Installing Samba
Unlike earlier versions of Samba, Samba 3.0 can operate in Windows networks running in Active Directory mode (or Windows 2000 native mode). If this functionality is required, you should install the samba3-3.0 package instead of samba-2.2.
Active Directory uses a different domain, computer, and user naming scheme based on DNS. For example, if there is a network named my.firm.com with computers host1.my.firm.com, host2.my.firm.com, and host3.my.firm.com, then the Active Directory domain will be named my.firm.com, and Active Directory users will have names in the format user@my.firm.com.
/etc/krb5.conf must contain at least the following lines:
[realms]
MY.FIRM.COM = {
kdc = your.kerberos.server
}
where MY.FIRM.COM is the domain name (or "realm" in Kerberos terminology; it must be specified in uppercase), and your.kerberos.server is the name or IP address of the KDC (Kerberos Domain Controller), analogous to the PDC (Primary Domain Controller) in Windows NT domains — for example, server.my.firm.com or 192.168.117.11.
You can verify the correctness of the parameters by running the command (replace the username with the actual one — for example, administrator@MY.FIRM.COM):
# kinit username@REALM
and ensuring that the password was accepted by the server. REALM is always specified in uppercase.
You must also ensure that it is possible to resolve the KDC name from its IP address (so-called Reverse DNS lookup). The KDC name must either match the NetBIOS name of the computer (the machine name in the Windows network without the domain) or consist of the NetBIOS name and the domain name. If you cannot resolve the KDC name from the address, you will receive a "local error" when attempting to join the domain.
If your DNS does not support reverse lookups or the KDC is not registered in DNS, you can specify the IP address to name mapping in /etc/hosts.
To operate in Active Directory, smb.conf must contain the following parameters:
[global] # Задает Kerberos realm, обычно совпадает с именем домена в # верхнем регистре, например realm = MY.FIRM.COM realm = <REALM> # Это обычно часть реалма до первой точки, например # workgroup = MY workgroup = <WORKGROUP> # Тип домена - Active Directory. security = ADS # В случае Active Directory пароли всегда шифруются. encrypt passwords = true # Обычно этот параметр указывать не обязательно, т.к. Samba сама # определяет адрес KDC, если в сети есть WINS-сервер и он указан # в smb.conf ads server = <your.kerberos.server>
Ensure that Samba is not running. If it is, stop it:
# service smb stop; service winbind stop
To join the computer to the domain, run the command:
# net ads join -U administrator
where administrator is the domain user name that has the right to create new accounts.
If no error message was issued, the machine has been successfully registered in the domain — otherwise, check the correctness of the parameters in /etc/samba/smb.conf and /etc/krb5.conf. Ensure that the user specified after -U in net ads join has the necessary rights to create new accounts.
Now you can start the required services:
# service smb start; service winbind start
You should receive a list of available resources, and smbclient should not prompt for a username and password.
To verify that access to your machine's resources is possible from other domain machines, you can try running the same command:
$ smbclient -k -L <имя вашего компьютера в домене>
and obtain a list of available resources. You can also try accessing a resource on your machine from a Windows machine that is part of the domain. In any case, the username and password should not be requested.
Unlike Windows NT domains, authentication in Active Directory is performed not by username and password, but using Kerberos protocol tickets. Because of this, working with smbclient may initially seem unusual.
First, when invoking smbclient, you need to specify the -k option. Second, Kerberos tickets are issued for a specific period (usually for a day, but this depends on server settings). Therefore, they need to be periodically refreshed using the kinit command:
# kinit username@REALM
where username is your username in the Active Directory domain REALM.
So, if smbclient suddenly stops connecting to domain resources, try refreshing the ticket — most likely, that is the issue.