-1

I've been trying to set my security as ADS for my Samba DC. Unfortunately, whenever I do, the LDAP server can no longer be found using net ads info. Below is my current smb.conf.

[global]
workgroup = EXAMPLE
security = ads
realm = EXAMPLE.COM
netbios name = DC1
server role = active directory domain controller
dns forwarder = 8.8.8.8
idmap_ldb:use rfc2307 = yes

If anyone has any insight as to how I can enable ads security and still have access to LDAP it would be greatly appreciated.

Improve this question

1 Answer 1

Reset to default
0

Sounds to me you didn't properly provision the domain controller. Because if you did, there really is nothing you're supposed to change in the global section. Saying that you manually changed to ads security rings alarm bells for me.

The Samba Wiki on setting up a Samba based AD DC is really very good and thorough so there is no sense in copying all the instructions over here, especially since there is no chance that Wiki will become obsolete as long as Samba exists. Also check the troubleshooting instructions if something should still not work for you.

Improve this answer
3
  • Provisioning samba with the following samba-tool domain provision --use-rfc2307 --interactive resulted in everything in that config except for the security = ads which was added later in hopes if using it with FreeRADIUS. This does not seem to be the issue.
    – Elegant
    Jan 9, 2016 at 22:08
  • 1
    It's plain wrong to add the line "security = ads". That line is only meant for AD members, not for the DC. By adding this line, you are saying to your Samba server "try to join this AD". That's definitely not what you want for your DC.
    – vic
    Jan 9, 2016 at 22:46
  • It almost sounds as if you already have an existing AD (Windows or another Samba instance) and that you just wish to connect FreeRADIUS to it. In that case you are not supposed to set up an AD DC but an AD member. Even if you are creating an entirely new AD, set up a separate member for FreeRADIUS, don't do it on the DC.
    – vic
    Jan 9, 2016 at 23:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .