Preface
I have been waiting for a long time to write this post. In order to test this out, I needed to upgrade my home lab. I had a VM machine running XCP-NG (I tried Proxmox, it’s just not the same), but it had an old dual core Intel and 8GB of ram, so not much I could do with other than host a good single VM… which is pointless, the server might as well be the function of that single VM. So recently I was able to upgrade my main system to a Ryzen 5 5600X with a new mobo, RAM, and PSU, so I figured I would use my old Ryzen 5 1600X in the server. So now I have 6 cores which translated to 12 Threads (each of which can be used as a virtual CPU), 32GB of RAM, and more then enough resources to make a few VMs with multiple purposes. The first of which of course was a Linux based Active Directory.
Video
Prerequisites
- Ubuntu Server (20.04/22.04)
- A user account with sudo privileges
- A Windows 10 PRO computer on the same network
- A Linux Desktop on the same server (Fedora or Ubuntu based)
In this example will be using Ubuntu 22.04 Server for the Active Directory. We will be connecting to it with a Windows 10 PRO client as well as Fedora as the Linux based client
DC Server Setup
Set the Server Hostname
For this demonstration we will be using the hostname dc1 for the Ubuntu server
1 2 |
# set up the hostname hostnamectl set-hostname dc1 |
Add Server to Hosts File
We will also need to modify the hosts file, add the following line to /etc/hosts
1 2 |
# setup FQDN dc1.cn.lan 192.168.0.254 dc1.cn.lan dc1 |
Verify Hostname
You can quickly verify everythign worked with the following command
1 2 3 4 5 |
# verify FQDN hostname -f # verify FQDN is resolved to the Samba IP address ping -c3 dc1.cn.lan |
Disable the DNS Resolver
Disable the DNS Resolver and unlink the config
1 2 3 4 5 |
# stop and disable systemd-resolved service sudo systemctl disable --now systemd-resolved # remove the symlink file /etc/resolv.conf sudo unlink /etc/resolv.conf |
Create our own Resolv.conf
1 2 |
# create a new /etc/resolv.conf file touch /etc/resolv.conf |
Enter the following into /etc/resolv.conf
1 2 3 4 5 6 7 8 |
# Samba server IP address nameserver 192.168.0.254 # fallback resolver nameserver 9.9.9.9 # main domain for Samba search cn.lan |
Make the file immutable
As we do not want anything to change this file automatically, we make it immutable so that it does not get modified
1 2 |
# add attribute immutable to the file /etc/resolv.conf sudo chattr +i /etc/resolv.conf |
Installing Samba
1 2 |
sudo apt update sudo apt install -y acl attr samba samba-dsdb-modules samba-vfs-modules smbclient winbind libpam-winbind libnss-winbind libpam-krb5 krb5-config krb5-user dnsutils chrony net-tools |
Enter the appropriate info
1 2 3 4 5 6 7 8 |
# Default Kerberos Verion 5 Realm: CN.LAN # Kerberos Servers for your realm: dc1.cn.lan # Adminitraive server for your Kerberos realm: dc1.cn.lan |
Disable Samba Services
1 2 |
# stop and disable samba services - smbd, nmbd, and winbind sudo systemctl disable --now smbd nmbd winbind |
Activate samba-ad-dc
1 2 3 4 5 |
# activate samba-ad-dc service sudo systemctl unmask samba-ad-dc # enable samba-ad-dc service sudo systemctl enable samba-ad-dc |
Configuring Samba Active Directory
First backup the original smb.conf file
1 |
sudo mv /etc/samba/smb.conf /etc/samba/smb.conf.bak |
Provision the Active Directory
1 2 |
# provisioning Samba Active Directory sudo samba-tool domain provision |
Enter the following info
- On Realm prompte – <Enter>
- On Domian Promp – <Enter>
- On Server Roll – <Enter>
- On DNS Backend – <Enter>
- DNS Forwarding IP – 9.9.9.9
- Enter an Admin Password
Backup and replace the Kerberos Config
1 2 3 4 5 |
# rename default Kerberos configuration to krb5.conf.orig sudo mv /etc/krb5.conf /etc/krb5.conf.orig # copy the Kerberos configuration generated by the samba-tool sudo cp /var/lib/samba/private/krb5.conf /etc/krb5.conf |
Start samba-ad-dc
1 2 3 4 5 |
# start samba-ad-dc service sudo systemctl start samba-ad-dc # verify samba-ad-dc service sudo systemctl status samba-ad-dc |
Set up Time Synchronization
Set permissions
1 2 3 4 5 |
# allow group _chrony to read the directory ntp_signd sudo chown root:_chrony /var/lib/samba/ntp_signd/ # change the permission of the directory ntp_signd sudo chmod 750 /var/lib/samba/ntp_signd/ |
Update Chrony
add the following to /etc/chrony/chrony.conf
1 2 3 4 5 6 7 8 |
# bind the chrony service to IP address of the Samba AD bindcmdaddress 192.168.0.254 # allow clients on the network to connect to the Chrony NTP server allow 192.168.0.0/24 # specify the ntpsigndsocket directory for the Samba AD ntpsigndsocket /var/lib/samba/ntp_signd |
1 2 3 4 5 |
# restart chronyd service sudo systemctl restart chronyd # verify chronyd service status sudo systemctl status chronyd |
Verifying Samba Active Directory
Run the following to verify
1 2 3 4 5 |
# verify domain example.lan host -t A cn.lan # verify domain dc1.example.lan host -t A dc1.cn.lan |
Then verify the Kerberos and ldap services
1 2 3 4 5 |
# verify SRV record for _kerberos host -t SRV _kerberos._udp.cn.lan # verify SRV record for _ldap host -t SRV _ldap._tcp.cn.lan |
Then verify the Samba resources
1 2 3 4 5 |
# verify SRV record for _kerberos host -t SRV _kerberos._udp.cn.lan # verify SRV record for _ldap host -t SRV _ldap._tcp.cn.lan |
Lastly KINIT
1 2 3 4 5 |
# authenticate to Kerberos using administrator (MUST BE IN CAPS) kinit administrator@CN.LAN # verify list cached Kerberos tickets klist |
Create your first user (Optional)
The reason why this is optional, is you have more options when adding a user through the Remote Server Administration Tools (RSAT) on Windows.
1 2 3 4 5 |
# create a new user in Samba sudo samba-tool user create mkoster # checking users on Samba sudo samba-tool user list |
Windows Setup
PreCheck
- Set Computer Name
- Set DNS/IP, The first DNS should be your Samba Server set up above
Verify DNS resolver
1 2 3 4 5 6 7 8 |
# In Powershell Get-DnsClientServerAddress # ping the AD domain dc1.cn.lan ping dc1.cn.lan # ping the AD domain cn.lan ping cn.lan |
Add Server to Directory
1 2 |
# add Windows 10 to Active Directory using POWERSHELL Add-Computer -DomainName "cn.lan" -Restart |
Install RSAT to administer domain from Windows
Download RSAT tools <– For Windows 10 – Could not find a DL source for Windows 11, something I need to look into.
Linux Setup
Precheck
- On Ubuntu, you may need to add the Universe repositories
123sudo add-apt-repository universesudo add-apt-repository multiversesudo apt update
Set Hostname
1 |
sudo hostnamectl set-hostname fedora.cn.lan |
Modify Resolved info
On Fedora edit the Resolved config (This works on Ubuntu as well, old editions you may need to change the /etc/resolv.conf file)
1 2 3 4 5 6 7 |
vi /etc/systemd/resolved.conf #add the following [Resolve] DNS=192.168.0.254 9.9.9.9 8.8.8.8 sudo systemctl restart systemd-resolved |
Install required packages (Ubuntu Only)
For Ubuntu Only
1 |
sudo apt -y install realmd libnss-sss libpam-sss sssd sssd-tools adcli samba-common-bin oddjob oddjob-mkhomedir packagekit |
Discover the Domain (Optional)
1 |
sudo realm discover cn.lan |
Join the Domain
1 |
sudo realm join -U Administrator cn.lan |