Active Directory Services (Hosting SAMBA on Linux Server)

I've always wanted to do magic. On clicking a button, all computers should display the same wallpaper on reboot. And, Yup! I did it (not in production of-course, Windows Licenses aren't cheap)

I installed Windows (trial) on five test-bed computers and added them to a domain created using Samba and two Domain Controllers. I Implemented group policies, apps to start on boot, theming, Windows Defender Options, Drive Maps, etc., etc. and etc. It was really fun.

image.png

Setting Up the Primary Domain Controller

Setting Up a Fail-over Domain Controller

Domain Controller Replication

image.png

Samba Internal DNS and dnsmasq?

Samba and other DNS Services on the same server just don't get along, until forced. Samba is really really keen in listening on port 389 and others (for AD) and DNS on 53.

As Samba integrates either with Internal DNS or with Bind9, I assigned two IPs to my Server made SAMBA listen on one (assume 10.0.0.31) and dnsmasq (Pi-Hole) on the other (assume 10.0.0.51). Both at port 53.

As mentioned in this post, I have three DNS Servers, One of them is this and the other is the secondary domain controller and the third is the Primary DNS Server which is bare-metal. Then, I setup all devices to use the Samba DNS Endpoints (on both DCs) and the Primary DNS Server by adding DHCP Options on the DHCP Server, which is my primary router.

image.png

Now, Samba DNS Endpoints resolve all AD Domain computers but neither my internal domains nor Google, YouTube, etc. To Fix this (remember I had deployed the dnsmasq instance on the same server with another IP - 10.0.0.51) I configured Samba to use 10.0.0.51 as the DNS by using the dns forwarder = 10.0.0.51 directive. It works.

You can assign multiple IPs to an Interface on Ubuntu 18.04 and above by editing the netplan configuration at /etc/netplan/00-installer-config.yml

/etc/samba/smb.conf
/etc/dnsmasq.d/99-bind-interface.conf
# Global parameters
[global]
	dns forwarder = 10.0.0.51
    interfaces = 10.0.0.31
    bind interfaces only = yes
	netbios name = ***
	realm = ***.ATHEESH.ORG
	server role = active directory domain controller
	workgroup = ***
	idmap_ldb:use rfc2307 = yes

[sysvol]
	path = /var/lib/samba/sysvol
	read only = No

[netlogon]
	path = /var/lib/samba/sysvol/login.atheesh.org/scripts
	read only = No

[Share001]
	path = /media/datadrive/***
	read only = No
	writeable = yes
	browseable = yes
	create mask = 0644
	directory mask = 0755
	valid users = @"DOMAIN\***"
	admin users = @"DOMAIN\***"

[Share002]
	path = /media/datadrive/***
	read only = No
        writeable = yes
        browseable = yes
        create mask = 0644
        directory mask = 0755
        valid users = @"DOMAIN\***"
        admin users = @"DOMAIN\***"

[Share003]
	path = /media/datadrive/***
	read only = No
        writeable = yes
        browseable = yes
        create mask = 0644
        directory mask = 0755
        valid users = @"DOMAIN\***"
        admin users = @"DOMAIN\***"
bind-interfaces
listen-address=10.0.0.51















































Revision #11
Created 7 July 2022 08:44:32 by Atheesh
Updated 10 July 2022 16:09:10 by Atheesh