Top

将samba当作活动目录域控制器

(Active Directory Domain Controller)
参考文章：
Setting_up_Samba_as_an_Active_Directory_Domain_Controller

从4.0版开始，samba可以作为AD域控制器(DC)。
如果是在生产环境中安装samba，建议运行两个或更多DC，以提供故障转移功能。

samba作为AD DC仅支持：

准备安装

安装

在FreeBSD下安装samba，只需要执行pkg install samba413。
但如果需要使用ldmap_adWinbind后台(例如AD成员服务器)，则需要从ports安装，并选中EXP_MODULES配置选项。 此处存疑，因为samba413并没有此项可选

配置samba Active Directory

samba AD配置操作创建一个AD数据库并添加初始记录，比如域管理员账号和必须的DNS条目。
samba-tool domain provision命令提供若干参数用于交互式和非交互式设置。使用以下命令可以获取帮助：
# samba-tool domain provision --help
配置新AD时，建议通过将--use-rfc2307参数传递给samba-tool域配置命令来启用NIS扩展。
启用NIS扩展没有缺点，但在现有域中启用它们需要手动扩展AD模式。

参数说明：
交互模式设置 非交互模式设置 说明
--use-rfc2307 --use-rfc2307 启用ADUC Unix属性选项卡所需的NIS扩展。
Realm --realm kerberos领域。AD DNS域的大写版本。例如：
SAMDOM.EXAMPLE.COM
Domain --domain NetBIOS域名（工作组）。
这可以是任何内容，但必须是一个单词，不超过15个字符，并且不包含点。建议使用AD DNS域的第一部分。例如
samdom
不要使用计算机短主机名。
Server Role --server-role 安装与控制器DC角色。
DNS backend --dns-backend 设置DNS后台。
AD中第一个DC必须使用DNS后台安装。注意，不支持BIND9_FLATFILE和NONE。
DNS forwarder IP address [无效] 仅当使用SAMBA_INTERNAL后台时此设置才有效
Administrator password --adminpass 设置域管理员密码。密码必须符合复杂性要求*。
其他常用参数：
--option="interfaces=lo eth0" --option="bind interfaces only=yes"
如果服务器有多个网卡，使用这些选项将samba绑定到指定的网卡。
这可以使samba-tool命令在连接期间在目录中注册正确的LAN IP地址。
注意：在AD域中设置第一个DC后，不要在同一域中设置任何其他DC、加入任何其他DC。

* 密码复杂性要求：

以交互模式配置Samba AD

先确认已经删除/usr/local/etc/smb4.conf。然后执行以下操作： 
root@X61s:/usr/ports/net/samba413 # samba-tool domain provision --use-rfc2307 --interactive
Realm [LOCAL]:  SAMDOM.EXAMPLE.COM
Domain [SAMDOM]:SAMDOM
Server Role (dc, member, standalone) [dc]:dc
DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]:SAMBA_INTERNAL
DNS forwarder IP address (write 'none' to disable forwarding) [8.8.8.8]:8.8.8.8
Administrator password:Passw0rd
Retype password:Passw0rd
INFO 1988-01-01 15:05:05,392 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #2131: Looking up IPv4 addresses
INFO 1988-01-01 15:05:05,393 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #2148: Looking up IPv6 addresses
WARNING 1988-01-01 15:05:05,394 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #2155: No IPv6 address will be assigned
INFO 1988-01-01 15:05:06,462 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #2299: Setting up share.ldb
INFO 1988-01-01 15:05:06,515 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #2303: Setting up secrets.ldb
INFO 1988-01-01 15:05:06,558 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #2308: Setting up the registry
INFO 1988-01-01 15:05:06,706 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #2311: Setting up the privileges database
INFO 1988-01-01 15:05:06,778 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #2314: Setting up idmap db
INFO 1988-01-01 15:05:06,831 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #2321: Setting up SAM db
INFO 1988-01-01 15:05:06,854 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #897: Setting up sam.ldb partitions and settings
INFO 1988-01-01 15:05:06,856 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #909: Setting up sam.ldb rootDSE
INFO 1988-01-01 15:05:06,863 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #1322: Pre-loading the Samba 4 and AD schema
Unable to determine the DomainSID, can not enforce uniqueness constraint on local domainSIDs

INFO 1988-01-01 15:05:06,956 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #1400: Adding DomainDN: DC=samdom,DC=example,DC=com
INFO 1988-01-01 15:05:06,991 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #1432: Adding configuration container
INFO 1988-01-01 15:05:07,025 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #1447: Setting up sam.ldb schema
INFO 1988-01-01 15:05:13,488 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #1465: Setting up sam.ldb configuration data
INFO 1988-01-01 15:05:13,861 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #1506: Setting up display specifiers
INFO 1988-01-01 15:05:18,064 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #1514: Modifying display specifiers and extended rights
INFO 1988-01-01 15:05:18,146 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #1521: Adding users container
INFO 1988-01-01 15:05:18,150 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #1527: Modifying users container
INFO 1988-01-01 15:05:18,152 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #1530: Adding computers container
INFO 1988-01-01 15:05:18,155 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #1536: Modifying computers container
INFO 1988-01-01 15:05:18,157 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #1540: Setting up sam.ldb data
INFO 1988-01-01 15:05:18,487 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #1570: Setting up well known security principals
INFO 1988-01-01 15:05:18,568 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #1584: Setting up sam.ldb users and groups
INFO 1988-01-01 15:05:18,883 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #1592: Setting up self join
Repacking database from v1 to v2 format (first record CN=ms-DS-Claim-Shares-Possible-Values-With-BL,CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com)
Repack: re-packed 10000 records so far
Repacking database from v1 to v2 format (first record CN=group-Display,CN=C04,CN=DisplaySpecifiers,CN=Configuration,DC=samdom,DC=example,DC=com)
Repacking database from v1 to v2 format (first record CN=6E157EDF-4E72-4052-A82A-EC3F91021A22,CN=Operations,CN=DomainUpdates,CN=System,DC=samdom,DC=example,DC=com)
INFO 1988-01-01 15:05:21,111 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/sambadns.py #1135: Adding DNS accounts
INFO 1988-01-01 15:05:21,153 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/sambadns.py #1169: Creating CN=MicrosoftDNS,CN=System,DC=samdom,DC=example,DC=com
INFO 1988-01-01 15:05:21,195 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/sambadns.py #1182: Creating DomainDnsZones and ForestDnsZones partitions
INFO 1988-01-01 15:05:21,316 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/sambadns.py #1187: Populating DomainDnsZones and ForestDnsZones partitions
Repacking database from v1 to v2 format (first record CN=Deleted Objects,DC=DomainDnsZones,DC=samdom,DC=example,DC=com)
Repacking database from v1 to v2 format (first record DC=_msdcs.samdom.example.com,CN=MicrosoftDNS,DC=ForestDnsZones,DC=samdom,DC=example,DC=com)
INFO 1988-01-01 15:05:21,812 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #2035: Setting up sam.ldb rootDSE marking as synchronized
INFO 1988-01-01 15:05:21,820 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #2040: Fixing provision GUIDs
INFO 1988-01-01 15:05:23,762 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #2376: A Kerberos configuration suitable for Samba AD has been generated at /var/db/samba4/private/krb5.conf
INFO 1988-01-01 15:05:23,764 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #2378: Merge the contents of this file with your system krb5.conf or replace it with this one. Do not create a symlink!
INFO 1988-01-01 15:05:23,889 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #2105: Setting up fake yp server settings
INFO 1988-01-01 15:05:24,052 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #489: Once the above files are installed, your Samba AD server will be ready to use
INFO 1988-01-01 15:05:24,052 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #494: Server Role:           active directory domain controller
INFO 1988-01-01 15:05:24,053 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #495: Hostname:              X61s
INFO 1988-01-01 15:05:24,053 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #496: NetBIOS Domain:        SAMDOM
INFO 1988-01-01 15:05:24,053 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #497: DNS Domain:            samdom.example.com
INFO 1988-01-01 15:05:24,053 pid:2780 /usr/local/lib/python3.9/site-packages/samba/provision/__init__.py #498: DOMAIN SID:            S-1-5-21-1888739682-2303175097-426578690
交互式配置模式支持向samba tool域配置命令传递更多参数。这使您能够修改不属于交互式设置的参数。
完成以上操作后自动创建/usr/local/etc/smb4.conf，内容如下： 
# Global parameters
[global]
        dns forwarder = 8.8.8.8
        netbios name = X61S
        realm = SAMDOM.EXAMPLE.COM
        server role = active directory domain controller
        workgroup = SAMDOM
        idmap_ldb:use rfc2307 = yes

[sysvol]
        path = /var/db/samba4/sysvol
        read only = No

[netlogon]
        path = /var/db/samba4/sysvol/samdom.example.com/scripts
        read only = No

以非交互模式配置Samba AD

假设： 执行以下命令： 
# samba-tool domain provision --server-role=dc --use-rfc2307 \
  --dns-backend=SAMBA_INTERNAL --realm=SAMDOM.EXAMPLE.COM \
  --domain=SAMDOM --adminpass=Passw0rd

配置DNS解析器

AD中的域成员使用DNS定位服务，如LDAP和Kerberos。为此，他们需要使用能够解析AD DNS区域的DNS服务器。 在DC的/etc/resolv.conf文件中的search行设置AD DNS域，在nameserver行设置： 
search samdom.example.com
nameserver 192.168.5.169

创建反转区域(reverse zone)

大概是反向解析此步骤可选。
# samba-tool dns zonecreate 192.168.5.169 0.99.10.in-addr.arpa -U Administrator
Password for [administrator@SAMDOM.EXAMPLE.COM]:
Zone 0.99.10.in-addr.arpa created successfully

配置kerberos

在AD中，kerberos用于人中用户、机器和服务。
# cp /usr/local/samba/private/krb5.conf /etc/krb5.conf

测试samba AD DC

手动测试samba服务，可以使用下面的命令：
# smaba

验证文件服务器

注意：以上步骤操作完成后需要重启服务器才能进行下面的验证
使用以下命令列出DC所有共享资源： 
root@X61s:~ # smbclient -L localhost -N
Anonymous login successful

        Sharename       Type      Comment
        ---------       ----      -------
        sysvol          Disk
        netlogon        Disk
        share           Disk
        IPC$            IPC       IPC Service (Samba 4.13.17)
SMB1 disabled -- no workgroup available

验证DNS

要验证AD DNS配置是否正常工作，请查询一些DNS记录：

关于将AD DC作为文件服务器

samba团队不建议使用DC作为文件服务器，原因如下：