Instalacja pakietów 

apt update && apt install -y samba smbclient krb5-user krb5-config winbind libpam-winbind libnss-winbind ldb-tools acl attr

Default Kerberos version 5 realm: LO.LAN

Kerberos servers for your realm: dc.lo.lan

Administrative server for your Kerberos realm: dc.lo.lan

 

Sprawdzenie danych przed promocją domeny

nano /etc/hosts
127.0.0.1       localhost
192.168.10.201  dc.lo.lan dc
nano /etc/hostname

dc

Resolved

systemctl stop systemd-resolved
systemctl disable systemd-resolved
rm -f /etc/resolv.conf
echo "nameserver 8.8.8.8" > /etc/resolv.conf

 

Promocja domeny

mv /etc/samba/smb.conf /etc/samba/smb.conf.orig
samba-tool domain provision --use-rfc2307 --interactive

Realm [LO.LAN]:
Domain [LO]:
Server Role (dc, member, standalone) [dc]:
DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]:
DNS forwarder IP address (write 'none' to disable forwarding) [8.8.8.8]:
Administrator password:

hasło Administratora

samba-tool user setpassword Administrator

Zmiana karty sieciowej

nano /etc/systemd/network/10-eth0.network
[Match]
Name=eth0

[Network]
Address=192.168.10.201/24
Gateway=192.168.10.200
DNS=192.168.10.201
systemctl restart systemd-networkd

Resolv

nano /etc/resolv.conf
domain lo.lan
search lo.lan
nameserver 192.168.10.201

Czyszczenie domyślnej konfiguracji serwera plików:

systemctl stop smbd nmbd winbind
systemctl disable smbd nmbd winbind
systemctl unmask samba-ad-dc 
systemctl start samba-ad-dc 
systemctl enable samba-ad-dc

Kerberos

cp /var/lib/samba/private/krb5.conf /etc/krb5.conf
nano /etc/krb5.conf
[libdefaults]
        default_realm = LO.LAN
        dns_lookup_realm = false
        dns_lookup_kdc = true

[realms]
LO.LAN = {
        default_domain = lo.lan
}

[domain_realm]
        dc = LO.LAN

 

kinit administrator
klist

Sprawdzenie

smbclient -L localhost -U% 
smbclient -L localhost -N
host -t SRV _ldap._tcp.lo.lan
host -t SRV _kerberos._udp.lo.lan
host -t A dc.lo.lan

Wyłączenie resrtykcji haseł

samba-tool domain passwordsettings set --complexity=off --min-pwd-length=0 --max-pwd-age=999 --history-length=0

 

Foldery domowe domeny

Wyjść z kontenera do debiana. W debianie:

mkdir -p /home/LO
chmod 770 /home/LO

Dodać do configa LXC dostęp do folderów domowych

nano /var/lib/lxc/srv-ad/config
#Montowanie katalogów domowych userów
lxc.mount.entry = /home/LO home/LO none bind,create=dir 0 0
lxc-stop -n srv-ad 
lxc-start -n srv-ad
lxc-attach -n srv-ad

W sambie powinien pojawić się folder 

/home/LO

chown root:"Domain Users" /home/LO

 

Netlogon

mkdir -p /home/netlogon
chmod 775 /home/netlogon
chown root:admini /home/netlogon

 

Zmiany w smb.conf

nano /etc/samba/smb.conf
# Global parameters
[global]
        dns forwarder = 8.8.8.8
        netbios name = dc
        realm = LO.LAN
        server role = active directory domain controller
        workgroup = LO
        idmap_ldb:use rfc2307 = yes
        template shell = /bin/bash

[sysvol]
        path = /var/lib/samba/sysvol
        read only = No

[netlogon]
        #path = /var/lib/samba/sysvol/lo.lan/scripts
        path = /home/netlogon/
        read only = No

[homes]
        path = /home/LO
        read only = no
        browseable = yes
        vfs objects = acl_xattr
        map acl inherit = yes
        store dos attributes = yes
        create mask = 0700
        directory mask = 0700

Restart

systemctl restart samba-ad-dc

Spis treści: