uccwiki

Setup Process

Clean Installation of samba & dependencies

The domain controller dc0.v.ucc.asn.au is based off a clone of samurai, cleaned up and configured using the steps below. dc1.v.ucc.asn.au was set up as a fresh install based on Debian 9.5.0 (netinst).

A fresh domain controller can probably be set up using the same steps; Note: These instructions are valid for Samba 4.7 and 4.8.5, older versions of Samba may be missing important configuration options and newer ones may behave slightly differently.

The rest of these instructions are based off the official Samba AD setup guide.

Provisioning a new AD Domain

Make sure you start with a clean installation. Note: Don't do this unless you want to set up a fresh domain, in which case you will need to change all the settings below to appropriate values.

Joining a new DC to an existing AD domain

Make sure you start with a clean installation.

Sysvol replication

Samba doesn't support sysvol replication and probably never will, but they have some (old) suggested workarounds. At the most basic level, the directory /var/lib/samba/sysvol must be synchronised between DCs to keep things working smoothly. Unfortunately the filesystem needs to support xattr and POSIX ACLs so using a simple NFS share isn't possible, and rsync is painful when it comes to two-way synchronisation.

Fortunately csync2 does exactly what we want (minus ACLs/xattr, but those can be fixed using samba-tool ntacl sysvolreset). Here's how you can set it up.

To manually replicate the sysvol directories between DCs:

dc0# scp -ar /var/lib/samba/sysvol dc1:/var/lib/samba/sysvol
dc1# samba-tool ntacl sysvolreset

Diagnostics

Sometimes group memberships don't seem to be updated, this can often be fixed by clearing the cache:

Sometimes, everything may break rather catastrophically. This may be due to the keytabs at /etc/krb5.keytab and /var/lib/samba/private/secrets.keytab becoming out of sync.

uccwiki: NewActiveDirectory/DomainControllers (last edited 2022-11-10 10:00:22 by 192)