Sunday, 17 August 2014

Samba 4 Domain Controller on Ubuntu 14.04 LTS


Linux Ubuntu 14.04 server with samba 4


Replace Windows Server "Active Directory Domain Controller" with a free Linux alternative.


Log on to your Ubuntu, "sudo su -" and follow below steps.

1. Configure network with a static ip address

edit /etc/network/interfaces
auto eth0
iface eth0 inet static
 dns-nameservers #the nameserver, we will change it later to point at itself
 dns-search test.local

2. Name your domain controller

hostname pdc
echo "pdc" > /etc/hostname

edit /etc/hosts and make sure below 3 lines look as follow: localhost pdc.test.local pdc pdc.test.local pdc

Bring system up to date
apt-get update && apt-get upgrade

3. Install packages ntp, acl, samba + tools

apt-get install ntp acl samba krb5-user smbclient

The kerberos package will prompt you for some values.
Your realm: TEST.LOCAL
Kerberos servers for your realm: pdc.test.local
Administrative server: pdc.test.local

4. Configure samba

Remove automatically created configuration
rm /etc/samba/smb.conf

Configure samba with samba-tool
samba-tool domain provision --realm test.local --domain TEST --adminpass Password123 --server-role=dc
Administrator's password can't be to simple as there's a password strength check applied and the command will fail if you choose something weak.

Run below command to set properly acl's
samba-tool ntacl sysvolreset

5. Configure DNS

For large, complex deployments you should use BIND, but in my scenario "built in" samba dns is good enough.

edit /etc/samba/smb.conf and add
dns forwarder =
allow dns updates = nonsecure

Update network configuration to use our new dns
edit /etc/network/interfaces

6. Test your new domain controller

Make sure all below commands return no errors.
host -t SRV _ldap._tcp.test.local.
host -t SRV _kerberos._udp.test.local.
host -t A pdc.test.local.

Test if you can log on as domain administrator
kinit administrator

Make sure smbclient can communicate with new DC
smbclient -L localhost -U%
smbclient //localhost/netlogon -U 'administrator'

7. Manage your new domain controller

Recommended way of managing your server is to use "Remote Server Administration Tools", which you can install on Windows 7 desktop pc as a feature.

You can also manage users & groups with samba-tool
samba-tool user add john --surname=Smith --given-name=John
samba-tool group add test_group
samba-tool group addmembers test_group john
samba-tool user list
getent passwd john
id john


Ubuntu desktop:

To make linux workstation work with Windows domain edit /etc/nsswitch.conf and replace hosts line:
hosts:          files mdns4_minimal [NOTFOUND=return] dns
hosts:          files dns mdns4_minimal [NOTFOUND=return]

This will only affect .local domains and will resolve them using dns instead of mdns4_minimal.

In /etc/resolv.conf you should have below entry, which can be propagated with your DHCP server.
search test.local

No comments:

Post a Comment