Samba. Ubuntu. User auth at the Ubuntu Samba Server and mount a share using remote user at the remote Active Directory Domain Controller

Links

https://blogs.iuvotech.com/active-directory-authenticated-cifssamba-file-sharing-w/ubuntu-20.04

https://askubuntu.com/questions/1412189/22-04-samba-with-ad-user-cannot-access-from-windows

https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs

Configuring

Server

Install cimponents

sudo apt install -y samba samba-common samba-dsdb-modules samba-vfs-modules winbind libnss-winbind libpam-winbind krb5-config dialog

Configure kerberos

sudo vim /etc/krb5.conf

[libdefaults]
       dns_lookup_kdc = yes
       dns_lookup_realm = yes
       ticket_lifitime = 24h
       renew_lifetime = 7d
       forwardable = true
       rdns = false
       default_realm = domain01.local
       default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
       default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
       permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5

[realms]
       innodev.local = {
               kdc = dv-dc-01.domain01.local
               kdc = dv-dc-02.domain01.local
               admin_server = dv-dc-01.domain01.local
               default_domain  = domain01.local
       }

#[domain_realm]
#       .domain01.local = domain01.local
#       domain01.local = domain01.local
#If incomprehensible bug sssd and oes not see domain users.

[domain_realm]
       .innodev.local = DOMAIN01.LOCAL
       innodev.local = DOMAIN01.LOCAL

[plugins]
       localauth = {
         module = winbind:/usr/lib/x86_64-linux-gnu/krb5/plugins/libkrb5/winbind_krb5_locator.so
         enable_only = winbind
       }

Create share

sudo mkdir -p /data002/sdpr_fileshare

sudo chmod 777 /data002/sdpr_fileshare

Configure Samba, and Winbind

sudo vim /etc/samba/smb.conf

[global]
  log level = 0
  socket options = TCP_NODELAY
  winbind enum users = yes
  winbind enum groups = yes
  winbind refresh tickets = yes
  winbind use default domain = yes
  winbind offline logon = yes
  vfs objects = acl_xattr
  map acl inherit = yes
  store dos attributes = yes
  os level = 20
  preferred master = no
  winbind separator = +
  max log size = 50
  log file = /var/log/samba/log.%m
  dns proxy = no
security = ads
  wins server = dv-dc-01.domain01.local
  wins proxy = no
  idmap config *:backend = tdb
  idmap config * : range = 3000-7999
  idmap config DOMAIN01 : backend = rid
  idmap config DOMAIN01 : schema_mode = rfc2307
  idmap config DOMAIN01 : range = 10000-9999999
  idmap config DOMAIN01 : unix_nss_info = yes
  idmap config DOMAIN01 : unix_primary_group = yes
  kerberos method = secrets and keytab
  dedicated keytab file = /etc/krb5.keytab
  realm = DOMAIN01.LOCAL
  workgroup = DOMAIN01
  password server = dv-dc-01.domain01.local
  load printers = no
  printing = bsd
  printcap name = /dev/null
  disable spoolss = yes

[sdpr_fileshare]
path = /data002/sdpr_fileshare
comment = sdpr_fileshare
create mask = 0777
directory mask = 0777
guest ok = no
read only = no
#public = yes
browseable = yes
inherit acls = no
inherit permissions = no

# domain users and group who allowed to mount the share
# for domain user "avchishko_sv@inno.local" it's necessary to add the following entry to allow share mounting
# (INNO means domain inno.local)
valid users = @"DOMAIN01+D0SDPR_TESTUI1_GRP", @"DOMAIN01+D0SDPR_ADMIN_GRP", "DOMAIN01+d0sdpr-fs-rw-svc", "DOMAIN01+smith_g"

Edit /etc/nsswitch.conf

sudo vim /etc/nsswitch.conf

...
passwd:         files sss winbind systemd
group:          files sss winbind systemd
...

Join the Active Directory Domain

Administrator - user with the admin permissions in the AD DC

sudo net ads join -U Administrator

       // (OR ???)

       // /usr/sbin/realm join --user=Administrator --user-principal="host/{{ ansible_nodename }}.{{ domain | lower }}@{{ domain }}" --computer-ou="{{ computer_ou }}" {{ admin_server }}'

Start services

sudo systemctl enable --now smbd nmbd

sudo systemctl enable --now winbind

After Samba is running, we can query AD for user information:

sudo getent passwd "DOMAIN01\Administrator"

(OR)

sudo getent passwd "avchishko_sv@domain01.local"

    ...
    smith_g@domain01.local:*:1433301252:1433301252:Gabriel Smith (smith_g):/home/smith_g:/bin/bash
    ...

Client

Linux

Install utils

sudo apt install samba-client cifs-utils

View samba server shares

https://askubuntu.com/questions/102924/list-samba-shares-and-current-users

smbclient -L ch-test-fs-srv.innodev.local -U smith_g@domain01.local

    ...
    Enter smith_g@domain01.local's password: <ENTER_PASSWORD>
    ...

    ...
            Sharename       Type      Comment
            ---------       ----      -------
            sdpr_fileshare  Disk      sdpr_fileshare
            IPC$            IPC       IPC Service (Samba 4.13.13-Debian)
    SMB1 disabled -- no workgroup available
    ...

Create mount dir for share    

mkdir -p /mnt/test

Mount

sudo mount -t cifs -o username=smith_g@domain01.local,password=PassWord#1,uid=1433301252,gid=1433301252,rw,noperm //ch-test-fs-srv.domain01.local/sdpr_fileshare /mnt/test/

Windows

Explorer

Share path: \\ch-test-fs-srv.domain01.local\sdpr_fileshare

Login: smith_g@domain01.local

Password: PassWord#1