be done by installing fresh, and replicating in the changes, which is better tested in Samba, gains new features and avoids a number of lingering data corruption risks.
The DC and file-server have different points at which an organisation would wish to upgrade. The needs for new features on the DC and file server come at different times. Currently the AD DC is evolving rapidly to gain features, whereas the fileserver, after over 20 years, is quite rightly more conservative.
mandatory smb signing is enforced on the DC.

If you do decide to use the Samba DC as a fileserver, please consider running a VM, on the DC, containing a separate Samba Unix domain member and use this instead.

If you must use the Samba DC as a fileserver, you should be aware that the auto-enabled acl_xattr virtual file system (VFS) object enables you to only configure shares with Windows access control lists (ACL). Running shares with POSIX ACLs on a Samba DC is not supported and will not work.

To provide network shares with the full capabilities of Samba, set up a Samba domain member with file shares. For details, see:

Setting up Samba as a Domain Member
Samba File Serving

If you only have a small domain (small office, home network) and do not want to follow the Samba team's recommendation and use the DC additionally as a file server, configure Winbindd before you start setting up shares. For details, see Configuring Winbindd on a Samba AD DC.

Troubleshooting

For further details, see Samba AD DC Troubleshooting.

Further Samba-related Documentation

See User Documentation.

Categories:

Domain ControlActive Directory

Navigation menu

Page Discussion View source History

Create account Log in

Navigation

Main Page
User Documentation
Developer Documentation
Categories
Current Events
Recent Changes
Random Page
Report Samba Bug
Report Doc Bug

Search

Tools

What links here
Related changes
Special pages
Printable version
Permanent link
Page information