Samba AD DC : Configure DC

Configute Samba Active Directory Domain Controller. This example configures on the environment bellow. Domain name : SMB01 Realm : SRV.WORLD Hostname : smb.srv.world
[1]Install some packages.
root@smb:~# apt -y install samba krb5-config winbind smbclient # set Realm
+––––––+ Configuring Kerberos Authentication +––––––+ | When users attempt to use Kerberos and specify a principal or user name | | without specifying what administrative Kerberos realm that principal | | belongs to, the system appends the default realm. The default realm may | | also be used as the realm of a Kerberos service running on the local | | machine. Often, the default realm is the uppercase version of the local | | DNS domain. | | | | Default Kerberos version 5 realm: | | | | SRV.WORLD________________________________________________________________ | | | | <Ok> | | | +–––––––––––––––––––––––––+ # specify the hostname
+––––––+ Configuring Kerberos Authentication +––––––+ | Enter the hostnames of Kerberos servers in the SRV.WORLD Kerberos | | realm separated by spaces. | | | | Kerberos servers for your realm: | | | | smb.srv.world____________________________________________________________ | | | | <Ok> | | | +–––––––––––––––––––––––––+ # specify the hostname
+––––––+ Configuring Kerberos Authentication +––––––+ | Enter the hostname of the administrative (password changing) server for | | the SRV.WORLD Kerberos realm. | | | | Administrative server for your Kerberos realm: | | | | smb.srv.world____________________________________________________________ | | | | <Ok> | | | +–––––––––––––––––––––––––+
[2]Configure Samba.
# rename or remove the default config file
root@smb:~# mv /etc/samba/smb.conf /etc/samba/smb.conf.org
root@smb:~# samba-tool domain provision
# specify Realm
Realm [SRV.WORLD]: SRV.WORLD
# specify Domain name
Domain [SRV]: SMB01
# Enter with default because it sets DC
Server Role (dc, member, standalone) [dc]:
# Enter with default because it uses Built-in DNS
DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]:
# confirm DNS setting and Enter if it’s OK
DNS forwarder IP address (write ‘none’ to disable forwarding) [10.0.0.10]:
# set admin password
# Do not set trivial password, if you input it, configuration wizard shows error and stops
Administrator password: Retype password: Looking up IPv4 addresses Looking up IPv6 addresses No IPv6 address will be assigned Setting up share.ldb Setting up secrets.ldb Setting up the registry Setting up the privileges database Setting up idmap db Setting up SAM db Setting up sam.ldb partitions and settings Setting up sam.ldb rootDSE Pre-loading the Samba 4 and AD schema Adding DomainDN: DC=srv,DC=world Adding configuration container Setting up sam.ldb schema Setting up sam.ldb configuration data Setting up display specifiers Modifying display specifiers Adding users container Modifying users container Adding computers container Modifying computers container Setting up sam.ldb data Setting up well known security principals Setting up sam.ldb users and groups Setting up self join Adding DNS accounts Creating CN=MicrosoftDNS,CN=System,DC=srv,DC=world Creating DomainDnsZones and ForestDnsZones partitions Populating DomainDnsZones and ForestDnsZones partitions Setting up sam.ldb rootDSE marking as synchronized Fixing provision GUIDs A Kerberos configuration suitable for Samba 4 has been generated at /var/lib/samba/private/krb5.conf Once the above files are installed, your Samba4 server will be ready to use Server Role: active directory domain controller Hostname: smb NetBIOS Domain: SMB01 DNS Domain: srv.world DOMAIN SID: S-1-5-21-2545056461-174665597-1916133120 root@smb:~# cp /var/lib/samba/private/krb5.conf /etc/
root@smb:~# systemctl stop smbd nmbd winbind
root@smb:~# systemctl disable smbd nmbd winbind
root@smb:~# systemctl unmask samba-ad-dc
Removed /etc/systemd/system/samba-ad-dc.service.
root@smb:~# systemctl start samba-ad-dc
root@smb:~# systemctl enable samba-ad-dc # show status
root@smb:~# smbclient -L localhost -U%
Domain=[SMB01] OS=[Windows 6.1] Server=[Samba 4.5.8-Debian] Sharename Type Comment ––– –- ––- netlogon Disk sysvol Disk IPC$ IPC IPC Service (Samba 4.5.8-Debian) Domain=[SMB01] OS=[Windows 6.1] Server=[Samba 4.5.8-Debian] Server Comment ––– ––- Workgroup Master ––– ––- WORKGROUP
[3]Confirm doman level and add a Domain user.
# confirm doman level
root@smb:~# samba-tool domain level show
Domain and forest function level for domain ‘DC=srv,DC=world’ Forest function level: (Windows) 2008 R2 Domain function level: (Windows) 2008 R2 Lowest function level of a DC: (Windows) 2008 R2 # add a donain user
root@smb:~# samba-tool user create debian
New Password:   # set password
Retype Password:
User ‘debian’ created successfully

Installing the snap in writable mode

The snap is by definition read-only, but some times it’s useful to poke at the contents of it to see what’s going on. If we want to do that, there are some hoops we can jump through to get there. Note that this is not recommended for production use. The snap won’t be as secure and will no longer update if you do this. This is handy for development/experimentation, nothing more.

I’m runnning these commands on a fully up-to-date Ubuntu 18.04, they are untested elsewhere. I know from experience that this does not work with home disk encryption (ecryptfs), but full disk encryption is fine.

Download the snap in question

This will download both the snap and the store assertion (store signature for the snap). You can optionally specify the channel, it will default to using stable:

$ snap download nextcloud [--channel=14/candidate]

Unpack the snap

We’re doing this so that we can modify it (otherwise we wouldn’t be able to write to the squashfs image):

$ unsquashfs nextcloud_10079.snap

That unpacks by default to a directory named „squashfs-root“.

Install the snap in read/write mode

We can use snap try to install the snap in read/write mode now that we’ve unpacked it:

$ sudo snap try squashfs-root

Use nextcloud and tinker away

The snap will fire up after the snap try command and start listening on port 80, so you can just visit http://localhost in your browser to create an admin user and get up and running. The Nextcloud sources are in squashfs-root/htdocs/, although note that the config being used is not in there, but in /var/snap/nextcloud/current/nextcloud/config/.

Remove nextcloud when done

When you’re satisfied with your tinkering, you can uninstall the Nextcloud snap like normal, getting rid of the config and all data:

$ sudo snap remove nextcloud

Linux lessons section

Samba AD DC : Configure DC

Configute Samba Active Directory Domain Controller. This example configures on the environment bellow. Domain name : SMB01 Realm : SRV.WORLD Hostname : smb.srv.world[1]Install some packages. root@smb:~# apt -y install samba krb5-config winbind smbclient # set...

Installing the snap in writable mode

The snap is by definition read-only, but some times it's useful to poke at the contents of it to see what's going on. If we want to do that, there are some hoops we can jump through to get there. Note that this is not recommended for production use. The snap won't be...

error: Content is protected !!