Poptop MSCHAP2 ADS Howto

9. Samba

FC4 comes with samba v3.0.14a. The samba project released v3.0.20 on 20 August 2005. Here is a quote from the v3.0.20 release note about winbind.

> -- quote --
> Winbindd has been completely rewritten in this release to support an almost completely non-blocking, asynchronous request/reply model. This means that winbindd will scale much better in large domain environments and on high latency networks.
> -- quote --

It is highly recommended to upgrade samba to v3.0.20 or above. The latest samba v3.0.21c rpms for FC4 can be found in here. Download a copy and then update samba with command "rpm -Uvh samba*.rpm".

Note: Samba v3.0.21 has a bug on the oplock code. Avoid this version. Use v3.0.21a or above.

9.1 Configure Samba

No matter you choose to use winbind or freeradius to connect to Active Directory, you will have to configure samba properly. The configuration file of samba is in /etc/samba and is called smb.conf. The file should have at least the following lines.

>     [global]
>     # define the netbios name of the domain
>     workgroup = EXAMPLE
>     # define the pptp server netbios name
>     netbios name = PPTPDSVR
>     # define the AD domain name
>     realm = EXAMPLENET.ORG
>     # server description
>     server string = pptpd Server
>     # printer stuff
>     printcap name = /etc/printcap
>     load printers = no
>     cups options = raw
>     # log file stuff
>     log file = /var/log/samba/%m.log
>     max log size = 50
>     # must set to ads
>     security = ads
>     # address of domain controller
>     password server = 10.0.0.1
>     # enable encrypt passwords
>     encrypt passwords = yes
>     # default setting
>     socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
>     # not to be a master browser
>     domain master = no
>     preferred master = no
>     # address of the WINS server
>     wins server = 10.0.0.1
>     dns proxy = no
>     # require this line to join the domain
>     client use spnego = yes
>     # winbind stuff
>     idmap uid = 50001-550000
>     idmap gid = 50001-550000
>     winbind separator = +
>     winbind nested groups = Yes
>     winbind enum users=yes
>     winbind enum groups=yes
>     template shell = /bin/false
>     winbind use default domain = no

The lines in bold are the important ones that you should pay attention to. Execute "testparm" to check the configuration. Correct any errors before proceeding to the next step.

9.2 Join the AD Domain

Once the Kerberos and Samba are configured, it's time to add the pptpd server to the AD domain.

>     [root@pptp ~]# net ads join -U skwok@EXAMPLENET.ORG "Asiapac/Australia/Sydney/Servers"
>     skwok@EXAMPLENET.ORG's password:
>     Using short domain name -- EXAMPLE
>     Joined 'PPTPDSVR' to realm 'EXAMPLENET.ORG'

The above net ads join command create the server in the container

"OU=Servers,OU=Sydney,OU=Australia,OU=Asiapac,DC=EXAMPLENET,DC=ORG"

The user must have admin right on the container to create the server object. If the operation is successful, you will see a new server object created in the AD.

Another test to see if the trust between the pptpd server and the domain is working is smbclient.

>     [root@pptp ~]# smbclient //dc1/c$ -k
>     OS=[Windows Server 2003 3790 Service Pack 1] Server=[Windows Server 2003 5.2]
>     smb: \> dir
>       AUTOEXEC.BAT                        A        0  Wed Jul 20 10:53:47 2005
>       boot.ini                         AHSR      208  Fri Jul 22 10:41:57 2005
>       CONFIG.SYS                          A        0  Wed Jul 20 10:53:47 2005
>       Documents and Settings              D        0  Fri Jul 22 16:25:51 2005
>       download                            D        0  Thu Aug  4 17:31:28 2005
>       IO.SYS                           AHSR        0  Wed Jul 20 10:53:47 2005
>       MSDOS.SYS                        AHSR        0  Wed Jul 20 10:53:47 2005
>       NTDETECT.COM                     AHSR    47772  Fri Jul 22 10:16:32 2005
>       ntldr                            AHSR   295536  Fri Jul 22 10:16:32 2005
>       pagefile.sys                      AHS 805306368  Fri Aug 12 11:24:27 2005
>       Program Files                      DR        0  Wed Jul 20 10:51:09 2005
>       shared1                             D        0  Thu Jul 21 17:06:28 2005
>       System Volume Information         DHS        0  Fri Jul 22 10:52:09 2005
>       WINDOWS                             D        0  Tue Aug 16 14:33:36 2005
>       wmpub                               D        0  Wed Jul 20 10:55:13 2005

> 39064 blocks of size 524288. 31129 blocks available
> smb: \>

Note: With Samba v3.0.14a or v3.0.20, everytime I run "net ads join", the command crash at the end with message "*** glibc detected *** net: free(): invalid pointer: 0x001cddb0 ***" and then a dump to the screen. The join seems to be working fine though. Samba v3.0.21a does not have this problem.

Next Previous Content