CentOS 6 编译安装samba4

         微软输了反垄断案，被法院判决向samba项目贡献代码，samba与微软的战争结束，换来了samba4 十多年来的第一个正式版，完全兼容win2k至win8所有的客户端。

        主流linux发行版里的samba4版本比较旧，debian wheezy用的也是beta2，其他都是alpha18，最新的fedora 18 自带了samba4正式版，但是使用的kerberos是MIT的，与samba4自带的heimdal kerberos有些出入，鉴于目前samba4的文档比较少，在redhat系的平台上，还是按照官方wiki说的做成功率比较高，也就是编译安装。

 

samba4内置了kerberos、dns和ldap，外加一个ntp就可以完成一个AD了。

 

环境：CentOS 6.3  x64

少废话，将经过测试和总结的精华写个脚本分享给大家，简单说明如下：

1、请根据需要修改【10-13行】，注意大小写；

2、主机名没有特别要求，非fqdn即可，不带域名的那种，比如samba；

3、samba4 AD 安装一步到位（加上启动脚本实际为2步，ntp请另行配置）

4、脚本可重复执行，除去下载，安装编译耗时约15分钟

5、配置文件位于/etc/samba，可执行文件和库文件都位于/usr/local/，

手册在/usr/share/samba，pid和lock都位于/var,日志位于/var/log/samba，做了日志轮转

 

#!/usr/bin/env bash
# name = setup-samba4-ad.sh
# author = [email protected]
# test under centos 6.3 mininal only ,
# at your own risk.

set -e

#------------------------------
realm=TEST.ORG
domain=TEST
adminpass="1q2w3edc4RFV"
DomainName=test.org

#install development packages
yum groupinstall "Development tools"  -y
yum install python-devel ctdb-devel docbook-style-xsl libacl-devel readline-devel \
    openssl-devel cups-devel libaio-devel pam-devel libtevent-devel libcap-devel \
    expect libuuid-devel libtdb-devel quota-devel openldap-devel krb5-workstation -y

rm -rf samba-4.0.3*

#wget http://www.samba.org/ftp/samba/samba-4.0.3.tar.gz
#wget http://192.168.122.1/pkg/samba-4.0.3.tar.gz

[ -f samba-4.0.3.tar.gz ] || wget http://www.samba.org/ftp/samba/samba-4.0.3.tar.gz
[ -d samba-4.0.3 ] || tar zxvf samba-4.0.3.tar.gz

mkdir -p /etc/samba/private

cd samba-4.0.3
./configure \
    --enable-debug \
    --enable-selftest \
    --disable-cups \
    --disable-gnutls \
    --enable-fhs \
    --prefix=/usr/local \
    --sysconfdir=/etc \
    --localstatedir=/var \
    --datarootdir=/usr/share \
    --with-privatedir=/etc/samba/private
#   --with-aio-support
make && make install

rm -rf /etc/samba/smb.conf
samba-tool domain provision \
    --realm=$realm \
    --domain=$domain \
    --workgroup=$DomainName \
    --adminpass="$adminpass" \
    --server-role=dc \
    --use-rfc2307

cat /etc/samba/private/krb5.conf > /etc/krb5.conf
echo "[kdc]" >>/etc/krb5.conf
echo "check-ticket-address = false" >>/etc/krb5.conf

#/usr/sbin/samba -D
#echo "/usr/local/sbin/samba -D" >>/etc/rc.local

curl http://192.168.122.1/samba4.init.sh >/etc/init.d/samba4
chmod 755 /etc/init.d/samba4
chkconfig --add samba4
chkconfig --level 2345 samba4 on
/etc/init.d/samba4 start
service iptables stop

echo domain $DomainName >/etc/resolv.conf
echo nameserver 127.0.0.1 >>/etc/resolv.conf

#for rsyslog
cat > /etc/rsyslog.d/samba.log <<SAMBA-LOG
/var/log/samba/* {
    notifempty
    olddir /var/log/samba/old
    missingok
    sharedscripts
    copytruncate
}
SAMBA-LOG

#DNS test
host -t SRV _ldap._tcp.$DomainName.
host -t SRV _kerberos._udp.$DomainName.
host -t A $HOSTNAME.$DomainName.

service samba4 restart

sleep 10

#samba-client test
smbclient --version
smbclient -L localhost -U%
smbclient //localhost/netlogon -U administrator -P $adminpass -c 'ls'

#kerberos test
expect -c "
   set timeout 5;
   spawn kinit [email protected]
   expect {
       "Password*" {send \"$adminpass\r\";}
   }
expect eof;"

#echo please enter your passwd of administrator
#kinit [email protected]
klist

cat <<NOTE >&2
#Warnning#
#Remember to open the following ports in your iptables firewall
#53         tcp/udp
#88         tcp/udp
#389        tcp/udp
#464        tcp/udp
#137        udp
#138        udp
#139        tcp
#445        tcp
#636        tcp
#1024       tcp
#3268       tcp
#3269       tcp
NOTE

echo "Congratuations! everything done successful"
#end of the script

 

 samba4开机脚本/etc/init.d/samba4

#!/bin/sh
# chkconfig: 2345 91 35
# description: Initialization script for Samba

#source function library
. /etc/rc.d/init.d/functions

# Make sure the configuration file exists
[ -f /etc/samba/smb.conf ] || exit 1

prog=samba
pidfile=/var/run/samba/samba.pid
lockfile=/var/lock/samba/samba
RETVAL=0

samba_start() {
    echo "Starting $prog: "
    /usr/local/sbin/samba -D
}

samba_stop() {
    echo -n $"Stopping $prog: "
    killproc -p ${pidfile} ${prog}
    RETVAL=$?
    echo
    [ $RETVAL = 0 ] && rm -f ${lockfile} ${pidfile}
}

samba_reload() {
    echo -n \$"Reloading $prog: "
    killproc -p ${pidfile} ${prog} -HUP
    RETVAL=$?
    echo
}

# See how we were called
case "$1" in
    'start')
        samba_start
        ;;
    'stop')
        samba_stop
        ;;
    'restart')
        samba_stop
        sleep 1
        samba_start
        ;;
    'reload')
        samba_reload
        ;;
    *)
        echo "Usage: $0 {start|stop|restart|reload}"

        ;;
esac

 

使用方法

chmod 755 /etc/init.d/samba4
chkconfig --add samba4
chkconfig --level 2345 samba4 on
/etc/init.d/samba4 start

 

防火墙脚本也一并送上

#!/usr/bin/env bash
# Name :firewall.sh
# Authhor :[email protected]
# Description:setup a simple host-based iptables firewall

if [ "$(id -u)" != "0" ]; then
   echo "This script is designed to run as root" 1>&2
   exit 1
fi

#only one net card
lan=192.168.0.0/16

# Load modules
modprobe ip_tables
modprobe iptable_filter
modprobe ipt_REJECT
modprobe ip_conntrack
modprobe xt_limit
modprobe xt_recent
modprobe xt_state

# Flush the current iptables rules
iptables -F
iptables -X
iptables -Z

# To prevent us blocked out of the server
# Set the INPUT policy to ACCEPT for the moment
iptables -P INPUT ACCEPT

# Allow related,established connection
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Limit the speed of ping,1 package per second
iptables -A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j ACCEPT

# Always trust lookback interface
iptables -A INPUT -i lo -j ACCEPT

# Allow ssh but limit 10 new connections per minute
# This will help to prevent too much password failure
iptables -A INPUT -s $lan -p tcp --dport 22 -m recent --set --name ssh --rsource
iptables -A INPUT -s $lan -p tcp --dport 22 -m recent ! --rcheck --seconds 60 --hitcount 10 --name ssh --rsource -j ACCEPT


# Open some port to local network only
iptables -A INPUT -s $lan --dport 53 -j ACCEPT
iptables -A INPUT -s $lan --dport 88 -j ACCEPT
iptables -A INPUT -s $lan --dport 389 -j ACCEPT
iptables -A INPUT -s $lan --dport 464 -j ACCEPT
iptables -A INPUT -s $lan -p udp --dport 137 -j ACCEPT
iptables -A INPUT -s $lan -p udp --dport 138 -j ACCEPT
iptables -A INPUT -s $lan -p tcp --dport 135 -j ACCEPT
iptables -A INPUT -s $lan -p tcp --dport 139 -j ACCEPT
iptables -A INPUT -s $lan -p tcp --dport 445 -j ACCEPT
iptables -A INPUT -s $lan -p tcp --dport 636 -j ACCEPT
iptables -A INPUT -s $lan -p tcp --dport 1024 -j ACCEPT
iptables -A INPUT -s $lan -p tcp --dport 3268 -j ACCEPT
iptables -A INPUT -s $lan -p tcp --dport 3269 -j ACCEPT

iptables -A INPUT -s $lan -p udp --dport 123 -j ACCEPT


# Set the global polciy now
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Drop some output request
iptables -A OUTPUT -s 224.0.0.0/8 -j DROP
iptables -A OUTPUT -d 224.0.0.0/8 -j DROP
iptables -A OUTPUT -s 255.255.255.255/32 -j DROP
iptables -A OUTPUT -m state --state INVALID -j DROP

# Save rules to /etc/sysconfig/iptables
/etc/init.d/iptables save
# Restart iptables service
/etc/init.d/iptables restart
# Show the final rules on the screen
iptables -n -v -L

 

windows 客户端配置（以win2003为例）

"我的电脑" =>"属性" =>"计算机名" =>"更改" =>勾选"隶属于域"，填上test.org ,然后输入域管理员的用户名和密码即可。

linux客户端配置（以centos6为例）

 在终端运行命令authconfig-tui，user information选择winbind，authentication选择winbind，但不要取消shadows passwords

 

Samba4 AD甚至可直接使用微软的工具进行管理，见samba官网wiki （点击进入）

 

 

顺带提点一下，本文仅为测试，实际环境中，会有潜在的风险，你懂的。

脚本运行结果，截图如下 

update2013-02-27

更新samba版本为4.0.3

修正kerberos测试中的嵌入的expect脚本，从而消除脚本中唯一交互之处，实现完全自动。