Samba install with AD authentication

[Kevin McNamara_1]

Can someone point me in to a Step-By-Step procedure on how to configure Samba to use AD authentication.

[Geoff Wild]

Certainly - look at my thread:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=949365

Rgds...Geoff

[Jim Mallett · Accepted solution]

I wrestled with this earlier this year and kept some notes on it, hopefully they help. Keep in mind that versions may have changed and your specific config may differ. Two of the main issues I had were trying to use recent version of non-HP Samba rather than the HP CIFS Server, and another pain was setting up Kerberos (the case sensitivity).

Normally I remove any of our site specific info (domain name, etc) but I'm not in the mood.

Geoff's thread was definitely a major reason I was successful though...so a long overdue thanks to Geoff for his thread.


***from my notes***

These are the steps that I needed to make to get CIFS to use ADS to authenticate users.

Required Software:
CIFS A.02.02 (released 1/06) or greater
Kerberos v5 (1.3.5.03) Client
(see Kerberos patch requirements, which include: PHNE_27796 and PHSS_33384)
LDAP-UX Integration

Steps (refer to- http://docs.hp.com/en/B8725-90093/ch05s01.html for HP version):
- Install or verify installation of products listed above, Kerberos patches should be installed first.
- Configure the /etc/krb5.conf file (the example below is from our test server), CASE SENSITIVE!

root@dqvcord1 [ /etc ]
# cat /etc/krb5.conf
[libdefaults]
default_realm = DENTAQUEST.COM
default_tkt_enctypes = DES-CBC-CRC
default_tgs_enctypes = DES-CBC-CRC
ccache_type = 2

[realms]
DENTAQUEST.COM = {
kdc = dqvdc03.dentaquest.com:88
admin_server = dqvdc03.dentaquest.com
}

[domain_realm]
dentaquest.com = DENTAQUEST.COM
.dentaquest.com = DENTAQUEST.COM

[logging]
kdc = FILE:/var/adm/krb5kdc.log
admin_server = FILE:/var/log/kadmin.log
default = FILE:/var/log/krb5lib.log


- As root run kinit and check Kerberos configuration
# kinit jmallett or # kinit jmallett@DENTAQUEST.COM


- Set up the /etc/opt/samba/smb.conf file manually (or run /opt/samba/bin/samba_setup
Example:

# Global parameters
[global]
workgroup = DDPMA
realm = DENTAQUEST.COM
server string = DQVCORD1
security = ADS
client schannel = No
password server = dqvdc03, dqvdc02
log level = 2
log file = /var/opt/samba/log.%m
max log size = 10000
keepalive = 0
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
load printers = No
show add printer wizard = No
preferred master = No
local master = No
domain master = No
wins server = dqvdc02

root@dqvcord1 [ /etc ]
# cat /etc/opt/samba/smb.conf
# Samba config file created using SWAT
# from 10.10.1.43 (10.10.1.43)
# Date: 2006/02/01 20:41:56

# Global parameters
[global]
workgroup = DDPMA
realm = DENTAQUEST.COM
server string = DQVCORD1
security = ADS
client schannel = No
password server = dqvdc03, dqvdc02
log level = 2
log file = /var/opt/samba/log.%m
max log size = 10000
keepalive = 0
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
load printers = No
show add printer wizard = No
preferred master = No
local master = No
domain master = No
wins server = dqvdc02
idmap uid = 10000-30000
idmap gid = 10000-30000
template primary group = users
winbind separator = +
winbind enum users = No
winbind enum groups = No
read only = No
create mask = 0664
force create mode = 0664
directory mask = 0775
short preserve case = No
dos filetime resolution = Yes

[Test]
path = /testing
valid users = DDPMA+jmallett

[ECSPROD]
path = /download/ecsprod
valid users = DDPMA+ecsprod, DDPMA+jmallett

[AP]
path = /download/AP
valid users = DDPMA+jmallett, DDPMA+unixadmin
read only = Yes


- Join the ADS domain manually by running:
# net ads join -U or # net ads join -U administrator%password (use first to be prompted rather than typing pass in command line)

- Depending on if you receive errors or not, you may want to update your /etc/nsswitch.conf file to include the following two lines:
passwd: files winbind
group: files winbind

- Start Samba (multiple ways, but I use): /sbin/init.d/samba start
You can 'ps -ef | grep samba' to be sure smdb, nmdb, and winbindd are running.

If nothing else, this might provide some direction. Good luck.

Jim