FreeBSD: Installing a Samba file server in a Windows domain (Active Directory)

Practice

Task: set up a file server based on Samba on an existing FreeBSD system. It needs to be part of the domain and allow domain users from Windows OS to log in.

Enabling ACLs

Make sure the disk that will hold the shared resources is not mounted, and run the command:

$ sudo tunefs -a enable /dev/ad1s1

where instead of /dev/ad1s1 you specify the disk and slice where our shared resources will be located.

If the shared resources will be on the system disk - i.e., you can't unmount it while the system is running - then you'll have to go to the server, boot into "Single mode", and only then run this command (tunefs is available from Single mode - confirmed).

Installing Kerberos

$ cd /usr/ports/security/heimdal
$ sudo make install clean

In the settings window that pops up, if we're not using IPv6, disable it. To be able to work with OpenLDAP using Kerberos - check the corresponding box.

Now go to /etc and create a krb5.conf file that looks like this:

[libdefaults]
default_realm = MYDOMAIN.RU
clockskew = 300
v4_instance_resolve = false
v4_name_convert = {
host = {
rcmd = host
ftp = ftp
}
plain = {
something = something-else
}
}

[realms]
MYDOMAIN.RU = {
kdc = pdc.mydomain.ru
admin_server = pdc.mydomain.ru
default_domain = mydomain.ru
}
OTHER.REALM = {
v4_instance_convert = {
kerberos = kerberos
computer = pdc.mydomain.ru
}
}

[domain_realm]
.mydomain.ru = MYDOMAIN.RU

here

instead of MYDOMAIN.RU and mydomain.ru, enter your own domain name
in the kdc option, replace pdc.mydomain.ru with the network name or IP of your domain controller (a single one)
in the admin_server option, replace pdc.mydomain.ru with the network name or IP of your domain controller (a single one). You can use the same name as in kdc
in the computer option, replace pdc.mydomain.ru with the network name or IP of your domain controller (a single one)

Synchronizing time

For authentication to succeed, the time on the FreeBSD server and on the Windows domain controllers must be in sync - this is a mandatory requirement, and failing to meet it risks the domain controller refusing to grant permissions.

$ sudo ntpdate pdc.mydomain.ru

where instead of pdc.mydomain.ru specify the network name or IP of your domain controller.

Let's check

$ sudo kinit -p domainadminuser

where instead of domainadminuser you enter the domain administrator's login (if that's you, enter your own login). You don't need to specify "@MYDOMAIN" or "MYDOMAIN\"!

You'll be prompted for the password for this user — enter it. If everything is fine, the system simply won't say anything. Otherwise it will report an error.

Let's check further:

$ sudo klist
Credentials cache: FILE:/tmp/krb5cc_0
Principal: mydomainadmin@MYDOMAIN.RU

Issued Expires Principal
Sep 13 18:23:49 Sep 14 04:23:49 krbtgt/MYDOMAIN.RU@MYDOMAIN.RU

If the response looks like the one above, then we're doing everything right and can continue.

Configuring nsswitch

Now let's go to /etc and edit the nsswitch.conf file. Leave only the following entries in it:

passwd: files winbind
group: files winbind
hosts: files dns

Now let's install Samba

$ cd /usr/ports/net/samba35
$ sudo make install clean

Actually, your latest Samba version may no longer be 3.5 (samba35), but higher. Accordingly, the directory name might be slightly different.

In the configurator I selected the following options (note that I did not enable the CUPS print server on this SAMBA server, so I did not specify the CUPS option):

LDAP
ADS
WINBIND
SWAT
ACL_SUPPORT
FAM_SUPPORT
SYSLOG
QUOTAS
PAM_SMBPASS
PORT

Enable SWAT if you want to be a bit lazy and configure SAMBA through the web console. ;)

During compilation you may be asked a few more times to "select options".

Now let's go to /etc and open the rc.conf file for editing. Here are the lines you need to add or make sure are present:

inetd_enable="YES"
nmbd_enable="YES"
smbd_enable="YES"
winbindd_enable="YES"

Open the inetd.conf file (located in the same place — in /etc) and uncomment the following line:

swat stream tcp nowait/400 root /usr/local/sbin/swat swat

Reboot the server (you can also start each service manually, but if you have the chance to reboot, let's not pass it up):

$ sudo reboot

Configuring Samba

Since we're lazy and enabled SWAT in the inetd settings, and enabled inetd itself, we won't configure things via the config file (which, by the way, is located at "/usr/local/etc/smb.conf"), but through the web console.

Yes indeed, Samba has a web management console called SWAT. To access it, type into the browser address bar:

http://192.168.0.1:901

where instead of 192.168.0.1 you enter the server's IP address, enter the login "root" and the root password for this server - and you're in the management console.

Through this management console we set the necessary parameters and save them using the "Commit" button (or "Сохранить", if, like in my case, SWAT showed its Russian side).

Configuration example

So, let's go to the "Wizard" tab.

Set the server type to "Domain Member".
Configure WINS as: "Do not use" or "WINS Server client".
Remote WINS Server: Specify the WINS server for your domain (if you have one). In this case "Configure WINS as" should be "WINS Server client".
Make home directories available: No (why would users need to see the /home/... folders of the FreeBSD server's users).

Click "Сохранить" (Save).

Now let's go to the "GLOBALS" tab and set the necessary parameters. I recommend choosing "Advanced" mode - there's a certain set of options that need to be changed but that aren't visible in "Basic" mode.

Here's what I have set on this page (I've listed only the main parameters):

dos charset = CP866
unix charset = KOI8-R (here you set the encoding that is used on your FreeBSD server. That is, if you use UTF-8 in the console, then set UTF-8)
display charset = CP866
workgroup = MYDOMAIN (here you specify the name of your domain)
realm = MYDOMAIN
netbios name = MYSERVER (server name)
netbios aliases =
netbios scope =
server string = Samba Server (here you can write whatever you like - the server name, for example, or its description)
interfaces =
bind interfaces only = No (specify the interfaces you need to listen on for Samba traffic in "interfaces", and set this option to Yes if you want to restrict the shared-folder server to a specific network card only)
security = DOMAIN
auth methods = winbind
encrypt password = Yes
update encrypted = Yes
client schannel = Auto
server schannel = Auto
allow trusted domains = Yes
map to guest = Never
null passwords = No
obey pam restrictions = No
password server = * (or specify the IP address of the domain controller)
smb passwd file = /usr/local/etc/samba/smbpasswd
private dir = /usr/local/etc/samba
passdb backend = tdbsam
algoriphmic rid base = 100
root directory =
guest account = nobody
enable privilages = Yes
pam password change = No
passwd program =
check password script =
username map =
password level = 0
username level = 0
user password sync = No
restrict anonymous = 0
lanman auth = No
ntlm auth = Yes
NTLMv2 auth = No (by the way, there can be problems with WS2008R2 domains if you enable this parameter - based on information from forums)
client lanman auth = No
client plaintext auth = No
client use spnego principal = No
invalid users = (here you can specify which users and groups are not allowed to work with Samba at the global level, i.e. at all; comma-separated list, group names start with an at sign @)
valid users = (if empty - it doesn't restrict anything, otherwise here you can specify the users and groups that alone are allowed to work with the server - others will not be able to)
admin users = (here are listed the users and groups granted admin rights - they can do anything in Samba)
read list = (users listed here are given read-only access)
write list = (users listed here are given read and write access)
acl check permissions = Yes
acl group control = Yes
acl map full control = Yes
create mask = 0744 (mask for files created in folders)
security mask = 0777 (mask of the attributes that a Windows user can change via the usual "Security" window in Explorer. 0777 means the user can change all attributes)
directory mask = 755 (mask for folders being created)
directory security mask = 0777 (same as security mask - for directories)
force unknown acl user = Yes (allows displaying the user/group "Unknown" in the "Security" window of Windows Explorer if the file was created not through Samba but directly on the server by a user who doesn't show up through Samba authorization - for example, a local user of the server itself)
hosts allow = (if empty, nothing is denied; otherwise you can specify IP addresses or networks here that are allowed to work with Samba — other computers (not in this list) will not be allowed)
hosts deny = (here you can specify IP addresses or networks of computers that are not allowed to work with Samba)
kerberos method = default
map untrusted to domain = No
max protocol = NT1 (you can set this to SMB2 — this is the protocol most compatible with Windows Vista and above, but it is still in "experimental" mode)
min protocol = CORE
ea support = No (we don't need access from OS/2)
nt acl support = Yes (but we do need Windows ACLs)
nt pipe support = Yes
nt status support = Yes
profile acls = No (should only be enabled for Windows 2000 and Windows XP without a Service Pack — i.e. not needed)
anounce as = NT
map acl inherit = Yes (actually a useful option — when enabled, ACLs, i.e. permissions, get inherited, just as they do in Windows itself... however, the Samba developers state that this option only works on Linux. Unfortunately, at the time of writing this article I hadn't yet had a chance to verify that fact)
case sensetive = No (since Windows doesn't distinguish between uppercase and lowercase letters, Samba shouldn't either)
hide dot files = Yes (hide — i.e. don't show to Windows clients — files whose names start with a dot, i.e. the files traditionally considered hidden on Unix)
hide unwritable files = No (an amusing option that lets you avoid showing users files they don't have write access to)
map archive = Yes (pass the "Archive" attribute through to the standard Explorer dialog)
map hidden = No (same thing — for "Hidden")
map system = No (same thing — for "System")
map readonly = Yes (same thing — for "Read-only")
idmap uid = 10000-20000 (the UID range that lets Idmap map domain users onto local ones — it won't work without this. It must not overlap with the range of locally used UIDs — see /etc/passwd)
idmap gid = 10000-20000 (the GID range that lets Idmap map domain groups onto local ones — it won't work without this. It must not overlap with the range of locally used GIDs — see /etc/group)

If needed, you can read the help for each option (in English) by clicking the "Help" link next to the option.

Then click "Save Changes".

Now go to the "STATUS" tab and restart all related daemons with the "Restart All" button.

PS. Configure everything carefully. For instance, not specifying winbind as the authentication service (the auth methods parameter), or not specifying the UID and GID range for Idmap... or some other slip-up - and you'll be in for a dance with authentication.

Joining the server to the domain

Run:

$ sudo net ads join -U domainadminuser
Using short domain name -- MYDOMAIN
Joined 'SERVERNAME' to realm 'mydomain'

here, instead of domainadminuser enter the domain administrator's login.

Note. The winbindd service may fail to start beforehand because the computer hadn't been joined to the domain yet. So after you add it to the domain - start this service manually (even via SWAT, if nothing else).

Let's check that we've joined the domain successfully and that winbind is working properly:

$ sudo wbinfo -t
checking the trust secret for domain MYDOMAIN via RPC calls succeeded

Now let's check that winbind sees the users and groups in the domain, and also test authentication:

$ sudo wbinfo -u
$ sudo wbinfo -g
$ sudo wbinfo -a domainuser%mysuperpassword

Creating shared resource folders

In the console, navigate to the directory where the shared resources are kept and create a new folder. This folder will be used as the storage for the shared resource - i.e. it's exactly where the files and sub-folders of the new share will live.

For example

$ cd /sharesdisk
$ sudo mkdir share1
$ sudo chmod 777 share1

As you can see, we gave write permission to this directory to everyone, from the Unix server's side. This is necessary - without it, you can't do anything inside the directory through Samba.

Let's go back to SWAT and switch to the SHARES tab. Here you can create shared resources. It's all fairly simple and clear.

To create a resource - enter its name (as it will appear when connecting to the server over the network from Windows) and click "Create Resource"

Next, we specify the resource parameters.

comment : Comments
path : Path to the directory on the FreeBSD server — the folder created above
invalid users : Users who are not allowed to work with this resource
valid users : If not specified, nothing is restricted (everyone can view it); otherwise you can list here the users and groups who alone are allowed to enter this folder (for example, "director, @buhgalteria")
admin users : Users with maximum privileges — administrators
read list : These users and groups can only read files, but cannot write to them (or to folders)
write list : Users and groups with Read-Write permissions.
read only : The resource is in "Read only" mode. Note that for users on the "read list" and "write list" this parameter doesn't matter — Samba ignores "read only" for them.
acl group control : Whether to enable ACL support
force unknown acl user : lets the user/group be shown as "Unknown" in the Windows Explorer "Security" dialog if the file was created not through Samba, but directly on the server by a user who doesn't show up via Samba authorization — for example, a local user of the server itself
guest ok : whether to allow "guests", i.e. unauthorized users, to log in
hosts allow : allow access only from the listed computers or networks (restricts nothing if the parameter is empty)
hosts deny : deny access from the listed computers or networks
map acl inherit : Inherit access permissions from the parent object
case sensetive : Whether to be case-sensitive for file and folder names (I recommend turning this off — Windows isn't case-sensitive anyway)
browsable : show the folder when browsing the server via Network Neighborhood (analogous to the Windows sharename$)
access based share enum : If enabled, when browsing the server, the folder will only be visible in Explorer to users who can actually access it (have read or write permissions). This is the equivalent of the option introduced in WS2008. In other words, users who would be denied entry to the folder anyway due to insufficient permissions simply won't see it.
available : Enable or disable this shared resource. In other words, you can temporarily disable the folder without removing its declaration from Samba.

After that, save the resource.

Let's check

Now, in Windows Explorer, we type in our server's address and we should see the folder we created, just as if we had connected to a computer running Windows.