Samba 4.1 as Active Directory configuration guide

 
I have written one more article with the steps to configure FreeIPA server and client which can also act as an alternate to Microsoft Active Directory. And since FreeIPA is a GUI based, it can be a better alternative then Samba4.
In my earlier post I had shown you the steps to install and configure Samba 4.0 but since then the Samba4 developers have upgraded the Samba version from 4.0 to 4.1. I will be releasing my post for upgrading Samba 4 very soon but in the mean time for the new users planning to configure Samba 4.1 in their machine. Please follow the below steps.
You can look out for the pre-requisites before installing Samba 4.1
Samba 4.1 AD OS Requirements
In my case I am using CentOS 6.2 and have verified all the pre requisite rpms and conditions.

NOTE:

Make sure you have python version more than 2.5 installed in your machine

For configuring Samba 4.0 follow this link
Samba 4.0 as Active Directory
 
In case you are planning to configure a secondary domain controller for your Samba4 and Windows Server 2008 AD
How to configure Secondary Domain Controller using Samba 4

NOTE:

Make sure you don't have any earlier version of Samba installed

 

Downloading Samba 4.1 package

NOTE: You can download the Samba4 package from their source directory of Samba. BUT using the below command you will download the latest release of Samba4 available. If you want to download a specific version of Samba4. I suggest you to download the package manually.
Automatic download of Samba 4.X

# git clone git://git.samba.org/samba.git samba-master

In case you get
-bash: git command not found

In RedHat, fedora and CentOS

32 thoughts on “Samba 4.1 as Active Directory configuration guide”

  1. Thank You for making it so much simpler. It took a bit of time but was finally able to over come.
    So finally I have configured Samba 4 on my Linux box.
    Doing a great job. Keep up the good work.

    Reply
  2. What are the advantages of using BIND9_FLATFILE instead of SAMBA_INTERNAL as DNS backend?
    Using SAMBA_INTERNAL as DNS backend is it possible to have Apache and Postfix serving sites and email for internet via public IP on the same machine of Samba 4.1?
    Could you help us with an article about installing Samba 4.1 rc3 (or final release) on Debian 7 Wheezy?
    Thanks,
    Roberto Carlos
    rc.1990 @ bol com br

    Reply
  3. As per the setup you are asking I believe BIN9_FLATFILE will have more advantage because using SAMBA_INTERNAL as DNS backend you won't get must customization feature for your DNS and for Apache specially you need a proper DNS setup for hosting.
    You can get more information on this page
    wiki.samba.org/index.php/DNS#Which_DNS_backend_should_I_choose.3F
    From the above page which says -If you already having BIND running, plan complex DNS setups or you require special functions (zone transfers only from defined hosts, etc.), that are currently not supported by the internal DNS, BIND should be the preferred backend.
    And replying to your last question I have not worked on Debian yet so I am not much familiar with commands but still I will try to figure out this setup and update a new post soon enough.
    Thanks
    Deepak

    Reply
  4. Hi Deepak.
    Thanks for your information on proper DNS setup por Samba 4.
    I am looking for new releases on wiki.samba.org/index.php/Release_Planning_for_Samba_4.1
    I have tried these articles about installing Samba 4.1 rc3 or rc4 or final release on Debian 7 Wheezy:
    wiki.samba.org/index.php/Samba_4/OS_Requirements
    wiki.samba.org/index.php/Samba_AD_DC_HOWTO
    jadota.com/2013/01/installing-samba4-on-ubuntu-12-04/
    sector7e.com/setup-a-samba4-domain-controller-on-debian-6-0-squeeze/
    mps.eti.br/home/?p=11
    I also tried some new information on Debian Experimental:
    forge.univention.org/bugzilla/show_bug.cgi?id=31698
    ——–
    The following packages are now renamed via transitional packages:
    samba4 -> samba-ad-dc
    python-samba4 -> python-samba
    winbind4 -> winbind
    ——–
    packages.debian.org/search?keywords=samba-ad-dc
    packages.debian.org/experimental/samba-ad-dc
    I am also trying to install via 'pinning':
    wiki.debian.org/AptPreferences
    apt-get -t experimental install samba-ad-dc
    us.generation-nt.com/answer/bug-721015-samba-ad-dc-documentation-fix-named-txt-setup-help-212272232.html
    us.generation-nt.com/answer/samba-samba-ad-dc-migration-official-packages-help-209928082.html
    Your articles on Samba 4 / 4.1 where the best I could find on internet. I tryed and they worked correctly on CentOS, but our cheap Linux Server in production is Debian and we did not succeed on migrating all services to CentOS.
    We really apreciate if you could provide in the futurre an article about setup and update of Samba 4.1 on Debian 7 Wheezy.
    Congratulations on your article about Samba 4 roaming profile.
    Could you make articles on Iptables for Samba 4.1, Squid autenticanting on Samba 4.1 and how to migrate from Samba 3.x to Samba 4.1?
    Thanks,
    Roberto Carlos
    rc.1990 @ bol com br

    Reply
  5. I really appreciate for the time you spent for your feedback.
    Will surely try to update an article on configuring Samba4 in Debian but before that I need to practice the same by myself to be very sure my article works.
    And regarding all other articles you have asked, I will try and update those as soon as possible.
    Thanks
    Deepak

    Reply
  6. I have create a new article for iptables in Samba 4 in the below link
    golinuxhub.com/2013/09/iptable-rules-for-samba-4-in-red-hat.html
    Kindly subscribe our website for more updates
    Thanks
    Deepak

    Reply
  7. Thanks again for your help.
    I have just subscribed, but I am always reading your articles. They help me a lot on improving my small knowledge of English and Linux.
    Roberto Carlos
    rc.1990 @ bol com br

    Reply
  8. Hello,
    As of now I have not tried to join Linux client to my domain server
    You can try following the below link (You need to be a valid subscriber to view the content)
    access.redhat.com/site/solutions/67432
    But I will try to upload an article on my blog soon enough for the same.
    Thanks and regards
    Deepak Prasad

    Reply
  9. I've been trying to follow this article using CentOS 6.4. I am however getting stuck when running the host commands:
    # host -t SRV _kerberos._udp.example.com.
    gives the response of:
    Host _kerberos._udp.example.com. not found: 3(NXDOMAIN)
    All three host commands fail with the same "not fould: 3(NXDOMAIN)" error. Any ideas why?

    Reply
  10. It means that your DNS server is not properly configured. make sure you have properly configured it (resolv.conf, date&time, example.com.zone etc..) Unless your DNS server works properly the above command would not work.
    Also make sure domain name you are using(example.com) is the one which you have used for configuration at the provision step as in my case I have just shown a test scenario.
    Thanks
    Deepak

    Reply
  11. Thanks Deepak, I'm not using "example.com", I just used that rather than providing my actual domain name. I'll check the configuration again. DNS resolution seems to work OK since I can ping "server" and "server.example.com" but I obviously I must have missed something 🙂

    Reply
  12. In that case you can check once /var/log/messages for any helpful hint as at initial stage even I had faced such issues and lastly it came out to be permission issue on one of the dns server config files.
    Thanks
    Deepak

    Reply
  13. I seem to have resolved my issue by changing resolv.conf to read "nameserver 127.0.0.1" rather than using the server IP address. I'm not exactly sure why this would be the case, I've even disabled the firewall completely in case it was a firewall config issue. Still, everything seems to work and I'll dig deeper to see what might be causing it.
    Thank you for replying, and thank you for writing such a great article.

    Reply
  14. I found out where I went wrong – I forgot to set the server IP address as a valid listening address in Bind. Mystery solved, and Samba AD now working like a charm 🙂

    Reply
  15. nice article deepak, now the problem i am facing is to join a linux client to samba4, will you please elaborate can we have active directory advantages like centralized login, roaming profiles etc.if joining our linux machine to samba AD?

    Reply
  16. nice Tutorial and thanx alot for sharing deepak, the problem is still how to configure linux client to join a samba domain and what features of active directory can we have on linux client.

    Reply
  17. Hi Deepak when i write smbclient -L localhost -U% it gives
    "session setup failed: NT_STATUS_INVALID_SERVER_STATE"
    kindly help me out.

    Reply
  18. Hi Humayoun,
    I have not yet tried to connect a Linux box to my Samba 4 AD so I might not be able to answer your question clearly. But I believe after joining Linux client with domain all the users under AD should be visible in the client as well. So that you can utilize the centralized login feature but again I have to test it to be 100% confirm
    Thanks
    Deepak

    Reply
  19. Hi Humayoun,
    Please make sure you have verified the pre-requisites properly before you start firing for the configuration.
    Also, Can you look out for some other logs generated inside your samba logs and /var/log/messages.
    As I would be needing more information. Any how I found this fix on web for
    the above issue please check if it works.
    "Manually creating directory "lib" in /usr/local/samba/var"
    Thanks
    Deepak

    Reply
  20. Just a quick update, I found a case where due to improper time this error was popping up. So check your date and time in the Linux box
    Thanks
    Deepak

    Reply
  21. thanx alot deepak for your time and help.
    will you please make a tutorial on samba4 as a backup domain controller? have you tried this out?

    Reply
  22. Honestly I am running a bit busy so couldn't try yet. But that is sure on my checklist and once I do, surely I will update it on my blog. Kindly subscribe for all the updates.
    Thanks
    Deepak

    Reply
  23. I will give you an example to help you understand
    Suppose you have 1000+ linux servers and you are a member of admin team, so every time a server is build all the user credentials has to be added and apart of that each machine username/password detail can vary making it complicated to remember. So better you can just add the linux machines to Samba 4 and utilize the centralized login feature of universal username/password for all linux box.
    Moreover you can interact almost all services of Linux with Samba4 like I have tested Quota, Roaming profile, DNS restrictions with my Samba 4 config
    I hope I made my self clear.
    Thanks
    Deepak

    Reply
  24. hello sir nice guide and i also build a samba 4 domain controller in redhat 6 using ur guide ,i download a remote administrative tools and install into windows 7 system ,it working fine i added a client user policy and to system its working fine , the problem is client system are very slow after adding to a domain control can you help me to solve the problem ……

    Reply
  25. Hi Udaya,
    The speed of the client machine will depend on the network used between your dc and client computers and also your server configuration.
    Have you implemented in any organisation or is it test basis?
    Have you implemented roaming profile or only AD?
    How many computers are connected to your domain server?
    Thanks Deepak

    Reply
  26. hello sir thanks
    my server configuration is less than client configuration ….may be problem with that ?!
    no, i am going to implement in company in future, but now it was testing only
    currently 7 system only connected,but in my office more than 120 system i don't know how to implement it
    i download a remote administrative tools and installed into windows7 system , in administrative tools i create a policy for user name and password for client system, i think its a roaming profile
    can u help me to solve the problem
    thx in advance

    Reply
  27. Hell Udaya,
    Before moving to production please look out for all the pre-requisites and possibilities. I had been using Samba 4.1 for more than 150 users in my last company and I never faced much of a problem. Though it is always a good idea to keep in touch with Samba4 mailing list for updates on bugs and fixes. Look out for a server with good configuration as for my case I was using a virtual server in VMware.
    In case you face load related issues you can always configure a secondary domain controller for multiple networks.
    You just need a server for Samba 4 and 1 client Windows 7 machine for Remote Administration and Group Policy Implementation
    Also if you want to implement Roaming Profiles then the network speed should be very promising or else end users would face many speed related issues.
    Thanks
    Deepak

    Reply
  28. hello deepak
    can u give a configuration details for sever then we can implement for testing and can u give a idea to control a client system with out a roaming profile then a network speed fast
    thanks

    Reply
  29. Hello Udaya,
    As I said in my last post I was using a virtual server. So I don't have much experience on that part, In case you are planning to use a physical server I would suggest you to create a thread in Samba4 mailing list and ask the members, they might guide you in a better way.
    As per your second question, I didn't understood completely
    You have the option to control your clients using GPO. Roaming profile is not used to control users. If you can explain what you want to do I might help
    Thanks
    Deepak

    Reply

Leave a Comment