> I have another samba server and upgraded it to samba4. testparm returns
> clean with the old config (ROLE_DOMAIN_PDC) and starts up fine. smbclient
> seems to work fine.
>
> The next thing now is to try and make it a domain member so it can auth
> against AD.
>
> Thanks, Andrew, I appreciate the pointers.
You might want to take a look at "Integrating Red Hat Enterprise Linux 6 with Active Directory". It's the best document I've seen on this topic. I found that Samba/Kerberos/Winbind is the most complete solution for attaching a Samba fileserver in my AD environment. https://access.redhat.com/sites/default/files/attachments/rhel-ad-integration-deployment-guidelines-v1.5.pdf
SSSD is really the way to go if you're running Centos 7, take a look at "Red Hat Enterprise Linux 7 Windows Integration Guide":
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/pdf/Windows_Integration_Guide/Red_Hat_Enterprise_Linux-7-Windows_Integration_Guide-en-US.pdf
Below is my documentation on how to attach a RHEL/CentOS system to an Active Directory Domain using Samba/Kerberos/Winbind. This configuration will allow you to provide SMB file sharing and SSH logins for users in your AD domain. Note this works in my AD domain but there might be some additional settings required for your AD domain. Work closely with your AD domain administrator.
The name of the example server in this document is server.example.com, substitute all values specific to your environment. Sample configuration files are included following these directions. The following packages should be installed:
samba4, samba4-common, samba4-client, samba4-winbind, samba4-winbind-clients, krb5-workstation, openldap-clients
1. Set NTP to use the correct server for your Active Directory domain:
system-config-time
Set the primary NTP server to be your domain/forest NTP server
NTP_IP_address
2. Make backups of and edit the following system configuration files:
a. cp -p /etc/resolv.conf{,.bak}
b. vi /etc/resolv.conf
c. cp -p /etc/hosts{,.bak}
d. vi /etc/hosts
e. cp -p /etc/nsswitch.conf{,.bak}
f. vi /etc/nsswitch.conf
g. cp -p /etc/samba/smb.conf{,.bak}
h. vi /etc/samba/smb.conf
If you are editing a smb.conf file of a previously existing Samba fileserver, do not change the range value in the "idmap config * : range =" parameter
i. cp -p /etc/krb5.conf{,.bak}
j. vi /etc/krb5.conf
3. Start the smb and winbind services:
a. /etc/init.d/smb start
b. /etc/init.d/winbindd start
Note that smb and winbind daemons need to be set to start up on boot. In addition, the appropriate TCP ports will need to open on the system firewall if you are deploying a SMB/CIFS fileserver.
4. Create a computer record in your Active Directory OU Computers container:
For server.example.com create a computer record called server
5. Initialize Kerberos and attach it to the Active Directory domain:
a. kinit username
b. net ads join -w EXAMPLE.COM -U username
6. Verify the bind to AD is valid:
a. net ads info
b. net ads testjoin
7. Create a Kerberos /etc/krb5.keytab file:
net ads keytab create -U username
8. Verify the contents of the Kerberos keytab file:
klist -ke
9. Add a share that has access restricted to an Active Directory group:
a. mkdir /data
b. vi /etc/samba/smb.conf
After the [homes}, section add the following text:
[data]
comment = Data Directory
path = /data
valid users = @"DOMAIN\AD_Group"
writable = yes
browseable = yes
Substitute DOMAIN\AD_Group with an AD group that will be accessing this share.
c. /etc/init.d/smb restart
10. Enable home directory creation
a. system-config-authentication
b. In the Advance Options tab, check the "Create home directories on the first login" checkbox.
11. Restrict SSH logins to a specific local and Active Directory groups
Add this line to /etc/ssh/sshd_config:
a. AllowGroups group_name
Replace group_name with your local and AD group names. Note that the group names cannot have a space in the group name. Also make sure that at least one local group is added, otherwise you will not be able to SSH into your own server with a local account.
12. Restart your server
Sample files:
/etc/resolv.conf
search example.com
nameserver IP_address
/etc/hosts
127.0.0.1 localhost.localdomain localhost
IP_address server.example.com server
/etc/nsswitch.conf
passwd: files winbind
shadow: files winbind
group: files winbind
hosts: files dns wins
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files
netgroup: files
publickey: nisplus
automount: files
aliases: files nisplus
/etc/samba/smb.conf
workgroup = example
realm = EXAMPLE.COM
server string = %h
password server = *
security = ads
client use spnego principal = yes
client use spnego = yes
kerberos method = secrets and keytab
server max protocol = SMB3
client signing = auto
server signing = auto
machine password timeout = 0
template shell = /bin/bash
winbind use default domain = true
winbind offline logon = false
winbind refresh tickets = true
idmap config * : range = 16777216-33554431
/etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = EXAMPLE.COM
default_keytab_name = /etc/krb5.keytab
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
forwardable = yes
[realms]
EXAMPLE.COM = {
kdc = kdc.example.com.:88
kdc = IP_address
admin_server = kdc.example.com
kdc = IP_address
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf
[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
Andrew
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
https://lists.centos.org/mailman/listinfo/centos
