Editing Samba4 implementation document

[[category:Installation]]
==Samba 4 on centos 6.2 ( dated 27/12/2012)==

==Caution==

'''Do not try on Centos 5.8 or below''' , You might end up spend lot of time .python 2.6 is required which is not by default .

EPEL repo http://dl.fedoraproject.org/pub/epel/5/i386/epel-release-5-4.noarch.rpm . But still issue will remian 

==Reference Document== 

https://wiki.samba.org/index.php/Samba4/HOWTO

https://wiki.samba.org/index.php/Samba4/InitScript

https://wiki.samba.org/index.php/Samba_4/OS_Requirements#Red_Hat_Enterprise_Linux_or_CentOS

==Initial Requirement Fulfilment== 

Install following Dependencies 

 yum install libacl-devel libblkid-devel gnutls-devel \
   readline-devel python-devel gdb pkgconfig krb5-workstation perl gcc \ 
   zlib-devel setroubleshoot-server \
   setroubleshoot-plugins policycoreutils-python \
   libsemanage-python setools-libs-python setools-libs \
   popt-devel libpcap-devel sqlite-devel libidn-devel \
   libxml2-devel libacl-devel libsepol-devel libattr-devel \
   keyutils-libs-devel cyrus-sasl-devel

==Download Samba == 

http://ftp.samba.org/pub/samba/

=Installation of Samba 4 =

Untar Samba tar file

==Compile Samba==

To build Samba, run the following command in your samba-master directory:

 cd samba-master
 ./configure --enable-debug --enable-selftest
 make && make install

This will take 1+ hour to complete 

==Provision Samba== 

Our Test Environment 

 Server IP - 192.168.1.13
 Server FQDN - samba4.tetra.in
 Server Small name - samba4

Start By following command 

 /usr/local/samba/bin/samba-tool domain provision

And Choose as per logically required . In our environment we have choosen 

 Realm [TETRA.IN]: 
 Domain [TETRA]: 
 Server Role (dc, member, standalone) [dc]: 
 DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]: 
 DNS forwarder IP address (write 'none' to disable forwarding) [8.8.8.8]: 
 Administrator password: Pa$$w0rd
 Retype password: Pa$$w0rd

Final Out Put 


A Kerberos configuration suitable for Samba 4 has been generated at /usr/local/samba/private/krb5.conf

Once the above files are installed, your Samba4 server will be ready to use

Server Role:           active directory domain controller

Hostname:              samba4

NetBIOS Domain:        TETRA

DNS Domain:            tetra.in

DOMAIN SID:            S-1-5-21-1363742443-4022821226-899015789

==Starting Samba== 

 /usr/local/samba/sbin/samba

We have created the rc.script via https://wiki.samba.org/index.php/Samba4/InitScript

Check the Smaba via process information ( ps -ef ) and netstat -ntplu

==Testing Samba as an AD DC== 

 /usr/local/samba/bin/smbclient --version

This should show you a version starting with "Version 4.0.XXXXX". 

Now run this command to list the shares on your Samba server:

 /usr/local/samba/bin/smbclient -L localhost -U%

The output of the command should be similar to what is shown below:

       Sharename       Type      Comment
       ---------       ----      -------
       netlogon        Disk
       sysvol          Disk
       IPC$            IPC       IPC Service (Samba 4.0.0)

The netlogon and sysvol shares are basic shares needed for Active Directory server operation. 

To test that authentication is working, you should try to connect to the netlogon share using the Administrator password you set earlier:

 smbclient //localhost/netlogon -UAdministrator%'p4$$word' -c 'ls'

The output of the command should be similar to what is shown below:

 Domain=[SAMDOM] OS=[Unix] Server=[Samba 4.0.0beta9-GIT-e4677e3]
  .                                   D        0  Wed Sep 12 21:00:36 2012
  ..                                  D        0  Wed Sep 12 21:02:28 2012


==Configure /etc/resolv.conf==

For all the local DNS lookups to resolve correctly, we need to modify the server's /etc/resolv.conf file. The following example should be sufficient to have DNS resolve properly:

 domain tetra.in
 nameserver 192.168.1.13

Note: Remember to change the IP Address to your Samba server's IP Address
Note: If your server is set up to receive its IP configuration via DHCP, the /etc/resolv.conf file might be automatically updated. Refer to your distribution's documentation on how to stop this behavior. 

==Testing DNS==

To test that DNS is working properly, run the following commands and compare the output to what is shown:

 $ host -t SRV _ldap._tcp.tetra.in
 _ldap._tcp.tetra.in has SRV record 0 100 389 samba4.tetra.in

 $ host -t SRV _kerberos._udp.tetra.in.
 _kerberos._udp.tetra.in has SRV record 0 100 88 samba4.tetra.in

 $ host -t A samba4.tetra.in.
 samba4.tetra.in has address 192.168.1.13

The answers you get should be similar to the ones above (adjusted for your DNS domain name and hostname). If you get any errors, carefully check your system logs to locate the problem.

==Configure Kerberos==

Kerberos configuration is handled by the krb.conf file. This file is typically located in the /etc directory, please refer to your distribution documentation for the location of this file on your system. Replace the existing file, if any, with the sample from /usr/local/samba/share/setup/krb5.conf. Edit the file and replace ${REALM} with the value you chose for the --realm parameter of the provision command above, make sure to enter the realm in uppercase letters:

 [libdefaults]
    default_realm = TETRA.IN
    dns_lookup_realm = false
    dns_lookup_kdc = true

==Testing Kerberos==

The simplest test is to use the kinit command as follows:

 $ kinit administrator@TETRA.IN
 Password:

Note: You must specify your domain realm TETRA.iN in uppercase letters 

kinit will not give you any output. To verify that Kerberos is working, and that you received a ticket, run the following:

 $ klist
 Ticket cache: FILE:/tmp/krb5cc_1000
 Default principal: administrator@TETRA.IN
 Valid starting     Expires            Service principal
 12/29/12 19:39:48  02/11/10 19:39:46  krbtgt/TETRA.IN@TETRA.IN


==Configure NTP==

Install NTP via YUM
 yum install ntp 

Add following at the end /etc/ntpd.conf

 ntpsigndsocket /usr/local/samba/var/lib/ntp_signd/
 restrict default mssntp


Start NTP server via 

 service ntpd start 
 chkconfig ntpd on 



==Adding Users into Samba 4 Active Directory  ( Text method )==

 /usr/local/samba/bin/samba-tool user add USERNAME 


user - biswajit
pass sys%%0bb

user - navdeep
pass -ss&&0099