Installation

Interface anpassen

vi /etc/network/interfaces

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
address 192.168.240.199
netmask 255.255.248.0
gateway 192.168.240.100
dns-nameservers 192.168.240.199 8.8.8.8
dns-search xinux.lan

hosts anpassen

vi /etc/hosts
127.0.0.1       localhost
192.168.240.199 fenetre fenetre.xinux.lan
echo fenetre.xinux.lan > /etc/hostname
reboot

samba4 installieren

apt-get install samba smbclient winbind

Domain anlegen

vorher das löschen:

rm /etc/samba/smb.conf

realm, domain und adminpass sollten/können angepasst werden!

samba-tool domain provision --realm=xinux.lan --domain=xinux --adminpass="Z0pp0Trump" --server-role=dc --dns-backend=SAMBA_INTERNAL

Reboot

reboot

smbversion, share und auth check

smbversion

Diese sollten übereinstimmen:

root@fenetre:~# samba -V
Version 4.1.6-Ubuntu
root@fenetre:~# smbclient -V
Version 4.1.6-Ubuntu

shares anzeigen:

root@fenetre:~# smbclient -L localhost -U%
Domain=[XINUX] OS=[Unix] Server=[Samba 4.1.6-Ubuntu]

	Sharename       Type      Comment
	---------       ----      -------
	netlogon        Disk      
	sysvol          Disk      
	IPC$            IPC       IPC Service (Samba 4.1.6-Ubuntu)
Domain=[XINUX] OS=[Unix] Server=[Samba 4.1.6-Ubuntu]

	Server               Comment
	---------            -------

	Workgroup            Master
	---------            -------
	WORKGROUP

Authentication check:

root@fenetre:~# smbclient //localhost/netlogon -UAdministrator%"Z0pp0Trump" -c 'ls'
Domain=[XINUX] OS=[Unix] Server=[Samba 4.1.6-Ubuntu]
  .                                   D        0  Thu Apr 24 15:51:50 2014
  ..                                  D        0  Thu Apr 24 15:51:54 2014

		52706 blocks of size 524288. 47502 blocks available

DNS setzen

Forwarder eintragen

sudo vi  /etc/samba/smb.conf

füge hinzu: (Man kann natürlich auch seinen eigenen DNS angeben)

dns forwarder = 192.168.240.21

Check

DOMAIN="xinux.lan"
CONTROLLER="fenetre"
root@fenetre:~# host -t SRV _ldap._tcp.$DOMAIN
_ldap._tcp.xinux.lan has SRV record 0 100 389 fenetre.xinux.lan.

root@fenetre:~# host -t SRV _kerberos._udp.$DOMAIN
_kerberos._udp.xinux.lan has SRV record 0 100 88 fenetre.xinux.lan.

root@fenetre:~# host -t A $CONTROLLER.$DOMAIN
fenetre.xinux.lan has address 192.168.240.199

Kerberos

ändere $(REALM) zu MYDOMAIN.LAN

vi /usr/local/samba/share/setup/krb5.conf

Share hinzufügen

mkdir -m 770 /share
chmod g+s /share
chown root:users /share

vi /usr/local/samba/etc/smb.conf

füg das ein:

[share]
directory_mode: parameter = 0700
read only = no
path = /share
csc policy = documents

Misc

ntp

vi /etc/ntp.conf

füge einen von hier hinzu:

http://www.pool.ntp.org/zone/de

service ntp restart
ntpdate 0.de.pool.ntp.org
ntpq -p

Adminpasswort läuft nicht ab

/usr/local/samba/bin/samba-tool user setexpiry administrator --noexpiry

samba upstart script

vi /etc/init.d/samba

description "SMB/CIFS File and Active Directory Server"
author      "Jelmer Vernooij <jelmer@ubuntu.com>" 

start on (local-filesystems and net-device-up)
stop on runlevel [!2345]

expect fork
normal exit 0 

pre-start script
	[ -r /etc/default/samba4 ] && . /etc/default/samba4
	install -o root -g root -m 755 -d /var/run/samba
	install -o root -g root -m 755 -d /var/log/samba
end script 
 
exec samba -D

Kennwortrichtlinie in Samba 4 Domain deaktivieren

samba-tool domain passwordsettings set --complexity=off
samba-tool domain passwordsettings set --history-length=0
samba-tool domain passwordsettings set --min-pwd-age=0
samba-tool domain passwordsettings set --max-pwd-age=0
samba-tool domain passwordsettings set --min-pwd-length 0

Kennwortrichtlinie in Samba 4 Domain anzeigen

samba-tool domain passwordsettings show

Freigaben einrichten

Die Partition muss mit den Optionen user_xattr und acl  gemountet sein ... 
/dev/vdb /mnt    ext4 user_xattr,acl 1 1

SeDiskOperatorPrivilege

net rpc rights grant 'WILLUX\Domain Admins' SeDiskOperatorPrivilege -Uadministrator

Vorhandene Rechte lassen sich so Anzeige

net rpc rights list accounts -Uadministrator

Winbind

winbind links setzen

Architektur ermitteln

gcc -print-multiarch

Links ersetzen

ln -s /usr/local/samba/lib/libnss_winbind.so.2 /lib/$(gcc -print-multiarch)/libnss_winbind.so
ln -s /lib/$(gcc -print-multiarch)/libnss_winbind.so /lib/x86_64-linux-gnu/libnss_winbind.so.2

aus den paketen

ln -s /lib/x86_64-linux-gnu/libnss_winbind.so.2 /lib/x86_64-linux-gnu/libnss_winbind.so

nsswitch.conf ändern

passwd:         compat winbind
group:          compat winbind

ist winbind is "pingbar

/usr/local/samba/bin/wbinfo -p 
Ping to winbindd succeeded

anzeigen der userliste

/usr/local/samba/bin/wbinfo -u
Administrator
Guest
krbtgt

funtioniert nsswitch

getent passwd
...
WILLUX\Administrator:*:0:100::/home/WILLUX/Administrator:/bin/false
WILLUX\Guest:*:3000011:3000012::/home/WILLUX/Guest:/bin/false
WILLUX\krbtgt:*:3000017:100::/home/WILLUX/krbtgt:/bin/false

Debian Samba4 ADS Domaincontroller

Inhaltsverzeichnis