From d00b6f125fd98d1842cba57c7b509d52470c82d7 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Wed, 2 Apr 2003 18:07:52 +0000 Subject: Regenerate docs (This used to be commit 20ee66b661e295cc9fb66f00b16de3b382a7e723) --- docs/htmldocs/ads.html | 165 ++++++++----------------------------------------- 1 file changed, 27 insertions(+), 138 deletions(-) (limited to 'docs/htmldocs/ads.html') diff --git a/docs/htmldocs/ads.html b/docs/htmldocs/ads.html index ef019915d8..f37bbf0abc 100644 --- a/docs/htmldocs/ads.html +++ b/docs/htmldocs/ads.html @@ -13,7 +13,7 @@ REL="UP" TITLE="Type of installation" HREF="type.html">

This is a rough guide to setting up Samba 3.0 with kerberos authentication against a Windows2000 KDC.

Pieces you need before you begin:

a Windows 2000 server.
samba 3.0 or higher.
the MIT kerberos development libraries (either install from the above sources or use a package). The heimdal libraries will not work.
the OpenLDAP development libraries.

8.1. Installing the required packages for Debian

On Debian you need to install the following packages:

libkrb5-dev
krb5-user

8.2. Installing the required packages for RedHat

On RedHat this means you should have at least:

krb5-workstation (for kinit)
krb5-libs (for linking with)
krb5-devel (because you are compiling from source)

in addition to the standard development environment.

Note that these are not standard on a RedHat install, and you may need -to get them off CD2.

8.3. Compile Samba8.1. Setup your smb.conf

If your kerberos libraries are in a non-standard location then - remember to add the configure option --with-krb5=DIR.

After you run configure make sure that include/config.h it - generates contains - lines like this:

#define HAVE_KRB5 1
-#define HAVE_LDAP 1

If it doesn't then configure did not find your krb5 libraries or - your ldap libraries. Look in config.log to figure out why and fix - it.

Then compile and install Samba as usual. You must use at least the - following 3 options in smb.conf:

You must use at least the following 3 options in smb.conf:

You do *not* need a smbpasswd file, and older clients will
   be authenticated as if "security = domain", although it won't do any harm
   and allows you to have local users not in the domain.
-  I expect that the above
-  required options will change soon when we get better active
-  directory integration.

8.4. Setup your /etc/krb5.conf8.2. Setup your /etc/krb5.conf

The minimal configuration for krb5.conf is:

8.5. Create the computer account8.3. Create the computer account

As a user that has write permission on the Samba private directory @@ -291,8 +180,8 @@ CLASS="SECT2" >

8.5.1. Possible errors8.3.1. Possible errors

8.6. Test your server setup8.4. Test your server setup

On a Windows 2000 client try

8.7. Testing with smbclient8.5. Testing with smbclient

On your Samba server try to login to a Win2000 server or your Samba @@ -349,12 +238,12 @@ CLASS="SECT1" >

8.8. Notes8.6. Notes

You must change administrator password at least once after DC install, - to create the right encoding types

You must change administrator password at least once after DC +install, to create the right encoding types

w2k doesn't seem to create the _kerberos._udp and _ldap._tcp in their defaults DNS setup. Maybe fixed in service packs?

How to Act as a Backup Domain Controller in a Purely Samba Controlled DomainSamba Backup Domain Controller to Samba Domain Control