docs/htmldocs/ads.html

   1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
   2 <HTML
   3 ><HEAD
   4 ><TITLE
   5 >Samba as a ADS domain member</TITLE
   6 ><META
   7 NAME="GENERATOR"
   8 CONTENT="Modular DocBook HTML Stylesheet Version 1.76b+
   9 "><LINK
  10 REL="HOME"
  11 TITLE="SAMBA Project Documentation"
  12 HREF="samba-howto-collection.html"><LINK
  13 REL="UP"
  14 TITLE="Type of installation"
  15 HREF="type.html"><LINK
  16 REL="PREVIOUS"
  17 TITLE="How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain"
  18 HREF="samba-bdc.html"><LINK
  19 REL="NEXT"
  20 TITLE="Samba as a NT4 domain member"
  21 HREF="domain-security.html"></HEAD
  22 ><BODY
  23 CLASS="CHAPTER"
  24 BGCOLOR="#FFFFFF"
  25 TEXT="#000000"
  26 LINK="#0000FF"
  27 VLINK="#840084"
  28 ALINK="#0000FF"
  29 ><DIV
  30 CLASS="NAVHEADER"
  31 ><TABLE
  32 SUMMARY="Header navigation table"
  33 WIDTH="100%"
  34 BORDER="0"
  35 CELLPADDING="0"
  36 CELLSPACING="0"
  37 ><TR
  38 ><TH
  39 COLSPAN="3"
  40 ALIGN="center"
  41 >SAMBA Project Documentation</TH
  42 ></TR
  43 ><TR
  44 ><TD
  45 WIDTH="10%"
  46 ALIGN="left"
  47 VALIGN="bottom"
  48 ><A
  49 HREF="samba-bdc.html"
  50 ACCESSKEY="P"
  51 >Prev</A
  52 ></TD
  53 ><TD
  54 WIDTH="80%"
  55 ALIGN="center"
  56 VALIGN="bottom"
  57 ></TD
  58 ><TD
  59 WIDTH="10%"
  60 ALIGN="right"
  61 VALIGN="bottom"
  62 ><A
  63 HREF="domain-security.html"
  64 ACCESSKEY="N"
  65 >Next</A
  66 ></TD
  67 ></TR
  68 ></TABLE
  69 ><HR
  70 ALIGN="LEFT"
  71 WIDTH="100%"></DIV
  72 ><DIV
  73 CLASS="CHAPTER"
  74 ><H1
  75 ><A
  76 NAME="ADS">Chapter 8. Samba as a ADS domain member</H1
  77 ><P
  78 >This is a rough guide to setting up Samba 3.0 with kerberos authentication against a
  79 Windows2000 KDC. </P
  80 ><P
  81 >Pieces you need before you begin:
  82 <P
  83 ></P
  84 ><TABLE
  85 BORDER="0"
  86 ><TBODY
  87 ><TR
  88 ><TD
  89 >a Windows 2000 server.</TD
  90 ></TR
  91 ><TR
  92 ><TD
  93 >samba 3.0 or higher.</TD
  94 ></TR
  95 ><TR
  96 ><TD
  97 >the MIT kerberos development libraries (either install from the above sources or use a package). The heimdal libraries will not work.</TD
  98 ></TR
  99 ><TR
 100 ><TD
 101 >the OpenLDAP development libraries.</TD
 102 ></TR
 103 ></TBODY
 104 ></TABLE
 105 ><P
 106 ></P
 107 ></P
 108 ><DIV
 109 CLASS="SECT1"
 110 ><H1
 111 CLASS="SECT1"
 112 ><A
 113 NAME="AEN1187">8.1. Installing the required packages for Debian</H1
 114 ><P
 115 >On Debian you need to install the following packages:
 116 <P
 117 ></P
 118 ><TABLE
 119 BORDER="0"
 120 ><TBODY
 121 ><TR
 122 ><TD
 123 >libkrb5-dev</TD
 124 ></TR
 125 ><TR
 126 ><TD
 127 >krb5-user</TD
 128 ></TR
 129 ></TBODY
 130 ></TABLE
 131 ><P
 132 ></P
 133 ></P
 134 ></DIV
 135 ><DIV
 136 CLASS="SECT1"
 137 ><H1
 138 CLASS="SECT1"
 139 ><A
 140 NAME="AEN1193">8.2. Installing the required packages for RedHat</H1
 141 ><P
 142 >On RedHat this means you should have at least:
 143 <P
 144 ></P
 145 ><TABLE
 146 BORDER="0"
 147 ><TBODY
 148 ><TR
 149 ><TD
 150 >krb5-workstation (for kinit)</TD
 151 ></TR
 152 ><TR
 153 ><TD
 154 >krb5-libs (for linking with)</TD
 155 ></TR
 156 ><TR
 157 ><TD
 158 >krb5-devel (because you are compiling from source)</TD
 159 ></TR
 160 ></TBODY
 161 ></TABLE
 162 ><P
 163 ></P
 164 ></P
 165 ><P
 166 >in addition to the standard development environment.</P
 167 ><P
 168 >Note that these are not standard on a RedHat install, and you may need
 169 to get them off CD2.</P
 170 ></DIV
 171 ><DIV
 172 CLASS="SECT1"
 173 ><H1
 174 CLASS="SECT1"
 175 ><A
 176 NAME="AEN1202">8.3. Compile Samba</H1
 177 ><P
 178 >If your kerberos libraries are in a non-standard location then
 179   remember to add the configure option --with-krb5=DIR.</P
 180 ><P
 181 >After you run configure make sure that include/config.h contains
 182   lines like this:</P
 183 ><P
 184 ><PRE
 185 CLASS="PROGRAMLISTING"
 186 >#define HAVE_KRB5 1
 187 #define HAVE_LDAP 1</PRE
 188 ></P
 189 ><P
 190 >If it doesn't then configure did not find your krb5 libraries or
 191   your ldap libraries. Look in config.log to figure out why and fix
 192   it.</P
 193 ><P
 194 >Then compile and install Samba as usual. You must use at least the
 195   following 3 options in smb.conf:</P
 196 ><P
 197 ><PRE
 198 CLASS="PROGRAMLISTING"
 199 >  realm = YOUR.KERBEROS.REALM
 200   security = ADS
 201   encrypt passwords = yes</PRE
 202 ></P
 203 ><P
 204 >In case samba can't figure out your ads server using your realm name, use the
 205 <B
 206 CLASS="COMMAND"
 207 >ads server</B
 208 > option in <TT
 209 CLASS="FILENAME"
 210 >smb.conf</TT
 211 >:
 212 <PRE
 213 CLASS="PROGRAMLISTING"
 214 >  ads server = your.kerberos.server</PRE
 215 ></P
 216 ><P
 217 >You do *not* need a smbpasswd file, although it won't do any harm
 218   and if you have one then Samba will be able to fall back to normal
 219   password security for older clients. I expect that the above
 220   required options will change soon when we get better active
 221   directory integration.</P
 222 ></DIV
 223 ><DIV
 224 CLASS="SECT1"
 225 ><H1
 226 CLASS="SECT1"
 227 ><A
 228 NAME="AEN1217">8.4. Setup your /etc/krb5.conf</H1
 229 ><P
 230 >The minimal configuration for krb5.conf is:</P
 231 ><P
 232 ><PRE
 233 CLASS="PROGRAMLISTING"
 234 >       [realms]
 235     YOUR.KERBEROS.REALM = {
 236         kdc = your.kerberos.server
 237     }</PRE
 238 ></P
 239 ><P
 240 >Test your config by doing a "kinit USERNAME@REALM" and making sure that
 241   your password is accepted by the Win2000 KDC. </P
 242 ><P
 243 >NOTE: The realm must be uppercase. </P
 244 ><P
 245 >You also must ensure that you can do a reverse DNS lookup on the IP
 246 address of your KDC. Also, the name that this reverse lookup maps to
 247 must either be the netbios name of the KDC (ie. the hostname with no
 248 domain attached) or it can alternatively be the netbios name
 249 followed by the realm. </P
 250 ><P
 251 >The easiest way to ensure you get this right is to add a /etc/hosts
 252 entry mapping the IP address of your KDC to its netbios name. If you
 253 don't get this right then you will get a "local error" when you try
 254 to join the realm.</P
 255 ><P
 256 >If all you want is kerberos support in smbclient then you can skip
 257 straight to step 5 now. Step 3 is only needed if you want kerberos
 258 support in smbd.</P
 259 ></DIV
 260 ><DIV
 261 CLASS="SECT1"
 262 ><H1
 263 CLASS="SECT1"
 264 ><A
 265 NAME="AEN1227">8.5. Create the computer account</H1
 266 ><P
 267 >Do a "kinit" as a user that has authority to change arbitrary
 268 passwords on the KDC ("Administrator" is a good choice). Then as a
 269 user that has write permission on the Samba private directory
 270 (usually root) run:
 271 <B
 272 CLASS="COMMAND"
 273 >net ads join</B
 274 ></P
 275 ><DIV
 276 CLASS="SECT2"
 277 ><H2
 278 CLASS="SECT2"
 279 ><A
 280 NAME="AEN1231">8.5.1. Possible errors</H2
 281 ><P
 282 ><P
 283 ></P
 284 ><DIV
 285 CLASS="VARIABLELIST"
 286 ><DL
 287 ><DT
 288 >"bash: kinit: command not found"</DT
 289 ><DD
 290 ><P
 291 >kinit is in the krb5-workstation RPM on RedHat systems, and is in /usr/kerberos/bin, so it won't be in the path until you log in again (or open a new terminal)</P
 292 ></DD
 293 ><DT
 294 >"ADS support not compiled in"</DT
 295 ><DD
 296 ><P
 297 >Samba must be reconfigured (remove config.cache) and recompiled (make clean all install) after the kerberos libs and headers are installed.</P
 298 ></DD
 299 ></DL
 300 ></DIV
 301 ></P
 302 ></DIV
 303 ></DIV
 304 ><DIV
 305 CLASS="SECT1"
 306 ><H1
 307 CLASS="SECT1"
 308 ><A
 309 NAME="AEN1243">8.6. Test your server setup</H1
 310 ><P
 311 >On a Windows 2000 client try <B
 312 CLASS="COMMAND"
 313 >net use * \\server\share</B
 314 >. You should
 315 be logged in with kerberos without needing to know a password. If
 316 this fails then run <B
 317 CLASS="COMMAND"
 318 >klist tickets</B
 319 >. Did you get a ticket for the
 320 server? Does it have an encoding type of DES-CBC-MD5 ? </P
 321 ></DIV
 322 ><DIV
 323 CLASS="SECT1"
 324 ><H1
 325 CLASS="SECT1"
 326 ><A
 327 NAME="AEN1248">8.7. Testing with smbclient</H1
 328 ><P
 329 >On your Samba server try to login to a Win2000 server or your Samba
 330 server using smbclient and kerberos. Use smbclient as usual, but
 331 specify the -k option to choose kerberos authentication.</P
 332 ></DIV
 333 ><DIV
 334 CLASS="SECT1"
 335 ><H1
 336 CLASS="SECT1"
 337 ><A
 338 NAME="AEN1251">8.8. Notes</H1
 339 ><P
 340 >You must change administrator password at least once after DC install,
 341  to create the right encoding types</P
 342 ><P
 343 >w2k doesn't seem to create the _kerberos._udp and _ldap._tcp in
 344    their defaults DNS setup. Maybe fixed in service packs?</P
 345 ></DIV
 346 ></DIV
 347 ><DIV
 348 CLASS="NAVFOOTER"
 349 ><HR
 350 ALIGN="LEFT"
 351 WIDTH="100%"><TABLE
 352 SUMMARY="Footer navigation table"
 353 WIDTH="100%"
 354 BORDER="0"
 355 CELLPADDING="0"
 356 CELLSPACING="0"
 357 ><TR
 358 ><TD
 359 WIDTH="33%"
 360 ALIGN="left"
 361 VALIGN="top"
 362 ><A
 363 HREF="samba-bdc.html"
 364 ACCESSKEY="P"
 365 >Prev</A
 366 ></TD
 367 ><TD
 368 WIDTH="34%"
 369 ALIGN="center"
 370 VALIGN="top"
 371 ><A
 372 HREF="samba-howto-collection.html"
 373 ACCESSKEY="H"
 374 >Home</A
 375 ></TD
 376 ><TD
 377 WIDTH="33%"
 378 ALIGN="right"
 379 VALIGN="top"
 380 ><A
 381 HREF="domain-security.html"
 382 ACCESSKEY="N"
 383 >Next</A
 384 ></TD
 385 ></TR
 386 ><TR
 387 ><TD
 388 WIDTH="33%"
 389 ALIGN="left"
 390 VALIGN="top"
 391 >How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain</TD
 392 ><TD
 393 WIDTH="34%"
 394 ALIGN="center"
 395 VALIGN="top"
 396 ><A
 397 HREF="type.html"
 398 ACCESSKEY="U"
 399 >Up</A
 400 ></TD
 401 ><TD
 402 WIDTH="33%"
 403 ALIGN="right"
 404 VALIGN="top"
 405 >Samba as a NT4 domain member</TD
 406 ></TR
 407 ></TABLE
 408 ></DIV
 409 ></BODY
 410 ></HTML
 411 >