Chapter 21. File and Print Servers

Procedure 21.3. Adding a Member Server to an Active Directory Domain

1. Create the /etc/samba/smb.conf configuration file on a member server to be added to the Active Directory domain. Add the following lines to the configuration file:

   [global]
   realm = EXAMPLE.COM
   security = ADS
   encrypt passwords = yes
   # Optional. Use only if Samba cannot determine the Kerberos server automatically.
   password server = kerberos.example.com

   Copy to Clipboard Toggle word wrap
   With the above configuration, Samba authenticates users for services being run locally but is also a client of the Active Directory. Ensure that your kerberos realm parameter is shown in all caps (for example realm = EXAMPLE.COM). Since Windows 2000/2003/2008 requires Kerberos for Active Directory authentication, the realm directive is required. If Active Directory and Kerberos are running on different servers, the password server directive is required to help the distinction.
2. Configure Kerberos on the member server. Create the /etc/krb5.conf configuration file with the following content:

   [logging]
    default = FILE:/var/log/krb5libs.log
   
   [libdefaults]
    default_realm = AD.EXAMPLE.COM
    dns_lookup_realm = true
    dns_lookup_kdc = true
    ticket_lifetime = 24h
    renew_lifetime = 7d
    rdns = false
    forwardable = false
   
   [realms]
   # Define only if DNS lookups are not working
   # AD.EXAMPLE.COM = {
   #  kdc = server.ad.example.com
   #  admin_server = server.ad.example.com
   #  master_kdc = server.ad.example.com
   # }
   
   [domain_realm]
   # Define only if DNS lookups are not working
   # .ad.example.com = AD.EXAMPLE.COM
   # ad.example.com = AD.EXAMPLE.COM

   Copy to Clipboard Toggle word wrap
   Uncomment the [realms] and [domain_realm] sections if DNS lookups are not working.
   For more information on Kerberos, and the /etc/krb5.conf file, see the Using Kerberos section of the Red Hat Enterprise Linux 6 Managing Single Sign-On and Smart Cards.
3. To join an Active Directory server, type the following command as root on the member server:

   ~]# net ads join -U administrator%password

   Copy to Clipboard Toggle word wrap
   The net command authenticates as Administrator using the NT LAN Manager (NTLM) protocol and creates the machine account. Then net uses the machine account credentials to authenticate with Kerberos.

   Note

   Since security = ads and not security = user is used, a local password back end such as smbpasswd is not needed. Older clients that do not support security = ads are authenticated as if security = domain had been set. This change does not affect functionality and allows local users not previously in the domain.

1. Adjust the smb.conf configuration file as shown in Example 21.7, “An Example Configuration of Primary Domain Controller (PDC) Using tdbsam”.
2. Add the root user to the Samba password database. You will be prompted to provide a new Samba password for the root user:

   ~]# smbpasswd -a root
   New SMB password:

   Copy to Clipboard Toggle word wrap
3. Start the smb service:

   ~]# service smb start

   Copy to Clipboard Toggle word wrap
4. Make sure all profile, user, and netlogon directories are created.
5. Add groups that users can be members of:

   ~]# groupadd -f users
   ~]# groupadd -f nobody
   ~]# groupadd -f ntadmins

   Copy to Clipboard Toggle word wrap
6. Associate the UNIX groups with their respective Windows groups.

   ~]# net groupmap add ntgroup="Domain Users" unixgroup=users
   ~]# net groupmap add ntgroup="Domain Guests" unixgroup=nobody
   ~]# net groupmap add ntgroup="Domain Admins" unixgroup=ntadmins

   Copy to Clipboard Toggle word wrap
7. Grant access rights to a user or a group. For example, to grant the right to add client machines to the domain on a Samba domain controller, to the members to the Domain Admins group, execute the following command:

   ~]# net rpc rights grant 'DOCS\Domain Admins' SetMachineAccountPrivilege -S PDC -U root

   Copy to Clipboard Toggle word wrap

Procedure 21.4. Configuring Samba Guest Shares

1. Create a username map file, in this example /etc/samba/smbusers, and add the following line to it:

   nobody = guest

   Copy to Clipboard Toggle word wrap
2. Add the following directives to the main section in the /etc/samba/smb.conf file. Also, do not use the valid users directive:

   [GLOBAL]
   ...
   security = user
   map to guest = Bad User
   username map = /etc/samba/smbusers
   ...

   Copy to Clipboard Toggle word wrap
   The username map directive provides a path to the username map file specified in the previous step.
3. Add the following directive to the share section in the /ect/samba/smb.conf file. Do not use the valid users directive.

   [SHARE]
   ...
   guest ok = yes
   ...

   Copy to Clipboard Toggle word wrap