Samba AD DC - サーバーの設定2014/04/26

Samba による Active Directory Domain Controller を構築します。

ここでは例として、以下のようなドメイン環境で設定します。

ドメイン名	: SMB01
レルム	: SMB.SRV.WORLD
ホスト名	: smb.srv.world

[1]

必要なものをインストール

root@smb:~#

apt-get -y install samba krb5-config

# レルム名を設定

 +------------------+ Configuring Kerberos Authentication +------------------+
 | When users attempt to use Kerberos and specify a principal or user name   |
 | without specifying what administrative Kerberos realm that principal      |
 | belongs to, the system appends the default realm.  The default realm may  |
 | also be used as the realm of a Kerberos service running on the local      |
 | machine.  Often, the default realm is the uppercase version of the local  |
 | DNS domain.                                                               |
 |                                                                           |
 | Default Kerberos version 5 realm:                                         |
 |                                                                           |
 | SMB.SRV.WORLD_________________________________________________________ |
 |                                                                           |
 |                                  <Ok>                                     |
 |                                                                           |
 +---------------------------------------------------------------------------+

# 自身のホスト名を指定

 +------------------+ Configuring Kerberos Authentication +------------------+
 | Enter the hostnames of Kerberos servers in the SMB.SRV.WORLD Kerberos  |
 | realm separated by spaces.                                                |
 |                                                                           |
 | Kerberos servers for your realm:                                          |
 |                                                                           |
 | smb.srv.world_________________________________________________________ |
 |                                                                           |
 |                                  <Ok>                                     |
 |                                                                           |
 +---------------------------------------------------------------------------+

# 自身のホスト名を指定

 +------------------+ Configuring Kerberos Authentication +------------------+
 | Enter the hostname of the administrative (password changing) server for   |
 | the SMB.SRV.WORLD Kerberos realm.                                      |
 |                                                                           |
 | Administrative server for your Kerberos realm:                            |
 |                                                                           |
 | smb.srv.world_________________________________________________________ |
 |                                                                           |
 |                                  <Ok>                                     |
 |                                                                           |
 +---------------------------------------------------------------------------+

[2]

Samba の設定

# デフォルトの設定ファイルはリネームまたは削除

root@smb:~#

mv /etc/samba/smb.conf /etc/samba/smb.conf.org

root@smb:~#

samba-tool domain provision

# レルム名を指定

Realm:

SMB.SRV.WORLD

# ドメイン名を指定

Domain [SMB]:

SMB01

# DC にするのでそのまま Enter

Server Role (dc, member, standalone) [dc]:

# Samba の内臓 DNS を使うのでそのまま Enter

DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]:

# DNS の参照先を確認して、OKであればそのまま Enter

DNS forwarder IP address (write 'none' to disable forwarding) [10.0.0.10]:

# 管理者パスワードを設定

# 単純なパスワードはエラーとなるため、6文字以上且つ英数字と大文字小文字を交えた複雑なパスワードにする

Administrator password:
Retype password:
Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up share.ldb
Setting up secrets.ldb
Setting up the registry
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
Adding DomainDN: DC=smb,DC=srv,DC=world
Adding configuration container
Setting up sam.ldb schema
Setting up sam.ldb configuration data
Setting up display specifiers
Modifying display specifiers
Adding users container
Modifying users container
Adding computers container
Modifying computers container
Setting up sam.ldb data
Setting up well known security principals
Setting up sam.ldb users and groups
Setting up self join
Adding DNS accounts
Creating CN=MicrosoftDNS,CN=System,DC=smb,DC=srv,DC=world
Creating DomainDnsZones and ForestDnsZones partitions
Populating DomainDnsZones and ForestDnsZones partitions
Setting up sam.ldb rootDSE marking as synchronized
Fixing provision GUIDs
A Kerberos configuration suitable for Samba 4 has been generated at /var/lib/samba/private/krb5.conf
Once the above files are installed, your Samba4 server will be ready to use
Server Role:           active directory domain controller
Hostname:              smb
NetBIOS Domain:        SMB01
DNS Domain:            smb.srv.world
DOMAIN SID:            S-1-5-21-2788139304-4264175402-297299711

# 一旦再起動

root@smb:~#

reboot

# ドメインの機能レベルを 2008 R2 に上げておく

root@smb:~#

samba-tool domain level raise --domain-level 2008_R2 --forest-level 2008_R2

Domain function level changed!
Forest function level changed!
All changes applied successfully!

# ドメインの機能レベル確認

root@smb:~#

samba-tool domain level show

Domain and forest function level for domain 'DC=smb,DC=srv,DC=world'

Forest function level: (Windows) 2008 R2
Domain function level: (Windows) 2008 R2
Lowest function level of a DC: (Windows) 2008 R2

# ドメインにユーザー登録

root@smb:~#

samba-tool user add trusty

New Password:

# パスワード設定

Retype Password:
User 'trusty' created successfully

[2]	以上で Samba AD DC の設定完了です。クライアントからのドメイン参加は次項を参照ください。