Translation(s): English - ?Português Brasileiro

This page is a walkthrough of how to set up a Samba Windows NT-style Domain Controller with LDAP as an authentication mechanism.

Windows computers will be able to join the domain as they would a regular Windows NT domain. Users will be able to log on to the domain from Windows machines using the pGina client.

Note: the old, NT-style Domain Controller setup is not to be confused with the newer Samba/ActiveDirectoryDomainController setup available in Samba 4.

Requirements

Install Samba

We will now install Samba that will be used to emulate a Windows NT server

gunzip -c /usr/share/doc/samba/examples/LDAP/samba.ldif.gz > samba.ldif
ldapadd -Q -Y EXTERNAL -H ldapi:/// -f samba.ldif

Create the LDAP directory structure

ToDo: example adding OUs using ldapadd/ldif files

The Samba domain setup requires three OrganizationalUnit objects at the root of your LDAP hierarchy:

ou=users,dc=example,dc=org
ou=groups,dc=example,dc=org
ou=machines,dc=example,dc=org

Configure Samba to use LDAP

# which backend will be used for storing user/group information
passdb backend = ldapsam:ldap://127.0.0.1

# base for all ldap suffixes and for storing the sambaDomain object
ldap suffix = dc=example,dc=org
 where machines should be added to the ldap tree.
ldap machine suffix = ou=machines
# where users should be added to the ldap tree.
ldap user suffix = ou=users
# where groups should be added to the ldap tree.
ldap group suffix = ou=groups

# Distinguished Name (DN) name used by Samba to contact the LDAP server
# when retreiving user account information
ldap admin dn = cn=admin,dc=example,dc=org


# provide the netlogon service for Windows 9X network logons for the
# workgroup it is in.
domain logons = yes

# honor privileges assigned to specific SIDs via net rpc rights
enable privileges = yes

testparm
smbpasswd -w password
systemctl restart samba

Unix/Windows Name: admins
GID: 20000
SID ending number: 512

Unix/Windows Name: users
GID: 20001
SID ending number: 513

Unix/Windows Name: guests
GID: 20002
SID ending number: 514

* Setup LDAP-backed authentication for Linux accounts (?NSS with libnss-ldapd, ?PAM with libpam-ldapd, using:

Page refactoring in progress below this point

Configure Server to authenticate locally using LDAP

aptitude install libpam-ldap

Answer yes
Answer no
Enter the admin profile - cn=admin,dc=buster,dc=lan (replace with your domain structure)
Enter your admin password

vim /etc/pam.d/common-account

add the following to the end of the file:

account         sufficient      pam_ldap.so
account         required        pam_unix.so     try_first_pass

vim /etc/pam.d/common-auth

add the following line to the beginning of the file:

password sufficient pam_ldap.so

restart ssh and samba

/etc/init.d/ssh restart (if ssh is installed)
/etc/init.d/samba restart

install nscd

aptitude install nscd
vim /etc/samba/smb.conf

add the following line to the file:

ldap password sync=yes

Setup users in the Domain

log back into phpldapadmin and create the following Samba3 Users under the users OU:

First Name

Last Name

username

UID

SID ending

Group

Home Directory

Domain

Admin

adminstrator

10000

21000

admins

/home/buster/adminstrator

(your)

(name)

(username)

10001

21001

admins

/home/buster/(username)

verify the new users are in the database:

getent passwd

create home directory

mkdir /home/buster
mkdir /home/buster/(username)
cp /etc/skel/.* /home/buster/(username)
chown -R (username):users /home/buster/(username)

Create Machine accounts for domain members

log back into phpldapadmin and create the a Samba3 machines under the machines OU:

Machine Name

UID

(machinename)$

30000

smbpwd -a root

enter your root password

Join a windows client to the domain

go to your windows machine and right-click on mycomputer and select properties
on the name tab select change
select the domain radio button and enter buster.lan and click ok
enter root for the username
enter your root password
you should see a welcome to the buster.lan domain message and then reboot and you can log in using user from your LDAP database.


CategoryNetwork | CategorySoftware | CategorySystemAdministration | CategoryObsolete | ToDo: merge with other Samba pages