Samba AD DC : Join in Domain

Samba AD DC : Join in Domain 2015/02/18

	Join in Samba AD DC domain from a Client computer. This example shows to configure Windows Server 2012 R2.
[1]	Change DNS settings to refer to the Samba AD DC.

[2]	Open system's property and specify Samba AD DC domainname.

[3]	Authenticate with Administrator user. The password is just the one you set in Samba AD DC configuration.

[4]	After authentication, it can join AD Doman. Next, Restart the computer once.

[5]	It's possible to logon with the Administrator or users added in Samba AD DC.

[6]	Just logon to the Samba Active Directory domain.

Samba AD DC : Basic User Management

Samba AD DC : Basic User Management 2015/02/18

	This is the basic user management for Samba4 Active Directory Domain Controller.
[1]	Display domain users list.

[root@smb ~]#  samba-tool user list  Administrator krbtgt redhat Guest cent

[2]	Add a domain user.

[root@smb ~]#  samba-tool user add cent  New Password: # set password Retype Password: User 'cent' created successfully # see many other options with "samba-tool user add --help"

[3]	Delete a domain user.

[root@smb ~]#  samba-tool user delete cent  Deleted user cent

[4]	Reset password for a user.

[root@smb ~]#  samba-tool user setpassword cent  New Password: Changed password OK

[5]	Set expiry for a user.

[root@smb ~]#  samba-tool user setexpiry cent --days=7  Expiry for user 'cent' set to 7 days.

[6]	Disable/Enable user account.

[root@smb ~]#  samba-tool user disable cent [root@smb ~]#  samba-tool user enable cent  Enabled user 'cent'

[7]	Display domain groups list.

[root@smb ~]#  samba-tool group list  Allowed RODC Password Replication Group Enterprise Read-Only Domain Controllers Denied RODC Password Replication Group ... ... DnsAdmins Guests Users

[8]	Display members in a group.

[root@smb ~]#  samba-tool group listmembers "Domain Users"  redhat Administrator krbtgt cent

[9]	Add a domain group.

[root@smb ~]#  samba-tool group add ServerWorld  Added group ServerWorld # see many other options with "samba-tool group add --help"

[10]	Delete a domain group.

[root@smb ~]#  samba-tool group delete ServerWorld  Deleted group ServerWorld

[11]	Add/remove a member from a domain group.

[root@smb ~]#  samba-tool group addmembers ServerWorld cent  Added members to group ServerWorld [root@smb ~]#  samba-tool group removemembers ServerWorld cent  Removed members from group ServerWorld

Samba AD DC : Install

Samba AD DC : Install 2015/02/18

	Configute Samba Active Directory Domain Controller. The Samba package provided from official repository does not provide the DC function yet, so Download Samba RPM package from the EnterpriseSAMBA.com ( http://enterprisesamba.com/ ) which is introduced by Samba official site ( https://www.samba.org/ ).
[1]	Register your user info on the site below first to download Samba RPM package. https://portal.enterprisesamba.com/
[2]	After registration, access to the URL above again and click 'Login' to login the site.
[3]	After login, remember your username and accesskey which is displayed on the site. It's necessarry to set in repo file for yum later.
[4]	Scroll down the page and download 'sernet-samba-4.1.repo' for CentOS 7 to your PC or server. Next, upload it to the server you will install Samba4 and move it under the '/etc/yum.repos.d'.
[5]	Set your username and accesskey in repo file.

[root@smb ~]#  vi /etc/yum.repos.d/sernet-samba-4.1.repo # change to your username and accesskey [sernet-samba-4.1] name=SerNet Samba 4.1 Packages (centos-7) type=rpm-md baseurl=https:// USERNAME:ACCESSKEY @download.sernet.de/packages/samba/4.1/centos/7/ gpgcheck=1 gpgkey=https:// USERNAME:ACCESSKEY @download.sernet.de/packages/samba/4.1/centos/7/repodata/repomd.xml.key enabled=1

[6]	Install Samba.

[root@smb ~]#  yum -y install sernet-samba sernet-samba-ad

[7]	Configure Samba AD DC.

[root@smb ~]#  samba-tool domain provision  # specify Realm Realm [SERVER.WORLD]:  SERVER.WORLD  # specify Domain name Domain [SERVER]:  SMB01  # Enter with default because it sets DC Server Role (dc, member, standalone) [dc]: # Enter with default because it uses Built-in DNS DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]: # confirm DNS setting and Enter if it's OK DNS forwarder IP address (write 'none' to disable forwarding) [10.0.0.1]: # set admin password # Do not set trivial password, if you input it, configuration wizard shows error and stops. Administrator password: Retype password: Looking up IPv4 addresses Looking up IPv6 addresses ... ... A Kerberos configuration suitable for Samba 4 has been generated at /var/lib/samba/private/krb5.conf Once the above files are installed, your Samba4 server will be ready to use Server Role: active directory domain controller Hostname: smb NetBIOS Domain: SMB01 DNS Domain: server.world DOMAIN SID: S-1-5-21-1554426047-3808867033-1778000025 [root@smb ~]#  vi /etc/default/sernet-samba # line 7: change SAMBA_START_MODE=" ad " [root@smb ~]#  cp /var/lib/samba/private/krb5.conf /etc/krb5.conf  [root@smb ~]#  systemctl start sernet-samba-ad  [root@smb ~]#  chkconfig sernet-samba-ad on  [root@smb ~]#  chkconfig sernet-samba-smbd off  [root@smb ~]#  chkconfig sernet-samba-nmbd off  [root@smb ~]#  chkconfig sernet-samba-winbindd off

[8]	Raise the domain level to 2008 R2.

[root@smb ~]#  samba-tool domain level raise --domain-level 2008_R2 --forest-level 2008_R2  Domain function level changed! Forest function level changed! All changes applied successfully! # show domain level [root@smb ~]#  samba-tool domain level show  Domain and forest function level for domain 'DC=server,DC=world' Forest function level: (Windows) 2008 R2 Domain function level: (Windows) 2008 R2 Lowest function level of a DC: (Windows) 2008 R2

Samba Winbind

Samba Winbind 2015/01/18

	Join in Windows Active Directory Domain with Samba Winbind. This tutorial needs Windows Active Directory Domain Service in your LAN. This example shows to configure on the environment below. Domain Server : Windows Server 2012 R2 Domain Name : FD3S01 Realm : FD3S.SERVER.WORLD Hostname : fd3s.server.world
[1]	Install Winbind.

[root@smb ~]#  yum -y install samba-winbind samba-winbind-clients pam_krb5

[2]	Configure Winbind.

# change DNS to Active Directory Host [root@smb ~]#  nmcli c modify eno16777736 ipv4.dns 10.0.0.100  [root@smb ~]#  nmcli c down eno16777736; nmcli c up eno16777736  Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/1) [root@smb ~]#  authconfig \ --enablekrb5 \ --krb5kdc=fd3s.server.world \ --krb5adminserver=fd3s.server.world \ --krb5realm=FD3S.SERVER.WORLD \ --enablewinbind \ --enablewinbindauth \ --smbsecurity=ads \ --smbrealm=FD3S.SERVER.WORLD \ --smbservers=fd3s.server.world \ --smbworkgroup=FD3S01 \ --winbindtemplatehomedir=/home/%U \ --winbindtemplateshell=/bin/bash \ --enablemkhomedir \ --enablewinbindusedefaultdomain \ --update  Job for winbind.service failed. See 'systemctl status winbind.service' and 'journalctl -xn' for details. # it's no ploblem winbind failed like above now

[3]	Join in Windows Active Directory Domain.

# join in Active Directory ( net ads join -U [AD's admin user]) [root@smb ~]#  net ads join -U Administrator  Enter Serverworld's password: Using short domain name -- FD3S01 Joined 'LAN' to dns domain 'fd3s.server.world' DNS Update for lan.server.world failed: ERROR_DNS_GSS_ERROR DNS update failed: NT_STATUS_UNSUCCESSFUL [root@smb ~]#  systemctl start winbind  [root@smb ~]#  systemctl enable winbind # show domain info [root@smb ~]#  net ads info  LDAP server: 10.0.0.100 LDAP server name: fd3s.fd3s.server.world Realm: FD3S.SERVER.WORLD Bind Path: dc=FD3S,dc=SERVER,dc=WORLD LDAP port: 389 Server time: Mon, 19 Jan 2015 01:37:41 JST KDC server: 10.0.0.100 Server time offset: 0 # show AD users info [root@smb ~]#  wbinfo -u  administrator guest serverworld krbtgt # try to switch to an AD user [root@smb ~]#  su - serverworld  Creating directory '/home/serverworld'. [serverworld@lan ~]$

Limited Accessed Shared Folder

Limited Accessed Shared Folder 2014/07/16

	Install Samba to configure File Server. This example shows to create a shared Folder which requires user authentication.
[1]	Configure Samba.

[root@smb ~]#  yum -y install samba samba-client [root@smb ~]#  groupadd security  [root@smb ~]#  mkdir /home/security  [root@smb ~]#  chgrp security /home/security  [root@smb ~]#  chmod 770 /home/security  [root@smb ~]#  vi /etc/samba/smb.conf # near line 66: add follows unix charset = UTF-8 # line 89: change (Windows' default) workgroup =  WORKGROUP # line 95: uncomment and change IP address you allow hosts allow = 127.  10.0.0. # add follows to the end [Security] # any name you like     path = /home/security     writable = yes     create mode = 0770     directory mode = 0770     share modes = yes     guest ok = no # guest not allowed     valid users = @security # allow only security group [root@smb ~]#  systemctl start smb nmb  [root@smb ~]#  systemctl enable smb nmb  # add a user in Samba [root@smb ~]#  smbpasswd -a cent  New SMB password:      # set password Retype new SMB password:      # confirm Added user cent. [root@smb ~]#  usermod -G security cent

[2]	If Firewalld is running, allow Samba service.

[root@smb ~]#  firewall-cmd --add-service=samba --permanent  success [root@smb ~]#  firewall-cmd --reload  success

[3]	If SELinux is enabled, change SELinux Context.

[root@smb ~]#  setsebool -P samba_enable_home_dirs on  [root@smb ~]#  restorecon -R /home/security

[4]	It's the way to access to the shared folder. This example is on Windows 10.  Select [Computer] - [Map Network Drive].

[5]	Specify the shared folder's place in Folder section and Click the 'Finish' button to enter.

[6]	Authentication required. Input the username and password you added in Samba.

[7]	Just accessed.

Fully Accessed Shared Folder

2014/07/16

	Install Samba to configure File Server. This example shows to create a fully accessed shared Folder which anybody can read and write, and also authentication is not required.
[1]	Configure Samba.

[root@smb ~]#  yum -y install samba samba-client [root@smb ~]#  mkdir /home/share  [root@smb ~]#  chmod 777 /home/share  [root@smb ~]#  vi /etc/samba/smb.conf # near line 66: add follows unix charset = UTF-8 dos charset = CP932 # line 90: change (Windows' default) workgroup =  WORKGROUP # line 96: uncomment and change IP address you allow hosts allow = 127.  10.0.0. # line 126: add ( no auth ) security = user passdb backend = tdbsam map to guest = Bad User # add follows to the end [Share] # any name you like     path = /home/share # shared directory     writable = yes # writable     guest ok = yes # guest allowed     guest only = yes # guest only     create mode = 0777 # fully accessed file     directory mode = 0777 # fully accessed directory     share modes = yes # warn if accessed concurrency to a file [root@smb ~]#  systemctl start smb nmb  [root@smb ~]#  systemctl enable smb nmb

[2]	If Firewalld is running, allow Samba service.

[root@smb ~]#  firewall-cmd --add-service=samba --permanent  success [root@smb ~]#  firewall-cmd --reload  success

[3]	If SELinux is enabled, change SELinux Context.

[root@smb ~]#  setsebool -P samba_enable_home_dirs on  [root@smb ~]#  restorecon -R /home/share

[4]	It's the way to access to the shared folder. This example is on Windows 10.  Select [Computer] - [Map Network Drive].

[5]	Specify the shared folder's place in Folder section and Click the 'Finish' button to enter.

[6]	Just accessed to the shared Folder.