CentOS 7とSamba4.9でActive Directory環境を作成する

https://www.samba.org/samba/history/samba-4.9.0.html

# nmcli general hostname dc01

$ hostname
dc01

# vi /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
#::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.241.221 dc01.testdom.local dc01 この行を追加する。

# vi /etc/chrony.conf

# These servers were defined in the installation:
#server 0.centos.pool.ntp.org iburst
#server 1.centos.pool.ntp.org iburst
#server 2.centos.pool.ntp.org iburst
#server 3.centos.pool.ntp.org iburst

server ntp1.jst.mfeed.ad.jp iburst
server ntp2.jst.mfeed.ad.jp iburst

# systemctl restart chronyd

$ systemctl status chronyd
● chronyd.service - NTP client/server
Loaded: loaded (/usr/lib/systemd/system/chronyd.service; enabled; vendor preset: enabled)
Active: active (running) since 金 2018-08-03 17:30:10 JST; 5s ago
Docs: man:chronyd(8)
man:chrony.conf(5)
Process: 2268 ExecStartPost=/usr/libexec/chrony-helper update-daemon (code=exited, status=0/SUCCESS)
Process: 2264 ExecStart=/usr/sbin/chronyd $OPTIONS (code=exited, status=0/SUCCESS)
Main PID: 2266 (chronyd)
CGroup: /system.slice/chronyd.service
mq2266 /usr/sbin/chronyd

# chronyc sources
210 Number of sources = 2
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^+ ntp1.jst.mfeed.ad.jp 2 6 17 1 -3995us[-7241us] +/- 93ms
^* ntp2.jst.mfeed.ad.jp 2 6 17 0 +1599us[-1648us] +/- 105ms

attr bind-utils docbook-style-xsl gcc gdb krb5-workstation \
libsemanage-python libxslt perl perl-ExtUtils-MakeMaker \
perl-Parse-Yapp perl-Test-Base pkgconfig policycoreutils-python \
python-crypto gnutls-devel libattr-devel keyutils-libs-devel \
libacl-devel libaio-devel libblkid-devel libxml2-devel openldap-devel \
pam-devel popt-devel python-devel readline-devel zlib-devel systemd-devel \
lmdb-devel jansson-devel gpgme-devel python-gpgme libarchive-devel

# yum install epel-release

$ yum list installed | grep epel

epel-release.noarch 7-9 @extras

$ yum repolist

読み込んだプラグイン:fastestmirror
Loading mirror speeds from cached hostfile
* base: ftp.yz.yamagata-u.ac.jp
* epel: ftp.yz.yamagata-u.ac.jp
* extras: ftp.yz.yamagata-u.ac.jp
* updates: ftp.yz.yamagata-u.ac.jp
リポジトリー ID リポジトリー名 状態
!base/7/x86_64 CentOS-7 - Base 9,591
!epel/x86_64 Extra Packages for Enterprise Linux 7 - x86_64 12,507
!extras/7/x86_64 CentOS-7 - Extras 448
!updates/7/x86_64 CentOS-7 - Updates 2,416
repolist: 24,962

# yum -y install attr bind-utils docbook-style-xsl gcc gdb krb5-workstation \
libsemanage-python libxslt perl perl-ExtUtils-MakeMaker \
perl-Parse-Yapp perl-Test-Base pkgconfig policycoreutils-python \
python-crypto gnutls-devel libattr-devel keyutils-libs-devel \
libacl-devel libaio-devel libblkid-devel libxml2-devel openldap-devel \
pam-devel popt-devel python-devel readline-devel zlib-devel systemd-devel \
lmdb-devel gpgme-devel libarchive-devel jansson-devel

# mkdir /usr/local/src/samba
# cd /usr/local/src/samba

# wget https://download.samba.org/pub/samba/samba-latest.tar.gz

--2018-08-30 12:02:03-- https://download.samba.org/pub/samba/samba-latest.tar.gz
download.samba.org (download.samba.org) をDNSに問いあわせています... 144.76.82.156, 2a01:4f8:192:486::443:2
download.samba.org (download.samba.org)|144.76.82.156|:443 に接続しています... 接続しました。
HTTP による接続要求を送信しました、応答を待っています... 200 OK
長さ: 17715401 (17M) [application/gzip]
`samba-latest.tar.gz' に保存中

100%[========================================================>] 17,715,401 4.75MB/s 時間 3.6s

2018-08-30 12:02:08 (4.75 MB/s) - `samba-latest.tar.gz' へ保存完了 [17715401/17715401]

src
`-- samba
|
`-- samba-latest.tar.gz

# tar zxvf samba-latest.tar.gz

samba-4.9.1/.gitlab-ci-private.yml
samba-4.9.1/.testr.conf
samba-4.9.1/.travis.yml
samba-4.9.1/.ycm_extra_conf.py
samba-4.9.1/BUILD_SYSTEMS.txt
samba-4.9.1/COPYING
samba-4.9.1/Makefile
samba-4.9.1/PFIF.txt
samba-4.9.1/README
samba-4.9.1/README.Coding
samba-4.9.1/README.cifs-utils
samba-4.9.1/README.contributing
samba-4.9.1/VERSION
samba-4.9.1/WHATSNEW.txt
samba-4.9.1/auth/auth_log.c
samba-4.9.1/auth/auth_sam_reply.c
samba-4.9.1/auth/auth_sam_reply.h

【略】

src
`-- samba
|-- samba-4.9.1
`-- samba-latest.tar.gz

# ls
samba-4.9.1 samba-latest.tar.gz
# cd samba-4.9.1/

BUILD_SYSTEMS.txt dfs_server script
COPYING docs selftest
Makefile docs-xml simple-dc-steps.sh
PFIF.txt dynconfig source3
README examples source4
README.Coding file_server testdata
README.cifs-utils include testprogs
README.contributing install_with_python.sh tests
VERSION lib testsuite
WHATSNEW.txt libcli third_party
auth libds wintest
bin libgpo wscript
buildtools librpc wscript_build
callcatcher-exceptions.grep nsswitch wscript_build_embedded_heimdal
configure packaging wscript_build_system_heimdal
configure.developer pidl wscript_build_system_mitkrb5
coverity python wscript_configure_system_mitkrb5
ctdb release-scripts

# ./configure

Checking for program gcc or cc : /usr/bin/gcc
Checking for program cpp : /usr/bin/cpp
Checking for program ar : /usr/bin/ar
Checking for program ranlib : /usr/bin/ranlib
Checking for gcc : ok
Checking for program git : /usr/bin/git
Check for -MD : yes
Checking for program gdb : /usr/bin/gdb
Checking for header sys/utsname.h : yes
Checking uname sysname type : Linux
Checking uname machine type : x86_64

【略】

Checking configure summary : ok
Checking compiler for PIE support : yes
Checking compiler for full RELRO support : yes
Checking if toolchain accepts -fstack-protector : yes
'configure' finished successfully (53.540s)

# make

WAF_MAKE=1 python ./buildtools/bin/waf build
Waf: Entering directory `/usr/local/src/samba/samba-4.9.1/bin'
symlink: tevent.py -> python/tevent.py
symlink: _tdb_text.py -> python/_tdb_text.py
symlink: _ldb_text.py -> python/_ldb_text.py
symlink: samba/__init__.py -> python/samba/__init__.py
symlink: samba/colour.py -> python/samba/colour.py
symlink: samba/common.py -> python/samba/common.py
symlink: samba/compat.py -> python/samba/compat.py
symlink: samba/dbchecker.py -> python/samba/dbchecker.py

【略】

[3976/3977] Generating man/nmblookup4.1
Note: Writing nmblookup4.1
[3977/3977] Generating man/samba_gpoupdate.8
Note: Writing samba_gpoupdate.8
Waf: Leaving directory `/usr/local/src/samba/samba-4.9.1/bin'
'build' finished successfully (9m35.266s)

# make install

WAF_MAKE=1 python ./buildtools/bin/waf install
Waf: Entering directory `/usr/local/src/samba/samba-4.9.1/bin'
Selected embedded Heimdal build
Checking project rules ...
Project rules pass
[ 139/4311] Linking default/lib/replace/libreplace-samba4.inst.so
* installing bin/default/lib/replace/libreplace-samba4.inst.so as /usr/local/samba/lib/private/libreplace-samba4.so
[ 140/4311] Generating VERSION
* installing bin/default/lib/param/samba-hostconfig.pc as /usr/local/samba/lib/pkgconfig/samba-hostconfig.pc
* installing bin/default/source4/librpc/dcerpc_samr.pc as /usr/local/samba/lib/pkgconfig/dcerpc_samr.pc
* installing bin/default/source4/librpc/dcerpc.pc as /usr/local/samba/lib/pkgconfig/dcerpc.pc
* installing bin/default/source4/dsdb/samdb.pc as /usr/local/samba/lib/pkgconfig/samdb.pc
* installing bin/default/librpc/ndr_standard.pc as /usr/local/samba/lib/pkgconfig/ndr_standard.pc
* installing bin/default/librpc/ndr_nbt.pc as /usr/local/samba/lib/pkgconfig/ndr_nbt.pc
* installing bin/default/librpc/ndr.pc as /usr/local/samba/lib/pkgconfig/ndr.pc

【略】

* installing bin/default/pidl/Parse::Pidl::Util.3pm as /usr/local/samba/share/man/man3/Parse::Pidl::Util.3pm
* installing bin/default/pidl/Parse::Pidl::NDR.3pm as /usr/local/samba/share/man/man3/Parse::Pidl::NDR.3pm
* installing bin/default/pidl/Parse::Pidl::Wireshark::NDR.3pm as /usr/local/samba/share/man/man3/Parse::Pidl::Wireshark::NDR.3pm
Waf: Leaving directory `/usr/local/src/samba/samba-4.9.1/bin'
'install' finished successfully (2m51.122s)

# vi /root/.bash_profile

# Get the aliases and functions
if [ -f ~/.bashrc ]; then
. ~/.bashrc
fi

# User specific environment and startup programs

PATH=$PATH:$HOME/bin

export PATH
export PATH="/usr/local/samba/bin:/usr/local/samba/sbin:${PATH}" この行を追加

source ~/.bash_profile

# samba -V
Version 4.9.1

# samba-tool domain provision --use-rfc2307 --interactive

Realm [TESTDOM.LOCAL]: ドメイン名
Domain [TESTDOM]: NETBIOSのドメイン名
Server Role (dc, member, standalone) [dc]: サーバーの役割（ドメインコントローラーの場合にはdc)
DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]: dnsとしてどれを利用するかを選択。SAMBA_INTERNALはSambaに含まれるdnsサーバー
DNS forwarder IP address (write 'none' to disable forwarding) [192.168.241.254]: dnsのフォワーダー先を指定。
Administrator password: ドメイン管理者のパスワードを入力
Retype password: 上記と同じものを入力

Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up share.ldb
Setting up secrets.ldb
Setting up the registry
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
Unable to determine the DomainSID, can not enforce uniqueness constraint on local domainSIDs

Adding DomainDN: DC=testdom,DC=local
Adding configuration container
Setting up sam.ldb schema
Setting up sam.ldb configuration data
Setting up display specifiers
Modifying display specifiers and extended rights
Adding users container
Modifying users container
Adding computers container
Modifying computers container
Setting up sam.ldb data
Setting up well known security principals
Setting up sam.ldb users and groups
Setting up self join
Adding DNS accounts
Creating CN=MicrosoftDNS,CN=System,DC=testdom,DC=local
Creating DomainDnsZones and ForestDnsZones partitions
Populating DomainDnsZones and ForestDnsZones partitions
Setting up sam.ldb rootDSE marking as synchronized
Fixing provision GUIDs
A Kerberos configuration suitable for Samba AD has been generated at /usr/local/samba/private/krb5.conf
Merge the contents of this file with your system krb5.conf or replace it with this one. Do not create a symlink!
Setting up fake yp server settings
Once the above files are installed, your Samba AD server will be ready to use
Server Role: active directory domain controller
Hostname: dc01
NetBIOS Domain: TESTDOM
DNS Domain: testdom.local
DOMAIN SID: S-1-5-21-4034970910-3372605962-264176640

# samba

# ps -aux | grep samba
/usr/local/samba/sbin/samba
/usr/local/samba/sbin/samba
/usr/local/samba/sbin/samba
/usr/local/samba/sbin/samba
/usr/local/samba/sbin/samba
/usr/local/samba/sbin/samba
/usr/local/samba/sbin/samba
/usr/local/samba/sbin/samba
/usr/local/samba/sbin/samba
/usr/local/samba/sbin/samba
/usr/local/samba/sbin/samba
/usr/local/samba/sbin/samba
/usr/local/samba/sbin/samba
/usr/local/samba/sbin/samba
/usr/local/samba/sbin/samba
/usr/local/samba/sbin/smbd -D --option=server role check:inhibit=yes --foreground
/usr/local/samba/sbin/samba
/usr/local/samba/sbin/winbindd -D --option=server role check:inhibit=yes --foreground
/usr/local/samba/sbin/smbd -D --option=server role check:inhibit=yes --foreground
/usr/local/samba/sbin/smbd -D --option=server role check:inhibit=yes --foreground
/usr/local/samba/sbin/winbindd -D --option=server role check:inhibit=yes --foreground
/usr/local/samba/sbin/winbindd -D --option=server role check:inhibit=yes --foreground
/usr/local/samba/sbin/winbindd -D --option=server role check:inhibit=yes --foreground
/usr/local/samba/sbin/smbd -D --option=server role check:inhibit=yes --foreground

# smbclient -L localhost -U%

Sharename Type Comment
--------- ---- -------
netlogon Disk
sysvol Disk
IPC$ IPC IPC Service (Samba 4.9.1)
Reconnecting with SMB1 for workgroup listing.

Server Comment
--------- -------

Workgroup Master
--------- -------

# smbclient //localhost/netlogon -UAdministrator -c 'ls'

Enter TESTDOM\Administrator's password: Administratorのパスワードを入力
. D 0 Wed Aug 29 19:06:09 2018
.. D 0 Wed Aug 29 19:06:12 2018

18307072 blocks of size 1024. 14824460 blocks available

# cat /etc/resolv.conf
# Generated by NetworkManager
search testdom.local
nameserver 192.168.241.254

# nmcli connection modify ens33 ipv4.dns 127.0.0.1 ipv4.dns-search testdom.local

# nmcli connection show ens33 | grep dns
ipv4.dns: 127.0.0.1
ipv4.dns-search: testdom.local
ipv4.dns-options: ""
ipv4.dns-priority: 0
ipv4.ignore-auto-dns: いいえ
ipv6.dns: --
ipv6.dns-search: --
ipv6.dns-options: ""
ipv6.dns-priority: 0
ipv6.ignore-auto-dns: いいえ

# systemctl restart network

# cat /etc/resolv.conf
# Generated by NetworkManager
search testdom.local
nameserver 127.0.0.1

# samba-tool dns zonelist 127.0.0.1 -U Administrator
Password for [TESTDOM\Administrator]: パスワードを入力します。

2 zone(s) found

pszZoneName : testdom.local
Flags : DNS_RPC_ZONE_DSINTEGRATED DNS_RPC_ZONE_UPDATE_SECURE
ZoneType : DNS_ZONE_TYPE_PRIMARY
Version : 50
dwDpFlags : DNS_DP_AUTOCREATED DNS_DP_DOMAIN_DEFAULT DNS_DP_ENLISTED
pszDpFqdn : DomainDnsZones.testdom.local

pszZoneName : _msdcs.testdom.local
Flags : DNS_RPC_ZONE_DSINTEGRATED DNS_RPC_ZONE_UPDATE_SECURE
ZoneType : DNS_ZONE_TYPE_PRIMARY
Version : 50
dwDpFlags : DNS_DP_AUTOCREATED DNS_DP_FOREST_DEFAULT DNS_DP_ENLISTED
pszDpFqdn : ForestDnsZones.testdom.local

# host dc01.testdom.local
dc01.testdom.local has address 192.168.241.221

# host -t SRV _ldap._tcp.testdom.local
_ldap._tcp.testdom.local has SRV record 0 100 389 dc01.testdom.local.

# host -t SRV _kerberos._tcp.testdom.local
_kerberos._tcp.testdom.local has SRV record 0 100 88 dc01.testdom.local.

# host www.yahoo.co.jp
www.yahoo.co.jp is an alias for edge.g.yimg.jp.
edge.g.yimg.jp has address 183.79.248.252
Host edge.g.yimg.jp not found: 3(NXDOMAIN)

# samba-tool user list
Administrator
Guest
krbtgt

# samba-tool fsmo show
SchemaMasterRole owner: CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testdom,DC=local
InfrastructureMasterRole owner: CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testdom,DC=local
RidAllocationMasterRole owner: CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testdom,DC=local
PdcEmulationMasterRole owner: CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testdom,DC=local
DomainNamingMasterRole owner: CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testdom,DC=local
DomainDnsZonesMasterRole owner: CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testdom,DC=local
ForestDnsZonesMasterRole owner: CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testdom,DC=local

# samba-tool drs showrepl
Default-First-Site-Name\DC01
DSA Options: 0x00000001
DSA object GUID: 248745bc-8ef2-46ab-ab33-798e17518edf
DSA invocationId: e8e44a95-d1ff-40c2-a747-f74dbf6f64e3

==== INBOUND NEIGHBORS ====

==== OUTBOUND NEIGHBORS ====

==== KCC CONNECTION OBJECTS ====

# samba-tool domain level show
Domain and forest function level for domain 'DC=testdom,DC=local'

Forest function level: (Windows) 2008 R2
Domain function level: (Windows) 2008 R2
Lowest function level of a DC: (Windows) 2008 R2

# mv /etc/krb5.conf krb5.conf.org

# cp -p /usr/local/samba/private/krb5.conf /etc/krb5.conf

[libdefaults]
default_realm = TESTDOM.LOCAL
dns_lookup_realm = false
dns_lookup_kdc = true

# kinit administrator@TESTDOM.LOCAL ADにコンピュータを追加する権限を持ったユーザを指定
Password for administrator@TESTDOM.LOCAL: ユーザーのパスワードを入力
Warning: Your password will expire in 41 days on 2018年10月10日 19時06分12秒

# klist
klist: Credentials cache keyring 'persistent:0:0' not found

# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: administrator@TESTDOM.LOCAL

Valid starting Expires Service principal
2018-08-30T10:13:45 2018-08-30T20:13:45 krbtgt/TESTDOM.LOCAL@TESTDOM.LOCAL
renew until 2018-08-31T10:13:41

# vi /etc/systemd/system/samba.service

[Unit]
Description= Samba 4 Active Directory
After=syslog.target
After=network.target

[Service]
Type=forking
PIDFile=/usr/local/samba/var/run/samba.pid
ExecStart=/usr/local/samba/sbin/samba

[Install]
WantedBy=multi-user.target

# systemctl daemon-reload

# systemctl enable samba
Created symlink from /etc/systemd/system/multi-user.target.wants/samba.service to /etc/systemd/system/samba.service.

# systemctl is-enabled samba
enabled

# firewall-cmd --add-port=53/tcp --permanent;firewall-cmd --add-port=53/udp --permanent; \
firewall-cmd --add-port=88/tcp --permanent;firewall-cmd --add-port=88/udp --permanent; \
firewall-cmd --add-port=135/tcp --permanent;firewall-cmd --add-port=137-138/udp --permanent; \
firewall-cmd --add-port=139/tcp --permanent;firewall-cmd --add-port=389/tcp --permanent; \
firewall-cmd --add-port=389/udp --permanent;firewall-cmd --add-port=445/tcp --permanent; \
firewall-cmd --add-port=464/tcp --permanent;firewall-cmd --add-port=464/udp --permanent; \
firewall-cmd --add-port=636/tcp --permanent;firewall-cmd --add-port=1024-5000/tcp --permanent;\
firewall-cmd --add-port=3268-3269/tcp --permanent;firewall-cmd --add-port=49152-65535/tcp --permanent

# firewall-cmd --reload

> nslookup dc01.testdom.local

# samba-tool user list
Administrator
user01
Guest
krbtgt