用源碼編譯安裝Samba 4.8.2做域控
10.0.0.10 Centos7 1708 64 bit
10.0.0.11 Win 10 RSAT
首先修改一下主機名
[root@localhost ~]# vi /etc/hostname
dc01.contoso.com
[root@locahost ~]# vi /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
10.0.0.10 dc01.contoso.com dc01
保存以後可以重啟一下,然後掛載光盤,用它做源來安裝一些依賴。
首先可以安裝development tools
[root@dc01 ~]# cd /etc/yum.repos.d/
[root@dc01 yum.repos.d]# mkdir /media/cdrom
[root@dc01 yum.repos.d]# mount /dev/cdrom /media/cdrom
[root@dc01 yum.repos.d]# yum -y --enablerepo=c7-media groupinstall "development tools"
再安裝一些samba需要的包,有一些不是必須,遇到./configure不行就要增加。
[root@dc01 yum.repos.d]# yum -y --enablerepo=c7-media install perl gcc attr libacl-devel libblkid-develgnutls-devel readline-devel python-devel gdb pkgconfig krb5-workstation zlib-devel setroubleshoot-server libaio-devel setroubleshoot-plugins policycoreutils-python libsemanage-python perl-ExtUtils-MakeMaker perl-Parse-Yapp perl-Test-Base popt-devel libxml2-devel libattr-develv keyutils-libs-devel cups-devel bind-utils libxslt docbook-style-xsl openldap-devel autoconf pam-devel python2-crypto libtomcrypt libtommath libidn-devel libpcap-devel cups libgnutls-dev gnutls-devel
把下載的samba源碼包上傳到/tmp文件夾,也可以通過wget下載。
[root@dc01 yum.repos.d]# cd /tmp
[root@localhost tmp]# ls
samba-4.8.2.tar.gz
[root@dc01 tmp]# tar -xvf samba-4.8.2.tar.gz
[root@dc01 tmp]# cd samba-4.8.2/buildtools/scripts/
[root@dc01 scripts]# ./autogen-waf.sh
[root@dc01 scripts]# cd /tmp/samba-4.8.2
[root@dc01 samba-4.8.2]# ./configure
[root@dc01 samba-4.8.2]# make && make install
註釋掉/etc/krb5.conf的includedir這行,否則提升域控會報錯。
[root@dc01 samba-4.8.2]# vi /etc/krb5.conf
#includedir /etc/krb5.conf.d/
[root@DC01 ~]# cd /usr/local/samba/bin
[root@DC01 bin]# ./samba-tool domain provision --use-rfc2307 --interactive
Realm [CONTOSO.COM]:
Domain [CONTOSO]:
Server Role (dc, member, standalone) [dc]:
DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]:
DNS forwarder IP address (write 'none' to disable forwarding) [10.0.0.20]: none
Administrator password:Aa123456
Retype password:Aa123456
Looking up IPv4 addresses
More than one IPv4 address found. Using 10.0.0.10
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up share.ldb
Setting up secrets.ldb
Setting up the registry
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
Unable to determine the DomainSID, can not enforce uniqueness constraint on local domainSIDs
Adding DomainDN: DC=contoso,DC=com
Adding configuration container
Setting up sam.ldb schema
Setting up sam.ldb configuration data
Setting up display specifiers
Modifying display specifiers and extended rights
Adding users container
Modifying users container
Adding computers container
Modifying computers container
Setting up sam.ldb data
Setting up well known security principals
Setting up sam.ldb users and groups
Setting up self join
Adding DNS accounts
Creating CN=MicrosoftDNS,CN=System,DC=contoso,DC=com
Creating DomainDnsZones and ForestDnsZones partitions
Populating DomainDnsZones and ForestDnsZones partitions
Setting up sam.ldb rootDSE marking as synchronized
Fixing provision GUIDs
A Kerberos configuration suitable for Samba AD has been generated at /usr/local/samba/private/krb5.conf
Merge the contents of this file with your system krb5.conf or replace it with this one. Do not create a symlink!
Setting up fake yp server settings
Once the above files are installed, your Samba AD server will be ready to use
Server Role: active directory domain controller
Hostname: DC01
NetBIOS Domain: CONTOSO
DNS Domain: contoso.com
DOMAIN SID: S-1-5-21-4094272009-52109158-380737006
添加防火墻規則
[root@DC01 bin]# firewall-cmd --add-port=53/tcp --permanent;firewall-cmd --add-port=53/udp --permanent;firewall-cmd --add-port=88/tcp --permanent;firewall-cmd --add-port=88/udp --permanent; \
> firewall-cmd --add-port=135/tcp --permanent;firewall-cmd --add-port=137-138/udp --permanent;firewall-cmd --add-port=139/tcp --permanent; \
> firewall-cmd --add-port=389/tcp --permanent;firewall-cmd --add-port=389/udp --permanent;firewall-cmd --add-port=445/tcp --permanent; \
> firewall-cmd --add-port=464/tcp --permanent;firewall-cmd --add-port=464/udp --permanent;firewall-cmd --add-port=636/tcp --permanent; \
> firewall-cmd --add-port=1024-5000/tcp --permanent;firewall-cmd --add-port=3268-3269/tcp --permanent
success
success
success
success
success
success
success
success
success
success
success
success
success
success
success
[root@DC01 bin]# firewall-cmd --reload
success
[root@DC01 bin]#
增加一個samba的服務文件。
[root@DC01 bin]# vi /etc/systemd/system/samba.service
[Unit]
Description= Samba 4 Active Directory
After=syslog.target
After=network.target
[Service]
Type=forking
PIDFile=/usr/local/samba/var/run/samba.pid
ExecStart=/usr/local/samba/sbin/samba
[Install]
WantedBy=multi-user.target
啟動samba
[root@DC01 bin]# systemctl enable samba
Created symlink from /etc/systemd/system/multi-user.target.wants/samba.service to /etc/systemd/system/samba.service.
[root@DC01 bin]# systemctl start samba
然後就用一臺WIN10的虛擬機設置同網段IP,DNS指向10.0.0.10,就能加入域,重啟用contoso\administrator和設置的密碼Aa123456登錄,下載安裝RSAT就能連接管理域了。
用源碼編譯安裝Samba 4.8.2做域控