SMB4 AD and Bind<\/p>\n\n\n\n
See DNS\/DHCP page for domain info.<\/p>\n\n\n\n
sudo apt-get update\nsudo apt-get update && sudo apt-get upgrade<\/strong><\/pre>\n\n\n\nInstall the acl<\/strong><\/p>\n\n\n\n
sudo apt-get install acl attr<\/strong><\/pre>\n\n\n\nConfigure acl<\/strong> in the \/etc\/fstab<\/p>\n\n\n\n
sudo nano \/etc\/fstab<\/strong><\/pre>\n\n\n\n\/dev\/mapper\/vg0-lv_data \/ ext4 user_xattr,acl,barrier=1,noatime 0 0\n<\/strong><\/pre>\n\n\n\nmount -a<\/strong><\/pre>\n\n\n\nReboot<\/strong><\/p>\n\n\n\n
Installing Samba software<\/p>\n\n\n\n
sudo apt-get install samba smbclient build-essential libacl1-dev libattr1-dev \\\n libblkid-dev libgnutls-dev libreadline-dev python-dev libpam0g-dev \\\n python-dnspython gdb pkg-config libpopt-dev libldap2-dev \\\n dnsutils libbsd-dev krb5-user docbook-xsl libcups2-dev ldb-tools<\/pre>\n\n\n\nDuring the installation process you will be asked some questions:<\/p>\n\n\n\n
\n
- Kerberos Authentication: MYDC.ABC.LAN<\/strong><\/li>\n\n\n\n
- hostname of Kerberos server: dcsrv.abc.lan<\/strong><\/li>\n\n\n\n
- hostname of the Administrative: dcsrv.abc.lan<\/strong><\/li>\n<\/ul>\n\n\n\n
Remove your old smb.conf\nsudo rm \/etc\/samba\/smb.conf<\/strong><\/pre>\n\n\n\nProvision AD:<\/p>\n\n\n\n
sudo samba-tool domain provision --use-rfc2307 --interactive<\/strong><\/pre>\n\n\n\nInput the following:<\/p>\n\n\n\n
\n
- Realm: MYDC.ABC.LAN<\/strong><\/li>\n\n\n\n
- DNS Backend: BIND9_DLZ<\/strong><\/li>\n<\/ul>\n\n\n\n
Realm: MYDC.ABC.LAN<\/strong>\n Domain [MYDC]: \n Server Role (dc, member, standalone) [dc]: \n DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]: BIND9_DLZ\nAdministrator password: \nRetype password: \nLooking up IPv4 addresses\nLooking up IPv6 addresses\nNo IPv6 address will be assigned\nSetting up share.ldb\nSetting up secrets.ldb\nSetting up the registry\nSetting up the privileges database\nSetting up idmap db\nSetting up SAM db\nSetting up sam.ldb partitions and settings\nSetting up sam.ldb rootDSE\nPre-loading the Samba 4 and AD schema\nAdding DomainDN: DC=mydc,DC=abc,DC=lan\nAdding configuration container\nSetting up sam.ldb schema\nSetting up sam.ldb configuration data\nSetting up display specifiers\nModifying display specifiers\nAdding users container\nModifying users container\nAdding computers container\nModifying computers container\nSetting up sam.ldb data\nSetting up well known security principals\nSetting up sam.ldb users and groups\nSetting up self join\nAdding DNS accounts\nCreating CN=MicrosoftDNS,CN=System,DC=mydc,DC=abc,DC=lan\nCreating DomainDnsZones and ForestDnsZones partitions\nPopulating DomainDnsZones and ForestDnsZones partitions\nSee \/var\/lib\/samba\/private\/named.conf for an example configuration include file for BIND\nand \/var\/lib\/samba\/private\/named.txt for further documentation required for secure DNS updates\nSetting up sam.ldb rootDSE marking as synchronized\nFixing provision GUIDs\nA Kerberos configuration suitable for Samba 4 has been generated at \/var\/lib\/samba\/private\/krb5.conf\nSetting up fake yp server settings\nOnce the above files are installed, your Samba4 server will be ready to use\nServer Role: active directory domain controller\nHostname: dcsrv\nNetBIOS Domain: MYDC\nDNS Domain: mydc.abc.lan\nDOMAIN SID: S-1-5-21-416587768-2115368124-2463890298\n<\/pre>\n\n\n\nDisable Domain administrator pasword from expiring. Note: its two dashes on noexpiry<\/strong><\/h2>\n\n\n\n
sudo samba-tool user setexpiry Administrator \u2013noexpiry<\/p>\n\n\n\n
Configuring Samba and Bind.<\/h2>\n\n\n\n
Edit the file \/etc\/samba\/smb.conf and add the following lines to the end of the [global] section.<\/p>\n\n\n\n
sudo nano \/etc\/samba\/smb.conf<\/strong><\/pre>\n\n\n\nallow dns updates = nonsecure and secure \n dns forwarder = 10.0.2.99\n printing = CUPS\n printcap name = \/dev\/null<\/strong><\/pre>\n\n\n\nAdd the following to \/etc\/bind\/named.conf.options at the end of the options. You may need to remove any duplicate existing lines.<\/p>\n\n\n\n
sudo nano \/etc\/bind\/named.conf.options<\/strong><\/pre>\n\n\n\nauth-nxdomain yes; \n empty-zones-enable no;\n tkey-gssapi-keytab \"\/var\/lib\/samba\/private\/dns.keytab\";<\/strong><\/pre>\n\n\n\nChoose your version of BIND by removing comment (see example below).<\/p>\n\n\n\n
sudo nano \/var\/lib\/samba\/private\/named.conf<\/strong><\/pre>\n\n\n\ndlz \"AD DNS Zone\" {\n # For BIND 9.8.0\n# database \"dlopen \/usr\/lib\/x86_64-linux-gnu\/samba\/bind9\/dlz_bind9.so\";\n \n # For BIND 9.9.0\n database \"dlopen \/usr\/lib\/x86_64-linux-gnu\/samba\/bind9\/dlz_bind9_9.so\";\n};<\/strong><\/pre>\n\n\n\nAdd the following to \/etc\/bind\/named.conf as the second line in the included section.<\/p>\n\n\n\n
sudo nano \/etc\/bind\/named.conf<\/strong><\/pre>\n\n\n\ninclude \"\/var\/lib\/samba\/private\/named.conf\";<\/strong><\/pre>\n\n\n\nAdd the following apparmor rules to the end of \/etc\/apparmor.d\/usr.sbin.named inside the { }<\/p>\n\n\n\n
sudo nano \/etc\/apparmor.d\/usr.sbin.named<\/strong><\/pre>\n\n\n\n\/usr\/lib\/x86_64-linux-gnu\/samba\/** rwmk,\n \/usr\/lib\/x86_64-linux-gnu\/ldb\/** rwmk,\n \/var\/lib\/samba\/private\/dns\/** rwmk,\n \/var\/lib\/samba\/private\/named.conf r,\n \/var\/lib\/samba\/private\/dns.keytab rk,\n \n \/dev\/urandom rw,<\/strong><\/pre>\n\n\n\nStatic IP should be set from the DNS\/DHCP tutorial. You will need to change the DNS name server to localhost 127.0.0.1<\/p>\n\n\n\n
auto eth0\niface eth0 inet static\n address 10.1.200.3\n gateway 10.1.200.1\n netmask 255.255.255.0\n dns-nameservers 127.0.0.1<\/strong><\/em>\n dns-search abc.lan\n\nreboot\n<\/pre>\n\n\n\nDone.<\/p>\n","protected":false},"excerpt":{"rendered":"
SMB4 AD and Bind \u201cUbuntu 14.04 LTS\u201d See DNS\/DHCP page for domain info. sudo apt-get update sudo apt-get update && sudo apt-get upgrade Install the acl sudo apt-get install acl attr Configure acl in the \/etc\/fstab sudo nano \/etc\/fstab \/dev\/mapper\/vg0-lv_data \/ ext4 user_xattr,acl,barrier=1,noatime 0 … Continue reading