\nsamba-ad-dc\u30b5\u30fc\u30d3\u30b9\u306e\u30de\u30b9\u30af\u3092\u89e3\u9664\u3059\u308b\u3002\n<\/p>\n
\r\n# systemctl unmask samba-ad-dc\r\n<\/pre>\n\n\u307e\u304e\u3089\u308f\u3057\u3044\u30b5\u30fc\u30d3\u30b9\u3092\u7121\u52b9\u5316\u3059\u308b\u3002\n<\/p>\n
\r\n# systemctl disable --now smbd nmbd winbind\r\n# systemctl mask smbd nmbd winbind\r\n<\/pre>\n\n\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u306e\u30d0\u30c3\u30af\u30a2\u30c3\u30d7\u3092\u53d6\u308b\u3002\n<\/p>\n
\r\n# mv \/etc\/samba\/smb.conf \/etc\/samba\/smb.conf.backup\r\n# mv \/etc\/krb5.conf \/etc\/krb5.conf.backup\r\n<\/pre>\n\u30d7\u30e9\u30a4\u30de\u30ea\u30c9\u30e1\u30a4\u30f3\u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u30fc\u306e\u8a2d\u5b9a\u624b\u9806<\/h4>\n
\n\u30c9\u30e1\u30a4\u30f3\u306e\u30d7\u30ed\u30d3\u30b8\u30e7\u30cb\u30f3\u30b0\u3092\u5b9f\u884c\u3059\u308b\u3002
\n\u203b\u2013-use-rfc2307<\/code> (UNIX\u7cfb\u3092\u8a8d\u8a3c\u3059\u308b\u5834\u5408\u306f\u5fc5\u9808)
\n\u203b--interactive<\/code> (\u30bb\u30c3\u30c8\u30a2\u30c3\u30d7\u3092\u5bfe\u8a71\u5f0f\u3067\u884c\u3046)\n<\/p>\n\r\n# samba-tool domain provision --use-rfc2307 --interactive\r\n----------------------------------------\r\nRealm: AD.EXAMPLE.JP\r\nDomain [AD]: EXAMPLE\r\nServer Role (dc, member, standalone) [dc]:\r\nDNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]:\r\nDNS forwarder IP address (write 'none' to disable forwarding) [127.0.0.53]: 8.8.8.8\r\nAdministrator password:\r\nRetype password:\r\n\u2026\r\n<\/pre>\n\n\u3082\u3057\u5b9f\u884c\u4e2d\u306b\u4e0b\u8a18\u30e1\u30c3\u30bb\u30fc\u30b8\u3067\u505c\u6b62\u3057\u3066\u3057\u307e\u3046\u5834\u5408\u306f\u3001samba\u3092purge\u3057\u3066\u3001\/var\/lib\/samba\/\u3092\u524a\u9664\u3057\u3066\u3001samba\u3092\u518d\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u3066\u304b\u3089\u3084\u308a\u76f4\u3059\u3002\n<\/p>\n
\r\nRepacking database from v1 to v2 format (first record CN=FileLinks,CN=System,DC=ad,DC=example,DC=jp)\r\n<\/pre>\n\n\u3067\u304d\u3042\u304c\u3063\u305fkrb5.conf\u3092\u30b3\u30d4\u30fc\u3059\u308b\u3002\n<\/p>\n
\r\n# cp \/var\/lib\/samba\/private\/krb5.conf \/etc\/krb5.conf\r\n<\/pre>\n\nsamba-ad-dc\u30b5\u30fc\u30d3\u30b9\u3092\u6709\u52b9\u5316\u3059\u308b\u3002\n<\/p>\n
\r\n# systemctl enable --now samba-ad-dc\r\n<\/pre>\n\nsystemd-resolved\u304cDNS\u30b5\u30fc\u30d0\u30fc\u306e\u90aa\u9b54\u3092\u3059\u308b\u306e\u3067\u7121\u52b9\u5316\u3059\u308b\u3002\n<\/p>\n
\r\n# systemctl disable --now systemd-resolved\r\n# rm \/etc\/resolv.conf\r\n<\/pre>\n\n\/etc\/resolv.conf\u3092NetworkManager\u306b\u4f5c\u3089\u305b\u308b\u305f\u3081main\u30bb\u30af\u30b7\u30e7\u30f3\u306b\u8ffd\u8a18\u3059\u308b\u3002\n<\/p>\n
\r\n[main]\r\ndns=default\r\n\u2026\r\n<\/pre>\n\nDNS\u3092\u81ea\u5206\u81ea\u8eab\u306b\u5909\u66f4\u3057\u3066\u518d\u8d77\u52d5\u3059\u308b\u3002\n<\/p>\n
\r\n# nmcli connection modify [\u30b3\u30cd\u30af\u30b7\u30e7\u30f3ID] ipv4.dns 127.0.0.1\r\n# shutdown -r now\r\n<\/pre>\n\u30bb\u30ab\u30f3\u30c0\u30ea\u30c9\u30e1\u30a4\u30f3\u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u30fc\u306e\u8a2d\u5b9a\u624b\u9806<\/h4>\n
\n\u53c2\u7167\u3059\u308bDNS\u3092\u30d7\u30e9\u30a4\u30de\u30ea\u306b\u5909\u66f4\u3059\u308b\u3002\n<\/p>\n
\r\n# nmcli connection modify [\u30b3\u30cd\u30af\u30b7\u30e7\u30f3ID] ipv4.dns 192.168.1.11\r\n# nmcli connection up [\u30b3\u30cd\u30af\u30b7\u30e7\u30f3ID]\r\n<\/pre>\n\n\u30c9\u30e1\u30a4\u30f3\u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u30fc\u3068\u3057\u3066join\u3059\u308b\u3002\n<\/p>\n
\r\n# samba-tool domain join ad.example.jp DC -U administrator@example\r\n<\/pre>\n\nsmb.conf\u306eglobal\u30bb\u30af\u30b7\u30e7\u30f3\u306b\u4e0b\u8a18\u3092\u8ffd\u8a18\u3059\u308b\u3002\n<\/p>\n
\r\n\u2026\r\ndns forwarder = [\u30d7\u30e9\u30a4\u30de\u30ea\u3068\u540c\u3058forwarder]\r\nidmap_ldb:use rfc2307 = yes\r\n\u2026\r\n<\/pre>\n\nGPO\u304c\u540c\u671f\u3055\u308c\u306a\u3044\u306e\u3067\u3001\u30bb\u30ab\u30f3\u30c0\u30ea\u5074\u304b\u3089\u30d7\u30e9\u30a4\u30de\u30ea\u306eGPO\u3092\u30b3\u30d4\u30fc\u3059\u308b\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u9069\u5f53\u306b\u66f8\u3044\u305f\u3002GPO\u306e\u5909\u66f4\u306f\u30d7\u30e9\u30a4\u30de\u30ea\u306b\u5bfe\u3057\u3066\u884c\u3046\u904b\u7528\u306b\u3057\u3066\u3001\u5909\u66f4\u5f8c\u306f\u30bb\u30ab\u30f3\u30c0\u30ea\u3067\u4e0b\u8a18\u30b9\u30af\u30ea\u30d7\u30c8\u3092root\u3067\u5b9f\u884c\u3059\u308b\u3088\u3046\u306b\u3059\u308b\u3002\u30b9\u30af\u30ea\u30d7\u30c8\u306b\u306f\u30d1\u30b9\u30ef\u30fc\u30c9\u66f8\u3044\u3066\u304a\u304f\u306e\u3067\u30d1\u30fc\u30df\u30c3\u30b7\u30e7\u30f3\u306f700\u306b\u3059\u308b\u3002\n<\/p>\n
\r\n#!\/bin\/bash\r\nif [ ${EUID:-${UID}} != 0 ]; then\r\n echo "Please run with Root."\r\n exit 1\r\nfi\r\nmount.cifs -V 1>\/dev\/null 2>\/dev\/null\r\nif [ ! $? -eq 0 ]; then\r\n echo "cifs-utils is not installed."\r\n exit 1;\r\nfi\r\ntemporary="\/tmp\/sysvol"\r\ndc="pdc.ad.example.jp"\r\ndomain="example";\r\nuser="administrator";\r\npass="password";\r\nmkdir -p $temporary\r\nmount.cifs -o username=$user@$domain,password=$pass,file_mode=0400,dir_mode=0500 \/\/$dc\/sysvol $temporary\r\nif [ ! $? -eq 0 ]; then\r\n exit 1;\r\nfi\r\ncp -rf $temporary\/* \/var\/lib\/samba\/sysvol\/\r\nsamba-tool ntacl sysvolreset\r\numount $temporary\r\n<\/pre>\n\n\u3053\u3053\u304b\u3089\u30d7\u30e9\u30a4\u30de\u30ea\u3068\u540c\u3058\u624b\u9806\u3002\n<\/p>\n
\r\n# cp \/var\/lib\/samba\/private\/krb5.conf \/etc\/krb5.conf\r\n# systemctl enable --now samba-ad-dc\r\n# systemctl disable --now systemd-resolved\r\n# rm \/etc\/resolv.conf\r\n# sed -i "s\/\\[main\\]\/\\[main\\]\\ndns=default\/g" \/etc\/NetworkManager\/NetworkManager.conf\r\n# nmcli connection modify [\u30b3\u30cd\u30af\u30b7\u30e7\u30f3ID] ipv4.dns 127.0.0.1\r\n# shutdown -r now\r\n<\/pre>\n\u30d5\u30a1\u30a4\u30eb\u30b5\u30fc\u30d0\u30fc\u306e\u8a2d\u5b9a\u624b\u9806<\/h4>\n
\u5171\u6709\u3059\u308b\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3092\u4f5c\u6210\u3059\u308b\u3002
\n\u203broot\u4ee5\u5916\u304c\u30a2\u30af\u30bb\u30b9\u3067\u304d\u306a\u3044\u3088\u3046\u306b\u3059\u308b<\/p>\n
\r\n# mkdir -p \/data\/samba\/share\r\n# chmod 770 \/data\/samba\/share\r\n<\/pre>\nsamba\u306e\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u7de8\u96c6\u3057\u3066\u6700\u4e0b\u884c\u306b\u8ffd\u8a18\u3059\u308b\u3002
\n\u203bLinux\u3078\u306e\u5171\u6709\u304c\u76ee\u7684\u306a\u306e\u3067\u300cWindows ACL\u300d\u306f\u3044\u3089\u306a\u3044
\n\u203b”force user”\u306broot\u3092\u6307\u5b9a\u3057\u3066\u30d5\u30a1\u30a4\u30eb\u64cd\u4f5c\u3092root\u3067\u5b9f\u884c\u3055\u305b\u308b<\/p>\n
\r\n\u2026\r\n[share]\r\npath = \/data\/samba\/share\r\nnt acl support = no\r\ncreate mask = 0660\r\ndirectory mask = 0770\r\nforce user = root\r\nwritable = yes\r\nvalid users = "example\\user1" @"example\\Domain Admins"\r\n<\/pre>\n\nsamba-ad-dc\u30b5\u30fc\u30d3\u30b9\u3092\u518d\u8d77\u52d5\u3059\u308b\u3002\n<\/p>\n
\r\n# systemctl restart samba-ad-dc\r\n<\/pre>\n\u4f7f\u3044\u305d\u3046\u306a\u30b3\u30de\u30f3\u30c9<\/h4>\n
\nDNS\u30ec\u30b3\u30fc\u30c9\u306b\u767b\u9332\u3055\u308c\u3066\u3044\u308bLDAP\u3068Kerberos\u306e\u30b5\u30fc\u30d3\u30b9\u3092\u78ba\u8a8d\u3067\u304d\u308b\u3002\u3053\u306e\u624b\u9806\u3067\u69cb\u7bc9\u3057\u305f\u74b0\u5883\u3067\u5b9f\u884c\u3059\u308b\u30682\u884c\u306e\u30ec\u30b3\u30fc\u30c9\u304c\u8868\u793a\u3055\u308c\u308b\u3002\n<\/p>\n
\r\n# host -t SRV _ldap._tcp.ad.example.jp.\r\n# host -t SRV _kerberos._udp.ad.example.jp.\r\n<\/pre>\n\nDNS\u306e\u66f4\u65b0\u72b6\u6cc1\u3092\u78ba\u8a8d\u3067\u304d\u308b\u3002
\nNo DNS updates needed \u306a\u3089OK\u3089\u3057\u3044\u3002\n<\/p>\n
\r\n# samba_dnsupdate --verbose\r\n<\/pre>\n\n\u30d1\u30b9\u30ef\u30fc\u30c9\u306b\u95a2\u3059\u308b\u30dd\u30ea\u30b7\u30fc\u306e\u78ba\u8a8d\u3068\u5909\u66f4\u304c\u3067\u304d\u308b\u3002\n<\/p>\n
\r\n# samba-tool domain passwordsettings show\r\n# samba-tool domain passwordsettings set --complexity=off\r\n# samba-tool domain passwordsettings set --min-pwd-length=5\r\n# samba-tool domain passwordsettings set --min-pwd-age=30\r\n# samba-tool domain passwordsettings set --max-pwd-age=0\r\n# samba-tool domain passwordsettings set --account-lockout-duration=60\r\n# samba-tool domain passwordsettings set --account-lockout-threshold=3\r\n# samba-tool domain passwordsettings set --reset-account-lockout-after=60\r\n# samba-tool domain passwordsettings set --history-length=5\r\n<\/pre>\n\n\u30e6\u30fc\u30b6\u30fc\u306e\u65b0\u898f\u4f5c\u6210\u3001\u521d\u56de\u30ed\u30b0\u30a4\u30f3\u6642\u306b\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u5909\u66f4\u3055\u305b\u308b\u3002\n<\/p>\n
\r\n# samba-tool user add user1 --must-change-at-next-login\r\n<\/pre>\n\n\u30e6\u30fc\u30b6\u30fc\u306e\u30ed\u30c3\u30af\u72b6\u614b\u3092\u89e3\u9664\u3059\u308b\u3002\n<\/p>\n
\r\n# samba-tool user unlock user1\r\n<\/pre>\n\n\u30e6\u30fc\u30b6\u30fc\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u5909\u66f4\u3057\u3066\u3001\u6b21\u56de\u30ed\u30b0\u30a4\u30f3\u6642\u306b\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u5909\u66f4\u3055\u305b\u308b\u3002\n<\/p>\n
\r\n# samba-tool user setpassword user1 --must-change-at-next-login\r\n<\/pre>\n\n\u30e6\u30fc\u30b6\u30fc\u3092\u30b0\u30eb\u30fc\u30d7\u306b\u8ffd\u52a0\u3059\u308b\u3002\n<\/p>\n
\r\n# samba-tool group addmembers "Domain Admins" user1\r\n<\/pre>\n\n\u30c9\u30e1\u30a4\u30f3\u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u30fc\u306e\u964d\u683c\u3002\n<\/p>\n
\r\n# samba-tool domain demote --remove-other-dead-server=[\u30db\u30b9\u30c8\u540d]\r\n<\/pre>\n\nFSMO\u3092\u78ba\u8a8d\u3067\u304d\u308b\u3002\n<\/p>\n
\r\n# samba-tool fsmo show\r\n<\/pre>\n\nFSMO\u306e\u79fb\u884c\u3002\u8ee2\u9001\u5148\u30b5\u30fc\u30d0\u30fc\u3067\u4e0b\u8a18\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3059\u308b\u3002\n<\/p>\n
\r\n# samba-tool fsmo transfer --role all\r\n<\/pre>\n\nDNS\u30ec\u30b3\u30fc\u30c9\u3092\u78ba\u8a8d\u3059\u308b\u3002\n<\/p>\n
\r\n# samba-tool dns query localhost ad.example.jp. @ ALL -U Administrator\r\n<\/pre>\n\nDNS\u30ec\u30b3\u30fc\u30c9\u3092\u524a\u9664\u3059\u308b\u3002\u307e\u308c\u306bDNS\u30ec\u30b3\u30fc\u30c9\u306eIP\u30a2\u30c9\u30ec\u30b9\u304c\u4e00\u5207\u66f4\u65b0\u3055\u308c\u306a\u304f\u306a\u308b\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u304c\u3042\u308b\u3002\u4e0b\u8a18\u3092\u5b9f\u884c\u3057\u3066\u53e4\u3044DNS\u30ec\u30b3\u30fc\u30c9\u3092\u524a\u9664\u3059\u308b\u3068\u305d\u306e\u3046\u3061\u76f4\u308b\u3002\n<\/p>\n
\r\n# samba-tool dns delete localhost ad.example.jp. client01 A 192.168.1.222 -U Administrator\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"\u524d\u63d0\u6761\u4ef6 \u203b\u30d7\u30e9\u30a4\u30de\u30ea(192.168.1.11)\u3068\u30bb\u30ab\u30f3\u30c0\u30ea(192.168.1.12)\u306e2\u53f0\u3092\u8a2d\u5b9a \u203bddns\u306f\u5225\u306ebind\u30b5\u30fc\u30d0\u30fc\u304c\u62c5\u3046\u306e\u3067\u8a2d\u5b9a\u3057\u306a\u3044 \u203bntp\u30b5\u30fc\u30d0\u30fc\u306f\u5916\u90e8\u306e\u3082\u306e\u3092\u4f7f\u3046\u306e\u3067\u8a2d\u5b9a\u3057\u306a\u3044 \u203b\u30d7\u30e9\u30a4\u30de\u30ea […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-2725","post","type-post","status-publish","format-standard","hentry","category-ubuntu"],"views":2431,"_links":{"self":[{"href":"https:\/\/weblog.hirohiro716.com\/index.php?rest_route=\/wp\/v2\/posts\/2725","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/weblog.hirohiro716.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/weblog.hirohiro716.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/weblog.hirohiro716.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/weblog.hirohiro716.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2725"}],"version-history":[{"count":47,"href":"https:\/\/weblog.hirohiro716.com\/index.php?rest_route=\/wp\/v2\/posts\/2725\/revisions"}],"predecessor-version":[{"id":2857,"href":"https:\/\/weblog.hirohiro716.com\/index.php?rest_route=\/wp\/v2\/posts\/2725\/revisions\/2857"}],"wp:attachment":[{"href":"https:\/\/weblog.hirohiro716.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2725"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/weblog.hirohiro716.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2725"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/weblog.hirohiro716.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2725"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}