Skip to content

Instantly share code, notes, and snippets.

@m-asama

m-asama/FreeBSD10_Samba4_AD.md

Last active August 29, 2015 14:21
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save m-asama/ec5c0feccce1b4286402 to your computer and use it in GitHub Desktop.
Save m-asama/ec5c0feccce1b4286402 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
FreeBSD10_Samba4_AD.md

FreeBSD10 と Samba4 で Active Directory

共通

インストール時のオプションは以下の通り。

Host Name
freebsd-(ad1|ad2|fs).samba4-ad.ginzado.co.jp
Distribution Select
lib32 のみ (games と ports は外す)
Partitioning
Auto (UFS)
System Configuration
sshd と ntpd と dumpdev

インストール後以下の作業を実施。

  • /etc/ssh/sshd_config で PermitRootLogin を yes に変更
  • /etc/fstab の / のオプションに acls を追加
  • /etc/rc.conf に ntpd_enable="YES" を追記
  • 再起動

pkg コマンドで samba41 と samba-nsupdate をインストールする。

root@freebsd-ad1:~ # pkg install samba41 samba-nsupdate
... 省略 ...
===============================================================================
Message for samba41-4.1.17:
===============================================================================

How to start: http://wiki.samba.org/index.php/Samba4/HOWTO

* Your configuration is: /usr/local/etc/smb4.conf

* All the relevant databases are under: /var/db/samba4

* All the logs are under: /var/log/samba4

* Provisioning script is: /usr/local/bin/samba-tool

%25%25NSUPDATE%25%25You will need to specify location of the 'nsupdate' command in the
%25%25NSUPDATE%25%25smb4.conf file:
%25%25NSUPDATE%25%25
%25%25NSUPDATE%25%25      nsupdate command = /usr/local/bin/samba-nsupdate -g
%25%25NSUPDATE%25%25
For additional documentation check: http://wiki.samba.org/index.php/Samba4

Bug reports should go to the: https://bugzilla.samba.org/

===============================================================================

AD1 作業

root@freebsd-ad1:~ # samba-tool domain provision --use-rfc2307 --interactive
Realm [SAMBA4-AD.GINZADO.CO.JP]: 
 Domain [SAMBA4-AD]: 
 Server Role (dc, member, standalone) [dc]: 
 DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]: 
 DNS forwarder IP address (write 'none' to disable forwarding) [110.92.1.13]: 
Administrator password: 
Retype password: 
Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up share.ldb
Setting up secrets.ldb
Setting up the registry
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
Adding DomainDN: DC=samba4-ad,DC=ginzado,DC=co,DC=jp
Adding configuration container
Setting up sam.ldb schema
Setting up sam.ldb configuration data
Setting up display specifiers
Modifying display specifiers
Adding users container
Modifying users container
Adding computers container
Modifying computers container
Setting up sam.ldb data
Setting up well known security principals
Setting up sam.ldb users and groups
Setting up self join
Adding DNS accounts
Creating CN=MicrosoftDNS,CN=System,DC=samba4-ad,DC=ginzado,DC=co,DC=jp
Creating DomainDnsZones and ForestDnsZones partitions
Populating DomainDnsZones and ForestDnsZones partitions
Setting up sam.ldb rootDSE marking as synchronized
Fixing provision GUIDs
A Kerberos configuration suitable for Samba 4 has been generated at /var/db/samba4/private/krb5.conf
Setting up fake yp server settings
Once the above files are installed, your Samba4 server will be ready to use
Server Role:           active directory domain controller
Hostname:              freebsd-ad1
NetBIOS Domain:        SAMBA4-AD
DNS Domain:            samba4-ad.ginzado.co.jp
DOMAIN SID:            S-1-5-21-3233004723-2732047097-3607321273

生成された krb5.conf を /etc/ にコピー。

root@freebsd-ad1:~ # cp /var/db/samba4/private/krb5.conf /etc/

smb4.conf に nsupdate command を追加。

# Global parameters
[global]
	workgroup = SAMBA4-AD
	realm = SAMBA4-AD.GINZADO.CO.JP
	netbios name = FREEBSD-AD1
	server role = active directory domain controller
	dns forwarder = 110.92.1.13
	idmap_ldb:use rfc2307 = yes
	nsupdate command = /usr/local/bin/samba-nsupdate -g

[netlogon]
	path = /var/db/samba4/sysvol/samba4-ad.ginzado.co.jp/scripts
	read only = No

[sysvol]
	path = /var/db/samba4/sysvol
	read only = No

/etc/rc.conf に samba_server_enable="YES" を追記。

再起動。

/etc/resolv.conf を以下の通り修正。

search samba4-ad.ginzado.co.jp
;nameserver 110.92.1.13
;nameserver 110.92.1.14
nameserver 172.31.2.65

AD2 作業

/etc/resolv.conf を以下の通り修正。

search samba4-ad.ginzado.co.jp
;nameserver 110.92.1.13
;nameserver 110.92.1.14
nameserver 172.31.2.65

/etc/krb5.conf を以下の内容で作成。

[libdefaults]
	default_realm = SAMBA4-AD.GINZADO.CO.JP
	dns_lookup_realm = false
	dns_lookup_kdc = true

kinit コマンドと klist コマンドを実行。

root@freebsd-ad2:~ # kinit administrator
administrator@SAMBA4-AD.GINZADO.CO.JP's Password: 
root@freebsd-ad2:~ # klist
Credentials cache: FILE:/tmp/krb5cc_0
        Principal: administrator@SAMBA4-AD.GINZADO.CO.JP

  Issued                Expires               Principal
May 12 12:40:39 2015  May 12 22:40:38 2015  krbtgt/SAMBA4-AD.GINZADO.CO.JP@SAMBA4-AD.GINZADO.CO.JP

samba-tool コマンドで作成した Active Directory に Domain Controller として参加。

root@freebsd-ad2:~ # samba-tool domain join samba4-ad.ginzado.co.jp DC --realm=samba4-ad.ginzado.co.jp -W SAMBA4-AD -U Administrator
Finding a writeable DC for domain 'samba4-ad.ginzado.co.jp'
Found DC freebsd-ad1.samba4-ad.ginzado.co.jp
Password for [SAMBA4-AD\Administrator]:
workgroup is SAMBA4-AD
realm is samba4-ad.ginzado.co.jp
checking sAMAccountName
Adding CN=FREEBSD-AD2,OU=Domain Controllers,DC=samba4-ad,DC=ginzado,DC=co,DC=jp
Adding CN=FREEBSD-AD2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=samba4-ad,DC=ginzado,DC=co,DC=jp
Adding CN=NTDS Settings,CN=FREEBSD-AD2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=samba4-ad,DC=ginzado,DC=co,DC=jp
Adding SPNs to CN=FREEBSD-AD2,OU=Domain Controllers,DC=samba4-ad,DC=ginzado,DC=co,DC=jp
Setting account password for FREEBSD-AD2$
Enabling account
Calling bare provision
No IPv6 address will be assigned
Provision OK for domain DN DC=samba4-ad,DC=ginzado,DC=co,DC=jp
Starting replication
Schema-DN[CN=Schema,CN=Configuration,DC=samba4-ad,DC=ginzado,DC=co,DC=jp] objects[402/1550] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=samba4-ad,DC=ginzado,DC=co,DC=jp] objects[804/1550] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=samba4-ad,DC=ginzado,DC=co,DC=jp] objects[1206/1550] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=samba4-ad,DC=ginzado,DC=co,DC=jp] objects[1550/1550] linked_values[0/0]
Analyze and apply schema objects
Partition[CN=Configuration,DC=samba4-ad,DC=ginzado,DC=co,DC=jp] objects[402/1614] linked_values[0/0]
Partition[CN=Configuration,DC=samba4-ad,DC=ginzado,DC=co,DC=jp] objects[804/1614] linked_values[0/0]
Partition[CN=Configuration,DC=samba4-ad,DC=ginzado,DC=co,DC=jp] objects[1206/1614] linked_values[0/0]
Partition[CN=Configuration,DC=samba4-ad,DC=ginzado,DC=co,DC=jp] objects[1608/1614] linked_values[0/0]
Partition[CN=Configuration,DC=samba4-ad,DC=ginzado,DC=co,DC=jp] objects[1614/1614] linked_values[28/0]
Replicating critical objects from the base DN of the domain
Partition[DC=samba4-ad,DC=ginzado,DC=co,DC=jp] objects[97/97] linked_values[23/0]
Partition[DC=samba4-ad,DC=ginzado,DC=co,DC=jp] objects[360/263] linked_values[23/0]
Done with always replicated NC (base, config, schema)
Replicating DC=DomainDnsZones,DC=samba4-ad,DC=ginzado,DC=co,DC=jp
Partition[DC=DomainDnsZones,DC=samba4-ad,DC=ginzado,DC=co,DC=jp] objects[40/40] linked_values[0/0]
Replicating DC=ForestDnsZones,DC=samba4-ad,DC=ginzado,DC=co,DC=jp
Partition[DC=ForestDnsZones,DC=samba4-ad,DC=ginzado,DC=co,DC=jp] objects[18/18] linked_values[0/0]
Partition[DC=ForestDnsZones,DC=samba4-ad,DC=ginzado,DC=co,DC=jp] objects[36/18] linked_values[0/0]
Committing SAM database
Sending DsReplicateUpdateRefs for all the replicated partitions
Setting isSynchronized and dsServiceName
Setting up secrets database
Joined domain SAMBA4-AD (SID S-1-5-21-3233004723-2732047097-3607321273) as a DC

/usr/local/etc/smb4.conf を以下の通り修正。

# Global parameters
[global]
	workgroup = SAMBA4-AD
	realm = SAMBA4-AD.GINZADO.CO.JP
	netbios name = FREEBSD-AD2
	server role = active directory domain controller
	dns forwarder = 110.92.1.14
	idmap_ldb:use rfc2307 = yes
	nsupdate command = /usr/local/bin/samba-nsupdate -g

[netlogon]
	path = /var/db/samba4/sysvol/samba4-ad.ginzado.co.jp/scripts
	read only = No

[sysvol]
	path = /var/db/samba4/sysvol
	read only = No

/etc/rc.conf に samba_server_enable="YES" を追記。

再起動。

/etc/resolv.conf を以下の通り修正。

search samba4-ad.ginzado.co.jp
nameserver 172.31.2.65
nameserver 172.31.2.66

AD1 作業

/etc/resolv.conf を以下の通り修正。

search samba4-ad.ginzado.co.jp
nameserver 172.31.2.65
nameserver 172.31.2.66

FS 作業

/etc/resolv.conf を以下の通り修正。

search samba4-ad.ginzado.co.jp
nameserver 172.31.2.65
nameserver 172.31.2.66

/usr/local/etc/smb4.conf を以下の通り作成。

[global]

   workgroup = SAMBA4-AD
   security = ADS
   realm = SAMBA4-AD.GINZADO.CO.JP
   dedicated keytab file = /etc/krb5.keytab
   kerberos method = secrets and keytab

   idmap config *:backend = tdb
   idmap config *:range = 2000-9999
   idmap config SAMBA4-AD:backend = ad
   idmap config SAMBA4-AD:schema_mode = rfc2307
   idmap config SAMBA4-AD:range = 10000-99999

   winbind nss info = rfc2307
   winbind trusted domains only = no
   winbind use default domain = yes
   winbind enum users  = yes
   winbind enum groups = yes
   winbind refresh tickets = Yes
   winbind expand groups = 4
   winbind normalize names = Yes
   domain master = no
   local master = no
   vfs objects = acl_xattr
   map acl inherit = Yes
   store dos attributes = Yes

   nsupdate command = /usr/local/bin/samba-nsupdate -g

[demoshare]
   path = /var/tmp/demoshare
   read only = no

/etc/krb5.conf を以下の通り作成。

[libdefaults]
	default_realm = SAMBA4-AD.GINZADO.CO.JP
	dns_lookup_realm = false
	dns_lookup_kdc = true

kinit コマンドと klist コマンドを実行。

root@freebsd-fs:~ # kinit administrator
administrator@SAMBA4-AD.GINZADO.CO.JP's Password: 
root@freebsd-fs:~ # klist
Credentials cache: FILE:/tmp/krb5cc_0
        Principal: administrator@SAMBA4-AD.GINZADO.CO.JP

  Issued                Expires               Principal
May 12 12:40:39 2015  May 12 22:40:38 2015  krbtgt/SAMBA4-AD.GINZADO.CO.JP@SAMBA4-AD.GINZADO.CO.JP

net コマンドで作成した Active Directory に Member Server として参加。

root@freebsd-fs:~ # net ads join -U administrator

/etc/nsswitch.conf の passwd と group を以下の通り修正。

passwd: files winbind
group: files winbind

/etc/rc.conf に samba_server_enable="YES" と winbindd_enable="YES" を追記。

再起動。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment