{"id":220,"date":"2020-09-26T13:32:33","date_gmt":"2020-09-26T13:32:33","guid":{"rendered":"https:\/\/dft.wiki\/?p=220"},"modified":"2021-04-16T22:25:17","modified_gmt":"2021-04-16T22:25:17","slug":"linux-as-domain-controller-ad","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=220","title":{"rendered":"Linux as Active Directory \/ Domain Controller (AD-DC) Principal"},"content":{"rendered":"

This is how to create one Linux (Ubuntu 18.04 LTS) Domain Controller to work as a Windows Server Active Directory.<\/p>\n

Lets make few assumptions and clarify something before the start:<\/p>\n

Be aware that in some moments the domain or the machine name has to be in ‘UPPERCASE<\/strong>‘ and other moments in ‘lowercase<\/strong>‘.<\/p>\n

For this example, we will use<\/strong> the domain ‘company.com<\/strong>‘ and the server will have the name ‘srv<\/strong>‘.<\/p>\n

Start issuing the commands:<\/p>\n

sudo apt update && sudo apt upgrade -y\r\nsudo passwd root\r\nsudo hostnamectl set-hostname srv<\/span><\/span><\/pre>\n
At this point create one password for the user ‘root<\/strong>‘, because you will have to proceed as ‘su<\/strong>‘ instead of the command ‘sudo<\/strong>‘. Then switch to root user:<\/p>\n
su\r\napt-get install samba krb5-config winbind net-tools smbclient -y<\/pre>\n
Three questions will popup. Answer the domain name in UPPERCASE:<\/p>\n
COMPANY.COM<\/pre>\n
Than answer twice<\/strong> in lowercase<\/strong> the FQDN for the server of your domain:<\/p>\n
srv.company.com<\/pre>\n
Issue the command below, but replace the IP ‘10.0.2.254<\/strong>‘ with your ‘srv<\/strong>‘ IP and domain name:<\/p>\n
echo '10.0.4.254 srv srv.company.com' >> \/etc\/hosts<\/pre>\n
Issue the commands to start a new Samba configuration:<\/p>\n
mv \/etc\/samba\/smb.conf \/etc\/samba\/smb.conf.bkp\r\nsamba-tool domain provision<\/pre>\n
\"\"<\/figure>\n
Follow the steps from the image above. For the DNS Forward, we are going to use the Google Public DNS Server (‘8.8.8.8<\/strong>‘). Then set the password to the user ‘Administrator<\/strong>‘ of the Active Directory, and you may get the same result:<\/p>\n
\"\"<\/figure>\n
Here the Samba configuration starts:<\/p>\n
cp \/var\/lib\/samba\/private\/krb5.conf \/etc\/\r\nsystemctl disable --now smbd nmbd winbind systemd-resolved\r\nsystemctl unmask samba-ad-dc.service\r\nsystemctl enable --now samba-ad-dc.service\r\nsamba-tool domain level show<\/pre>\n
\"\"<\/figure>\n
rm \/etc\/resolv.conf\r\necho 'nameserver 127.0.0.1' >> \/etc\/resolv.conf<\/pre>\n
DONE! Now check that everything is working properly:<\/p>\n
Go to the client computer (Windows or Linux) and change the DNS server to the IP address of your server (in my example was 10.0.2.254<\/strong>).<\/p>\n
Then go to the command prompt and try to ping ‘srv.company.com<\/strong>‘, ‘company.com<\/strong>‘, ‘srv<\/strong>‘, and ‘google.com<\/strong>‘.<\/p>\n
If all the ping were resolved and the pings went through, go ahead and try to join the computer to de domain.<\/p>\n
Now joining the computers to the domain and create users in the AD.<\/p>\n
Most popular commands of commands:<\/p>\n
sudo samba-tool user list\r\nsudo samba-tool user create UserName\r\nsudo samba-tool user delete UserName\r\nsudo samba-tool user disable UserName\r\nsudo samba-tool user enable UserName\r\nsudo samba-tool user setpassword UserName\r\nsudo samba-tool user setexpiry UserName --days=30\r\nsudo samba-tool group list\r\nsudo samba-tool group listmembers GroupName\r\nsudo samba-tool group add GroupName\r\nsudo samba-tool group delete GroupName\r\nsudo samba-tool group addmembers GroupName UserName\r\nsudo samba-tool group removemembers GroupName UserName\r\nsudo samba-tool computer list<\/pre>\n
Few other commands for special requests:<\/p>\n
sudo samba-tool group add \u2013h\r\nsudo samba-tool user add -h\r\nsudo samba-tool user add domainName --given-name=givenName --surname=surName --mail-address=userName@example.com --login-shell=\/bin\/bash\r\nsudo samba-tool domain passwordsettings show\r\nsudo samba-tool domain passwordsettings set -h\r\nsudo samba-tool gpo listall\r\nsudo samba-tool drs showrepl\r\nsudo samba-tool dns -help\r\nsudo samba-tool dns query 10.0.0.1 example.com zone A -U Administrator\r\nsudo samba-tool dns zonecreate domain.local 0.0.10.in-addr.arpa -U Administrator\r\nsudo samba-tool processes\r\nsudo samba-tool visualize ntdsconn\r\nsudo samba-tool visualize reps<\/pre>\n
Wouldn’t be complete without the\u00a0Remote Server Administration Tools for Windows 10<\/strong> [Link<\/a>].<\/p>\n","protected":false},"excerpt":{"rendered":"
This is how to create one Linux (Ubuntu 18.04 LTS) Domain Controller to work as […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,6],"tags":[],"class_list":["post-220","post","type-post","status-publish","format-standard","hentry","category-linux","category-raspberry-pi"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/220","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=220"}],"version-history":[{"count":15,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/220\/revisions"}],"predecessor-version":[{"id":1955,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/220\/revisions\/1955"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=220"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=220"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}