10.0.0.10 Centos7 1708 64 bit

10.0.0.11 Win 10 RSAT

首先修改一下主機名

[root@localhost ~]# vi /etc/hostname

dc01.contoso.com

[root@locahost ~]# vi /etc/hosts

127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4

::1 localhost localhost.localdomain localhost6 localhost6.localdomain6

10.0.0.10 dc01.contoso.com dc01

保存以後可以重啟一下，然後掛載光盤，用它做源來安裝一些依賴。

首先可以安裝development tools

[root@dc01 ~]# cd /etc/yum.repos.d/

[root@dc01 yum.repos.d]# mkdir /media/cdrom

[root@dc01 yum.repos.d]# mount /dev/cdrom /media/cdrom

[root@dc01 yum.repos.d]# yum -y --enablerepo=c7-media groupinstall "development tools"

再安裝一些samba需要的包，有一些不是必須，遇到./configure不行就要增加。

[root@dc01 yum.repos.d]# yum -y --enablerepo=c7-media install perl gcc attr libacl-devel libblkid-develgnutls-devel readline-devel python-devel gdb pkgconfig krb5-workstation zlib-devel setroubleshoot-server libaio-devel setroubleshoot-plugins policycoreutils-python libsemanage-python perl-ExtUtils-MakeMaker perl-Parse-Yapp perl-Test-Base popt-devel libxml2-devel libattr-develv keyutils-libs-devel cups-devel bind-utils libxslt docbook-style-xsl openldap-devel autoconf pam-devel python2-crypto libtomcrypt libtommath libidn-devel libpcap-devel cups libgnutls-dev gnutls-devel

把下載的samba源碼包上傳到/tmp文件夾，也可以通過wget下載。

[root@dc01 yum.repos.d]# cd /tmp

[root@localhost tmp]# ls

samba-4.8.2.tar.gz

[root@dc01 tmp]# tar -xvf samba-4.8.2.tar.gz

[root@dc01 tmp]# cd samba-4.8.2/buildtools/scripts/

[root@dc01 scripts]# ./autogen-waf.sh

[root@dc01 scripts]# cd /tmp/samba-4.8.2

[root@dc01 samba-4.8.2]# ./configure

[root@dc01 samba-4.8.2]# make && make install

註釋掉/etc/krb5.conf的includedir這行，否則提升域控會報錯。

[root@dc01 samba-4.8.2]# vi /etc/krb5.conf

#includedir /etc/krb5.conf.d/

[root@DC01 ~]# cd /usr/local/samba/bin

[root@DC01 bin]# ./samba-tool domain provision --use-rfc2307 --interactive

Realm [CONTOSO.COM]:

Domain [CONTOSO]:

Server Role (dc, member, standalone) [dc]:

DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]:

DNS forwarder IP address (write 'none' to disable forwarding) [10.0.0.20]: none

Administrator password:Aa123456

Retype password:Aa123456

Looking up IPv4 addresses

More than one IPv4 address found. Using 10.0.0.10

Looking up IPv6 addresses

No IPv6 address will be assigned

Setting up share.ldb

Setting up secrets.ldb

Setting up the registry

Setting up the privileges database

Setting up idmap db

Setting up SAM db

Setting up sam.ldb partitions and settings

Setting up sam.ldb rootDSE

Pre-loading the Samba 4 and AD schema

Unable to determine the DomainSID, can not enforce uniqueness constraint on local domainSIDs

Adding DomainDN: DC=contoso,DC=com

Adding configuration container

Setting up sam.ldb schema

Setting up sam.ldb configuration data

Setting up display specifiers

Modifying display specifiers and extended rights

Adding users container

Modifying users container

Adding computers container

Modifying computers container

Setting up sam.ldb data

Setting up well known security principals

Setting up sam.ldb users and groups

Setting up self join

Adding DNS accounts

Creating CN=MicrosoftDNS,CN=System,DC=contoso,DC=com

Creating DomainDnsZones and ForestDnsZones partitions

Populating DomainDnsZones and ForestDnsZones partitions

Setting up sam.ldb rootDSE marking as synchronized

Fixing provision GUIDs

A Kerberos configuration suitable for Samba AD has been generated at /usr/local/samba/private/krb5.conf

Merge the contents of this file with your system krb5.conf or replace it with this one. Do not create a symlink!

Setting up fake yp server settings

Once the above files are installed, your Samba AD server will be ready to use

Server Role: active directory domain controller

Hostname: DC01

NetBIOS Domain: CONTOSO

DNS Domain: contoso.com

DOMAIN SID: S-1-5-21-4094272009-52109158-380737006

添加防火墻規則

[root@DC01 bin]# firewall-cmd --add-port=53/tcp --permanent;firewall-cmd --add-port=53/udp --permanent;firewall-cmd --add-port=88/tcp --permanent;firewall-cmd --add-port=88/udp --permanent; \

> firewall-cmd --add-port=135/tcp --permanent;firewall-cmd --add-port=137-138/udp --permanent;firewall-cmd --add-port=139/tcp --permanent; \

> firewall-cmd --add-port=389/tcp --permanent;firewall-cmd --add-port=389/udp --permanent;firewall-cmd --add-port=445/tcp --permanent; \

> firewall-cmd --add-port=464/tcp --permanent;firewall-cmd --add-port=464/udp --permanent;firewall-cmd --add-port=636/tcp --permanent; \

> firewall-cmd --add-port=1024-5000/tcp --permanent;firewall-cmd --add-port=3268-3269/tcp --permanent

success

success

success

success

success

success

success

success

success

success

success

success

success

success

success

[root@DC01 bin]# firewall-cmd --reload

success

[root@DC01 bin]#

增加一個samba的服務文件。

[root@DC01 bin]# vi /etc/systemd/system/samba.service

[Unit]

Description= Samba 4 Active Directory

After=syslog.target

After=network.target

[Service]

Type=forking

PIDFile=/usr/local/samba/var/run/samba.pid

ExecStart=/usr/local/samba/sbin/samba

[Install]

WantedBy=multi-user.target

啟動samba

[root@DC01 bin]# systemctl enable samba

Created symlink from /etc/systemd/system/multi-user.target.wants/samba.service to /etc/systemd/system/samba.service.

[root@DC01 bin]# systemctl start samba

然後就用一臺WIN10的虛擬機設置同網段IP，DNS指向10.0.0.10，就能加入域，重啟用contoso\administrator和設置的密碼Aa123456登錄，下載安裝RSAT就能連接管理域了。

用源碼編譯安裝Samba 4.8.2做域控