بسم الله الرحمن الرحيم
Abstract
- A tutorial to install Samba 4.3 as an Active Directory Domain Controller in a FreeNAS 9.10 Jail.
- Configure and enable SSL for Samba's LDAP backend.
Assumptions and Prerequisites
- Domain: example.com
- Hostname: dc.example.com
- OS: FreeNAS 9.10.1-U2 (FreeBSD 10.3-STABLE)
- Container: Warden Jail
- Jail Name: dc
- Private IP: 10.0.0.58
- Subnet Mask: 255.255.255.0/24
- Main Router IP: 10.0.0.1
- DNS Forwarder IP: 10.0.0.1 (main router)
- Service: Samba 4.3.11
- DNS: Internal Samba DNS
- NTP Host IP: 10.0.0.1 (main router)
- CA Certificate File: /usr/local/etc/ssl/certs/ca.pem
- SSL Certificate File: /usr/local/etc/ssl/certs/dc.example.com.crt
- SSL Key File: /usr/local/etc/ssl/private/dc.example.com.key
Instructions
Pre-installation setup
- Edit file /etc/rc.conf and change hostname to dc.example.com.# vi /etc/rc.conf
(7) hostname="dc.example.com"
- Edit file /etc/hosts file and change the 10.0.0.58 -> dc.example.com dc
# vi /etc/hosts
(14) 127.0.0.1 localhost localhost.localdomain dc
(15) 10.0.0.58 dc.example.com dc
Installation
- Install samba43. Don't install samba44 or a newer version of samba than 4.3 because the newer versions doesn't come with ntvfs option anymore. i.e no --use-ntvfs option for zfs.# pkg install samba43
- Provision Samba as an Active Directory Domain Controller
# samba-tool domain provision --use-ntvfs --use-rfc2307 --interactive
Realm [EXAMPLE.COM]: (press Enter)
Domain [EXAMPLE]: (press Enter)
Server Role (dc, member, standalone) [dc]: (press Enter)
DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]: (press Enter)
DNS forwarder IP address (write 'none' to disable forwarding) [10.0.0.1]: (press Enter)
Administrator password: (enter password)
Retype password: (re-enter password)
Query Result:
Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up share.ldb
Setting up secrets.ldb
Setting up the registry
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
Adding DomainDN: DC=example,DC=com
Adding configuration container
Setting up sam.ldb schema
Setting up sam.ldb configuration data
Setting up display specifiers
Modifying display specifiers
Adding users container
Modifying users container
Adding computers container
Modifying computers container
Setting up sam.ldb data
Setting up well known security principals
Setting up sam.ldb users and groups
Setting up self join
Adding DNS accounts
Creating CN=MicrosoftDNS,CN=System,DC=example,DC=com
Creating DomainDnsZones and ForestDnsZones partitions
Populating DomainDnsZones and ForestDnsZones partitions
Setting up sam.ldb rootDSE marking as synchronized
Fixing provision GUIDs
A Kerberos configuration suitable for Samba 4 has been generated at /var/db/samba4/private/krb5.conf
Setting up fake yp server settings
Once the above files are installed, your Samba4 server will be ready to use
Server Role: active directory domain controller
Hostname: dc
NetBIOS Domain: EXAMPLE
DNS Domain: example.com
DOMAIN SID: S-1-5-21-458877043-2880298934-1173284452
- Edit the /etc/resolv.conf file for host dns to point to the samba DNS.
# vi /etc/resolv.conf
(1) search example.com
(2) domain example.com
(3) nameserver 127.0.0.1
- Create symbolic links for the kerberos keytab and config files in the /usr/local/etc directory.
# ln -s /var/db/samba4/private/krb5.conf /usr/local/etc/krb5.conf
# ln -s /var/db/samba4/private/dns.keytab /usr/local/etc/krb5.keytab
- Enable samba to run and also start at boot
# sysrc samba_server_enable="YES"
- Start samba server
# service samba_server start
Test Samba Server
- Verify LDAP Service DNS Record# host -t SRV _ldap._tcp.example.com
Query Result: _ldap._tcp.example.com has SRV record 0 100 389 dc.example.com.
- Verify Kerberos Service DNS Record
# host -t SRV _kerberos._udp.example.com
Query Result: _kerberos._udp.example.com has SRV record 0 100 88 dc.example.com.
- Verify Domain Controller DNS Record
# host -t A dc.example.com
Query Result: dc.example.com has address 10.0.0.58
- Test Kerberos Authentication
# kinit administrator@EXAMPLE.COM
# klist
Query Result:
Credentials cache: FILE:/tmp/krb5cc_0
Principal: administrator@EXAMPLE.COM
Issued Expires Principal
Nov 6 21:16:46 2016 Nov 7 07:16:46 2016 krbtgt/EXAMPLE.COM@EXAMPLE.COM
- Test Samba File Server
# smbclient -L localhost -U%
Query Result:
Domain=[EXAMPLE] OS=[Unix] Server=[Samba 4.3.11]
Sharename Type Comment
--------- ---- -------
netlogon Disk
sysvol Disk
IPC$ IPC IPC Service
Domain=[EXAMPLE] OS=[Unix] Server=[Samba 4.3.11]
Server Comment
--------- -------
Workgroup Master
--------- -------
- Test Samba User Logon
# smbclient //localhost/netlogon -Uadministrator
Query Result:
Enter administrator's password:
Domain=[EXAMPLE] OS=[Unix] Server=[Samba 4.3.11]
smb: \>
- List Domain Users
# wbinfo -u | sort
- List Domain Groups
# wbinfo -g | sort
Enable SSL for LDAP Backend
- Generate Self-Signed Certificate Authority, Server Certificate and Key.- Edit file /usr/local/etc/smb4.conf to configure SSL certs
# vi /usr/local/etc/smb4.conf
(13) tls enabled = yes
(14) tls cafile = /usr/local/etc/ssl/certs/ca.pem
(15) tls certfile = /usr/local/etc/ssl/certs/dc.example.com.crt
(16) tls keyfile = /usr/local/etc/ssl/private/dc.example.com.key
- Restart samba server
# service samba_server restart
