Join Linux to Active Directory with Samba 3.0
Scott Lowe
Published: 17 Sep 2002 09:59 BST
Configuring Samba
Once installation is complete, you need to create a Samba configuration file. Samba uses the file /usr/local/samba/lib/smb.conf for its configuration parameters. To begin, I'll set up a very minimal configuration file that looks like this:
realm = SLOWE.COMads server = 10.109.10.133security = ADSencrypt passwords = yes
In this configuration file, the realm statement sets the Kerberos realm information. This is analogous to a domain name and has to be all uppercase. The ads server statement is the resolvable name or the IP address of your Windows 2000 domain controller server. I chose to use the IP address to remove the possibility of any DNS issues. The security statement tells Samba to use Active Directory security. Finally, the encrypt passwords statement tells Samba that passwords need to be encrypted to work with the Kerberos protocol.
Putting it all together
With Samba and Kerberos both configured, you need to create a computer account in the Windows 2000 Active Directory. To do this, you must log in to the Windows 2000 server as a user, such as Administrator, with the rights to do this. To log in to the server from your Linux machine, run the /usr/kerberos/bin/kinit administrator@SLOWE.COM command, and you'll be prompted for your Administrator password. To create the computer account, enter the /usr/local/samba/bin/net ads join command. If successful, you'll get a message similar to: Joined 'LDAPS' to realm 'SLOWE.COM.
To verify that the process worked, go to your Windows 2000 Server, open Active Directory Users And Computers, and look at the entries. If the previous step worked, you'll see an entry in this list with the name of your Linux server. My Linux server is named ldaps and now appears in the list.
Testing it
On your Linux machine, you should be able to connect to Windows shares using Samba's smbclient without a password (thanks to Kerberos). To test this, enter the /usr/local/samba/bin/smbclient //w2k/c\$ -k command at the Linux prompt.
Since this is still an alpha version of Samba 3.0, you'll see a number of errors scroll by, but this command still works. You'll finally be connected to the C$ administrative share on your Windows 2000 Server.
On my system, this resulted in the output that appears in Listing B. I've also included a directory listing to show that it's actually connected. Notice the line "Doing kerberos session setup." Samba has come a long way.
And now, the problems!
Being alpha code, Samba 3.0 still has bugs, which is to be expected. Among the errors I received were various compilation warnings, as well as errors when utilities were run. These bugs are due to the drastic changes made in transition from Samba 2.x to 3.0 and will all eventually disappear as Samba 3.0 reaches final release. In addition to the standard bug fare, I'm not able to make Kerberos connections to the Samba server, but as you could see from the examples, the server is more than capable of initiating them. Making the connection from Windows to Linux is one of the major focuses of the Samba development team, so rest assured that this feature will be in place at some point between the alpha release and the final release.
Stay tuned for more
One interesting quirk in my trial install was that the Linux server was able to connect to the Win2K server and access and use the available shares, but the Win2K server was unable to access and use the Linux shared directories. I contacted the Samba team to make sure that they were aware of the inability of Samba 3.0 to allow two-way use of shared directories.
As Samba 3.0 develops into full-release status, they're confident this problem will be resolved. The Samba teams also informed me that they'll add the first-ever upgrade wizards to help users and administrators make the migration from the old Samba 2.x smb.conf files to the newer Samba 3.0 smb.conf files. You can be sure that TechRepublic will be covering these wizards as they arrive.
If you are interested in staying on top of the development process of Samba 3.0, the best place to keep apprised of news is one of the many Samba mailing lists. For more information on where the Samba 3.0 development is heading, visit the Samba road map.
Have your say instantly in the
Tech Update forum.
Find out what's where in the new Tech Update with our
Guided Tour.
Let the editors know what you think in the
Mailroom.
Previous
Did you find this article useful?
77 out of 235 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
