Samba login using windows AD on Centos 7
Posted on May 4, 2018 • 6 minutes • 1192 words • Suggest Changes
I’m no expert on this, but I had to google everything together so many times, I made a soon-to-be-outdated half-ass guide on how to let users access a samba share on Linux using the windows domain controller “AD” (active directory) or at least how I got it to work. Let me know if it worked out for you or if you hit a brick wall. Perhaps we need to tune the sound a bit ;-).
They might be needed or not, I have no clue, just install them already.
yum install sssd realmd oddjob oddjob-mkhomedir adcli krb5-workstation openldap-clients policycoreutils-python samba samba-client samba-common samba-common-tools ntpdate ntp
sssd, is a relatively new method of getting the system to talk to the AD server. Samba obviously is needed for creating the windows accessible shares. The last dependency might not be required but its good to make sure if you got issues its not because servers disagree on time/date. Hence, NTP will help set a same date between servers.
Or better say lets “join” the dark side of windows. I’m not gone lie, this is pretty ugly, but in Kerbal Space Program’s motto, any landing you can walk away from is called a succes.
First add the domain controller to
/etc/hosts this ensures that every connection will go to the right server, irrelevant of DNS, since the hosts file has the highest priority.
# cat /etc/hosts 18.104.22.168 mydomain.at.my.be mydomain
22.214.171.124 should be the IP and mydomain.at.my.be should be the full domain and the last is optional the alias for the domain.
Many guides will also adapt
/etc/resolv.conf while I don’t think its needed, we do not take risks here, resolv.conf is used for looking up the DNS, for this server the domain controller is highly suggested.
# cat /etc/resolv.conf search my_domain.be nameserver 126.96.36.199
Adapt as required.
The next step, is making sure the servers have the same time setup, this won’t be an issue for many, but its good practice. Do a ntpdate call to the domain server to get a fix.
# ntpdate domain 4 May 15:47:01 ntpdate: adjust time server 188.8.131.52 offset 0.015744 sec
Something similar should be shown, after that we can set the service up to take over. If there is a huge difference, perhaps add the domain controller as NTP server. This would be done in
/etc/ntp.conf as “server domain iburst”.
systemctl enable ntpd.service systemctl start ntpd.service
Then finally we are ready to join the domain, this is done using :
realm join --user=domain_admin mydomain
This hopefully, silently ads your computer to the domain (after login), or if it fails it spits errors. After this is silently successful, you will find the realm in the realm list.
# realm list domain.url type: kerberos realm-name: DOMAIN.url domain-name: DOMAIN.url configured: kerberos-member server-software: active-directory client-software: sssd required-package: oddjob required-package: oddjob-mkhomedir required-package: sssd required-package: adcli required-package: samba-common-tools login-formats: %U login-policy: allow-realm-logins
note : slightly modified configuration shown.
After we got initial connection, its time to setup the configuration, this is done in
/etc/sssd/sssd.conf . There are multiple parameters here that can be adapted here. One in particular pops up as having an annoying default set.
By default this is set to True, domain users will be identified as “[email protected]” instead of “name”. Set False, to drop the @domain
use_fully_qualified_names = False
In a similar way, home directories have a _@ _symbol in the name. While this in itself is harmless it can be annoying in script or tools that can’t deal with these symbols. Perhaps some people have multiple domains, but for me its never the case. So I tend to remove the domain entirely. Alternatively you could do something like /home/domain/user
/home/%d/%u . Below I use /home/user, such as native users on Linux system. Change
fallback_homedir = /home/%u
After edit(s), reload sssd :
systemctl restart sssd
To verify the connection is functional, you can check a random (non-local) AD user :
# id svennd uid=1406204049(svennd) gid=1406200519(enterprise admins) groups=1406200519(enterprise admins),1406200513(domain users),1406200512(domain admins),1406204598(bioinf users)
At this point, all AD users should be able login using SSH on the system. (if sshd is running)
OK, now users can login to the server over ssh, but we want to bring a samba share available; so install samba if you did not do this in the first part. Don’t worry I will wait.
yum install samba samba-client samba-common
Now adapt the configuration mostly to your own wishes; This is how I use mine : (/etc/samba/smb.conf)
# See smb.conf.example for a more detailed config file or # read the smb.conf manpage. # Run 'testparm' to verify the config is correct after # you modified it. [global] workgroup = DOMAIN # CAPITALS make it work, domain controllers need hearing aids security = ads # active domain server encrypt passwords = yes realm = domain_url # adapt to full domain url passdb backend = tdbsam # starting this will replace it for user_id issues printing = cups printcap name = /dev/null # mute annoying errors load printers = no cups options = raw [data] valid users = @"[email protected]_url" path = /data public = yes # everyone can see it (if you are able to login) writable = yes # evereyone can write here (if you are a valid_user) guest ok = no
Important parts here are :
workgroup = DOMAIN
Workgroup has to be the domain.
security = ads
Sets the security as “Active Directory Server”, domain won’t work.
realm = domain_url
Full realm, you can find this using
For restriction you can change the valid users using this syntax :
valid users = @"[email protected]_url"
This would only allow users of that group, syntax works for domain groups, local groups just have @devs. Also individual users can be added. Like this :
valid users = @"[email protected]_url" @localgroup svennd alice
Pitfalls & debugging
- Firewall / Iptables
During debugging shut them down and if everything is resolved put them back up. For the firewalld lovers (default) add samba as allowed ports :
firewall-cmd --permanent --zone=public --add-service=samba firewall-cmd --reload
Ow god this again, yes!!! To check if SELinux is enabled, (yes by default, even on minimal) use sestatus :
# sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Max kernel policy version: 28
Unless you want to disable selinux, you will require the typical voodoo SELinux talk; For any directory where you set a share you need to run :
chcon -t samba_share_t /dir
If you like to have home directories automatically generated if a domain users authenticates (/etc/samba/smb.conf)
[homes] comment = Home Directories valid users = %S, %D%w%S browseable = No read only = No inherit acls = Yes
You need to run :
semanage fcontext -a -t home_root_t /home semanage fcontext -a -t user_home_dir_t /home semanage fcontext -a -t user_home_t /home restorecon -Rv /home
or some other magic.
After all that, you can start samba :
systemctl enable smb systemctl enable nmb systemctl start smb systemctl start nmb
And that’s it. Kudo’s to all the slightly-out-date tutorials.