In our previous tutorial, we have shown you how to setup a Samba Standalone server. This tutorial describes how to setup Samba Primary Domain Controller in CentOS 7. This setup was tested in CentOS 7 minimal server, although the same steps should work on RHEL 7 and Scientific Linux 7 as well.
I will be using two systems as mentioned below for the purpose of this article.
- OS: CentOS 7 Minimal server
- Hostname: server.unixmen.local
- IP Address: 192.168.1.150/24
- Samba Domain: UNIXMEN
- OS: Windows 7 32 bit
- Hostname: mywindesktop
- IP Address: 192.168.1.100/24
Well, now let us dive into the Samba PDC setup.
Run the following command to install samba packages.
yum install samba* -y
To verify the version of Samba, enter the following commands:
The output will be as below:
Edit samba default configuration file;
Find the following lines, and make the changes as shown below. Replace UNIXMEN with your own domain name.
[Global] workgroup = UNIXMEN security = user domain master = yes domain logons = yes local master = yes preferred master = yes passdb backend = tdbsam logon path = \\%L\Profiles\%U logon script = logon.bat add machine script = /usr/sbin/useradd -d /dev/null -g 200 -s /sbin/nologin -M %u [homes] comment = Home Directories browseable = yes writable = yes [printers] comment = All Printers path = /var/spool/samba printable = Yes print ok = Yes browseable = No [netlogon] comment = Network Logon Service path = /var/lib/samba/netlogon browseable = No writable = No [Profiles] path = /var/lib/samba/profiles create mask = 0755 directory mask = 0755 writable = Yes
To make this much simple, move your old smb.conf file to a safe location.
mv /etc/samba/smb.conf /etc/samba/smb.conf.bak
Create a new smb.conf file under /etc/samba/ directory;
and copy/paste the above lines. Don’t forget to change the Domain name with your own.
Save and close the file
Test Samba configuration file syntax errors using the following command:
Your output might look like below.
Load smb config files from /etc/samba/smb.conf rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384) Processing section "[homes]" Processing section "[printers]" Processing section "[netlogon]" Processing section "[Profiles]" Loaded services file OK. Server role: ROLE_DOMAIN_PDC Press enter to see a dump of your service definitions [global] workgroup = UNIXMEN add machine script = /usr/sbin/useradd -d /dev/null -g 200 -s /sbin/nologin -M %u logon script = logon.bat logon path = \\%L\Profiles\%U domain logons = Yes preferred master = Yes domain master = Yes idmap config * : backend = tdb [homes] comment = Home Directories read only = No [printers] comment = All Printers path = /var/spool/samba printable = Yes print ok = Yes browseable = No [netlogon] comment = Network Logon Service path = /var/lib/samba/netlogon browseable = No [Profiles] path = /var/lib/samba/profiles read only = No create mask = 0755
Create the shares with proper permissions which we have mentioned in the smb.conf file
mkdir -m 1777 /var/lib/samba/netlogon mkdir -m 1777 /var/lib/samba/profiles
useradd user1 useradd user2
Create Machine accounts:
You need to create machine account for every machine in order to allow domain login from Windows machines. The machine account are special accounts with $ at the end, i.e. machine$. The system accounts for machines do not need login shell neither home directory.
Add a new group named “machine” with group id “200”.
groupadd -g 200 machine
To add a Samba machine account, run the following command:
smbpasswd -m -a machine1$
Here, smbpasswd -m …. – tells that account will be used as NT primary domain controller (Machine account).
For more details about, smbpasswd command, refer this link.
Create Samba user accounts:
smbpasswd -a root smbpasswd -a user1 smbpasswd -a user2
Here, ‘root’ user is the administrator that can be used to join the Windows NT/2000/XP/7 systems to be part of the domain. In this case, do not provide smbpasswd with the same password as the actual root account on the server. Create a different password to be used solely for creating computer accounts. This will reduce the possibility of compromising the root password.
Start Samba services:
Finally start samba services and enable them to start automatically on every boot.
systemctl start smb systemctl start nmb systemctl enable smb systemctl enable nmb
Samba uses the following Ports when runs as an Active Directory Domain Controller:
|End Point Mapper (DCE/RPC Locator Service)||135||tcp|
|NetBIOS Name Service||137||udp|
|SMB over TCP||445||tcp|
|LDAPS (only if “tls enabled = yes”)||636||tcp|
|Dynamic RPC Ports*||1024-5000||tcp|
|Global Cataloge SSL (only if “tls enabled = yes”)||3269||tcp|
Run the following commands one by one to allow Samba ports through firewall.
firewall-cmd --permanent --add-port=53/tcp firewall-cmd --permanent --add-port=53/udp firewall-cmd --permanent --add-port=88/tcp firewall-cmd --permanent --add-port=88/udp firewall-cmd --permanent --add-port=135/tcp firewall-cmd --permanent --add-port=137/tcp firewall-cmd --permanent --add-port=137/udp firewall-cmd --permanent --add-port=138/udp firewall-cmd --permanent --add-port=139/tcp firewall-cmd --permanent --add-port=389/tcp firewall-cmd --permanent --add-port=389/udp firewall-cmd --permanent --add-port=445/tcp firewall-cmd --permanent --add-port=464/tcp firewall-cmd --permanent --add-port=464/udp firewall-cmd --permanent --add-port=636/tcp firewall-cmd --permanent --add-port=1024-5000/tcp firewall-cmd --permanent --add-port=1024-5000/udp firewall-cmd --permanent --add-port=3268/tcp firewall-cmd --permanent --add-port=3269/tcp firewall-cmd --permanent --add-port=5353/tcp firewall-cmd --permanent --add-port=5353/udp
Finally restart firewall service.
Apply the proper SELinux policies to Samba domain controller.
setsebool -P samba_domain_controller on setsebool -P samba_enable_home_dirs on
Also to the Samab shares which we have defined in the smb.conf file.
chcon -t samba_share_t /var/lib/samba/netlogon chcon -t samba_share_t /var/lib/samba/profiles
If you don’t want to mess up with Firewall and SELinux, simply disable them. Restart your server once you completed all above steps.
Joining Windows Clients To Samba PDC
Now try to join the samba domain from Windows OS client using the newly created user.
Right click on My Computer, go to Properties ->Advanced system settings.
In the Computer Name tab, Click on the Change button.
In the Domain field, enter your Domain name. In my case, it’s unixmen.
Enter the Samba administrator, which is root in our case, and it’s password. Not the actual root user password. Enter the root password which we created earlier using smbpasswd command.
"The specified domain either does not exist or could not be contacted"
Don’t worry. We can easily fix this error by doing the following tricks.
To get rid of this error, open the windows registry. Go to HKEY_LOCAL_MACHINE -> SYSTEM -> CurrentControlSet -> Services -> LanmanWorkstation -> Parameters.
Create new two DWORD values called “DomainCompatibilityMode” and “DNSNameResolutionRequired”. And set values for “DomainCompatibilityMode” as 1(one) and “DNSNameResolutionRequired” as 0(zero). Refer the below screenshot.
Now, you’ll be able to join your windows client to domain.
Click Ok to continue.
Opps! Again error!!
Changing the Primary Domain DNS name of this computer to "" failed. The name will remain "UNIXMEN". The error was: The specified domain either does not exist or could not be contacted
Simply click Ok to ignore this message. Don’t restart now.
Download and install a hotfix from the following link to prevent this error in future.
After installing the fix, restart the Windows OS machine and you will able to login to Samba domain now.
Press CTRL+ALT+Del keys, Click Switch user, and select Other user option.
Enter the user name and password. Remember we already have created two users namely user1 and user2 in our previous steps.
That’s it. The new user will be able to login to the domain now.
Please note that, a network drive will be automatically created for the each user. The users can store their personal files/folders in that network folder if they want.
You access the samba users roaming profiles in the following location in the Samba server.
Viewing individual users profiles:
AppData Desktop Downloads Links NTUSER.DAT Pictures Searches Contacts Documents Favorites Music ntuser.ini Saved Games Videos
At this stage you have a fully operational Samba Domain Controller on CentOS 7. That’s it. Start using your Samba PDC. Good luck!
For more details, refer the official Samba documentation.