Samba

Description

This is a short howto about connecting a Linux machine via Samba to an Windows ADS Domain.

USE-Flags

File: /etc/portage/package.use

net-nds/openldap kerberos samba
net-fs/samba -cups addns ads ldap winbind

Installation

# emerge samba

Configuration

See kerberos for the required kerberos configuration.

File: /etc/conf.d/samba

daemon_list="smbd nmbd winbind"

File: /etc/samba/smb.conf

[global]
        workgroup = YOURDOMAIN
        netbios name = HOSTNAME
        server string = HOSTNAME
        realm = YOURDOMAIN.LOCAL
        security = ADS
        encrypt passwords = yes
        client use spnego = yes
        idmap config * : backend = tdb
        idmap config * : range = 1000000 - 1999999
        idmap config YOURDOMAIN : backend = rid
        idmap config YOURDOMAIN : range = 15000 - 49999
        winbind use default domain = yes
        wins server = xxx.xxx.xxx.xxx
        dos charset = 850
        unix charset = UTF-8
        log level = 3
        max protocol = SMB2
        rpc_server:epmapper = daemon
        domain master = no
        local master = no
        preferred master = no
        os level = 0

        client signing = yes
        kerberos method = secrets and keytab
        password server = yourdc.yourdomain.local


        # printing disabled
        load printers = no
        printcap name = /dev/null
        disable spoolss = yes

        # printing enabled
        load printers = yes
        printing = cups
        printcap name = cups
        disable spoolss = no

include = /etc/samba/shares.conf

File: /etc/samba/shares.conf

[testshare]
        comment = Testshare
        path = /mnt/storage/testshare
        valid users = YOURDOMAIN\username, @YOURDOMAIN\groupname
        writeable = No
        guest ok = Yes
        browseable = Yes

You only need this when not using SSSD.

File: /etc/nsswitch.conf

passwd:      compat winbind
shadow:      compat winbind
group:       compat winbind

Join the ADS Domain

# net ads join -U Administrator

and enter the domain-administrator password.

Finalize

# /etc/init.d/samba start

# rc-update add samba default

Testing

Show information about the domain.

# net ads info

Show online status of the domain.

# wbinfo --online-status

Show current DC.

# wbinfo --getdcname YOURDOMAIN.LOCAL

Verify that the workstation trust account is working.

# wbinfo -t

List domain users.

# wbinfo -u

List domain groups.

# wbinfo -g

Further Reading

• Squid - Authenticate Squid users against ADS
• kerberos - Kerberos configuration for authenticating users against ADS
• SSSD - Authenticate system users against ADS
• not available yet - Manage your Samba shares in a MySQL database and administer them via a webinterface