I85PREP
⌘ K
LPIC-3 Mixed Environment study materials
LPIC-3 Mixed Environment study resources

LPIC-3 Mixed Environment: Samba and Active Directory Domains

LPIC-3 Mixed Environment · Work through your exam, one topic at a time.

All guide sections

Samba and Active Directory Domains

The Samba and Active Directory Domains domain tests joining a Samba member server to an AD domain, Kerberos authentication, and correct identity mapping through winbind. The exam focuses on the sequence and the parameters that make the join survive a reboot.

Prerequisites

  • DNS must resolve the AD DNS domain and its SRV records; point the server at AD DNS, not a public resolver.
  • Time must be synchronized within five minutes, usually with chrony or ntpd, or Kerberos rejects tickets.
  • /etc/krb5.conf needs the uppercase realm, KDC entries and a usable credential cache.
  • Install krb5-user, samba, winbind, libnss-winbind and libpam-winbind as appropriate.

smb.conf for ADS

Set security = ADS, workgroup = EXAMPLE, realm = EXAMPLE.COM, and an idmap layout such as idmap config * : backend = tdb, idmap config * : range = 3000-7999, idmap config EXAMPLE : backend = rid, and idmap config EXAMPLE : range = 10000-999999. The default * range covers BUILTIN and other well-known SIDs; domain ranges must not overlap. template shell and winbind use default domain affect how users appear.

Join and verify

Run kinit Administrator, then net ads join -U Administrator, then net ads testjoin. Enable and start winbind, then check wbinfo -t, wbinfo -u, and getent passwd for a domain user. Add winbind to the passwd and group lines in nsswitch.conf, and configure PAM with pam_winbind or an SSSD design. net ads keytab create is used when services need Kerberos keytabs.

Worked example

A file server has correct AD DNS and time, but net ads join fails with a Kerberos error. klist shows no ticket, so the admin runs kinit Administrator and retries the join. After net ads testjoin succeeds, wbinfo -t verifies the trust secret and getent passwd confirms NSS resolution. Reasoning: the join is a Kerberos-authenticated LDAP operation; DNS, time and a ticket must all work before the machine account is created.

Traps

Using the workgroup instead of the realm; pointing DNS at an external resolver; clock skew; overlapping idmap ranges causing unstable UIDs; and expecting winbind to enumerate a large domain quickly.