SAMBA Windows DC authentication on RedHat/Centos/Oracle Linux 6.x with SElinux enabled

Install winbind

yum install samba samba-winbind

Kerberos authentication

Create a backup of the krb5.conf file.

mv /etc/krb5.conf /etc/krb5.conf.org

vi /etc/krb5.conf

[logging]
default = FILE:/var/log/krb5.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmin.log

[libdefaults]
default_realm = CONTOSO.COM
dns_lookup_realm = false
dns_lookup_kdc = false
clock_skew = 300
ticket_lifetime = 24h
forwardable = yes

[realms]
CONTOSO.COM = {
kdc = DC.CONTOSO.COM
admin_server = DC.CONTOSO.COM
default_domain = CONTOSO.COM
}

Test kerberos DC connection

kinit administrator 

SMB configuration

Create a backup of the smb.conf file.

mv /etc/samba/smb.conf /etc/samba/smb.conf.org

vi /etc/samba/smb.conf

[global]
workgroup = CONTOSO
realm = CONTOSO.COM
load printers = no
preferred master = no
local master = no
server string = fileserver
password server = 10.0.0.2
encrypt passwords = yes
security = ADS
netbios name = storage
client signing = Yes
dns proxy = No
wins server = 10.0.0.2
idmap uid = 10000-20000
idmap gid = 10000-20000
winbind separator = +
winbind enum users = Yes
winbind enum groups = Yes
winbind use default domain = Yes
auth methods = winbind
template shell = /bin/false
interfaces = lo eth0 127.0.0.1 10.0.0.10
bind interfaces only = yes
#
acl compatibility = auto
socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=262144 SO_SNDBUF=262144
getwd cache = yes
#
#log level = 1

Add SAMBA server to Domain

kinit administrator
net ads join -U administrator 

Start winbind

/etc/init.d/winbind start
/etc/init.d/winbind status
net rpc getsid 
or
net rpc getsid net rpc getsid -S CONTOSO.COM -U administrator

Edit /etc/nsswitch.conf and add wins to do host lookups.

hosts: files dns wins

Check winbind get domain users/grups

wbinfo -u 
wbinfo -g 

Now tell PAM that samba requires authentication and account from winbind. Add the following lines to /etc/pam.d/samba

vi /etc/pam.d/samba
auth required /lib/security/pam_winbind.so 
account required /lib/security/pam_winbind.so

Edit the /etc/nsswitch.conf file so it will look like this:

vi /etc/nsswitch.conf 
passwd: compat winbind 
group: compat winbind 
shadow: compat

Create a share. 

First we need to create a folder

mkdir –p /data/share

chmod 777 /data/share

Mount filesystem

vi /etc/fstab

/dev/sda3   /data/share      ext4    rw,acl,user_xattr       0 0
mount /data/share
# Or remount existing partition
#mount -o remount /data/share

Enable SELinux share permission (relable)

chcon -R -t samba_share_t '/data/share'

Open the /etc/samba/smb.conf file and paste the following lines:

vi /etc/samba/smb.conf
[share]
comment = share
read only = no
path = /data/share
hide files = /lost+found/
valid users = @"CONTOSO+domain users"
admin users = @"CONTOSO+Domain Admins", root , administrator
write list = @"CONTOSO+Domain Admins" , root , administrator
read list = @"CONTOSO+domain users"
available = yes
browseable = yes
public = yes
writable = yes
acl check permissions = Yes
acl group control = Yes
acl map full control = Yes
#acl map full control = no
force unknown acl user = No
dos filemode = no
inherit permissions = yes
store dos attributes = no
map archive = No
map hidden = No
map system = No
map readonly = No
nt acl support = Yes
map acl inherit = yes
profile acls = No
inherit owner = No
inherit acls = yes
acl group control = yes
vfs objects = acl_xattr

Restart the Samba service via:

/etc/init.d/samba restart

Test the new share. Go to your Windows box and browse to the Linux box via \\share

Debuging

SAMBA reset ACL on file or directory

setfacl -b FileOrFolder

SAMBA show ACL

getfacl FileOrFolder

SAMBA set ACL group

setfacl -m g:group:rw  FileOrFolder

SAMBA set ACL user

setfacl -m u:user:r FileOrFolder