Samba

Samba4
https://wiki.samba.org/index.php/Samba_4/OS_Requirements#Gentoo

eselect python set python2.7 python-updater emerge --unmerge --ask app-crypt/mit-krb5 emerge --ask --quiet app-crypt/heimdal revdep-rebuild -- -ask echo "net-dns/bind berkdb dlz gssapi" >>/etc/portage/package.use echo "net-dns/bind-tools gssapi" >>/etc/portage/package.use emerge --ask --quiet net-dns/bind net-dns/bind-tools nano /etc/portage/package.keywords sys-libs/tevent ~amd64 sys-libs/tdb ~amd64 sys-libs/ldb ~amd64 sys-libs/talloc ~amd64 nano /etc/portage/package.use sys-libs/tdb python sys-libs/talloc python emerge --ask --quiet sys-libs/talloc sys-libs/tdb sys-libs/tevent sys-libs/ldb emerge --ask --quiet net-libs/gnutls sys-apps/acl dev-libs/cyrus-sasl dev-python/subunit dev-python/dnspython net-dns/libidn nano /etc/fstab /dev/md4  /home     ext4     user_xattr,acl,barrier=1,noatime         1 1 cd /usr/src/linux make menuconfig make && make modules_install cp -av arch/x86/boot/bzImage /boot/kernel-3.3.8-gentoo cp -av System.map /boot/System.map-3.3.8-gentoo cp -av .config /boot/config-3.3.8-gentoo reboot mkdir /root/misc/ cd /root/misc/ touch test.txt setfattr -n user.test -v test test.txt setfattr -n security.test -v test2 test.txt getfattr -d test.txt getfattr -n security.test -d test.txt touch test3.txt setfacl -m g:adm:rwx test3.txt getfacl test3.txt eselect python set python2.7 mkdir /usr/src/samba4 cd /usr/src/samba4 git clone git://git.samba.org/samba.git samba-master cd samba-master ./configure --enable-debug --enable-selftest make Waf: Leaving directory `/usr/src/samba4/samba-master/bin' 'build' finished successfully (11m54.988s) make install Waf: Leaving directory `/usr/src/samba4/samba-master/bin' 'install' finished successfully (3m15.214s) samba.EXAMPLE.com ~ $ /usr/local/samba/bin/samba-tool domain provision Realm [EXAMPLE.COM]: Domain [EXAMPLE]: Server Role (dc, member, standalone) [dc]: DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]: DNS forwarder IP address (write 'none' to disable forwarding) [192.168.0.1]: Administrator password: Retype password: Looking up IPv4 addresses More than one IPv4 address found. Using 172.16.215.1 Looking up IPv6 addresses No IPv6 address will be assigned Setting up share.ldb Setting up secrets.ldb Setting up the registry Setting up the privileges database Setting up idmap db Setting up SAM db Setting up sam.ldb partitions and settings Setting up sam.ldb rootDSE Pre-loading the Samba 4 and AD schema Adding DomainDN: DC=EXAMPLE,DC=com Adding configuration container Setting up sam.ldb schema Setting up sam.ldb configuration data Setting up display specifiers Modifying display specifiers Adding users container Modifying users container Adding computers container Modifying computers container Setting up sam.ldb data Setting up well known security principals Setting up sam.ldb users and groups Setting up self join Adding DNS accounts Creating CN=MicrosoftDNS,CN=System,DC=EXAMPLE,DC=com Creating DomainDnsZones and ForestDnsZones partitions Populating DomainDnsZones and ForestDnsZones partitions Setting up sam.ldb rootDSE marking as synchronized Fixing provision GUIDs A Kerberos configuration suitable for Samba 4 has been generated at /usr/local/samba/private/krb5.conf Once the above files are installed, your Samba4 server will be ready to use Server Role:          active directory domain controller Hostname:             samba NetBIOS Domain:       EXAMPLE DNS Domain:           EXAMPLE.com DOMAIN SID:           S-1-5-21-1142887457-1374467446-1811036830 /usr/local/samba/sbin/samba -i -M single
 * 1) required by samba4

(separate terminal)

$ /usr/local/samba/bin/smbclient --version Version 4.1.0pre1-GIT-8aae8b5 $ /usr/local/samba/bin/smbclient -L localhost -U% Domain=[EXAMPLE] OS=[Unix] Server=[Samba 4.1.0pre1-GIT-8aae8b5]

Sharename      Type      Comment -            ---        netlogon        Disk sysvol         Disk IPC$           IPC       IPC Service (Samba 4.1.0pre1-GIT-8aae8b5) Domain=[EXAMPLE] OS=[Unix] Server=[Samba 4.1.0pre1-GIT-8aae8b5]

/usr/local/samba/bin/smbclient //localhost/netlogon -UAdministrator%'passW0rd' -c 'ls'

host -t SRV _ldap._tcp.example.com. _ldap._tcp.example.com has SRV record 0 100 389 samba.example.com. host -t SRV _kerberos._udp.example.com. _kerberos._udp.example.com has SRV record 0 100 88 samba.example.com. kinit Administrator@EXAMPLE.COM Administrator@EXAMPLE.COM's Password: klist Credentials cache: FILE:/tmp/krb5cc_0 Principal: Administrator@EXAMPLE.COM Issued               Expires               Principal Apr 10 15:52:04 2013 Apr 11 01:52:04 2013  krbtgt/EXAMPLE.COM@EXAMPLE.COM -= DNS ISSUES / PROBLEMS / HOW TO EDIT SAMBA4_INTERNAL A RECORDS =-

host -t A samba.example.com samba.example.com has address 172.16.215.1 samba.example.com has address 172.16.224.1 samba.example.com has address 192.168.0.208 /usr/local/samba/bin/samba-tool dns zonelist 192.168.0.208 /usr/local/samba/bin/samba-tool dns delete samba example.com @ A 172.16.215.1 /usr/local/samba/bin/samba-tool dns delete samba example.com samba.example.com A 172.16.215.1 /usr/local/samba/bin/samba-tool dns delete samba example.com @ A 172.16.224.1 /usr/local/samba/bin/samba-tool dns delete samba example.com samba.example.com A 172.16.224.1

0. http://en.gentoo-wiki.com/wiki/Samba4_as_Active_Directory_Server 1. https://wiki.samba.org/index.php/Samba4

2. https://wiki.samba.org/index.php/Samba_4/OS_Requirements

3. https://wiki.samba.org/index.php/Samba_AD_DC_HOWTO

4. https://wiki.samba.org/index.php/Configuring_a_windows_client_for_AD

5. https://wiki.samba.org/index.php/Samba_AD_management_from_windows

6. http://www.alexwyn.com/computer-tips/centos-samba4-active-directory-domain-controller

Shut Down A Windows PC Remotely
net rpc SHUTDOWN -C "Test of remote shutdown with Samba" -f -I "192.168.0.61" -U username%password Shutdown of remote machine succeeded

ERROR: read_data: Accessing Share From Windows 7
Windows PC cannot access Samba Share. This is from Samba log file (/var/log/samba/log.mypc)...

[2012/06/08 12:03:21, 0] lib/util_sock.c:read_data(534) read_data: read failure for 4 bytes to client 192.168.0.55. Error = Connection reset by peer

Fix #1:

Control Panel > System and Security > Administrative Tools > Local Security Policy Local Policies > Security Options > Network Security LAN Manager Authentication Level > Send LM & NTML Responses Uncheck Require 128-bit Encryption on Clients Uncheck Require 128-bit Encryption on Servers Save and Reboot

Fix #2:

Control Panel > Credentials Manager > Browse to Samba Server and check or delete stored usernames and passwords Save and Reboot

Adding And Testing Users
Adding...

smbpasswd -a testuser

or...

pdbedit -a -u testuser

Testing...

grep 'testuser' /etc/passwd testuser:*:1001:1001::0:0:Test User:/home/testuser:/usr/sbin/nologin

pdbedit -u testuser testuser:1001:Test User

pdbedit -v -u testuser

Add Roaming Profile Machine Trust Account
useradd -c "Company 003 Machine Account" -d /dev/null -g machines -s /bin/false company-003$ smbpasswd -a -n -m company-003

You should have entries like the following:

/etc/passwd: company-010$:x:1016:101:Company-010 Machine Account:/dev/null:/bin/false /etc/shadow: company-003$:!:15393:0:99999:7::: /var/lib/samba/private/smbpasswd: company-003$:1035:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:2D6AF5372CEEE519054B3EAA0FC1B9D6:[W         ]:LCT-4F4664C3:

Test Samba Share Via Command Line
server.domain.co.uk ~ $ smbclient -U username //server.domain.co.uk/sharename Password: Domain=[DOAMIN] OS=[Unix] Server=[Samba 3.0.28] smb: \> ls smb: \> quit

Tweaks For Network Browsing
smb port = 139 local master = yes domain master = yes preferred master = yes os level = 35 interfaces = 192.168.0.0/24 127.0.0.1 bind interfaces only = yes

Fix Subnet Interface Errors
If you cannot access your samba server, and in the /var/log/samba/log.nmbd you see this error...

create_subnets: No local IPv4 non-loopback interfaces create_subnets: Waiting for an interface to appear

...then change your interfaces parameter in /etc/samba/smb.conf to match your actual network interface card. For example...

From

interfaces = 192.168.0.0/24 127.0.0.1

To

interfaces = 192.168.0.200/24 127.0.0.1

Weird, but it works. :-/

Windows 7: Domain Log On
There are currently two registry settings required to be added on the Windows 7 client prior to joining a Samba Domain. These are:

HKLM\System\CCS\Services\LanmanWorkstation\Parameters DWORD DomainCompatibilityMode = 1 DWORD DNSNameResolutionRequired = 0

Do not edit any other registry parameters (NETLOGON) that have been seen in the wild. If you have already modified your Windows 7 registry, please make sure to reset the keys to their default values.

If you have changed the NETLOGON Parameters, make sure and turn them back to '1' as shown below:

HKLM\System\CCS\Services\Netlogon\Parameters DWORD RequireSignOrSeal = 1 DWORD RequireStrongKey = 1

Primary Domain Controller
http://en.gentoo-wiki.com/wiki/Samba/Primary_Domain_Controller