From ff78c3bf5c3a73cf90f6517d9b2d6b8c12d22d68 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Tue, 18 Feb 2003 22:14:04 +0000 Subject: Regenerate (This used to be commit 1ab5a3b17feb677425bb1071357c3dbabcc46c7e) --- docs/htmldocs/ads.html | 86 ++++++++++++++++++++++++++++++-------------------- 1 file changed, 51 insertions(+), 35 deletions(-) (limited to 'docs/htmldocs/ads.html') diff --git a/docs/htmldocs/ads.html b/docs/htmldocs/ads.html index 26ec1d04a7..2c556b61f3 100644 --- a/docs/htmldocs/ads.html +++ b/docs/htmldocs/ads.html @@ -5,8 +5,7 @@ >Samba as a ADS domain member

Chapter 8. Samba as a ADS domain member

Chapter 7. Samba as a ADS domain member

This is a rough guide to setting up Samba 3.0 with kerberos authentication against a Windows2000 KDC.

Pieces you need before you begin: -

Pieces you need before you begin:

8.1. Installing the required packages for Debian

7.1. Installing the required packages for Debian

On Debian you need to install the following packages:

On Debian you need to install the following packages: -

8.2. Installing the required packages for RedHat

7.2. Installing the required packages for RedHat

On RedHat this means you should have at least:

On RedHat this means you should have at least: -

8.3. Compile Samba

7.3. Compile Samba

If your kerberos libraries are in a non-standard location then remember to add the configure option --with-krb5=DIR.

After you run configure make sure that include/config.h contains +>After you run configure make sure that include/config.h it + generates contains lines like this:

  ads server = your.kerberos.server

You do *not* need a smbpasswd file, although it won't do any harm - and if you have one then Samba will be able to fall back to normal - password security for older clients. I expect that the above +>You do *not* need a smbpasswd file, and older clients will + be authenticated as if "security = domain", although it won't do any harm + and allows you to have local users not in the domain. + I expect that the above required options will change soon when we get better active directory integration.

8.4. Setup your /etc/krb5.conf

7.4. Setup your /etc/krb5.conf

The minimal configuration for krb5.conf is:

	[realms]
+>[realms]
     YOUR.KERBEROS.REALM = {
 	kdc = your.kerberos.server
     }

If all you want is kerberos support in smbclient then you can skip straight to step 5 now. Step 3 is only needed if you want kerberos -support in smbd.

8.5. Create the computer account

7.5. Create the computer account

Do a "kinit" as a user that has authority to change arbitrary -passwords on the KDC ("Administrator" is a good choice). Then as a -user that has write permission on the Samba private directory +>As a user that has write permission on the Samba private directory (usually root) run:

8.5.1. Possible errors

7.5.1. Possible errors

8.5.1. Possible errors
"bash: kinit: command not found"

kinit is in the krb5-workstation RPM on RedHat systems, and is in /usr/kerberos/bin, so it won't be in the path until you log in again (or open a new terminal)

"ADS support not compiled in"

8.6. Test your server setup

7.6. Test your server setup

On a Windows 2000 client try

8.7. Testing with smbclient

7.7. Testing with smbclient

On your Samba server try to login to a Win2000 server or your Samba server using smbclient and kerberos. Use smbclient as usual, but @@ -335,7 +349,9 @@ CLASS="SECT1" >

8.8. Notes

7.8. Notes

You must change administrator password at least once after DC install, to create the right encoding types

Samba as a NT4 domain memberSamba as a NT4 or Win2k domain member