Samba AD DC - Server's Settings

 

Configute Samba Active Directory Domain Controller.

This example configures on the environment bellow.

Domain name : SMB01

Realm : SMB.SERVER.WORLD

Hostname : smb.server.world

[1] Install some packages

root@smb:~# aptitude -y install samba krb5-config

# set Realm

 +------------------+ Configuring Kerberos Authentication +------------------+

 | When users attempt to use Kerberos and specify a principal or user name   |

 | without specifying what administrative Kerberos realm that principal      |

 | belongs to, the system appends the default realm.  The default realm may  |

 | also be used as the realm of a Kerberos service running on the local      |

 | machine.  Often, the default realm is the uppercase version of the local  |

 | DNS domain.                                                               |

 |                                                                           |

 | Default Kerberos version 5 realm:                                         |

 |                                                                           |

 | SMB.SERVER.WORLD_________________________________________________________ |

 |                                                                           |

 |                                  <Ok>                                     |

 |                                                                           |

 +---------------------------------------------------------------------------+

# specify the hostname

 +------------------+ Configuring Kerberos Authentication +------------------+

 | Enter the hostnames of Kerberos servers in the SMB.SERVER.WORLD Kerberos  |

 | realm separated by spaces.                                                |

 |                                                                           |

 | Kerberos servers for your realm:                                          |

 |                                                                           |

 | smb.server.world_________________________________________________________ |

 |                                                                           |

 |                                  <Ok>                                     |

 |                                                                           |

 +---------------------------------------------------------------------------+

 

# specify the hostname

 +------------------+ Configuring Kerberos Authentication +------------------+

 | Enter the hostname of the administrative (password changing) server for   |

 | the SMB.SERVER.WORLD Kerberos realm.                                      |

 |                                                                           |

 | Administrative server for your Kerberos realm:                            |

 |                                                                           |

 | smb.server.world_________________________________________________________ |

 |                                                                           |

 |                                  <Ok>                                     |

 |                                                                           |

 +---------------------------------------------------------------------------+

[2] Configure Samba

# rename or remove the default config file

root@smb:~# mv /etc/samba/smb.conf /etc/samba/smb.conf.org 

root@smb:~# samba-tool domain provision 

# specify Realm

Realm: SMB.SERVER.WORLD 

# specify Domain name

Domain [SMB]: SMB01 

# Enter with default because it sets DC

Server Role (dc, member, standalone) [dc]:

# Enter with default because it uses Built-in DNS

DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]:

# confirm DNS setting and Enter if it's OK

DNS forwarder IP address (write 'none' to disable forwarding) [10.0.0.10]:

# set admin password

# Do not set trivial password, if you input it, configuration wizard shows error and stops.

Administrator password:

Retype password:

Looking up IPv4 addresses

Looking up IPv6 addresses

No IPv6 address will be assigned

Setting up share.ldb

Setting up secrets.ldb

Setting up the registry

Setting up the privileges database

Setting up idmap db

Setting up SAM db

Setting up sam.ldb partitions and settings

Setting up sam.ldb rootDSE

Pre-loading the Samba 4 and AD schema

Adding DomainDN: DC=smb,DC=server,DC=world

Adding configuration container

Setting up sam.ldb schema

Setting up sam.ldb configuration data

Setting up display specifiers

Modifying display specifiers

Adding users container

Modifying users container

Adding computers container

Modifying computers container

Setting up sam.ldb data

Setting up well known security principals

Setting up sam.ldb users and groups

Setting up self join

Adding DNS accounts

Creating CN=MicrosoftDNS,CN=System,DC=smb,DC=server,DC=world

Creating DomainDnsZones and ForestDnsZones partitions

Populating DomainDnsZones and ForestDnsZones partitions

Setting up sam.ldb rootDSE marking as synchronized

Fixing provision GUIDs

A Kerberos configuration suitable for Samba 4 has been generated at /var/lib/samba/private/krb5.conf

Once the above files are installed, your Samba4 server will be ready to use

Server Role:           active directory domain controller

Hostname:              smb

NetBIOS Domain:        SMB01

DNS Domain:            smb.server.world

DOMAIN SID:            S-1-5-21-2788139304-4264175402-297299711

# restart the computer

root@smb:~# reboot

# raise domain level to 2008 R2

root@smb:~# samba-tool domain level raise --domain-level 2008_R2 --forest-level 2008_R2 

Domain function level changed!

Forest function level changed!

All changes applied successfully!

# confirm doman level

root@smb:~# samba-tool domain level show 

Domain and forest function level for domain 'DC=smb,DC=server,DC=world'

Forest function level: (Windows) 2008 R2

Domain function level: (Windows) 2008 R2

Lowest function level of a DC: (Windows) 2008 R2

# add a user in domain

root@smb:~# samba-tool user add trusty 

New Password:   # set password

Retype Password:

User 'trusty' created successfully