Windows AD域使用Linux Samba

Windows AD域使用Linux Samba

这个CASE烦就烦在不是简单的Windows服务器挂载Samba,而是服务器以域用户身份进行Samba验证.
这样就需要将Linux服务器先加到Windows域并取得域用户信息后对登录进行验证.

1. 初始化配置

1.1 初始化配置

配置服务器名

hostnamectl set-hostname samba.sh.pana.cn

hosts文件配置,确保正常解析到本机和域控

[root@centos7 ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4 samba.sh.pana.cn
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6 samba.sh.pana.cn
192.168.31.104 samba.sh.pana.cn
192.168.31.101 ad.sh.pana.cn

确保域控为dns

[root@centos7 ~]# cat /etc/resolv.conf
# Generated by NetworkManager
search sh.pana.cn
nameserver 192.168.31.101
[root@centos7 ~]# grep DNS /etc/sysconfig/network-scripts/ifcfg-eth0
DNS1=192.168.31.101

禁用selinux

[root@samba ~]# sed -ir 's#=enforcing#=disabled#g' /etc/selinux/config
[root@samba ~]# grubby --update-kernel ALL --args selinux=0

配置防火墙(或者直接关闭防火墙)

[root@samba ~]# firewall-cmd --permanent --add-service=samba
success
[root@samba ~]# firewall-cmd --reload
success
[root@samba ~]# systemctl stop firewalld && systemctl disable --now firewalld
Removed "/etc/systemd/system/multi-user.target.wants/firewalld.service".
Removed "/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service".

1.2 Yum仓库

可以使用光盘镜像仓库或者云yum仓库

[root@centos7 ~]# mount /dev/sr0 /media/
mount: /dev/sr0 is write-protected, mounting read-only
[root@centos7 ~]# cat /etc/yum.repos.d/centos7.repo
[centos7]
name=centos7
baseurl=file:///media/
gpgcheck=0
[root@centos7 ~]# yum makecache
Loaded plugins: fastestmirror
Determining fastest mirrors
centos7                                                                                                                       | 3.6 kB  00:00:00
(1/4): centos7/group_gz                                                                                                       | 153 kB  00:00:00
(2/4): centos7/primary_db                                                                                                     | 6.1 MB  00:00:00
(3/4): centos7/filelists_db                                                                                                   | 7.2 MB  00:00:00
(4/4): centos7/other_db                                                                                                       | 2.6 MB  00:00:00
Metadata Cache Created

2. 安装Samba

[root@samba BaseOS]# yum install -y samba samba-client*  samba-winbind* samba-swat* \
 samba-common-tools realmd adcli sssd oddjob oddjob-mkhomedir \
  samba-common-tools krb5-workstation authselect-compat vim

3. 将Samba服务器加入域

发现网络中的域

[root@samba ~]# realm list
[root@samba ~]# realm discover ad.sh.pana.cn
sh.papa.cn
  type: kerberos
  realm-name: SH.PAPA.CN
  domain-name: sh.papa.cn
  configured: no
  server-software: active-directory
  client-software: sssd
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd
  required-package: adcli
  required-package: samba-common-tools

扫描域是否可达

[root@centos7 ~]# realm join --user=Administrator ad.sh.pana.cn
Password for Administrator:
## 确认加域成功
[root@centos7 ~]# realm list
sh.papa.cn
  type: kerberos
  realm-name: SH.PAPA.CN
  domain-name: sh.papa.cn
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd
  required-package: adcli
  required-package: samba-common-tools
  login-formats: %U@sh.papa.cn
  login-policy: allow-realm-logins

将Samba服务器加入pana域

[root@samba ~]# net ads join -U administrator
Enter administrator's password:
Using short domain name -- SH
Joined 'SAMBA' to dns domain 'sh.papa.cn'
DNS update failed: NT_STATUS_UNSUCCESSFUL
[root@samba ~]# systemctl restart winbind
[root@samba ~]# wbinfo -t
checking the trust secret for domain SH via RPC calls succeeded
[root@samba ~]# wbinfo -u
administrator
guest
krbtgt
samba

此时在ad服务器上可以看到samba服务器已经加入

4. Samba配置

[root@samba BaseOS]# mkdir -p /samba/data
[root@samba BaseOS]# chmod -R a+rw /samba/data

4.1 配置文件smb.conf

/etc/samba/smb.conf

# See smb.conf.example for a more detailed config file or
# read the smb.conf manpage.
# Run 'testparm' to verify the config is correct after
# you modified it.
[global]
        workgroup = SH
        realm = sh.papa.cn
        security = ADS
        password server = 192.168.31.101
        idmap uid = 10000 - 20000
        idmap gid = 10000 - 20000
        template shell = /bin/bash
        winbind separator = /
        winbind use default domain = yes
        winbind enum users = yes
        winbind enum groups = yes
        encrypt passwords = yes

        printing = cups
        printcap name = cups
        load printers = yes
        cups options = raw

[homes]
        comment = Home Directories
        valid users = %S, %D%w%S
        browseable = No
        read only = No
        inherit acls = Yes

[printers]
        comment = All Printers
        path = /var/tmp
        printable = Yes
        create mask = 0600
        browseable = No

[print$]
        comment = Printer Drivers
        path = /var/lib/samba/drivers
        write list = @printadmin root
        force group = @printadmin
        create mask = 0664
        directory mask = 0775
[share]
     comment = Home Directories
     path=/samba/data
     browseable = yes
     writable = yes
     valid users = samba

4.2 配置文件nsswitch.conf

/etc/nsswitch.conf

[root@centos7 ~]# sed -ir 's#^passwd:.*#passwd:     files winbind#g' /etc/nsswitch.conf
[root@centos7 ~]# sed -ir 's#^group:.*#group:      files winbind#g' /etc/nsswitch.conf
[root@centos7 ~]# sed -ir '/^shadow/d' /etc/nsswitch.conf

4.3 修改配置文件krb5.conf

/etc/krb5.conf

# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/

includedir /var/lib/sss/pubconf/krb5.include.d/
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
# default_realm = EXAMPLE.COM
 default_ccache_name = KEYRING:persistent:%{uid}

 default_realm = SH.PAPA.CN
[realms]
## 修改以下4行
 SH.PAPA.CN = {
  kdc = 192.168.31.101:88
  defautl_domain = SH.PAPA.CN
 }

[domain_realm]
# .example.com = EXAMPLE.COM
# example.com = EXAMPLE.COM
 sh.papa.cn = SH.PAPA.CN
 .sh.papa.cn = SH.PAPA.CN

4.4 重启samba服务

[root@samba ~]# systemctl enable --now smb
Created symlink from /etc/systemd/system/multi-user.target.wants/smb.service to /usr/lib/systemd/system/smb.service.
[root@samba ~]# systemctl restart smb

5. Windows域服务器访问Samba

5.1 确保网络正常

C:\Users\Administrator>ping samba.sh.pana.cn

正在 Ping samba.sh.pana.cn [192.168.31.104] 具有 32 字节的数据:
来自 192.168.31.104 的回复: 字节=32 时间<1ms TTL=64
来自 192.168.31.104 的回复: 字节=32 时间<1ms TTL=64
来自 192.168.31.104 的回复: 字节=32 时间<1ms TTL=64
来自 192.168.31.104 的回复: 字节=32 时间<1ms TTL=64

192.168.31.104 的 Ping 统计信息:
    数据包: 已发送 = 4，已接收 = 4，丢失 = 0 (0% 丢失)，
往返行程的估计时间(以毫秒为单位):
    最短 = 0ms，最长 = 0ms，平均 = 0ms

C:\Users\Administrator>

5.2 访问Samba

输入域用户名密码

用户名取决于/etc/samba/smb.conf中share中的valid user

此时就能在samba上正常创建和删除文件了

此时在samba服务器下也能看到此文件

[root@samba ~]# ls /samba/data/
111.bmp