Preface
I have been waiting for a long time to write this post. In order to test this out, I needed to upgrade my home lab. I had a VM machine running XCP-NG (I tried Proxmox, it’s just not the same), but it had an old dual core Intel and 8GB of ram, so not much I could do with other than host a good single VM… which is pointless, the server might as well be the function of that single VM. So recently I was able to upgrade my main system to a Ryzen 5 5600X with a new mobo, RAM, and PSU, so I figured I would use my old Ryzen 5 1600X in the server. So now I have 6 cores which translated to 12 Threads (each of which can be used as a virtual CPU), 32GB of RAM, and more then enough resources to make a few VMs with multiple purposes. The first of which of course was a Linux based Active Directory.
Video
https://www.youtube.com/watch?v=KT6O-TfJ41g
Prerequisites
- Ubuntu Server (20.04/22.04)
- A user account with sudo privileges
- A Windows 10 PRO computer on the same network
- A Linux Desktop on the same server (Fedora or Ubuntu based)
In this example will be using Ubuntu 22.04 Server for the Active Directory. We will be connecting to it with a Windows 10 PRO client as well as Fedora as the Linux based client
DC Server Setup
Set the Server Hostname
For this demonstration we will be using the hostname dc1 for the Ubuntu server
Add Server to Hosts File
We will also need to modify the hosts file, add the following line to /etc/hosts
Verify Hostname
You can quickly verify everythign worked with the following command
Disable the DNS Resolver
Disable the DNS Resolver and unlink the config
Create our own Resolv.conf
Enter the following into /etc/resolv.conf
Make the file immutable
As we do not want anything to change this file automatically, we make it immutable so that it does not get modified
Installing Samba
Enter the appropriate info
Disable Samba Services
Activate samba-ad-dc
Configuring Samba Active Directory
First backup the original smb.conf file
Provision the Active Directory
Enter the following info
- On Realm prompte – <Enter>
- On Domian Promp – <Enter>
- On Server Roll – <Enter>
- On DNS Backend – <Enter>
- DNS Forwarding IP – 9.9.9.9
- Enter an Admin Password
Backup and replace the Kerberos Config
Start samba-ad-dc
Set up Time Synchronization
Set permissions
Update Chrony
add the following to /etc/chrony/chrony.conf
Verifying Samba Active Directory
Run the following to verify
Then verify the Kerberos and ldap services
Then verify the Samba resources
Lastly KINIT
Create your first user (Optional)
The reason why this is optional, is you have more options when adding a user through the Remote Server Administration Tools (RSAT) on Windows.
Windows Setup
PreCheck
- Set Computer Name
- Set DNS/IP, The first DNS should be your Samba Server set up above
Verify DNS resolver
Add Server to Directory
Install RSAT to administer domain from Windows
Download RSAT tools <– For Windows 10 – Could not find a DL source for Windows 11, something I need to look into.
Linux Setup
Precheck
- On Ubuntu, you may need to add the Universe repositories
Set Hostname
Modify Resolved info
On Fedora edit the Resolved config (This works on Ubuntu as well, old editions you may need to change the /etc/resolv.conf file)
Install required packages (Ubuntu Only)
For Ubuntu Only
For Windows 10 version 1809 and all later versions, Windows 11 included, the RSAT tools are now a Features on Demand install vs the old download method. Annoying but usually works ok unless your computers are behind a proxy server and have WSUS on the network, which then needs some Group Policy settings changed.
This is a really awesome tutorial. Thank you so much for adding this. Can you use this, or similar methodology to join an existing Windows domain?
To be honest, never tried. Although I know that Fedora has a built in way to connect to a windows domain, I am not sure about other linux flavours.
is it possible running DNS service ? like bind 9 ?
RSAT tools on Windows 10 and 11 can be installed by going to Settings > Apps > Optional Features > Add an optional feature > View features > search RSAT and tick what you need. Hope this helps!
I have used this and it works GREAT!! How do I add a second so there is 2 DCs not just one?
Sorry for such a late reply. I have never tested setting up a second DC. I have done it with Windows Server 2012 but never with Samba… Might be something I will try in the future.
Thanks for the guide! After learning how to do this myself, and then finding your guide reassured me that things were done the right way.
I`m currently looking for some guidance to a guide or good reading material for my current exercise: I have a much older version of samba (4.3.11) that I need to update to the latest version.
The current, outdated samba instance is live so it cannot afford any downtime.
Before I attempt to update my old DC, I want to migrate it’s users and groups to this new instance so that I have a fallback incase things go wrong.
Perfectly working thanks bro
In windows 11 I can not find the dc:
ping dc1.cn.lan
Ping request could not find host dc1.cn.lan. Please check the name and try again.
ping cn.lan
Ping request could not find host cn.lan. Please check the name and try again.
Any ideas?
Sounds like a DNS issue. Make sure your DNS is set as the Samba server and not something else.
So when I ping 192.168.0.254, it says it’s unavailable. I put my IP address in there and the ping works fine. However when I do host -t A cn.lan it says Host cn.lan nof found: 3(NXDOMAIN).
what do I do to fix this?
You need to make sure your server IP is set to 192.168.0.254. You can change this to whatever you want, I used 192.168.0.254 only as an example as I usually set higher IPs for servers and lower IPs for clients (for example 192.168.0.10), but others reverse that. You can find the server’s ip by using the “ip a” command or “ifconfig” if net-tools is installed.
Also, you do not need to use cn.lan, again this was an example, as cn stands for Considered Normal. Hope this helped.
This isn’t working for me. After I create the new resolv.conf file and set the nameserver to the IP of the server I am creating of 172.16.8.53, I lose access to the internet and can’t do any updates. What am I doing wrong?
# Samba server IP address
nameserver 172.16.8.53
# fallback resolver
nameserver 9.9.9.9
nameserver 1.1.1.1
# main domain for Samba
search xxxxxxxx.com
Password for administrator@domain.local:
KDC reply did not match expectations while getting initial credentials
Did you get solution to above?
Works great! Thank you.
Mayble some file sharing and GPO next?
Cheers!
It’s important to consider more modern approaches to network configuration on Ubuntu systems. Instead of directly modifying the
/etc/resolv.conffile, which may be overwritten by network management tools or breaks the network, consider the following steps:1. Disable the stub listener in
systemd-resolvedto prevent it from managing DNS resolution:sudo systemctl edit systemd-resolved
Add the following lines to the editor:
[Resolve]
DNSStubListener=no
Save the file and exit the editor.
2. Restart the
systemd-resolvedservice to apply the changes:sudo systemctl restart systemd-resolved
3. Manage DNS configuration using
netplan, Ubuntu’s preferred method:sudo nano /etc/netplan/00-installer-config.yaml
Inside the file, specify your DNS servers under the
nameserverssection. For example:network:
ethernets:
ens18:
addresses:
- 192.168.0.10/24
nameservers:
addresses:
- 192.168.0.10
- 8.8.8.8
search:
- cn.lan
routes:
- to: default
via: 192.168.0.1
version: 2
Save the file and exit the editor.
4. Apply the changes made with netplan:
sudo netplan apply
By following these steps, you ensure that DNS configuration remains consistent and resilient to changes, aligning with best practices for network management on Ubuntu systems.
Good Morning Sir, Great Video I wish you could do more about this same topic.
Right now I am trying to make a DC and print and file share on Ubuntu server 24.04.
if you can give me some tips I would really appreciated.
Thank you and have a wonderful Sunday!
Great tutorial. Works like a charm.
One thing i spotted on here:
The sections for “Then verify the Samba resources” is the same commands as “Then verify the Kerberos and ldap services”
It should be:
“smbclient -L cn.lan -N”