====== Samba AD DCの冗長化 ======
===== プライベートリポジトリの設定 =====
[[linux:samba:private_repository_setting|プライベートリポジトリの設定]]を参照。
===== パッケージインストール =====
$ sudo yum install samba samba-dc samba-client bind-utils \
tdb-tools psmisc krb5-workstation --enablerepo=mgc
wbinfoを使えるように以下もインストールしておくとよい。
$ sudo yum install samba-winbind-clients --enablerepo=mgc
===== Kerberosクライアントのデフォルト設定 =====
==== 設定ファイルのバックアップ ====
$ sudo cp /etc/krb5.conf /etc/krb5.conf.org
==== 設定ファイルの編集 ====
$ sudo vi /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = FIREBALL.LOCAL <-
dns_lookup_realm = false <- 追記
dns_lookup_kdc = true <-
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
[realms]
# EXAMPLE.COM = {
# kdc = kerberos.example.com
# admin_server = kerberos.example.com
# }
FIREBALL.LOCAL = { <-
kdc = blue-dc.fireball.local <- 追記
kdc = blue-dc1.fireball.local <-
} <-
[domain_realm]
# .example.com = EXAMPLE.COM
# example.com = EXAMPLE.COM
.fireball.local = FIREBALL.LOCAL <- 追記
fireball.local = FIREBALL.LOCAL <-
===== Kerberosの動作確認 =====
$ kinit administrator
Password for administrator@FIREBALL.LOCAL: <- パスワードを入力
Warning: Your password will expire in 41 days on 2013年11月20日 01時23分51秒
===== DCとしてドメインへ参加 =====
==== 設定ファイルのバックアップ ====
$ sudo mv /etc/samba/smb.conf /etc/samba/smb.conf.org
または
$ sudo rm /etc/samba/smb.conf
※smb.confを移動 or 削除しないとsamba-toolでエラーが発生する。
==== DCのドメイン参加 ====
$ sudo samba-tool domain join fireball.local DC -Uadministrator --realm=fireball.local
Finding a writeable DC for domain 'fireball.local'
Found DC blue-dc.fireball.local
Password for [WORKGROUP\administrator]: <-パスワードを入力
workgroup is FIREBALL
realm is fireball.local
checking sAMAccountName
Adding CN=BLUE-DC2,OU=Domain Controllers,DC=fireball,DC=local
Adding CN=BLUE-DC2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fireball,DC=local
Adding CN=NTDS Settings,CN=BLUE-DC2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fireball,DC=local
Adding SPNs to CN=BLUE-DC2,OU=Domain Controllers,DC=fireball,DC=local
Setting account password for BLUE-DC2$
Enabling account
Calling bare provision
No IPv6 address will be assigned
Provision OK for domain DN DC=fireball,DC=local
Starting replication
Schema-DN[CN=Schema,CN=Configuration,DC=fireball,DC=local] objects[402/1550] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=fireball,DC=local] objects[804/1550] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=fireball,DC=local] objects[1206/1550] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=fireball,DC=local] objects[1550/1550] linked_values[0/0]
Analyze and apply schema objects
Partition[CN=Configuration,DC=fireball,DC=local] objects[402/1615] linked_values[0/0]
Partition[CN=Configuration,DC=fireball,DC=local] objects[804/1615] linked_values[0/0]
Partition[CN=Configuration,DC=fireball,DC=local] objects[1206/1615] linked_values[0/0]
Partition[CN=Configuration,DC=fireball,DC=local] objects[1608/1615] linked_values[0/0]
Partition[CN=Configuration,DC=fireball,DC=local] objects[1615/1615] linked_values[28/0]
Replicating critical objects from the base DN of the domain
Partition[DC=fireball,DC=local] objects[97/97] linked_values[28/0]
Partition[DC=fireball,DC=local] objects[365/268] linked_values[28/0]
Done with always replicated NC (base, config, schema)
Replicating DC=DomainDnsZones,DC=fireball,DC=local
Partition[DC=DomainDnsZones,DC=fireball,DC=local] objects[57/57] linked_values[0/0]
Replicating DC=ForestDnsZones,DC=fireball,DC=local
Partition[DC=ForestDnsZones,DC=fireball,DC=local] objects[18/18] linked_values[0/0]
Partition[DC=ForestDnsZones,DC=fireball,DC=local] objects[36/18] linked_values[0/0]
Committing SAM database
Sending DsReplicateUpdateRefs for all the replicated partitions
Setting isSynchronized and dsServiceName
Setting up secrets database
Joined domain FIREBALL (SID S-1-5-21-4124656217-1713613446-3469194152) as a DC
==== 生成された設定ファイルの修正 ====
$ cat /etc/samba/smb.conf
# Global parameters
[global]
workgroup = FIREBALL
realm = fireball.local
netbios name = BLUE-DC2
server role = active directory domain controller
dns forwarder = 192.168.1.10 <- 最初に構築したDCのIPアドレスを追記
idmap_ldb:use rfc2307 = yes <- 追記
printing = bsd <- 追記
[netlogon]
path = /var/lib/samba/sysvol/fireball.local/scripts
read only = No
[sysvol]
path = /var/lib/samba/sysvol
read only = No
===== サービス定義ファイルの作成 =====
$ sudo vi /lib/systemd/system/samba.service
[Unit]
Description=Samba Active Directory Domain Controller Daemon
After=syslog.target network.target named.service
[Service]
Type=forking
PIDFile=/run/samba.pid
LimitNOFILE=16384
EnvironmentFile=-/etc/sysconfig/samba
ExecStart=/usr/sbin/samba $SAMBAOPTIONS
ExecReload=/usr/bin/kill -HUP $MAINPID
ExecStop=/usr/bin/killall samba
[Install]
WantedBy=multi-user.target
===== サービス自動起動設定 =====
$ sudo systemctl enable samba.service
===== サービス起動 =====
$ sudo systemctl start samba.service
===== DC間のレプリケーション動作確認 =====
$ sudo samba-tool drs showrepl
Default-First-Site-Name\BLUE-DC2
DSA Options: 0x00000001
DSA object GUID: 7072208a-a934-4288-8df9-7f6140af0ee0
DSA invocationId: 0cc44a03-f4b5-45e5-9355-d73c65ef8206
==== INBOUND NEIGHBORS ====
DC=DomainDnsZones,DC=fireball,DC=local
Default-First-Site-Name\BLUE-DC via RPC
DSA object GUID: ea201fc1-7580-4e6f-b041-8ee42f472a9a
Last attempt @ Thu Oct 17 06:49:58 2013 JST was successful
0 consecutive failure(s).
Last success @ Thu Oct 17 06:49:58 2013 JST
CN=Schema,CN=Configuration,DC=fireball,DC=local
Default-First-Site-Name\BLUE-DC via RPC
DSA object GUID: ea201fc1-7580-4e6f-b041-8ee42f472a9a
Last attempt @ Thu Oct 17 06:49:58 2013 JST was successful
0 consecutive failure(s).
Last success @ Thu Oct 17 06:49:58 2013 JST
DC=fireball,DC=local
Default-First-Site-Name\BLUE-DC via RPC
DSA object GUID: ea201fc1-7580-4e6f-b041-8ee42f472a9a
Last attempt @ Thu Oct 17 06:49:58 2013 JST was successful
0 consecutive failure(s).
Last success @ Thu Oct 17 06:49:58 2013 JST
CN=Configuration,DC=fireball,DC=local
Default-First-Site-Name\BLUE-DC via RPC
DSA object GUID: ea201fc1-7580-4e6f-b041-8ee42f472a9a
Last attempt @ Thu Oct 17 06:49:58 2013 JST was successful
0 consecutive failure(s).
Last success @ Thu Oct 17 06:49:58 2013 JST
DC=ForestDnsZones,DC=fireball,DC=local
Default-First-Site-Name\BLUE-DC via RPC
DSA object GUID: ea201fc1-7580-4e6f-b041-8ee42f472a9a
Last attempt @ Thu Oct 17 06:49:58 2013 JST was successful
0 consecutive failure(s).
Last success @ Thu Oct 17 06:49:58 2013 JST
==== OUTBOUND NEIGHBORS ====
==== KCC CONNECTION OBJECTS ====
Connection --
Connection name: 4bd1dee9-545a-4ba1-ba73-0926e3fb22e7
Enabled : TRUE
Server DNS name : blue-dc.fireball.local
Server DN name : CN=NTDS Settings,CN=BLUE-DC,CN=Servers,
CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fireball,DC=local
TransportType: RPC
options: 0x00000001
Warning: No NC replicated for Connection!
===== 参考文献 =====
[[http://www.unix-power.net/linux/samba4_secondary.html|CentOS6 Samba4でドメインコントローラを冗長化]]\\
[[https://wiki.samba.org/index.php/Samba4/HOWTO/Join_a_domain_as_a_DC|Samba4/HOWTO/Join a domain as a DC - SambaWiki]]\\