This is how to integrate the blastwave-provided samba 3.0.23 into a Windows 2003 Active Directory Primary Domain
\nController, using kerberos, ldap, nss, samba, winbind.
\nThis gets you to the stage where you can access your samba shares passwordless, when logged in as an
\nauthorized user to access them. This does not get you to login to your solaris server (ssh,telnet) with an
\nActiveDirectory user+pass.
\nFirst, set your pkg-get repo by editing \/opt\/csw\/etc\/pkg-get.conf:
\nurl=http:\/\/ibiblio.org\/pub\/packages\/solaris\/csw\/unstable
\nNow, we must get these pkgs:
\nCSWkrb5user, CSWkrb5libdev, CSWsamba, CSWsambaclient, CSWsambacommon,CSWsambalib,
\nCSWsambalibdev, CSWsambawb
\nWe do so by issuing:
\n# pkg-get -i krb5_user krb5_lib_dev samba samba_client samba_common samba_lib samba_libdev
\nsamba_wb
\nSeveral dependencies will be installed automagically:
\nCSWsasl, CSWoldaprt, CSWlibpopt, CSWlibnet, CSWlibcups, CSWkrb5lib, CSWiconv, CSWgettext,
\nCSWfam, CSWcommon
\nAfter getting all packages make sure you have samba 3.0.23 by issuing:
\n# pkginfo -l CSWsambalibdev CSWsamba CSWsambalib CSWsambacommon CSWsambaclient | grep
\nVERSION
\nVERSION: 3.0.23,REV=2006.08.09b
\nVERSION: 3.0.23,REV=2006.08.09b
\nVERSION: 3.0.23,REV=2006.08.09b
\nVERSION: 3.0.23,REV=2006.08.09b
\nVERSION: 3.0.23,REV=2006.08.09b
\nIt is very important that all versions above are equal and that you have 3.0.23.
\nWe can now configure, we start by configuring kerberos at \/etc\/krb5.conf, and make an exact copy at
\n\/opt\/csw\/etc\/krb 5.conf
\n[libdefaults]
\nclockskew = 300
\ndefault_realm = AWW.COM
\n[realms]
\nAWW.COM = {
\n139\/433
\nkdc = fwa-dc01.aww.com
\ndefault_domain = AWW
\nkpasswd_server = fwa-dc01.aww.com
\n}
\n[domain_realm]
\n.AWW = AWW.COM
\n[logging]
\ndefault = SYSLOG:NOTICE: DAEMON
\nkdc = FILE:\/var\/log\/kdc.log
\nkadmind = FILE:\/var\/log\/kadmind.log
\n[appdefaults]
\npam = {
\nticket_lifetime = 1d
\nrenew_lifetime = 1d
\nforwardable = true
\nproxiable = false
\nretain_after_close = false
\nminimum_uid = 0
\ndebug = false
\n}
\nWe now configure samba, the config file is at \/opt\/csw\/etc\/samba\/smb.conf
\n[global]
\nrealm = AWW.COM
\nworkgroup = AWW
\npassword server = fwa-dc01.aww.com
\nsecurity = ADS
\nencrypt passwords = yes
\nmap to guest = never
\nclient use spnego = yes
\nidmap uid = 10000-60000
\nwinbind gid = 10000-60000
\nwinbind use default domain = yes
\nnetbios name = netra
\nloglevel = 10
\ninterfaces = 172.16.1.38
\nbind interfaces only = yes
\n[200gb]
\ncomment = 200gb disk
\npath = \/200gb
\nread only = no
\npublic = yes
\nbrowseable = yes
\nwriteable = yes
\ncreate mode = 644
\nvalid users = AWWbmahock
\n[htdocs]
\ncomment = Apache htdocs
\npath = \/usr\/local\/apache2\/htdocs
\nread only = no
\npublic = yes
\nbrowseable = yes
\n140\/433
\nwriteable = yes
\ncreate mode = 644
\nvalid users = AWWbmahock
\nOur Windows 2003 ActiveDirectory PDC is called fwa-dc01. Our Solaris 10 server is called “netra” and it’s
\nfqdn is “netra.aww.com”, so we need to add that to \/etc\/hosts, please make sure the FQDN appears
\nFIRST!!!!!!!!!!! !!!!!
\n172.16.1.38 netra.aww.com netra loghost
\n172.16.1.55 fwa-dc01.aww.com fwa-dc01
\nWe don’t need to edit \/etc\/resolv.conf to add any particular dns settings.
\nWe need to add winbind to \/etc\/nsswitch.conf:
\npasswd: files winbind
\ngroup: files winbind
\nWe need to get libgroups in order for winbind to work, check http:\/\/www.blastwave.org\/~fredrik\/, and get
\nhttp:\/\/www.blast wave.org\/~fredrik\/libgroups.SPARC.so
\nI placed that at \/usr\/lib\/libgroups.SPARC.so, and as stated at that url, added a line to the top of
\n\/etc\/init.d\/cswsamba with:
\nLD_PRELOAD=\/usr\/lib\/libgroups.SP ARC.so
\nNow we can join samba to the AD PDC and start rolling!
\nIf not already there, set \/opt\/csw\/* in the PATH
\n# export PATH=$PATH:\/opt\/csw\/sbin:\/opt\/csw\/bin
\nKill any already running samba:
\n# pkill winbindd
\n# pkill smbd
\n# pkill nmbd
\n# \/etc\/init.d\/cswsamba stop
\nDestroy any kerberos ticket we might have:
\n# \/opt\/csw\/bin\/kdestroy
\nTest ticket creation to the AD PDC, this will test if ur \/etc\/krb5.conf and \/opt\/csw\/etc\/krb5.conf is ok
\n# \/opt\/csw\/bin\/kinit Administrator@AWW.COM
\nPassword for Administrator@AWW.COM:
\nDelete any previous instance of our server in the AD
\n# \/opt\/csw\/bin\/net ads leave -U Administrator
\nAdministrator’s password:
\nJoin our samba server to the AD
\n141\/433
\n# \/opt\/csw\/bin\/net ads join -U Administrator
\nAdministrator’s password:
\nUsing short domain name — AWW
\nJoined ‘NETRA’ to realm ‘AWW.COM’
\nStart all samba daemons
\n# \/etc\/init.d\/cswsamba start
\nNow test if all is ok:
\nDisplay samba status:
\nbash-3.00# \/opt\/csw\/bin\/smbclient -L netra -U%
\nDomain=[AWW] OS=[Unix] Server=[Samba 3.0.23b]
\nSharename Type Comment
\n——— —- ——-
\n200gb Disk 200gb disk
\nhtdocs Disk Apache htdocs
\nIPC$ IPC IPC Service (Samba 3.0.23b)
\nDomain=[AWW] OS=[Unix] Server=[Samba 3.0.23b]
\nServer Comment
\n——— ——-
\nNETRA Samba 3.0.23b
\nWorkgroup Master
\n——— ——-
\nAWW
\nCheck for Domains we belong to, this is very important!!! our domain (AWW) must be there!
\nbash-3.00# wbinfo -m
\nAWW
\nCheck for users in the domain:
\nbash-3.00# wbinfo -u
\nAdministrator
\nGuest
\nSUPPORT_388945a0
\nkrbtgt
\nbmahock
\ntpsmith
\nquser
\nCheck for groups in the domain:
\nbash-3.00# wbinfo -g
\nBUILTINadministrators
\nBUILTINDomain Computers
\nDomain Controllers
\nSchema Admins
\nEnterprise Admins
\nDomain Admins
\n142\/433
\nDomain Users
\nDomain Guests
\nGroup Policy Creator Owners
\nDnsUpdateProxy
\nGet information for a user, this would test that you configured \/etc\/nsswitch.conf ok with winbind, and that it is
\nusing \/lib\/libnss_winbind.so
\nbash-3.00# getent passwd “bmahock”
\nbmahock:*:10004: 10002:Brian Mahocker:\/home\/AWW\/bmahock:\/bin\/false
\nNow test if you did really join through ActiveDirectory, using “net ads” queries:
\nbash-3.00# net ads testjoin
\nJoin is OK
\nbash-3.00# net ads info
\nLDAP server: 172.16.1.55
\nLDAP server name: fwa-dc01.aww.com
\nRealm: AWW.COM
\nBind Path: dc=AWW,dc=COM
\nLDAP port: 389
\nServer time: Sat, 02 Feb 2008 11:13:52 CST
\nKDC server: 172.16.1.55
\nServer time offset: 76
\nNow get all ActiveDirectory properties for your computer:
\nbash-3.00# net ads status
\nobjectClass: top
\nobjectClass: person
\nobjectClass: organizationalPerson
\nobjectClass: user
\nobjectClass: computer
\ncn: netra
\ndistinguishedName: CN=netra,CN=Computers,DC=aww, DC=com
\ninstanceType: 4
\nwhenCreated: 20080202171033.0 Z
\nwhenChanged: 20080202171208.0 Z
\nuSNCreated: 45102
\nuSNChanged: 45137
\nname: netra
\nobjectGUID: bea32ea2-8208-4119-9d4c-87186a3866c4
\nuserAccountControl: 69632
\nbadPwdCount: 0
\ncodePage: 0
\ncountryCode: 0
\nbadPasswordTime: 0
\nlastLogoff: 0
\nlastLogon: 128464460293750000
\nlocalPolicyFlags: 0
\npwdLastSet: 0
\nprimaryGroupID: 515
\nobjectSid: S-1-5-21-875145104-1252384033-126309636-1125
\n143\/433
\naccountExpires: 9223372036854775807
\nlogonCount: 13
\nsAMAccountName: netra$
\nsAMAccountType: 805306369
\ndNSHostName: netra.aww.com
\nservicePrincipalName: HOST\/netra.aww.com
\nservicePrincipalName: HOST\/NETRA
\nobjectCategory: CN=Computer,CN=Schema,CN=Configuration,DC=aww,DC=com
\nisCriticalSystemObject: FALSE
\n————– Security Descriptor (revision: 1, type: 0x8c14)
\nowner SID: S-1-5-21-875145104-1252384033-126309636-512
\ngroup SID: S-1-5-21-875145104-1252384033-126309636-513
\n——- (system) ACL (revision: 4, size: 120, number of ACEs: 2)
\n——- ACE (type: 0x07, flags: 0x5a, size: 0x38, mask: 0x20, object flags: 0x3)
\naccess SID: S-1-1-0
\naccess type: AUDIT OBJECT
\nPermissions:
\n[Write All Properties]
\n——- ACE (type: 0x07, flags: 0x5a, size: 0x38, mask: 0x20, object flags: 0x3)
\naccess SID: S-1-1-0
\naccess type: AUDIT OBJECT
\nPermissions:
\n[Write All Properties]
\n——- (user) ACL (revision: 4, size: 1908, number of ACEs: 39)
\n——- ACE (type: 0x00, flags: 0x00, size: 0x24, mask: 0xf01ff)
\naccess SID: S-1-5-21-875145104-1252384033-126309636-512
\naccess type: ALLOWED
\nPermissions: [Full Control]
\n——- ACE (type: 0x00, flags: 0x00, size: 0x18, mask: 0xf01ff)
\naccess SID: S-1-5-32-548
\naccess type: ALLOWED
\nPermissions: [Full Control]
\n——- ACE (type: 0x00, flags: 0x00, size: 0x14, mask: 0xf01ff)
\naccess SID: S-1-5-18
\naccess type: ALLOWED
\nPermissions: [Full Control]
\n——- ACE (type: 0x00, flags: 0x00, size: 0x24, mask: 0x301d4)
\naccess SID: S-1-5-21-875145104-1252384033-126309636-512
\naccess type: ALLOWED
\nPermissions:
\n[List Contents]
\n[Read All Properties]
\n[Delete Subtree]
\n[List Object]
\n[Change Password]
\n[Reset Password]
\n[Delete]
\n[Read Permissions]
\n——- ACE (type: 0x05, flags: 0x00, size: 0x38, mask: 0x20, object flags: 0x1)
\naccess SID: S-1-5-21-875145104-1252384033-126309636-512
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Write All Properties]
\n144\/433
\n——- ACE (type: 0x00, flags: 0x00, size: 0x14, mask: 0x20094)
\naccess SID: S-1-5-11
\naccess type: ALLOWED
\nPermissions:
\n[List Contents]
\n[Read All Properties]
\n[List Object]
\n[Read Permissions]
\n——- ACE (type: 0x05, flags: 0x00, size: 0x28, mask: 0x100, object flags: 0x1)
\naccess SID: S-1-1-0
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Change Password]
\n[Reset Password]
\n——- ACE (type: 0x00, flags: 0x00, size: 0x14, mask: 0x3)
\naccess SID: S-1-5-10
\naccess type: ALLOWED
\nPermissions:
\n[Create All Child Objects]
\n[Delete All Child Objects]
\n——- ACE (type: 0x05, flags: 0x00, size: 0x2c, mask: 0x3, object flags: 0x1)
\naccess SID: S-1-5-32-550
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Create All Child Objects]
\n[Delete All Child Objects]
\n——- ACE (type: 0x05, flags: 0x00, size: 0x38, mask: 0x30, object flags: 0x1)
\naccess SID: S-1-5-21-875145104-1252384033-126309636-517
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Read All Properties]
\n[Write All Properties]
\n——- ACE (type: 0x05, flags: 0x00, size: 0x28, mask: 0x8, object flags: 0x1)
\naccess SID: S-1-5-10
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[All validate writes]
\n——- ACE (type: 0x05, flags: 0x00, size: 0x28, mask: 0x30, object flags: 0x1)
\naccess SID: S-1-5-10
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Read All Properties]
\n[Write All Properties]
\n——- ACE (type: 0x05, flags: 0x00, size: 0x28, mask: 0x8, object flags: 0x1)
\naccess SID: S-1-5-10
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[All validate writes]
\n——- ACE (type: 0x05, flags: 0x00, size: 0x38, mask: 0x8, object flags: 0x1)
\naccess SID: S-1-5-21-875145104-1252384033-126309636-512
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[All validate writes]
\n145\/433
\n——- ACE (type: 0x05, flags: 0x00, size: 0x38, mask: 0x8, object flags: 0x1)
\naccess SID: S-1-5-21-875145104-1252384033-126309636-512
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[All validate writes]
\n——- ACE (type: 0x05, flags: 0x00, size: 0x48, mask: 0x20, object flags: 0x3)
\naccess SID: S-1-5-21-875145104-1252384033-126309636-512
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Write All Properties]
\n——- ACE (type: 0x05, flags: 0x00, size: 0x48, mask: 0x20, object flags: 0x3)
\naccess SID: S-1-5-21-875145104-1252384033-126309636-512
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Write All Properties]
\n——- ACE (type: 0x05, flags: 0x00, size: 0x48, mask: 0x20, object flags: 0x3)
\naccess SID: S-1-5-21-875145104-1252384033-126309636-512
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Write All Properties]
\n——- ACE (type: 0x05, flags: 0x00, size: 0x48, mask: 0x20, object flags: 0x3)
\naccess SID: S-1-5-21-875145104-1252384033-126309636-512
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Write All Properties]
\n——- ACE (type: 0x05, flags: 0x00, size: 0x2c, mask: 0x10, object flags: 0x1)
\naccess SID: S-1-5-32-560
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Read All Properties]
\n——- ACE (type: 0x00, flags: 0x12, size: 0x18, mask: 0xf01bd)
\naccess SID: S-1-5-32-544
\naccess type: ALLOWED
\nPermissions:
\n[Create All Child Objects]
\n[List Contents]
\n[All validate writes]
\n[Read All Properties]
\n[Write All Properties]
\n[List Object]
\n[Change Password]
\n[Reset Password]
\n[Delete]
\n[Read Permissions]
\n[Modify Permissions]
\n[Modify Owner]
\n——- ACE (type: 0x00, flags: 0x12, size: 0x24, mask: 0xf01ff)
\naccess SID: S-1-5-21-875145104-1252384033-126309636-519
\naccess type: ALLOWED
\nPermissions: [Full Control]
\n——- ACE (type: 0x00, flags: 0x12, size: 0x18, mask: 0x4)
\naccess SID: S-1-5-32-554
\naccess type: ALLOWED
\n146\/433
\nPermissions:
\n[List Contents]
\n——- ACE (type: 0x05, flags: 0x1a, size: 0x3c, mask: 0x10, object flags: 0x3)
\naccess SID: S-1-5-32-554
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Read All Properties]
\n——- ACE (type: 0x05, flags: 0x1a, size: 0x3c, mask: 0x10, object flags: 0x3)
\naccess SID: S-1-5-32-554
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Read All Properties]
\n——- ACE (type: 0x05, flags: 0x1a, size: 0x3c, mask: 0x10, object flags: 0x3)
\naccess SID: S-1-5-32-554
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Read All Properties]
\n——- ACE (type: 0x05, flags: 0x1a, size: 0x3c, mask: 0x10, object flags: 0x3)
\naccess SID: S-1-5-32-554
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Read All Properties]
\n——- ACE (type: 0x05, flags: 0x1a, size: 0x3c, mask: 0x10, object flags: 0x3)
\naccess SID: S-1-5-32-554
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Read All Properties]
\n——- ACE (type: 0x05, flags: 0x1a, size: 0x2c, mask: 0x20094, object flags: 0x2)
\naccess SID: S-1-5-32-554
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[List Contents]
\n[Read All Properties]
\n[List Object]
\n[Read Permissions]
\n——- ACE (type: 0x05, flags: 0x1a, size: 0x2c, mask: 0x20094, object flags: 0x2)
\naccess SID: S-1-5-32-554
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[List Contents]
\n[Read All Properties]
\n[List Object]
\n[Read Permissions]
\n——- ACE (type: 0x05, flags: 0x1a, size: 0x3c, mask: 0x10, object flags: 0x3)
\naccess SID: S-1-5-32-554
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Read All Properties]
\n——- ACE (type: 0x05, flags: 0x1a, size: 0x3c, mask: 0x10, object flags: 0x3)
\naccess SID: S-1-5-32-554
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Read All Properties]
\n147\/433
\n——- ACE (type: 0x05, flags: 0x1a, size: 0x3c, mask: 0x10, object flags: 0x3)
\naccess SID: S-1-5-32-554
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Read All Properties]
\n——- ACE (type: 0x05, flags: 0x1a, size: 0x3c, mask: 0x10, object flags: 0x3)
\naccess SID: S-1-5-32-554
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Read All Properties]
\n——- ACE (type: 0x05, flags: 0x1a, size: 0x3c, mask: 0x10, object flags: 0x3)
\naccess SID: S-1-5-32-554
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Read All Properties]
\n——- ACE (type: 0x05, flags: 0x1a, size: 0x2c, mask: 0x20094, object flags: 0x2)
\naccess SID: S-1-5-32-554
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[List Contents]
\n[Read All Properties]
\n[List Object]
\n[Read Permissions]
\n——- ACE (type: 0x05, flags: 0x1a, size: 0x38, mask: 0x10, object flags: 0x3)
\naccess SID: S-1-5-9
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Read All Properties]
\n——- ACE (type: 0x05, flags: 0x1a, size: 0x38, mask: 0x10, object flags: 0x3)
\naccess SID: S-1-5-9
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Read All Properties]
\n——- ACE (type: 0x05, flags: 0x12, size: 0x38, mask: 0x10, object flags: 0x3)
\naccess SID: S-1-5-9
\naccess type: ALLOWED OBJECT
\nPermissions:
\n[Read All Properties]
\n————– End Of Security Descriptor
\nIf all these tests are ok, your samba is joined correctly to the AD domain.
\nSlackware 12 Samba 3.0.28 bound to Windows 2003 Active Directory
\nThis is how to get a Slackware 12 bound to a Windows 2003 Active Directory, using AD (kerberos\/ldap).
\nFirst, you need a windows 2003 server, with Active Directory enabled, i assume you know how to do that
\npart, in my case this one is called fwa-dc01.
\n148\/433
\n172.16.1.55 fwa-dc01 fwa-dc01.aww.com
\nNow with our slackware 12… This one is called “kraftek”
\n172.16.1.50 kraftek kraftek.aww.com
\nWe will use all slack12 included packages except samba, so please make sure these pkgs are at
\n\/var\/log\/packages:
\nkrb5-1.6.1-i686-2dl
\ncyrus-sasl-2.1.22-i486-1
\nopenldap-client-2.3.36-i686-1dl
\nopenssl-0.9.8e-i 486-3
\nopenssl-solibs-0.9.8e-i486-3
\ndb42-4.2.52-i486-3
\ndb44-4.4.20-i486-2
\nThen we should get the latest samba sources, we need to build SAMBA, since the slackware 12 included
\nsamba does not support ActiveDirectory. The release i got is samba 3.0.28, from
\nhttp:\/\/us4.samba.org\/samba\/ftp\/stable\/samba-3.0.28.tar.gz
\nafter uncompressing, it all fell into \/builds\/samba-3.0.28, so i did:
\n# cd \/builds\/samba-3.0.28\/source
\n# .\/configure –with-ads –with-winbind –with-smbmount –prefix=\/usr\/samba_ad –with-pam
\n# make && make install
\nThis builds it all and places samba at \/usr\/samba_ad
\nWe also need to install the nss helpers to our system default directories:
\n# cp \/builds\/samba-3.0.28\/source\/nsswitch\/libnss_winbind.so \/lib
\n# cp \/builds\/samba-3.0.28\/source\/nsswitch\/libnss_wins.so \/lib
\n# ln -s \/lib\/libnss_winbind.so \/lib\/libnss_winbind.so.2
\n# ln -s \/lib\/libnss_wins.so \/lib\/libnss_wins.so.2
\nThen, we need to configure Kerberos ;), i placed this in \/etc\/krb5.conf:
\n[libdefaults]
\nclockskew = 300
\ndefault_realm = AWW.COM
\n[realms]
\nAWW.COM = {
\nkdc = fwa-dc01.aww.com
\ndefault_domain = AWW
\nkpasswd_server = fwa-dc01.aww.com
\n}
\n[domain_realm]
\n.AWW = AWW.COM
\n[logging]
\ndefault = SYSLOG:NOTICE: DAEMON
\nkdc = FILE:\/var\/log\/kdc.log
\nkadmind = FILE:\/var\/log\/kadmind.log
\n[appdefaults]
\n149\/433
\npam = {
\nticket_lifetime = 1d
\nrenew_lifetime = 1d
\nforwardable = true
\nproxiable = false
\nretain_after_close = false
\nminimum_uid = 0
\ndebug = false
\n}
\nOf course we need to edit \/etc\/hosts and add our Active Directory PDC there, and our server name with a
\nfqdn, both belonging to aww.com(our AD domain):
\n172.16.1.55 fwa-dc01 fwa-dc01.aww.com
\n172.16.1.50 kraftek kraftek.aww.com
\nWe do not really need to do much at \/etc\/resolv.conf, we don’t need DNS lookups to AD here.
\nWe need to modify \/etc\/nsswitch.conf, and add “winbind” as an option to passwd and group:
\npasswd: files compat winbind
\ngroup: files compat winbind
\nNotice that for this to work you REALLY have to have \/lib\/libnss_winbind.so in place!!!
\nNow we configure SAMBA, the SAMBA we compiled looks for its smb.conf at \/usr\/samba_ad\/lib\/smb.conf, so
\nthat’s where we place it, and it has:
\n[global]
\nrealm = AWW.COM
\nworkgroup = AWW
\npassword server = fwa-dc01.aww.com
\nsecurity = ADS
\nencrypt passwords = yes
\nmap to guest = never
\nclient use spnego = yes
\nidmap uid = 10000-60000
\nwinbind gid = 10000-60000
\nwinbind use default domain = yes
\nnetbios name = kraftek
\nloglevel = 10
\ninterfaces = 172.16.1.50
\nbind interfaces only = yes
\n[200gb]
\ncomment = 200gb disk
\npath = \/200gb
\nread only = no
\npublic = yes
\nbrowseable = yes
\nwriteable = yes
\ncreate mode = 644
\nvalid users = AWWbmahock
\n[htdocs]
\ncomment = Apache htdocs
\npath = \/usr\/local\/apache2\/htdocs
\n150\/433
\nread only = no
\npublic = yes
\nbrowseable = yes
\nwriteable = yes
\ncreate mode = 644
\nvalid users = AWWbmahock
\nGood, notice we’re using security=ADS and we specify the realm and workgroup, and our windows 2003
\nserver is fwa-dc01.aww. com, just as in \/etc\/hosts
\nNow it is time to make the machinery move!!!!!!!
\nGet our PATH set up to use our samba
\n# export PATH=$PATH:\/usr\/samba_ad\/sbin:\/usr\/samba_ad\/bin
\nKill any existing samba
\n# pkill winbindd
\n# pkill smbd
\n# pkill nmbd
\nDestroy all kerberos tickets we have
\n# kdestroy
\nGet a kerberos ticket from our windows 2003 PDC, this reads \/etc\/krb5.conf
\n# kinit Administrator@AWW.COM
\nPassword for Administrator@AWW.COM:
\nJoin our windows 2003 AD domain
\n# \/usr\/samba_ad\/bin\/net ads join -U Administrator
\nAdministrator’s password:
\nUsing short domain name — AWW
\nJoined ‘KRAFTEK’ to realm ‘AWW.COM’
\nStart our samba deamons
\n# \/usr\/samba_ad\/sbin\/winbindd -B
\n# \/usr\/samba_ad\/sbin\/smbd -D
\n# \/usr\/samba_ad\/sbin\/nmbd -D
\nTest our config
\n# \/usr\/samba_ad\/bin\/smbclient -L kraftek -U%
\nDomain=[AWW] OS=[Unix] Server=[Samba 3.0.28]
\nSharename Type Comment
\n——— —- ——-
\n200gb Disk 200gb disk
\nhtdocs Disk Apache htdocs
\nIPC$ IPC IPC Service (Samba 3.0.28)
\ndeskjet Printer Hp deskjet 845c at Home
\nDomain=[AWW] OS=[Unix] Server=[Samba 3.0.28]
\n151\/433
\nServer Comment
\n——— ——-
\nKRAFTEK Samba 3.0.28
\nWorkgroup Master
\n——— ——-
\nAWW
\nCheck what are our trusted users, a list should appear, including users at our Windows 2003 PDC
\n# \/usr\/samba_ad\/bin\/wbinfo -u
\nadministrator
\nguest
\nsupport_388945a0
\nkrbtgt
\nbmahock
\ntpsmith
\nquser
\nCheck our known groups, this should list our windows 2003 groups
\n# \/usr\/samba_ad\/bin\/wbinfo -g
\nBUILTINadministrators
\nBUILTINusers
\ndomain computers
\ndomain controllers
\nschema admins
\nenterprise admins
\ndomain admins
\ndomain users
\ndomain guests
\ngroup policy creator owners
\ndnsupdateproxy
\nCheck our trusted domains, this is extra important!!!, our windows 2003 domain (AWW) should be there!
\n# \/usr\/samba_ad\/bin\/wbinfo -m
\nAWW
\nGetent should give us details of any Windows 2003 user, this passes thru \/etc\/nsswitch.conf, then uses
\n\/lib\/libnss_winbind.so, connects to the running winbind daemon and queries the windows pdc
\n# getent passwd “AWWbmahock”
\nbmahock:*:10000: 10006:Brian Mahocker:\/home\/AWW\/bmahock:\/bin\/false
\nFinally , do a test authentication with wbinfo, if this, and all previous tests work, you have a single sign on
\nSamba, bound to a Windows 2003 Active Directory
\n# wbinfo -a “bmahock%R3515t0l1”
\nplaintext password authentication succeeded
\nchallenge\/response password authentication succeeded
\nEnjoy
\n152\/433
\n153\/433<\/p>\n","protected":false},"excerpt":{"rendered":"
This is how to integrate the blastwave-provided samba 3.0.23 into a Windows 2003 Active Directory Primary Domain Controller, using kerberos, ldap, nss, samba, winbind. This gets you to the stage where you can access your samba shares passwordless, when logged in as an authorized user to access them. This does not get you to login […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-451","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"\/blog\/index.php\/wp-json\/wp\/v2\/posts\/451","targetHints":{"allow":["GET"]}}],"collection":[{"href":"\/blog\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"\/blog\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"\/blog\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"\/blog\/index.php\/wp-json\/wp\/v2\/comments?post=451"}],"version-history":[{"count":0,"href":"\/blog\/index.php\/wp-json\/wp\/v2\/posts\/451\/revisions"}],"wp:attachment":[{"href":"\/blog\/index.php\/wp-json\/wp\/v2\/media?parent=451"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"\/blog\/index.php\/wp-json\/wp\/v2\/categories?post=451"},{"taxonomy":"post_tag","embeddable":true,"href":"\/blog\/index.php\/wp-json\/wp\/v2\/tags?post=451"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}