Setting up an Active Directory server with Debian and Samba. First part

Hello everyone. In this series of courses I am going to teach you how to set up a server Active Directory for networks with computers Windows with Debian (If we are going to set up a server, we are going to do it properly, firewood). In this first installment I will explain the installation and configuration of the server and in the second I will teach how to use the remote administration tools de Windows 7 and how to join the computers to the domain (Windows 7 itself and a Windows XP). Later I will make a third installment apart from how to join teams with GNU / Linux since it is something that I have yet to test.

This idea came to me while I was (or was, it depends on when you read this entry) taking a course on the strike of Microcomputer Equipment Repair Technician in which we set up a network server Windows 2008 (not RC2) and I started looking if I could implement the same under GNU / Linux and the result is really good, even my teacher was surprised at the speed of the server.

Before continuing, and surely many of you ask yourself, What is Active Directory? Well, it is the term that Microsoft uses to refer to its set of tools for network administration such as the server DNS, the administration of network users, etc.

We will need the following:

• Debian in its stable branch (in my case Wheezy 7.5 with XFCE as desktop environment)
• Samba 4
• A client with Windows 7 / 8 / 8.1 with the package to install remote server control functions (required to manage the server, such as share a folder with users). This will be explained in the next tutorial.

Setting up the server

Before continuing, we must edit some files so that everything works, especially so that the computers on the network can find the domain server.

The first thing is to give our server an address fixed IP. In the case of my Debian testing in Virtualbox use networking, which is what comes from the base, but in the real server I configure it from Network Manager, so I will explain how it is done in both.

Networking

The first file we will edit is / etc / network / interfaces.
# This file describes the network interfaces available on your system

auto eth0
iface eth0 inet static
address 192.168.0.67
netmask 255.255.255.0
gateway 172.26.0.1
dns-nameservers 192.168.0.67
dns-search clase.org
dns-domain clase.org
Being:

• address: the IP of our team.
• netmask: the network mask. In a small network or a home it is usually this.
• gateway: the gateway. Normally it is the IP of the router that gives us the exit to the Internet.
• dns-nameservers: Server ip DNS. In this case the server, but you can add a second, for example the publics of Google.
• The last 2 indicate the domain search name and the domain name itself.

Now we must add the following lines to / etc / hosts:
127.0.0.1 Matrix.clase.org Matrix
192.168.0.67 Matrix.clase.org Matrix

With this, the domain name will be resolved so that it can be found on the network. Matrix is the name I gave the server.

Finally we edit /etc/resolv.conf:

nameserver 192.168.0.13

In some tutorials I found, they added another nameserver line and a couple more variables, but in my case only one line was enough.
Now we restart the network service and that's it:

/etc/init.d/networking restart

Network Manager

Click with the right mouse button on the networks icon and select Edit connections. We will get the networks that we have configured, but we are only interested in the call Wired network 1 or whatever you named it. We double click on it and a new window will appear and we will go to IPv4 settings. In method select Manual. Now click on Add and fill in all the fields:

Now we go to the tab General and we make sure that it is marked All users must connect to this network. Click on Save and we left.

Installing Samba 4

In our case we are going to download and compile Samba 4 from its page because in Debian it is only available through the repository backports and it gave me dependency problems.

We're going to http://samba.org to download the latest stable version and unzip the package in a folder.

To compile it we will need to install the following packages:

apt-get install build-essential libacl1-dev libattr1-dev \
libblkid-dev libgnutls-dev libreadline-dev python-dev libpam0g-dev \
python-dnspython gdb pkg-config libpopt-dev libldap2-dev \
dnsutils libbsd-dev attr krb5-user docbook-xsl libcups2-dev acl

Once downloaded and unzipped we open a terminal and move to the folder and execute the following commands:
./configure --enable-debug
make
make install

Now we add the new routes in the PATH. In my case in /etc/bash.bashrc to apply to all users, including root.

export PATH=$PATH:/usr/local/samba/bin:/usr/local/samba/sbin

And we also create a link inside / etc for Samba to find the configuration file:

ln -s /usr/local/samba/etc/ /etc/samba

We are going to configure the Samba server. For this we execute:

samba-tool domain provision --realm=clase.org --domain=CLASE --adminpass=Contraseña --use-rfc2307

where:

• –Realm: is the full domain name.
• –Domain: is the domain. Has to be in capital letters
• –Adminspass: is the password of the network administrator.
• –Use-rfc2307: to activate AC.

If everything goes well after a little while Samba will finish configuring itself. If you want to know all the possible options, just run:

samba-tool domain provision -h

Now we are going to edit the file /etc/samba/smb.conf. For now what interests us is the following line:
dns forwarder = 192.168.0.1

This line must point to the DNS server that gives us access to the Internet (in this case, the router). Samba takes the default configuration of the network but it is recommended to verify it.

Now we start the service:

samba

and we check the connection by executing:

smbclient -L localhost -U%

And if everything is correct we will see something similar to this:

In case it gives us a connection error, we verify the steps of the previous point. The Samba log is located in /usr/local/samba/var/log.samba

Now we are going to copy the file /usr/local/samba/private/krb5.conf a / Etc. Now we are going to check that we can connect:

kinit administrator@CLASE.ORG

Eye, the domain has to be capitalized.

Then it will ask us for the user's password (in this case the administrator's) and if we get a message similar to “Warning: Your password will expire in 40 days on Mon Jul 14 13:57:10 2014” is that it came out correctly.

And so far the first part of the tutorial. We read in the following.