CentOS 7とSamba 4.8でActive Directoryを設定する

# nmcli general hostname dc01

$ hostname
dc01

# vi /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
#::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.241.221 dc01.testdom.local dc01 この行を追加する。

# vi /etc/chrony.conf

# These servers were defined in the installation:
#server 0.centos.pool.ntp.org iburst
#server 1.centos.pool.ntp.org iburst
#server 2.centos.pool.ntp.org iburst
#server 3.centos.pool.ntp.org iburst

server ntp1.jst.mfeed.ad.jp iburst
server ntp2.jst.mfeed.ad.jp iburst

# systemctl restart chronyd

$ systemctl status chronyd
● chronyd.service - NTP client/server
Loaded: loaded (/usr/lib/systemd/system/chronyd.service; enabled; vendor preset: enabled)
Active: active (running) since 金 2018-08-03 17:30:10 JST; 5s ago
Docs: man:chronyd(8)
man:chrony.conf(5)
Process: 2268 ExecStartPost=/usr/libexec/chrony-helper update-daemon (code=exited, status=0/SUCCESS)
Process: 2264 ExecStart=/usr/sbin/chronyd $OPTIONS (code=exited, status=0/SUCCESS)
Main PID: 2266 (chronyd)
CGroup: /system.slice/chronyd.service
mq2266 /usr/sbin/chronyd

attr bind-utils docbook-style-xsl gcc gdb krb5-workstation
libsemanage-python libxslt perl perl-ExtUtils-MakeMaker
perl-Parse-Yapp perl-Test-Base pkgconfig policycoreutils-python
python-crypto gnutls-devel libattr-devel keyutils-libs-devel
libacl-devel libaio-devel libblkid-devel libxml2-devel openldap-devel
pam-devel popt-devel python-devel readline-devel zlib-devel systemd-devel

# yum install epel-release

$ yum list installed | grep epel

epel-release.noarch 7-9 @extras

$ yum repolist

読み込んだプラグイン:fastestmirror
Loading mirror speeds from cached hostfile
* base: ftp.yz.yamagata-u.ac.jp
* epel: ftp.yz.yamagata-u.ac.jp
* extras: ftp.yz.yamagata-u.ac.jp
* updates: ftp.yz.yamagata-u.ac.jp
リポジトリー ID リポジトリー名 状態
!base/7/x86_64 CentOS-7 - Base 9,591
!epel/x86_64 Extra Packages for Enterprise Linux 7 - x86_64 12,507
!extras/7/x86_64 CentOS-7 - Extras 448
!updates/7/x86_64 CentOS-7 - Updates 2,416
repolist: 24,962

# yum -y install attr bind-utils docbook-style-xsl gcc gdb krb5-workstation \
libsemanage-python libxslt perl perl-ExtUtils-MakeMaker \
perl-Parse-Yapp perl-Test-Base pkgconfig policycoreutils-python \
python-crypto gnutls-devel libattr-devel keyutils-libs-devel \
libacl-devel libaio-devel libblkid-devel libxml2-devel openldap-devel \
pam-devel popt-devel python-devel readline-devel zlib-devel systemd-devel

# mkdir /usr/local/src/samba
# cd /usr/local/src/samba

# wget https://download.samba.org/pub/samba/samba-latest.tar.gz

--2018-08-30 12:02:03-- https://download.samba.org/pub/samba/samba-latest.tar.gz
download.samba.org (download.samba.org) をDNSに問いあわせています... 144.76.82.156, 2a01:4f8:192:486::443:2
download.samba.org (download.samba.org)|144.76.82.156|:443 に接続しています... 接続しました。
HTTP による接続要求を送信しました、応答を待っています... 200 OK
長さ: 17715401 (17M) [application/gzip]
`samba-latest.tar.gz' に保存中

100%[========================================================>] 17,715,401 4.75MB/s 時間 3.6s

2018-08-30 12:02:08 (4.75 MB/s) - `samba-latest.tar.gz' へ保存完了 [17715401/17715401]

src
`-- samba
|
`-- samba-latest.tar.gz

# tar zxvf samba-latest.tar.gz

samba-4.8.5/.gitlab-ci-private.yml
samba-4.8.5/.testr.conf
samba-4.8.5/.travis.yml
samba-4.8.5/.ycm_extra_conf.py
samba-4.8.5/BUILD_SYSTEMS.txt
samba-4.8.5/COPYING
samba-4.8.5/Makefile
samba-4.8.5/PFIF.txt
samba-4.8.5/README
samba-4.8.5/README.Coding
samba-4.8.5/README.cifs-utils
samba-4.8.5/README.contributing
samba-4.8.5/VERSION
samba-4.8.5/WHATSNEW.txt
samba-4.8.5/auth/auth_log.c
samba-4.8.5/auth/auth_sam_reply.c
samba-4.8.5/auth/auth_sam_reply.h

【略】

src
`-- samba
|-- samba-4.8.5
`-- samba-latest.tar.gz

# ls
samba-4.8.5 samba-latest.tar.gz
# cd samba-4.8.5/

# ls
BUILD_SYSTEMS.txt docs script
COPYING docs-xml selftest
Makefile dynconfig simple-dc-steps.sh
PFIF.txt examples source3
README file_server source4
README.Coding include testdata
README.cifs-utils install_with_python.sh testprogs
README.contributing lib tests
VERSION libcli testsuite
WHATSNEW.txt libds third_party
auth libgpo wintest
buildtools librpc wscript
callcatcher-exceptions.grep nsswitch wscript_build
configure packaging wscript_build_embedded_heimdal
configure.developer pidl wscript_build_system_heimdal
coverity prog_guide4.txt wscript_build_system_mitkrb5
ctdb python wscript_configure_system_mitkrb5
dfs_server release-scripts

# ./configure

Checking for program gcc or cc : /usr/bin/gcc
Checking for program cpp : /usr/bin/cpp
Checking for program ar : /usr/bin/ar
Checking for program ranlib : /usr/bin/ranlib
Checking for gcc : ok
Checking for program git : /usr/bin/git
Check for -MD : yes
Checking for program gdb : /usr/bin/gdb
Checking for header sys/utsname.h : yes
Checking uname sysname type : Linux
Checking uname machine type : x86_64

【略】

Checking configure summary : ok
Checking compiler for PIE support : yes
Checking compiler for full RELRO support : yes
Checking if toolchain accepts -fstack-protector : yes
'configure' finished successfully (53.540s)

# make

WAF_MAKE=1 python ./buildtools/bin/waf build
Waf: Entering directory `/usr/local/src/samba/samba-4.8.5/bin'
symlink: tevent.py -> python/tevent.py
symlink: _tdb_text.py -> python/_tdb_text.py
symlink: _ldb_text.py -> python/_ldb_text.py
symlink: samba/__init__.py -> python/samba/__init__.py
symlink: samba/colour.py -> python/samba/colour.py
symlink: samba/common.py -> python/samba/common.py
symlink: samba/compat.py -> python/samba/compat.py
symlink: samba/dbchecker.py -> python/samba/dbchecker.py

【略】

[3976/3977] Generating man/nmblookup4.1
Note: Writing nmblookup4.1
[3977/3977] Generating man/samba_gpoupdate.8
Note: Writing samba_gpoupdate.8
Waf: Leaving directory `/usr/local/src/samba/samba-4.8.5/bin'
'build' finished successfully (9m35.266s)

# make install

WAF_MAKE=1 python ./buildtools/bin/waf install
Waf: Entering directory `/usr/local/src/samba/samba-4.8.5/bin'
Selected embedded Heimdal build
Checking project rules ...
Project rules pass
[ 139/4311] Linking default/lib/replace/libreplace-samba4.inst.so
* installing bin/default/lib/replace/libreplace-samba4.inst.so as /usr/local/samba/lib/private/libreplace-samba4.so
[ 140/4311] Generating VERSION
* installing bin/default/lib/param/samba-hostconfig.pc as /usr/local/samba/lib/pkgconfig/samba-hostconfig.pc
* installing bin/default/source4/librpc/dcerpc_samr.pc as /usr/local/samba/lib/pkgconfig/dcerpc_samr.pc
* installing bin/default/source4/librpc/dcerpc.pc as /usr/local/samba/lib/pkgconfig/dcerpc.pc
* installing bin/default/source4/dsdb/samdb.pc as /usr/local/samba/lib/pkgconfig/samdb.pc
* installing bin/default/librpc/ndr_standard.pc as /usr/local/samba/lib/pkgconfig/ndr_standard.pc
* installing bin/default/librpc/ndr_nbt.pc as /usr/local/samba/lib/pkgconfig/ndr_nbt.pc
* installing bin/default/librpc/ndr.pc as /usr/local/samba/lib/pkgconfig/ndr.pc

【略】

* installing bin/default/pidl/Parse::Pidl::Util.3pm as /usr/local/samba/share/man/man3/Parse::Pidl::Util.3pm
* installing bin/default/pidl/Parse::Pidl::NDR.3pm as /usr/local/samba/share/man/man3/Parse::Pidl::NDR.3pm
* installing bin/default/pidl/Parse::Pidl::Wireshark::NDR.3pm as /usr/local/samba/share/man/man3/Parse::Pidl::Wireshark::NDR.3pm
Waf: Leaving directory `/usr/local/src/samba/samba-4.8.5/bin'
'install' finished successfully (2m51.122s)

# vi /root/.bash_profile

# Get the aliases and functions
if [ -f ~/.bashrc ]; then
. ~/.bashrc
fi

# User specific environment and startup programs

PATH=$PATH:$HOME/bin

export PATH
export PATH="/usr/local/samba/bin:/usr/local/samba/sbin:${PATH}" <=この行を追加

source ~/.bash_profile

# samba -V
Version 4.8.5

# samba-tool domain provision --use-rfc2307 --interactive

Realm [TESTDOM.LOCAL]: <=ドメイン名
Domain [TESTDOM]: <=NETBIOSのドメイン名
Server Role (dc, member, standalone) [dc]: <=サーバーの役割（ドメインコントローラーの場合にはdc)
DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]: <=dnsとしてどれを利用するかを選択。SAMBA_INTERNALはSambaに含まれるdnsサーバー
DNS forwarder IP address (write 'none' to disable forwarding) [192.168.241.254]:<=dnsのフォワーダー先を指定。
Administrator password: <=ドメイン管理者のパスワードを入力
Retype password: <=上記と同じものを入力

Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up share.ldb
Setting up secrets.ldb
Setting up the registry
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
Unable to determine the DomainSID, can not enforce uniqueness constraint on local domainSIDs

Adding DomainDN: DC=testdom,DC=local
Adding configuration container
Setting up sam.ldb schema
Setting up sam.ldb configuration data
Setting up display specifiers
Modifying display specifiers and extended rights
Adding users container
Modifying users container
Adding computers container
Modifying computers container
Setting up sam.ldb data
Setting up well known security principals
Setting up sam.ldb users and groups
Setting up self join
Adding DNS accounts
Creating CN=MicrosoftDNS,CN=System,DC=testdom,DC=local
Creating DomainDnsZones and ForestDnsZones partitions
Populating DomainDnsZones and ForestDnsZones partitions
Setting up sam.ldb rootDSE marking as synchronized
Fixing provision GUIDs
A Kerberos configuration suitable for Samba AD has been generated at /usr/local/samba/private/krb5.conf
Merge the contents of this file with your system krb5.conf or replace it with this one. Do not create a symlink!
Setting up fake yp server settings
Once the above files are installed, your Samba AD server will be ready to use
Server Role: active directory domain controller
Hostname: dc01
NetBIOS Domain: TESTDOM
DNS Domain: testdom.local
DOMAIN SID: S-1-5-21-4034970910-3372605962-264176640

# samba

# ps -aux | grep samba
root 36520 1.3 3.6 585148 36248 ? Ss 09:54 0:00 samba
root 36521 0.0 2.3 585148 23104 ? S 09:54 0:00 samba
root 36522 2.2 2.8 589828 28452 ? S 09:54 0:00 samba
root 36523 0.0 2.2 585152 22688 ? S 09:54 0:00 samba
root 36524 0.0 2.5 589300 25736 ? S 09:54 0:00 samba
root 36525 0.0 2.3 585148 22992 ? S 09:54 0:00 samba
root 36526 8.8 2.5 585148 25832 ? S 09:54 0:02 samba
root 36527 1.1 4.0 644068 40704 ? Ss 09:54 0:00 /usr/local/samba/sbin/smbd -D --option=server role check:inhibit=yes --foreground
root 36528 0.0 2.3 585148 23260 ? S 09:54 0:00 samba
root 36529 0.0 2.5 585148 25300 ? S 09:54 0:00 samba
root 36530 0.2 2.4 585148 24424 ? S 09:54 0:00 samba
root 36531 0.0 2.3 585148 23072 ? S 09:54 0:00 samba
root 36532 0.0 2.3 585148 23092 ? S 09:54 0:00 samba
root 36533 0.0 2.2 585152 22688 ? S 09:54 0:00 samba
root 36534 0.5 3.1 585148 31496 ? S 09:54 0:00 samba
root 36535 0.1 2.4 585148 24132 ? S 09:54 0:00 samba
root 36536 1.0 3.8 626112 38248 ? Ss 09:54 0:00 /usr/local/samba/sbin/winbindd -D --option=server role check:inhibit=yes --foreground
root 36537 0.0 2.5 585568 25348 ? S 09:54 0:00 samba
root 36546 0.0 2.2 639000 22724 ? S 09:54 0:00 /usr/local/samba/sbin/smbd -D --option=server role check:inhibit=yes --foreground
root 36547 0.0 2.2 639000 22540 ? S 09:54 0:00 /usr/local/samba/sbin/smbd -D --option=server role check:inhibit=yes --foreground
root 36548 0.0 2.6 632480 26640 ? S 09:54 0:00 /usr/local/samba/sbin/winbindd -D --option=server role check:inhibit=yes --foreground
root 36549 0.0 2.4 627060 24704 ? S 09:54 0:00 /usr/local/samba/sbin/winbindd -D --option=server role check:inhibit=yes --foreground
root 36550 0.0 2.6 632480 25948 ? S 09:54 0:00 /usr/local/samba/sbin/winbindd -D --option=server role check:inhibit=yes --foreground
root 36551 0.0 2.3 644592 23544 ? S 09:54 0:00 /usr/local/samba/sbin/smbd -D --option=server role check:inhibit=yes --foreground
root 36565 0.0 0.0 112720 980 pts/0 S+ 09:54 0:00 grep --color=auto samba

# smbclient -L localhost -U%

Sharename Type Comment
--------- ---- -------
netlogon Disk
sysvol Disk
IPC$ IPC IPC Service (Samba 4.8.5)
Reconnecting with SMB1 for workgroup listing.

Server Comment
--------- -------

Workgroup Master
--------- -------

# smbclient //localhost/netlogon -UAdministrator -c 'ls'

Enter TESTDOM\Administrator's password:
. D 0 Wed Aug 29 19:06:09 2018
.. D 0 Wed Aug 29 19:06:12 2018

18307072 blocks of size 1024. 14824460 blocks available

# cat /etc/resolv.conf
# Generated by NetworkManager
search testdom.local
nameserver 192.168.241.254

# nmcli connection modify ens33 ipv4.dns 127.0.0.1 ipv4.dns-search testdom.local

# nmcli connection show ens33 | grep dns
ipv4.dns: 127.0.0.1
ipv4.dns-search: testdom.local
ipv4.dns-options: ""
ipv4.dns-priority: 0
ipv4.ignore-auto-dns: いいえ
ipv6.dns: --
ipv6.dns-search: --
ipv6.dns-options: ""
ipv6.dns-priority: 0
ipv6.ignore-auto-dns: いいえ

# systemctl restart network

# cat /etc/resolv.conf
# Generated by NetworkManager
search testdom.local
nameserver 127.0.0.1

# samba-tool dns zonelist 127.0.0.1 -U Administrator
Password for [TESTDOM\Administrator]: <=パスワードを入力します。

2 zone(s) found

pszZoneName : testdom.local
Flags : DNS_RPC_ZONE_DSINTEGRATED DNS_RPC_ZONE_UPDATE_SECURE
ZoneType : DNS_ZONE_TYPE_PRIMARY
Version : 50
dwDpFlags : DNS_DP_AUTOCREATED DNS_DP_DOMAIN_DEFAULT DNS_DP_ENLISTED
pszDpFqdn : DomainDnsZones.testdom.local

pszZoneName : _msdcs.testdom.local
Flags : DNS_RPC_ZONE_DSINTEGRATED DNS_RPC_ZONE_UPDATE_SECURE
ZoneType : DNS_ZONE_TYPE_PRIMARY
Version : 50
dwDpFlags : DNS_DP_AUTOCREATED DNS_DP_FOREST_DEFAULT DNS_DP_ENLISTED
pszDpFqdn : ForestDnsZones.testdom.local

# host dc01.testdom.local
dc01.testdom.local has address 192.168.241.221

# host -t SRV _ldap._tcp.testdom.local
_ldap._tcp.testdom.local has SRV record 0 100 389 dc01.testdom.local.

# host -t SRV _kerberos._tcp.testdom.local
_kerberos._tcp.testdom.local has SRV record 0 100 88 dc01.testdom.local.

# host www.yahoo.co.jp
www.yahoo.co.jp is an alias for edge.g.yimg.jp.
edge.g.yimg.jp has address 183.79.248.252
Host edge.g.yimg.jp not found: 3(NXDOMAIN)

# samba-tool user list
Administrator
Guest
krbtgt

# samba-tool fsmo show
SchemaMasterRole owner: CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testdom,DC=local
InfrastructureMasterRole owner: CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testdom,DC=local
RidAllocationMasterRole owner: CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testdom,DC=local
PdcEmulationMasterRole owner: CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testdom,DC=local
DomainNamingMasterRole owner: CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testdom,DC=local
DomainDnsZonesMasterRole owner: CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testdom,DC=local
ForestDnsZonesMasterRole owner: CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testdom,DC=local

# samba-tool drs showrepl
Default-First-Site-Name\DC01
DSA Options: 0x00000001
DSA object GUID: 248745bc-8ef2-46ab-ab33-798e17518edf
DSA invocationId: e8e44a95-d1ff-40c2-a747-f74dbf6f64e3

==== INBOUND NEIGHBORS ====

==== OUTBOUND NEIGHBORS ====

==== KCC CONNECTION OBJECTS ====

# samba-tool domain level show
Domain and forest function level for domain 'DC=testdom,DC=local'

Forest function level: (Windows) 2008 R2
Domain function level: (Windows) 2008 R2
Lowest function level of a DC: (Windows) 2008 R2

# mv /etc/krb5.conf krb5.conf.org

# cp -p /usr/local/samba/private/krb5.conf /etc/krb5.conf

[libdefaults]
default_realm = TESTDOM.LOCAL
dns_lookup_realm = false
dns_lookup_kdc = true

# kinit administrator@TESTDOM.LOCAL <=ADにコンピュータを追加する権限を持ったユーザを指定
Password for administrator@TESTDOM.LOCAL: <=ユーザーのパスワードを入力
Warning: Your password will expire in 41 days on 2018年10月10日 19時06分12秒

# klist
klist: Credentials cache keyring 'persistent:0:0' not found

# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: administrator@TESTDOM.LOCAL

Valid starting Expires Service principal
2018-08-30T10:13:45 2018-08-30T20:13:45 krbtgt/TESTDOM.LOCAL@TESTDOM.LOCAL
renew until 2018-08-31T10:13:41

# vi /etc/systemd/system/samba.service

[Unit]
Description= Samba 4 Active Directory
After=syslog.target
After=network.target

[Service]
Type=forking
PIDFile=/usr/local/samba/var/run/samba.pid
ExecStart=/usr/local/samba/sbin/samba

[Install]
WantedBy=multi-user.target

# systemctl daemon-reload

# systemctl enable samba
Created symlink from /etc/systemd/system/multi-user.target.wants/samba.service to /etc/systemd/system/samba.service.

# systemctl is-enabled samba
enabled

# firewall-cmd --add-port=53/tcp --permanent;firewall-cmd --add-port=53/udp --permanent; \
firewall-cmd --add-port=88/tcp --permanent;firewall-cmd --add-port=88/udp --permanent; \
firewall-cmd --add-port=135/tcp --permanent;firewall-cmd --add-port=137-138/udp --permanent; \
firewall-cmd --add-port=139/tcp --permanent;firewall-cmd --add-port=389/tcp --permanent; \
firewall-cmd --add-port=389/udp --permanent;firewall-cmd --add-port=445/tcp --permanent; \
firewall-cmd --add-port=464/tcp --permanent;firewall-cmd --add-port=464/udp --permanent; \
firewall-cmd --add-port=636/tcp --permanent;firewall-cmd --add-port=1024-5000/tcp --permanent;\
firewall-cmd --add-port=3268-3269/tcp --permanent;firewall-cmd --add-port=49152-65535/tcp --permanent

# firewall-cmd --reload

> nslookup dc01.testdom.local

# samba-tool user list
Administrator
user01
Guest
krbtgt