Chapter 6. Directory Services

In this chapter, we will cover:

• Configuring Samba as an Active Directory compatible directory service

• Joining a Linux box to the domain

Introduction

If you have worked in corporate environments, then you are probably familiar with a directory service such as Active Directory. What you may not realize is that Samba, originally created to be an open source implementation of Windows file sharing (SMB/CIFS), can now operate as an Active Directory compatible directory service. It can even act as a Backup Domain Controller (BDC) in an Active Directory domain. In this chapter, we will configure Samba to centralize authentication for your network services. We will also configure a Linux client to leverage it for authentication and set up a RADIUS server, which uses the directory server for authentication.

Configuring Samba as an Active Directory compatible directory service

As of Samba 4.0, Samba has the ability to act as a primary domain controller (PDC) in a manner that is compatible with Active Directory.

How to do it…

Installing on Ubuntu 14.04:

1. Configure your system with a static IP address and update /etc/hosts to point to that IP address rather than localhost.

2. Make sure that your time is kept up to date by installing an NTP client:

   sudo apt-get install ntp
   

3. Pre-emptively disable smbd/nmbd from running automatically:

   sudo bash -c 'echo "manual" > /etc/init/nmbd.override'
   sudo bash –c 'echo "manual" > /etc/init/smbd.override'
   

4. Install Samba and smbclient:

   sudo apt-get install samba smbclient
   

5. Remove stock smb.conf:

   sudo rm /etc/samba/smb.conf
   

6. Provision the domain:

   sudo samba-tool domain provision --realm ad.example.org --domain example --use-rfc2307 --option="interfaces=lo eth1" --option="bind interfaces only=yes" --dns-backend BIND9_DLZ
   

7. Save the randomly generated admin password.

8. Symlink...

Joining a Linux box to the domain

In order to participate in an AD style domain, you must have the machine joined to the domain using Administrator credentials. This will create the machine's account within the database, and provide credentials to the system for querying the ldap server.

How to do it…

1. Install Samba, heimdal-clients, and winbind:

   sudo apt-get install winbind
   

2. Populate /etc/samba/smb.conf:

   [global]
       workgroup = EXAMPLE
       realm = ad.example.org
       security = ads
       idmap uid = 10000-20000
       idmap gid = 10000-20000
       winbind enum users = yes
       winbind enum groups = yes
       template homedir = /home/%U
       template shell = /bin/bash
       winbind use default domain = yes

3. Join the system to the domain:

   sudo net ads join -U Administrator
   

4. Configure the system to use winbind for account information in /etc/nsswitch.conf:

   passwd:         compat winbind
   group:          compat winbind

How it works…

Joining a Linux box to an AD domain, you need to utilize winbind that provides a PAM...