Compile Samba 4 under Red Hat Enterprise Linux 8 as an AD domain controller

Leave a reply

Unfortunately RHEL 7 and RHEL 8 do not support running Samba as an Active Directory Domain Controller (AD DC):
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/deploying_different_types_of_servers/assembly_using-samba-as-a-server_deploying-different-types-of-servers

Therefore you need to download the samba sources and compile them yourself.
https://download.samba.org/pub/samba/stable

In this example we use the following settings:

  • Server names:
    • server1.example.com: 192.168.10.1/24
    • server2.example.com: 192.168.10.2/24
  • Domain name:
    DOM1
  • External DNS server:
    8.8.8.8

Samba 4 must use it’s own builtin DNS server for local domain names (e.g. client1.example.com). Unfortunately there is no option to specify a separate DNS server. You may define a forwarder DNS for all non-local domain names (e.g. http://www.microsoft.com). In this example we use the public Google DNS server 8.8.8.8 as a forwarder, but you may use any other DNS server to resolve non-local names.

1. Install necessary packages

sudo dnf install gcc libacl-devel libblkid-devel gnutls-devel readline-devel python36-devel gdb krb5-workstation zlib-devel setroubleshoot-server libaio-devel setroubleshoot-plugins python3-policycoreutils python3-libsemanage python3-setools popt-devel libpcap-devel sqlite-devel libidn-devel libxml2-devel libacl-devel libsepol-devel libattr-devel keyutils-libs-devel cyrus-sasl-devel cups-devel bind-utils libxslt docbook-style-xsl openldap-devel pam-devel bzip2 lmdb-devel perl-Parse-Yapp jansson-devel libarchive-devel python3-iso8601 python3-pyasn1 python3-markdown python3-dns rpcgen libtirpc-devel
2. Download tarball

curl -O https://download.samba.org/pub/samba/stable/samba-4.14.6.tar.gz
tar -xzvf samba-4.14.6.tar.gz
cd samba-4.14.6
3. Patch source code

vim source3/include/includes.h
Comment lines 359-367 so that the code block looks like this:
/* #ifdef TRUE
#undef TRUE
#endif
#define TRUE __ERROR__XX__DONT_USE_TRUE

#ifdef FALSE
#undef FALSE
#endif
#define FALSE __ERROR__XX__DONT_USE_FALSE */
4. Run configure, make and make install

./configure --enable-debug --enable-selftest --with-ads --with-systemd --with-winbind --without-gpgme --with-shared-modules='!vfs_snap
per'
make
sudo make install
5. Edit system configuration files

/etc/hosts:
192.168.10.1 SERVER1.dom1.example.com     SERVER1
192.168.10.2 SERVER2.dom1.example.com     SERVER2

/etc/profile:
PATH=$PATH:/usr/local/samba/bin
export PATH

/etc/resolv.conf:
options timeout:2
nameserver 192.168.10.1
nameserver 192.168.10.2

/etc/logrotate.d/samba:
/usr/local/samba/var/log.samba /usr/local/samba/var/log.smbd /usr/local/samba/var/log.wb-BUILTIN /usr/local/samba/var/wb-DOM1 /usr/local/samba/var/log.winbindd /usr/local/samba/var/log.winbindd-idmap {
    weekly
    maxsize 200M
    missingok
    notifempty
    sharedscripts
    rotate 4
    compress
    delaycompress
    postrotate
        /bin/kill -HUP `cat /usr/local/samba/var/run/samba.pid  2>/dev/null`  2> /dev/null || true
    endscript
}

/etc/init.d/samba:
#!/bin/bash
#
# samba-ad-dc   This shell script takes care of starting and stopping
#               samba AD daemons.
#
# chkconfig: - 58 74
# description: Samba Active Directory Domain Controller
 
### BEGIN INIT INFO
# Provides: samba
# Required-Start: $network $local_fs $remote_fs
# Required-Stop: $network $local_fs $remote_fs
# Should-Start: $syslog $named
# Should-Stop: $syslog $named
# Short-Description: start and stop samba
# Description: Samba Active Directory Domain Controller
### END INIT INFO
 
# Source function library.
. /etc/init.d/functions
 
# Source networking configuration.
. /etc/sysconfig/network
 
prog=samba
prog_dir=/usr/local/samba/sbin/
lockfile=/var/lock/subsys/$prog
 
start() {
        [ "$NETWORKING" = "no" ] && exit 1
        echo -n $"Starting Samba AD DC: "
        daemon $prog_dir/$prog -D
        RETVAL=$?
        echo
        [ $RETVAL -eq 0 ] && touch $lockfile
        return $RETVAL
}
 
 stop() {
        [ "$EUID" != "0" ] && exit 4
        echo -n $"Shutting down Samba AD DC: "
        killproc $prog_dir/$prog
        RETVAL=$?
        echo
        [ $RETVAL -eq 0 ] && rm -f $lockfile
        return $RETVAL
}
 
case "$1" in
start)
        start
        ;;
stop)
        stop
        ;;
status)
        status $prog
        ;;
restart)
        stop
        start
        ;;
*)
        echo $"Usage: $0 {start|stop|status|restart}"
        exit 2
esac
6. Open ports on firewall

Standard ports:
samba, ldap, ldaps, kerberos, kpasswd, dns, ntp

Additional ports:
389/udp, 135/tcp, 1024-65535/tcp
7. Edit samba configuration files

/usr/local/samba/etc/samba.conf:
[global]
        dns forwarder = 8.8.8.8
        netbios name = SERVER1
        realm = DOM1.EXAMPLE.COM
        server role = active directory domain controller
        workgroup = DOM1
        idmap_ldb:use rfc2307 = yes
        logging = syslog@3
        log level = 1 auth_audit:3
[netlogon]
        path = /usr/local/samba/var/locks/sysvol/server1.example.com/scripts
        read only = No
[sysvol]
        path = /usr/local/samba/var/locks/sysvol
        read only = No

/etc/krb5.conf
includedir /etc/krb5.conf.d/
[logging]
        default = FILE:/var/log/krb5libs.log
        kdc = FILE:/var/log/krb5kdc.log
        admin_server = FILE:/var/log/kadmind.log
[libdefaults]
        dns_lookup_realm = false
        ticket_lifetime = 24h
        renew_lifetime = 7d
        forwardable = true
        rdns = false
        pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
        # default_realm = EXAMPLE.COM
        default_ccache_name = KEYRING:persistent:%{uid}
[realms]
        # EXAMPLE.COM = {
        #  kdc = kerberos.example.com
        #  admin_server = kerberos.example.com
        # }
[domain_realm]
        # .example.com = EXAMPLE.COM
        # example.com = EXAMPLE.COM
8. Create domain

sudo samba-tool domain provision --use-rfc2307 --interactive
Realm [DOM1.EXAMPLE.COM]:  
Domain [DOM1]:  
Server Role (dc, member, standalone) [dc]:  
DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]:  
DNS forwarder IP address (write 'none' to disable forwarding) [8.8.8.8]:  
Administrator password: yourpasswordhere
Retype password: yourpasswordhere
9. Set password restrictions (optional)

samba-tool domain passwordsettings set --min-pwd-age=0
samba-tool domain passwordsettings set --max-pwd-age=180
samba-tool domain passwordsettings set --account-lockout-threshold=10
samba-tool domain passwordsettings set --account-lockout-duration=10
samba-tool domain passwordsettings set --history-length=10
samba-tool domain passwordsettings set --min-pwd-length=12
 
samba-tool domain passwordsettings show
 
samba-tool domain passwordsettings pso create admin 10 --account-lockout-duration=5 --history-length=5 --min-pwd-length=20
samba-tool domain passwordsettings pso create system 20 --account-lockout-duration=5 --history-length=4 --min-pwd-length=20 --max-pwd-age=365
samba-tool domain passwordsettings pso list
 
samba-tool domain passwordsettings pso apply system Administrator
10. Start samba on server1

sudo systemctl daemon-reload
sudo systemctl start samba

Alternatively you may start samba directly:
sudo /usr/local/samba/sbin/samba &
11. Add the second DC to the domain (run all commands on server2)

/etc/krb5.conf:
[libdefaults]
        dns_lookup_realm = false
        dns_lookup_kdc = true
        default_realm = DOM1.EXAMPLE.COM

/usr/local/samba/etc/samba.conf:
[global]
        dns forwarder = 8.8.8.8
        netbios name = SERVER2
        realm = DOM1.EXAMPLE.COM
        server role = active directory domain controller
        workgroup = DOM1
        idmap_ldb:use rfc2307 = yes
        logging = syslog@3
        log level = 1 auth_audit:3
[netlogon]
        path = /usr/local/samba/var/locks/sysvol/dom1.example.com/scripts
        read only = No
[sysvol]
        path = /usr/local/samba/var/locks/sysvol
        read only = No

Add server2 to domain
samba-tool domain join dom1.example.com DC -U"DOM1\administrator" --option='idmap_ldb:use rfc2307 = yes'
...
Password for [DOM1\administrator]: yourpasswordhere

Change krb5.conf again to make server2 a fully standalone DC
/etc/krb5.conf:
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
[logging]
        default = FILE:/var/log/krb5libs.log
        kdc = FILE:/var/log/krb5kdc.log
        admin_server = FILE:/var/log/kadmind.log
[libdefaults]
        dns_lookup_realm = false
        dns_lookup_kdc = false
        default_realm = DOM1.EXAMPLE.COM
        ticket_lifetime = 24h
        renew_lifetime = 7d
        forwardable = true
        rdns = false
        pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
        # default_realm = EXAMPLE.COM
        default_ccache_name = KEYRING:persistent:%{uid}
[realms]
 DOM1.EXAMPLE.COM = {
        kdc = SERVER2.example.com
        admin_server = SERVER2.example.com
 }
 # EXAMPLE.COM = {
 #        kdc = kerberos.example.com
 #        admin_server = kerberos.example.com
 # }
[domain_realm]
        # .example.com = EXAMPLE.COM
        # example.com = EXAMPLE.COM

Start samba on server2
sudo systemctl daemon-reload
sudo systemctl start samba
12. Check replication status (run command on both servers)

sudo samba-tool drs showrepl

Leave a comment