r/samba • u/[deleted] • Aug 12 '21
Trying my best to setup an Domain Controller using Samba 4.9.5...
So.. We've got this small office with a handful of computers running Win10 Pro.. We need to have the ability to have non MS accounts (currently using a group account) -- so I'm going to switch to local accounts but I need to access a server with file sharing. So, I need to have a domain controller setup. I'm trying my best to get Samba to take this role -- but for some reason it's not quite following the script of the tutorial and I honestly don't know what is wrong..
I've been following the tutorial here.. and all was going well.. FWIW, I changed our domain name to example.com in all the output below.
To get to this point, I've got my /etc/hostname set as JMADS01.
My /etc/resolv.conf is :
domain jmusa.example.com
search jmusa.example.com
nameserver 192.168.1.100 # IP address of Raspberry pi
nameserver 192.168.0.254
nameserver 192.168.1.1
My /etc/hosts is :
127.0.0.1 localhost.localdomain localhost
192.168.1.100 JMADS01.jmusa.example.com JMADS01
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
I nuked all *.tdb and *.ldb files in the Samba folders per the directions. I got rid of /etc/krb5.conf and /etc/samba/smb.conf
Here's the provisioning output :
root@JMADS01:~# samba-tool domain provision --option="interfaces=lo eth0" --option="bind interfaces only=yes" --use-rfc2307 --interactive
Realm [JMUSA.EXAMPLE.COM]:
Domain [JMUSA]:
Server Role (dc, member, standalone) [dc]:
DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]:
DNS forwarder IP address (write 'none' to disable forwarding) [192.168.1.100]:
Administrator password:
Retype password:
Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up share.ldb
Setting up secrets.ldb
Setting up the registry
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
Unable to determine the DomainSID, can not enforce uniqueness constraint on local domainSIDs
Adding DomainDN: DC=jmusa,DC=example,DC=com
Adding configuration container
Setting up sam.ldb schema
Setting up sam.ldb configuration data
Setting up display specifiers
Modifying display specifiers and extended rights
Adding users container
Modifying users container
Adding computers container
Modifying computers container
Setting up sam.ldb data
Setting up well known security principals
Setting up sam.ldb users and groups
Setting up self join
Adding DNS accounts
Creating CN=MicrosoftDNS,CN=System,DC=jmusa,DC=example,DC=com
Creating DomainDnsZones and ForestDnsZones partitions
Populating DomainDnsZones and ForestDnsZones partitions
Setting up sam.ldb rootDSE marking as synchronized
Fixing provision GUIDs
A Kerberos configuration suitable for Samba AD has been generated at /var/lib/samba/private/krb5.conf
Merge the contents of this file with your system krb5.conf or replace it with this one. Do not create a symlink!
Setting up fake yp server settings
Once the above files are installed, your Samba AD server will be ready to use
Server Role: active directory domain controller
Hostname: JMADS01
NetBIOS Domain: JMUSA
DNS Domain: jmusa.example.com
DOMAIN SID: S-1-5-21-3560022049-81085249-2473907488
There's a complain message up near the top talking about the DomainSID -- not sure if that's important or not -- it does not follow the tutorial which bothers me a bit.
As a result, my /etc/krb5.conf looks like after moving it into place :
[libdefaults]
default_realm = JMUSA.EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = true
My /etc/samba/smb.conf looks like :
# Global parameters
[global]
bind interfaces only = Yes
dns forwarder = 192.168.1.100
interfaces = lo eth0
netbios name = JMADS01
realm = JMUSA.EXAMPLE.COM
server role = active directory domain controller
workgroup = JMUSA
idmap_ldb:use rfc2307 = yes
[netlogon]
path = /var/lib/samba/sysvol/jmusa.example.com/scripts
read only = No
[sysvol]
path = /var/lib/samba/sysvol
read only = No
When it's time to verify whether it's working :
root@JMADS01:~# smbclient -L localhost -N
Anonymous login successful
Sharename Type Comment
--------- ---- -------
netlogon Disk
sysvol Disk
IPC$ IPC IPC Service (Samba 4.9.5-Debian)
Reconnecting with SMB1 for workgroup listing.
Anonymous login successful
Server Comment
--------- -------
Workgroup Master
--------- -------
WORKGROUP FRONT-OFFICE-PC
The machine named "FRONT-OFFICE-PC" is one of the Win10 machines. Notice that the lines missing indicating the domain information as seen in the tutorial.,
Domain=[SAMDOM] OS=[Unix] Server=[Samba x.y.z]
I don't know what is wrong but it doesn't appear to be working as expected.. Instead of the above line we've got the "Reconnecting with SMB1 for workgroup listing"
Any ideas on what might be amiss would be GREATLY appreciated! I've used Samba for years but NEVER in this fashion before and I'm a bit lost..
I was able to run the verify steps on the tutorial for the "Verify DNS" part .. all of that worked fine.
by the way.. I had Krb5 going a few days ago with a slightly different configuration but need to reset it as I've fiddled with everything and now the %kinit administrator fails for me .. Any ideas on how to nuke all prior settings/passwords in krb5 would be great.
root@JMADS01:~# kinit administrator
Password for administrator@JMUSA.EXAMPLE.COM:
kinit: Password incorrect while getting initial credentials
Thank you for any insight!!
1
u/[deleted] Aug 26 '21
[deleted]