docs/docbook/projdoc/ADS-HOWTO.sgml

   1 <chapter id="ADS">
   2
   3 <chapterinfo>
   4         &author.tridge;
   5         &author.jelmer;
   6         <pubdate>2002/2003</pubdate>
   7 </chapterinfo>
   8
   9 <title>Samba as a ADS domain member</title>
  10
  11 <para>
  12 This is a rough guide to setting up Samba 3.0 with kerberos authentication against a
  13 Windows2000 KDC.
  14 </para>
  15
  16 <sect1>
  17 <title>Setup your <filename>smb.conf</filename></title>
  18
  19 <para>You must use at least the following 3 options in smb.conf:</para>
  20
  21 <para><programlisting>
  22   realm = YOUR.KERBEROS.REALM
  23   security = ADS
  24   encrypt passwords = yes
  25 </programlisting></para>
  26
  27 <para>
  28 In case samba can't figure out your ads server using your realm name, use the
  29 <command>ads server</command> option in <filename>smb.conf</filename>:
  30 <programlisting>
  31   ads server = your.kerberos.server
  32 </programlisting>
  33 </para>
  34
  35 <note><para>You do *not* need a smbpasswd file, and older clients will
  36   be authenticated as if <command>security = domain</command>,
  37   although it won't do any harm
  38   and allows you to have local users not in the domain.
  39   I expect that the above required options will change soon when we get better
  40   active directory integration.</para></note>
  41
  42 </sect1>
  43
  44 <sect1>
  45 <title>Setup your <filename>/etc/krb5.conf</filename></title>
  46
  47 <para>The minimal configuration for <filename>krb5.conf</filename> is:</para>
  48
  49 <para><programlisting>
  50 [realms]
  51     YOUR.KERBEROS.REALM = {
  52         kdc = your.kerberos.server
  53     }
  54 </programlisting></para>
  55
  56 <para>Test your config by doing a <userinput>kinit <replaceable>USERNAME</replaceable>@<replaceable>REALM</replaceable></userinput> and making sure that
  57   your password is accepted by the Win2000 KDC. </para>
  58
  59 <note><para>The realm must be uppercase. </para></note>
  60
  61 <para>
  62 You also must ensure that you can do a reverse DNS lookup on the IP
  63 address of your KDC. Also, the name that this reverse lookup maps to
  64 must either be the netbios name of the KDC (ie. the hostname with no
  65 domain attached) or it can alternatively be the netbios name
  66 followed by the realm.
  67 </para>
  68
  69 <para>
  70 The easiest way to ensure you get this right is to add a
  71 <filename>/etc/hosts</filename> entry mapping the IP address of your KDC to
  72 its netbios name. If you don't get this right then you will get a
  73 "local error" when you try to join the realm.
  74 </para>
  75
  76 <para>
  77 If all you want is kerberos support in &smbclient; then you can skip
  78 straight to <link linkend="ads-test-smbclient">Test with &smbclient;</link> now.
  79 <link linkend="ads-create-machine-account">Creating a computer account</link>
  80 and <link linkend="ads-test-server">testing your servers</link>
  81 is only needed if you want kerberos
  82 support for &smbd; and &winbindd;.
  83 </para>
  84
  85 </sect1>
  86
  87 <sect1 id="ads-create-machine-account">
  88 <title>Create the computer account</title>
  89
  90 <para>
  91 As a user that has write permission on the Samba private directory
  92 (usually root) run:
  93 <userinput>net ads join</userinput>
  94 </para>
  95
  96 <sect2>
  97 <title>Possible errors</title>
  98
  99 <para>
 100 <variablelist>
 101 <varlistentry><term>"ADS support not compiled in"</term>
 102 <listitem><para>Samba must be reconfigured (remove config.cache) and recompiled (make clean all install) after the kerberos libs and headers are installed.</para></listitem></varlistentry>
 103 </variablelist>
 104 </para>
 105
 106 </sect2>
 107
 108 </sect1>
 109
 110 <sect1 id="ads-test-server">
 111 <title>Test your server setup</title>
 112
 113 <para>
 114 On a Windows 2000 client try <userinput>net use * \\server\share</userinput>. You should
 115 be logged in with kerberos without needing to know a password. If
 116 this fails then run <userinput>klist tickets</userinput>. Did you get a ticket for the
 117 server? Does it have an encoding type of DES-CBC-MD5 ?
 118 </para>
 119
 120 </sect1>
 121
 122 <sect1 id="ads-test-smbclient">
 123 <title>Testing with &smbclient;</title>
 124
 125 <para>
 126 On your Samba server try to login to a Win2000 server or your Samba
 127 server using &smbclient; and kerberos. Use &smbclient; as usual, but
 128 specify the <parameter>-k</parameter> option to choose kerberos authentication.
 129 </para>
 130
 131 </sect1>
 132
 133 <sect1>
 134 <title>Notes</title>
 135
 136 <para>You must change administrator password at least once after DC
 137 install, to create the right encoding types</para>
 138
 139 <para>w2k doesn't seem to create the _kerberos._udp and _ldap._tcp in
 140    their defaults DNS setup. Maybe fixed in service packs?</para>
 141 </sect1>
 142
 143 </chapter>