From a84f1e7535b64dcfb1f274097cf947d0ad6fd1ec Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Thu, 16 Jan 2003 02:21:51 +0000 Subject: regenerate docs (This used to be commit 2215dc37e26bec17eb971e7b54818622a9bb5b97) --- docs/htmldocs/ads.html | 64 ++++++++++++++++++++------------------------------ 1 file changed, 26 insertions(+), 38 deletions(-) (limited to 'docs/htmldocs/ads.html') diff --git a/docs/htmldocs/ads.html b/docs/htmldocs/ads.html index 49345be2c0..26ec1d04a7 100644 --- a/docs/htmldocs/ads.html +++ b/docs/htmldocs/ads.html @@ -5,7 +5,8 @@ >Samba as a ADS domain member

Chapter 9. Samba as a ADS domain member

Chapter 8. Samba as a ADS domain member

This is a VERY ROUGH guide to setting up the current (November 2001) -pre-alpha version of Samba 3.0 with kerberos authentication against a -Windows2000 KDC. The procedures listed here are likely to change as -the code develops.

This is a rough guide to setting up Samba 3.0 with kerberos authentication against a +Windows2000 KDC.

Pieces you need before you begin:

9.1. Installing the required packages for Debian

8.1. Installing the required packages for Debian

On Debian you need to install the following packages:

9.2. Installing the required packages for RedHat

8.2. Installing the required packages for RedHat

On RedHat this means you should have at least:

9.3. Compile Samba

8.3. Compile Samba

If your kerberos libraries are in a non-standard location then remember to add the configure option --with-krb5=DIR.

  realm = YOUR.KERBEROS.REALM
-  ads server = your.kerberos.server
   security = ADS
   encrypt passwords = yes

Strictly speaking, you can omit the realm name and you can use an IP - address for the ads server. In that case Samba will auto-detect these.

In case samba can't figure out your ads server using your realm name, use the +ads server option in smb.conf: +
  ads server = your.kerberos.server

You do *not* need a smbpasswd file, although it won't do any harm and if you have one then Samba will be able to fall back to normal @@ -225,9 +225,7 @@ CLASS="SECT1" >

9.4. Setup your /etc/krb5.conf

8.4. Setup your /etc/krb5.conf

The minimal configuration for krb5.conf is:

9.5. Create the computer account

8.5. Create the computer account

Do a "kinit" as a user that has authority to change arbitrary passwords on the KDC ("Administrator" is a good choice). Then as a @@ -281,9 +277,7 @@ CLASS="SECT2" >

9.5.1. Possible errors

8.5.1. Possible errors

9.6. Test your server setup

8.6. Test your server setup

On a Windows 2000 client try

9.7. Testing with smbclient

8.7. Testing with smbclient

On your Samba server try to login to a Win2000 server or your Samba server using smbclient and kerberos. Use smbclient as usual, but @@ -345,9 +335,7 @@ CLASS="SECT1" >

9.8. Notes

8.8. Notes

You must change administrator password at least once after DC install, to create the right encoding types