Samba4 implementation document - Revision history

Biswajit: /* Testing DNS */

2013-02-09T11:21:27Z

Testing DNS

← Older revision		Revision as of 11:21, 9 February 2013
Line 140:		Line 140:

	$ host -t SRV _ldap._tcp.tetra.in		$ host -t SRV _ldap._tcp.tetra.in
	_ldap._tcp.tetra.in has SRV record 0 100 389 samba4.tetra.in		_ldap._tcp.tetra.in has SRV record 0 100 389 samba4.tetra.in

	$ host -t SRV _kerberos._udp.~~samdom~~.~~example.com~~.		$ host -t SRV _kerberos._udp.tetra.in.
	_kerberos._udp.tetra.in has SRV record 0 100 88 samba4.tetra.in		_kerberos._udp.tetra.in has SRV record 0 100 88 samba4.tetra.in

	$ host -t A ~~samba~~.~~samdom~~.~~example.com~~.		$ host -t A samba4.tetra.in.
	samba4.tetra.in has address 192.168.1.13		samba4.tetra.in has address 192.168.1.13

	The answers you get should be similar to the ones above (adjusted for your DNS domain name and hostname). If you get any errors, carefully check your system logs to locate the problem.		The answers you get should be similar to the ones above (adjusted for your DNS domain name and hostname). If you get any errors, carefully check your system logs to locate the problem.


	==Configure Kerberos==		==Configure Kerberos==

Biswajit at 08:14, 30 December 2012

2012-12-30T08:14:57Z

← Older revision		Revision as of 08:14, 30 December 2012
Line 1:		Line 1:
	[[category:~~Implementation~~]]		[[category:Installation]]
	==Samba 4 on centos 6.2 ( dated 27/12/2012)==		==Samba 4 on centos 6.2 ( dated 27/12/2012)==

Biswajit at 08:13, 30 December 2012

2012-12-30T08:13:56Z

← Older revision		Revision as of 08:13, 30 December 2012
Line 1:		Line 1:
			[[category:Implementation]]
	==Samba 4 on centos 6.2 ( dated 27/12/2012)==		==Samba 4 on centos 6.2 ( dated 27/12/2012)==

Biswajit: /* Starting Samba */

2012-12-30T08:12:12Z

Starting Samba

← Older revision		Revision as of 08:12, 30 December 2012
Line 91:		Line 91:

	We have created the rc.script via https://wiki.samba.org/index.php/Samba4/InitScript		We have created the rc.script via https://wiki.samba.org/index.php/Samba4/InitScript
	Check the Smaba via process information ( ps -ef ) and netstat -ntplu
			Check the Smaba via process information ( ps -ef ) and netstat -ntplu

	==Testing Samba as an AD DC==		==Testing Samba as an AD DC==

Biswajit: /* Provision Samba */

2012-12-30T08:11:35Z

Provision Samba

← Older revision		Revision as of 08:11, 30 December 2012
Line 73:		Line 73:

	A Kerberos configuration suitable for Samba 4 has been generated at /usr/local/samba/private/krb5.conf		A Kerberos configuration suitable for Samba 4 has been generated at /usr/local/samba/private/krb5.conf

	Once the above files are installed, your Samba4 server will be ready to use		Once the above files are installed, your Samba4 server will be ready to use

	Server Role: active directory domain controller		Server Role: active directory domain controller

	Hostname: samba4		Hostname: samba4

	NetBIOS Domain: TETRA		NetBIOS Domain: TETRA

	DNS Domain: tetra.in		DNS Domain: tetra.in

	DOMAIN SID: S-1-5-21-1363742443-4022821226-899015789		DOMAIN SID: S-1-5-21-1363742443-4022821226-899015789

Biswajit: /* Provision Samba */

2012-12-30T08:10:44Z

Provision Samba

← Older revision		Revision as of 08:10, 30 December 2012
Line 61:		Line 61:
	And Choose as per logically required . In our environment we have choosen		And Choose as per logically required . In our environment we have choosen

	Realm [TETRA.IN]:		Realm [TETRA.IN]:
	Domain [TETRA]:		Domain [TETRA]:
	Server Role (dc, member, standalone) [dc]:		Server Role (dc, member, standalone) [dc]:
	DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]:		DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]:
	DNS forwarder IP address (write 'none' to disable forwarding) [8.8.8.8]:		DNS forwarder IP address (write 'none' to disable forwarding) [8.8.8.8]:
	Administrator password: Pa$$w0rd		Administrator password: Pa$$w0rd
	Retype password: Pa$$w0rd		Retype password: Pa$$w0rd

	Final Out Put		Final Out Put

Biswajit: /* Reference Document */

2012-12-30T08:09:35Z

Reference Document

← Older revision		Revision as of 08:09, 30 December 2012
Line 11:		Line 11:

	https://wiki.samba.org/index.php/Samba4/HOWTO		https://wiki.samba.org/index.php/Samba4/HOWTO

	https://wiki.samba.org/index.php/Samba4/InitScript		https://wiki.samba.org/index.php/Samba4/InitScript

	https://wiki.samba.org/index.php/Samba_4/OS_Requirements#Red_Hat_Enterprise_Linux_or_CentOS		https://wiki.samba.org/index.php/Samba_4/OS_Requirements#Red_Hat_Enterprise_Linux_or_CentOS



	==Initial Requirement Fulfilment==		==Initial Requirement Fulfilment==

Biswajit at 08:09, 30 December 2012

2012-12-30T08:09:01Z

← Older revision		Revision as of 08:09, 30 December 2012
Line 4:		Line 4:
	==Caution==		==Caution==

	Do not try on Centos 5.8 or below , You might end up spend lot of time .python 2.6 is required which is not by default .EPEL repo http://dl.fedoraproject.org/pub/epel/5/i386/epel-release-5-4.noarch.rpm . But still issue will remian		'''Do not try on Centos 5.8 or below''' , You might end up spend lot of time .python 2.6 is required which is not by default .

			EPEL repo http://dl.fedoraproject.org/pub/epel/5/i386/epel-release-5-4.noarch.rpm . But still issue will remian

	==Reference Document==		==Reference Document==

Biswajit: Created page with " ==Samba 4 on centos 6.2 ( dated 27/12/2012)== ==Caution== Do not try on Centos 5.8 or below , You might end up spend lot of time .python 2.6 is required which is not by de..."

2012-12-30T08:08:05Z

Created page with " ==Samba 4 on centos 6.2 ( dated 27/12/2012)== ==Caution== Do not try on Centos 5.8 or below , You might end up spend lot of time .python 2.6 is required which is not by de..."

New page

==Samba 4 on centos 6.2 ( dated 27/12/2012)==

==Caution==

Do not try on Centos 5.8 or below , You might end up spend lot of time .python 2.6 is required which is not by default .EPEL repo http://dl.fedoraproject.org/pub/epel/5/i386/epel-release-5-4.noarch.rpm . But still issue will remian

==Reference Document==

https://wiki.samba.org/index.php/Samba4/HOWTO
https://wiki.samba.org/index.php/Samba4/InitScript
https://wiki.samba.org/index.php/Samba_4/OS_Requirements#Red_Hat_Enterprise_Linux_or_CentOS

==Initial Requirement Fulfilment==

Install following Dependencies

yum install libacl-devel libblkid-devel gnutls-devel \
readline-devel python-devel gdb pkgconfig krb5-workstation perl gcc \
zlib-devel setroubleshoot-server \
setroubleshoot-plugins policycoreutils-python \
libsemanage-python setools-libs-python setools-libs \
popt-devel libpcap-devel sqlite-devel libidn-devel \
libxml2-devel libacl-devel libsepol-devel libattr-devel \
keyutils-libs-devel cyrus-sasl-devel

==Download Samba ==

http://ftp.samba.org/pub/samba/

=Installation of Samba 4 =

Untar Samba tar file

==Compile Samba==

To build Samba, run the following command in your samba-master directory:

cd samba-master
./configure --enable-debug --enable-selftest
make && make install

This will take 1+ hour to complete

==Provision Samba==

Our Test Environment

Server IP - 192.168.1.13
Server FQDN - samba4.tetra.in
Server Small name - samba4

Start By following command

/usr/local/samba/bin/samba-tool domain provision

And Choose as per logically required . In our environment we have choosen

Realm [TETRA.IN]:
Domain [TETRA]:
Server Role (dc, member, standalone) [dc]:
DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]:
DNS forwarder IP address (write 'none' to disable forwarding) [8.8.8.8]:
Administrator password: Pa$$w0rd
Retype password: Pa$$w0rd

Final Out Put

A Kerberos configuration suitable for Samba 4 has been generated at /usr/local/samba/private/krb5.conf
Once the above files are installed, your Samba4 server will be ready to use
Server Role: active directory domain controller
Hostname: samba4
NetBIOS Domain: TETRA
DNS Domain: tetra.in
DOMAIN SID: S-1-5-21-1363742443-4022821226-899015789

==Starting Samba==

/usr/local/samba/sbin/samba

We have created the rc.script via https://wiki.samba.org/index.php/Samba4/InitScript
Check the Smaba via process information ( ps -ef ) and netstat -ntplu

==Testing Samba as an AD DC==

/usr/local/samba/bin/smbclient --version

This should show you a version starting with "Version 4.0.XXXXX".

Now run this command to list the shares on your Samba server:

/usr/local/samba/bin/smbclient -L localhost -U%

The output of the command should be similar to what is shown below:

Sharename Type Comment
--------- ---- -------
netlogon Disk
sysvol Disk
IPC$ IPC IPC Service (Samba 4.0.0)

The netlogon and sysvol shares are basic shares needed for Active Directory server operation.

To test that authentication is working, you should try to connect to the netlogon share using the Administrator password you set earlier:

smbclient //localhost/netlogon -UAdministrator%'p4$$word' -c 'ls'

The output of the command should be similar to what is shown below:

Domain=[SAMDOM] OS=[Unix] Server=[Samba 4.0.0beta9-GIT-e4677e3]
. D 0 Wed Sep 12 21:00:36 2012
.. D 0 Wed Sep 12 21:02:28 2012

==Configure /etc/resolv.conf==

For all the local DNS lookups to resolve correctly, we need to modify the server's /etc/resolv.conf file. The following example should be sufficient to have DNS resolve properly:

domain tetra.in
nameserver 192.168.1.13

Note: Remember to change the IP Address to your Samba server's IP Address
Note: If your server is set up to receive its IP configuration via DHCP, the /etc/resolv.conf file might be automatically updated. Refer to your distribution's documentation on how to stop this behavior.

==Testing DNS==

To test that DNS is working properly, run the following commands and compare the output to what is shown:

$ host -t SRV _ldap._tcp.tetra.in
_ldap._tcp.tetra.in has SRV record 0 100 389 samba4.tetra.in

$ host -t SRV _kerberos._udp.samdom.example.com.
_kerberos._udp.tetra.in has SRV record 0 100 88 samba4.tetra.in

$ host -t A samba.samdom.example.com.
samba4.tetra.in has address 192.168.1.13

The answers you get should be similar to the ones above (adjusted for your DNS domain name and hostname). If you get any errors, carefully check your system logs to locate the problem.

==Configure Kerberos==

Kerberos configuration is handled by the krb.conf file. This file is typically located in the /etc directory, please refer to your distribution documentation for the location of this file on your system. Replace the existing file, if any, with the sample from /usr/local/samba/share/setup/krb5.conf. Edit the file and replace ${REALM} with the value you chose for the --realm parameter of the provision command above, make sure to enter the realm in uppercase letters:

[libdefaults]
default_realm = TETRA.IN
dns_lookup_realm = false
dns_lookup_kdc = true

==Testing Kerberos==

The simplest test is to use the kinit command as follows:

$ kinit administrator@TETRA.IN
Password:

Note: You must specify your domain realm TETRA.iN in uppercase letters

kinit will not give you any output. To verify that Kerberos is working, and that you received a ticket, run the following:

$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: administrator@TETRA.IN
Valid starting Expires Service principal
12/29/12 19:39:48 02/11/10 19:39:46 krbtgt/TETRA.IN@TETRA.IN

==Configure NTP==

Install NTP via YUM
yum install ntp

Add following at the end /etc/ntpd.conf

ntpsigndsocket /usr/local/samba/var/lib/ntp_signd/
restrict default mssntp

Start NTP server via

service ntpd start
chkconfig ntpd on

==Adding Users into Samba 4 Active Directory ( Text method )==

/usr/local/samba/bin/samba-tool user add USERNAME

user - biswajit
pass sys%%0bb

user - navdeep
pass -ss&&0099