Samba4 implementation document

Caution

Do not try on Centos 5.8 or below , You might end up spend lot of time .python 2.6 is required which is not by default .

EPEL repo http://dl.fedoraproject.org/pub/epel/5/i386/epel-release-5-4.noarch.rpm . But still issue will remian

Reference Document

https://wiki.samba.org/index.php/Samba4/HOWTO https://wiki.samba.org/index.php/Samba4/InitScript https://wiki.samba.org/index.php/Samba_4/OS_Requirements#Red_Hat_Enterprise_Linux_or_CentOS

Initial Requirement Fulfilment

Install following Dependencies

yum install libacl-devel libblkid-devel gnutls-devel \
  readline-devel python-devel gdb pkgconfig krb5-workstation perl gcc \ 
  zlib-devel setroubleshoot-server \
  setroubleshoot-plugins policycoreutils-python \
  libsemanage-python setools-libs-python setools-libs \
  popt-devel libpcap-devel sqlite-devel libidn-devel \
  libxml2-devel libacl-devel libsepol-devel libattr-devel \
  keyutils-libs-devel cyrus-sasl-devel

Download Samba

http://ftp.samba.org/pub/samba/

Installation of Samba 4

Untar Samba tar file

Compile Samba

To build Samba, run the following command in your samba-master directory:

cd samba-master
./configure --enable-debug --enable-selftest
make && make install

This will take 1+ hour to complete

Provision Samba

Our Test Environment

Server IP - 192.168.1.13
Server FQDN - samba4.tetra.in
Server Small name - samba4

Start By following command

/usr/local/samba/bin/samba-tool domain provision

And Choose as per logically required . In our environment we have choosen

Realm [TETRA.IN]:

Domain [TETRA]: 
Server Role (dc, member, standalone) [dc]: 
DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]: 
DNS forwarder IP address (write 'none' to disable forwarding) [8.8.8.8]: 

Administrator password: Pa$$w0rd Retype password: Pa$$w0rd

Final Out Put

A Kerberos configuration suitable for Samba 4 has been generated at /usr/local/samba/private/krb5.conf Once the above files are installed, your Samba4 server will be ready to use Server Role: active directory domain controller Hostname: samba4 NetBIOS Domain: TETRA DNS Domain: tetra.in DOMAIN SID: S-1-5-21-1363742443-4022821226-899015789

Starting Samba

/usr/local/samba/sbin/samba

We have created the rc.script via https://wiki.samba.org/index.php/Samba4/InitScript Check the Smaba via process information ( ps -ef ) and netstat -ntplu

Testing Samba as an AD DC

/usr/local/samba/bin/smbclient --version

This should show you a version starting with "Version 4.0.XXXXX".

Now run this command to list the shares on your Samba server:

/usr/local/samba/bin/smbclient -L localhost -U%

The output of the command should be similar to what is shown below:

      Sharename       Type      Comment
      ---------       ----      -------
      netlogon        Disk
      sysvol          Disk
      IPC$            IPC       IPC Service (Samba 4.0.0)

The netlogon and sysvol shares are basic shares needed for Active Directory server operation.

To test that authentication is working, you should try to connect to the netlogon share using the Administrator password you set earlier:

smbclient //localhost/netlogon -UAdministrator%'p4$$word' -c 'ls'

The output of the command should be similar to what is shown below:

Domain=[SAMDOM] OS=[Unix] Server=[Samba 4.0.0beta9-GIT-e4677e3]
 .                                   D        0  Wed Sep 12 21:00:36 2012
 ..                                  D        0  Wed Sep 12 21:02:28 2012

Configure /etc/resolv.conf

For all the local DNS lookups to resolve correctly, we need to modify the server's /etc/resolv.conf file. The following example should be sufficient to have DNS resolve properly:

domain tetra.in
nameserver 192.168.1.13

Note: Remember to change the IP Address to your Samba server's IP Address Note: If your server is set up to receive its IP configuration via DHCP, the /etc/resolv.conf file might be automatically updated. Refer to your distribution's documentation on how to stop this behavior.

Testing DNS

To test that DNS is working properly, run the following commands and compare the output to what is shown:

$ host -t SRV _ldap._tcp.tetra.in

_ldap._tcp.tetra.in has SRV record 0 100 389 samba4.tetra.in

$ host -t SRV _kerberos._udp.samdom.example.com.

_kerberos._udp.tetra.in has SRV record 0 100 88 samba4.tetra.in

$ host -t A samba.samdom.example.com.
samba4.tetra.in has address 192.168.1.13

The answers you get should be similar to the ones above (adjusted for your DNS domain name and hostname). If you get any errors, carefully check your system logs to locate the problem.

Configure Kerberos

Kerberos configuration is handled by the krb.conf file. This file is typically located in the /etc directory, please refer to your distribution documentation for the location of this file on your system. Replace the existing file, if any, with the sample from /usr/local/samba/share/setup/krb5.conf. Edit the file and replace ${REALM} with the value you chose for the --realm parameter of the provision command above, make sure to enter the realm in uppercase letters:

[libdefaults]
   default_realm = TETRA.IN
   dns_lookup_realm = false
   dns_lookup_kdc = true

Testing Kerberos

The simplest test is to use the kinit command as follows:

$ kinit administrator@TETRA.IN
Password:

Note: You must specify your domain realm TETRA.iN in uppercase letters

kinit will not give you any output. To verify that Kerberos is working, and that you received a ticket, run the following:

$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: administrator@TETRA.IN
Valid starting     Expires            Service principal
12/29/12 19:39:48  02/11/10 19:39:46  krbtgt/TETRA.IN@TETRA.IN

Configure NTP

Install NTP via YUM

yum install ntp 

Add following at the end /etc/ntpd.conf

ntpsigndsocket /usr/local/samba/var/lib/ntp_signd/
restrict default mssntp

Start NTP server via

service ntpd start 
chkconfig ntpd on 

Adding Users into Samba 4 Active Directory ( Text method )

/usr/local/samba/bin/samba-tool user add USERNAME 

user - biswajit pass sys%%0bb

user - navdeep pass -ss&&0099