Samba-3 and Active Directory

[dev44]

Hi Folks,

I am required to get our HPUX boxes authenticating through Active Directory. Apparently, Samba 3.0x does that and CIFS does not. The documentation that I found says that MIT Krb5 development libraries and OpenLDAP libraries are required.

Has anyone setup Samba with Active Directory support? Did you download the MIT Krb5 and OpenLDAP libraries and install them, or did you install HP CIFS which says that it includes them? Or are they even required at all (the only docs I found were for Linux)?

Thanks all,
SD

[Steven E. Protter]

http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=CIFSTP3

http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=CIFSTP22

These are not production code releases. But they are based on Samba 3 and can do ADS authentication.

SEP

[Xavier Gutierrez_2 · Accepted solution]

Hi, Sally.

You only need the CIFS server.

The client part (which has the LDAP and the KBR stuff) is not needed at all, as the authentication will be done on the AD servers.

I installed the following product on 8 of our servers:
CIFS-Server A.01.10 HP CIFS Server (Samba) File and Print Server

You'll have to create an entry in the AD for your unix server and setup the file /etc/opt/samba/smb.conf as following (I just paste the Global part...):

# Global parameters
[global]
workgroup = <-- your AD domain name
server string =
security = DOMAIN
encrypt passwords = Yes
password server = <-- Your AD controllers
syslog = 0
log file = /var/opt/samba/log.%m
max log size = 1000
keepalive = 0
local master = No
wins server = <-- Your WINS server
guest account =
read only = No
short preserve case = No
dos filetime resolution = Yes


Hope this helps,

Javier.

[Rodney Hills]

If you are only doing password authentication against a Win2000 ADS server, then you can use "pam".

Add entries to /etc/pam.conf, specifically-
login auth required /usr/lib/security/libpam_ntlm.1

You will need to create ADS users on the Win2000 server that match the unix login. If you have a name that can't match, their is a usermap file to map a unix login to a windows login.

HTH

-- Rod Hills

[Xavier Gutierrez_2]

Hi, Sally.

For the user access part to the different shared directories, we have used the group approach:

You create a unix group, let's say, smbusers that is allowed to see the samba share(s) through the smb.conf file.

Then you add a unix user per windows user that needs to access the share. These users must belong to the group smbusers (as primary or as secondary group)

UNIX accounts for users that were added on purpose for the samba share can be disabled so that they cannot perform UNIX login but they will still be able to access the share as the authentication is AD based.

And that's it...


Regards,

Javier.

[rmueller58]

FWIW,

I just went through some Samba configurations. If you download the source avoid 3.0.9. I had problems with it recognizing ADS auth, I rolled back to 3.0.8 even though there is one Errata and It worked fine.
http://us1.samba.org/samba/ftp/old-versions/samba-3.0.8.tar.gz


Also, Webmin (the lastest rev) makes configuring and managing Samba a lot easier.