Paste a {{title}} link…

Unbenannt

# Hostname ändern

test

```javascript
hostnamectl set-hostname dc1
```

```javascript
#/etc/hosts
<IP-Address> <FQDN> <hostname>
```

```javascript
# verify FQDN
hostname -f

# verify FQDN is resolved to the Samba IP address
ping -c3 dc1.example.lan
```

# DNS Server bearbeiten

```javascript
# stop and disable systemd-resolved service
sudo systemctl disable --now systemd-resolved

# remove the symlink file /etc/resolv.conf
sudo unlink /etc/resolv.conf
```

```javascript
# create a new /etc/resolv.conf file
touch /etc/resolv.conf
```

```javascript
# Samba server IP address
nameserver <samba ad dc IP Address>

# fallback resolver
nameserver <DNS Server>

# main domain for Samba
search <Domäne>
```

```javascript
sudo chattr +i /etc/resolv.conf
```

# Samba installieren

```javascript
sudo apt install -y acl attr samba samba-dsdb-modules samba-vfs-modules smbclient winbind libpam-winbind libnss-winbind libpam-krb5 krb5-config krb5-user dnsutils chrony net-tools
```

```javascript
##Default Kerberos verison 5 realm
<DOMAIN.DE>
```

```javascript
#Kerberos servers for your realm
<fqdn from Domaincontroller>
```

```javascript
#Administrative server for your bKerberos realm
<fqdn from Domaincontroller>
```

# Samba Service bearbeiten

```javascript
# stop and disable samba services - smbd, nmbd, and winbind
sudo systemctl disable --now smbd nmbd winbind
```

```javascript
# activate samba-ad-dc service
sudo systemctl unmask samba-ad-dc

# enable samba-ad-dc service
sudo systemctl enable samba-ad-dc
```

# Samba Konfiguiren

```javascript
# backup default Samba configuration file
sudo mv /etc/samba/smb.conf /etc/samba/smb.conf.orig
```

## Domäne erstellen

```javascript
sudo samba-tool domain provision --server-role=dc --use-rfc2307 --dns-backend=SAMBA_INTERNAL --realm=<REALM> --domain=<DOMAIN> --adminpass=<PASSWORT>reate ad
```

## lb cl


:::info
Dies ist sehr wichtig, da sonst die Passwort hostabfrage nicht geht.

:::

```javascript
sudo cp /var/lib/samba/private/krb5.conf /etc/krb5.conf
```

# Einstellungen verifizieren

```javascript
# verify domain example.lan
host -t A <Domain>

# verify domain dc1.example.lan
host -t A <FQDN>
```

```javascript
# verify SRV record for _kerberos
host -t SRV _kerberos._udp.<Domain>

# verify SRV record for _ldap
host -t SRV _ldap._tcp.<Domain>
```

```javascript
# checking available resources on Samba AD
smbclient -L <Domain> -N
```

```javascript
# authenticate to Kerberos using administrator
kinit administrator@<DOMAIN>

# verify list cached Kerberos tickets
klist
```

# Selfsigned Zertifikat einpflegen


:::info
Samba hat die Pfade geändert in Version 4 dennoch werden diese nicht automatisch erkannt daher müssen die Zertifikate mit Gesamt Pfad angegeben werden.

:::

```javascript
cd /etc/samba/tls/
openssl req -newkey rsa:2048 -keyout myKey.pem -nodes -x509 -days 365 -out myCert.pem
```

```javascript
chmod 600 myKey.pem
```

```javascript
nano /etc/samba/smb.conf
[general]
#Hier hinzufügen
tls enabled  = yes
tls keyfile  = tls/myKey.pem
tls certfile = tls/myCert.pem
tls cafile   = 
ldap server require strong auth = allow_sasl_over_tls #Wird benötigt um StrongAuth auszuschalten
```

Samba ist nun über LDAPS erreichbar aktiviere bei der Verbindung SSL/TLS und nimm Port 636

\
wbinfo ldap

\
<https://adamtheautomator.com/samba-active-directory/>

Samba AD DC