32bit環境にSamba ADは導入可能か？

今後 32bit CPU などアリエナイ上に、現行でも滅びつつある中では全く不毛な話。ではあるのだが、テスト機材の都合でここでは必要。

・リポジトリ指定なしに CentOS 6.7 に yum で導入(4.0.-)はNG
・4.2.8をダウンロードしてコンパイルは可

とりあえず設定を進めてみる。

[root@DC01 ~]# /usr/local/samba/bin/samba-tool domain provision --use-rfc2307 --interactive --function-level=2008_R2
Realm: Samba4-AD.LOCAL
 Domain [Samba4-AD]:
 Server Role (dc, member, standalone) [dc]:
 DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]:
 DNS forwarder IP address (write 'none' to disable forwarding) [127.0.0.1]:
Administrator password:
Retype password:
Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up share.ldb
Setting up secrets.ldb
Setting up the registry
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
Adding DomainDN: DC=samba4-ad,DC=local
Adding configuration container
Setting up sam.ldb schema
Setting up sam.ldb configuration data
Setting up display specifiers
Modifying display specifiers
Adding users container
Modifying users container
Adding computers container
Modifying computers container
Setting up sam.ldb data
Setting up well known security principals
Setting up sam.ldb users and groups
Setting up self join
Adding DNS accounts
Creating CN=MicrosoftDNS,CN=System,DC=samba4-ad,DC=local
Creating DomainDnsZones and ForestDnsZones partitions
Populating DomainDnsZones and ForestDnsZones partitions
Setting up sam.ldb rootDSE marking as synchronized
Fixing provision GUIDs
A Kerberos configuration suitable for Samba 4 has been generated at /usr/local/samba/private/krb5.conf
Setting up fake yp server settings
Once the above files are installed, your Samba4 server will be ready to use
Server Role:           active directory domain controller
Hostname:              DC01
NetBIOS Domain:        SAMBA4-AD
DNS Domain:            samba4-ad.local
DOMAIN SID:            S-1-5-21-98334141-1155700478-3900901028

[root@DC01 ~]#

[root@DC01 ~]#
[root@DC01 ~]# chmod 755 /etc/rc.d/init.d/samba4
[root@DC01 ~]# chmod +x /etc/rc.d/init.d/samba4
[root@DC01 ~]# ln -s /etc/rc.d/init.d/samba4 /etc/rc3.d/S80samba4
[root@DC01 ~]#
[root@DC01 ~]#
[root@DC01 ~]# chkconfig samba4 on && systemctl start samba4
-bash: systemctl: コマンドが見つかりません
[root@DC01 ~]#

CentOS 6.7 なので systemctl は無い。


[root@DC01 ~]# chkconfig samba4 on
[root@DC01 ~]#
[root@DC01 ~]# /etc/rc.d/init.d/samba4 restart
/etc/rc.d/init.d/samba4: line 1: amba4: コマンドが見つかりません
Shutting down samba4:                                      [失敗]
Starting samba4:                                           [  OK  ]
[root@DC01 ~]#

init.d ディレクトリ下の samba4 の 1行目 で誤記述に確認漏れ。幸い設定に影響はないが修正、
 
[root@DC01 ~]# vi /etc/rc.d/init.d/samba4

# Samba4        This shell script takes care of starting and stopping
#               samba4 daemons.
#
# chkconfig: - 58 74
# description: Samba 4.0 will be the next version of the Samba suite
# and incorporates all the technology found in both the Samba4 alpha
# series and the stable 3.x series. The primary additional features
# over Samba 3.6 are support for the Active Directory logon protocols
# used by Windows 2000 and above.

### BEGIN INIT INFO
# Provides: samba4
# Required-Start: $network $local_fs $remote_fs
# Required-Stop: $network $local_fs $remote_fs
# Should-Start: $syslog $named
. /etc/init.d/functions

# Source networking configuration.
. /etc/sysconfig/network

prog=samba
prog_dir=/usr/local/samba/sbin/
lockfile=/var/lock/subsys/$prog

start() {
        [ "$NETWORKING" = "no" ] && exit 1
#       [ -x /usr/sbin/ntpd ] || exit 5

                # Start daemons.
                echo -n $"Starting samba4: "
                daemon $prog_dir/$prog -D
        RETVAL=$?
                echo
        [ $RETVAL -eq 0 ] && touch $lockfile
        return $RETVAL
}

stop() {
        [ "$EUID" != "0" ] && exit 4
                echo -n $"Shutting down samba4: "
        killproc $prog_dir/$prog
        RETVAL=$?
                echo
        [ $RETVAL -eq 0 ] && rm -f $lockfile
        return $RETVAL
}

DOMAIN SID:            S-1-5-21-98334141-1155700478-3900901028

[root@DC01 ~]#

属性ももう一度変更。
[root@DC01 ~]# chmod 755 /etc/rc.d/init.d/samba4
[root@DC01 ~]# chmod +x /etc/rc.d/init.d/samba4
[root@DC01 ~]# ln -s /etc/rc.d/init.d/samba4 /etc/rc3.d/S80samba4
[root@DC01 ~]#
[root@DC01 ~]#
[root@DC01 ~]# chkconfig samba4 on && systemctl start samba4
-bash: systemctl: コマンドが見つかりません
[root@DC01 ~]#
コピペ脳の愚行、まさに愚か。

[root@DC01 ~]# chkconfig samba4 on
[root@DC01 ~]#
[root@DC01 ~]#
[root@DC01 ~]# /etc/rc.d/init.d/samba4 restart
/etc/rc.d/init.d/samba4: line 1: amba4: コマンドが見つかりません
Shutting down samba4:                                      [失敗]
Starting samba4:                                           [  OK  ]
[root@DC01 ~]#
[root@DC01 ~]#


DNSの設定。これに先立ち、resolv.conf へもループバックの記述が必要。
[root@DC01 ~]# sed -i "/^DNS1/cDNS1=127.0.0.1" /etc/sysconfig/network-scripts/ifcfg-*
[root@DC01 ~]#

DNS設定後のネットワーク機能リスタート。
[root@DC01 ~]# /etc/rc.d/init.d/network restart
インターフェース eth0 を終了中:  デバイスの状態: 3 (切断済み)
                                                           [  OK  ]
ループバックインターフェースを終了中                       [  OK  ]
ループバックインターフェイスを呼び込み中                   [  OK  ]
インターフェース eth0 を活性化中:  アクティブ接続の状態: アクティベート済み
アクティブ接続のパス: /org/freedesktop/NetworkManager/ActiveConnection/1
                                                           [  OK  ]
[root@DC01 ~]#
[root@DC01 ~]#






DNSの動作確認だが、またやらかす。

[root@DC01 ~]# /usr/local/samba/bin/samba-tool dns zonelist 127.0.0.1 -U Administrator
Password for [SAMBA4-AD\Administrator]:
  2 zone(s) found

  pszZoneName                 : samba4-ad.local


  Flags                       : DNS_RPC_ZONE_DSINTEGRATED DNS_RPC_ZONE_UPDATE_SECURE
  ZoneType                    : DNS_ZONE_TYPE_PRIMARY
  Version                     : 50
  dwDpFlags                   : DNS_DP_AUTOCREATED DNS_DP_DOMAIN_DEFAULT DNS_DP_ENLISTED
  pszDpFqdn                   : DomainDnsZones.samba4-ad.local

  pszZoneName                 : _msdcs.samba4-ad.local
  Flags                       : DNS_RPC_ZONE_DSINTEGRATED DNS_RPC_ZONE_UPDATE_SECURE
  ZoneType                    : DNS_ZONE_TYPE_PRIMARY
  Version                     : 50
  dwDpFlags                   : DNS_DP_AUTOCREATED DNS_DP_FOREST_DEFAULT DNS_DP_ENLISTED
  pszDpFqdn                   : ForestDnsZones.samba4-ad.local
[root@DC01 ~]#

これはOKだが、次に目先も見てないコピペ脳炸裂。

[root@DC01 ~]# host -t SRV _ldap._tcp.レルム名 127.0.0.1
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:

_ldap._tcp.レルム名 has no SRV record

[root@DC01 ~]#
[root@DC01 ~]#
[root@DC01 ~]#
[root@DC01 ~]# host -t SRV _kerberos._udp.レルム名 127.0.0.1
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:

_kerberos._udp.レルム名 has no SRV record

[root@DC01 ~]#
[root@DC01 ~]#
[root@DC01 ~]# host -t A dc.samba4-ad.local 127.0.0.1
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:

Host dc.samba4-ad.local not found: 3(NXDOMAIN)

[root@DC01 ~]#
[root@DC01 ~]#
[root@DC01 ~]# host -t SRV _ldap._tcp.samba4-ad 127.0.0.1
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:

_ldap._tcp.samba4-ad has no SRV record

[root@DC01 ~]# host -t SRV _kerberos._udp.samba4-ad 127.0.0.1
host: '_kerberos._udp..samba4-ad' is not a legal name (unexpected end of input)
[root@DC01 ~]# host -t SRV _kerberos._udp.Samba4-AD 127.0.0.1
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:

_kerberos._udp.Samba4-AD has no SRV record

[root@DC01 ~]#

やり直し。

[root@DC01 ~]# host -t SRV _ldap._tcp.samba4-ad.local 127.0.0.1
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:

_ldap._tcp.samba4-ad.local has SRV record 0 100 389 dc01.samba4-ad.local.
[root@DC01 ~]#
[root@DC01 ~]#
[root@DC01 ~]#
[root@DC01 ~]# host -t SRV _kerveros._udp.samba4-ad 127.0.0.1
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:

_kerveros._udp.samba4-ad has no SRV record
[root@DC01 ~]#
[root@DC01 ~]# host -t SRV _kerberos._udp.samba4-ad 127.0.0.1
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:

_kerberos._udp.samba4-ad has no SRV record
[root@DC01 ~]# host -t SRV _kerberos._udp.samba4-ad.local 127.0.0.1
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:

_kerberos._udp.samba4-ad.local has SRV record 0 100 88 dc01.samba4-ad.local.
[root@DC01 ~]#
[root@DC01 ~]#
[root@DC01 ~]# host -t A dc.samba4-ad 127.0.0.1
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:

dc.samba4-ad has no A record
[root@DC01 ~]# host -t A dc.samba4-ad.local 127.0.0.1
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:

Host dc.samba4-ad.local not found: 3(NXDOMAIN)
[root@DC01 ~]# host -t A dc01.samba4-ad.local 127.0.0.1
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:

dc01.samba4-ad.local has address 172.19.19.10
[root@DC01 ~]#


誤読、誤記述くりかえしつつ、一応設定が通ったように見える。この時点で、iptables について全く考慮がまわっていなかったので当然、Windowsクライアントのドメイン変更(以前のテストドメインから新しテストドメイン)がNG。

/etc/sysconfig/iptable

を編集。編集して

/etc/rc.d/init.d/iptables

を再起動の繰り返し。なぜ何度も繰り返したかというと

・思考及ばず全く何もしない状態
・DNSとSMBを通す
・LDAPを通す
・LDAPの設定を間違える
・Kerberosが漏れていることに気付く

という繰り返し。実際にどのポートが必要かというと、MicrosoftとSamba Wikiから。

Active Directory and Active Directory Domain Services Port Requirements
https://technet.microsoft.com/en-us/library/dd772723%28WS.10%29.aspx

Samba port usage
https://wiki.samba.org/index.php/Samba_port_usage



とりあえず、hogehogeドメインへようこそ、までは辿り着いた。しかし、実際にドメインログオンは、iptablesを外さないとうまくいかない。と言っても、本当に必要なポートだけをひとつずつ開けているので、まだ詳細が特定できていないというだけのことだ。


どうやら、ワークPCから VirtualBox(CentOS+Samba)を撤去できそうだぜ AWESOME！



追記:

Samba について iptables な設定については後日別エントリにて。