Centos7.1 minimal installation of Domain Controllers for building Active Directory Service

Centos7.1 minimal installation of Domain Controllers for building Active Directory Service

Lab Platform

I3 generation II, 8 GB memory, WIN764-bit system, Virtualbox4.3.26 installed, CENTOS7.1 virtual machine, mounted minimal disc installation system.

At the same time, download and prepare a Centos everything 7g dvd to facilitate the installation of dependency packages without the need for real-time online YUM installation.

1. Minimal installation of CENTOS7.1. The process is omitted.

2. log on to Centos7.1 and install dependencies. I like to install software with the downloaded Centos DVD, which is faster than the network.

1. If you want to connect to a virtual machine through SSH using PUTTY or other software from WIN7, You need to configure a fixed IP address and enable SSH. I am a virtual machine connected with securecrt. I select a NIC to bridge the dynamic IP address of the local Nic, a host-only network, and a IP segment to set 192.168.6 .*.

Last login: Thu Apr 16 04:20:06 2015 from 192.168.6.1

2. Mount the everything CD
[Root @ localhost ~] # Mount/dev/cdrom/mnt
Mount:/dev/sr0 is write-protected, mounting read-only

3. Go to the/etc/yum. repos. d/directory and rename the backup repo files in batches.

[Root @ localhost ~] # Cd/etc/yum. repos. d/
[Root @ localhost yum. repos. d] # find.-type f | xargs-I mv {}{}. bkp
[Root @ localhost yum. repos. d] # ls
CentOS-Base.repo.bkp CentOS-Debuginfo.repo.bkp CentOS-Sources.repo.bkp
CentOS-CR.repo.bkp CentOS-fasttrack.repo.bkp CentOS-Vault.repo.bkp

4. Create a CD installation source in the editor.
[Root @ localhost yum. repos. d] # vi CentOS-Media.repo
C7-media
Name = CentOS-$ releasever-Media
Baseurl = file: // mnt
Gpgcheck = 0
Enabled = 1

"CentOS-Media.repo" 5L, 83C written
5. Install "development tools" from the CD"

[Root @ localhost yum. repos. d] # yum groupinstall "development tools"

Installation Process

6. install some dependencies

[Root @ localhost samba-4.2.1] # yum-y install libacl-devel libblkid-devel gnutls-devel readline-devel python-devel autoconf gdb bind rsyslog-gssapi cyrus-sasl-gssapi

There are also a few RPM packages. I use the RPM command to compile the command later and report an error before installing the package. You can also install the package once in the YUM above.

[Root @ localhost samba-4.2.1] # rpm-ivh/mnt/Packages/python-devel-2.7.5-16.el7.x86_64.rpm
Warning:/mnt/Packages/python-devel-2.7.5-16.el7.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY
Preparing... ################################### [100%]
Package python-devel-2.7.5-16.el7.x86_64 is already installed
[Root @ localhost samba-4.2.1] # rpm-ivh/mnt/Packages/cyrus-sasl-2.1.26-17.el7.x86_64.rpm
Warning:/mnt/Packages/cyrus-sasl-2.1.26-17.el7.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY
Preparing... ################################### [100%]
Updating/installing...
1: cyrus-sasl-2.1.26-17.el7 ################################# [100%]
[Root @ localhost samba-4.2.1] # rpm-ivh/mnt/Packages/cyrus-sasl-devel-2.1.26-17.el7.x86_64.rpm
Warning:/mnt/Packages/cyrus-sasl-devel-2.1.26-17.el7.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY
Preparing... ################################### [100%]
Updating/installing...
1: cyrus-sasl-devel-2.1.26-17.el7 ################################# [100%]
[Root @ localhost samba-4.2.1] # rpm-ivh/mnt/Packages/openldap-devel-2.4.39-6.el7.x86_64.rpm
Warning:/mnt/Packages/openldap-devel-2.4.39-6.el7.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY
Preparing... ################################### [100%]
Updating/installing...
1: openldap-devel-2.4.39-6.el7 ################################# [100%]

3. Download and compile Samda

7. Download The SAMBA4.2.1 source code package and upload it to the/tmp directory using SECUREFXP. wget is too slow.

8. Now go to the/tmp directory, decompress and prepare to compile samba4.2.1.

[Root @ localhost ~] # Cd/tmp
[Root @ localhost tmp] # ls
Ks-script-BL7c5a samba-latest.tar.gz yum. log
[Root @ localhost tmp] # tar-xvf samba-latest.tar.gz
[Root @ localhost tmp] # ls
Ks-script-BL7c5a samba-4.2.1 samba-latest.tar.gz yum. log
[Root @ localhost tmp] # cd samba-4.2.1/

Run the autogen-waf.sh in the buildtools/scripts/directory before Compilation

[Root @ localhost samba-4.2.1] # cd buildtools/scripts/
[Root @ localhost scripts] #./autogen-waf.sh

Setting up for waf build
Looking for the buildtools directory
Found buildtools in./..././buildtools
Setting up configure
Setting up Makefile
Done. Now run./configure or./configure. developer then make.

Go back to the decompressed directory and start compiling samba.

[Root @ localhost scripts] # cd/tmp/samba-4.2.1/
[Root @ localhost samba-4.2.1] #./configure

Compilation process ......
'Configure 'finished successfully (1m8. 178 s)

Compilation is completed here.

9. Start make installation

[Root @ localhost samba-4.2.1] # make & make install

Installation process ......
Waf: Leaving directory '/tmp/samba-4.2.1/bin'
'Install' finished successfully (3m22. 415 s)

So far, samba4.2.1 source code compilation and installation are complete.

10. Change the host name to DC1 and write the complete FQDN domain name. The advantage is that the domain name is upgraded to domain control without losing.

[Root @ localhost samba-4.2.1] # vi/etc/hostname
DC1.contoso.com

4. Upgrade to domain control

11. The VM can be shut down to create a snapshot, and then start and log on to the VM to promote the linux host to a domain controller.

[Root @ DC1 ~] # Cd/usr/local/samba/bin

[Root @ DC1 bin] #./samba-tool domain provision

Realm [CONTOSO. COM]:

Domain [CONTOSO]:

Server Role (dc, member, standalone) [dc]:

DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]: BIND9_FLATFILE # BIND9 DNS selected here, you can also install the DNS that comes with Samba.

Administrator password: enter the password of the domain controller Administrator. The password must be complex and contain uppercase/lowercase letters and numbers, for example, Ab123456 &
Retype password: Enter Ab123456 again &

Looking up IPv4 addresses More than one IPv4 address found. Using 192.168.6.3

Looking up IPv6 address

No IPv6 addresswill be assigned

Setting up secrets. ldb

Setting up the registry

Setting up the privileges database

Setting up idmap db

Setting up sam. ldb partitions and settings

Setting up sam. ldb rootDSE

Pre-loading the Samba 4 and AD schema

Adding DomainDN: DC = contoso, DC = com

Adding configuration container

Setting up sam. ldb schema

Setting up sam. ldb configuration data

Setting up display specifiers

Modifying display specifiers

Adding users container

Modifying users container

Adding computers container

Modifying computers container

Setting up sam. ldb data

Setting up well known security principals

Setting up sam. ldb users and groups

Setting up self join

Adding DNS accounts

Creating CN = MicrosoftDNS, CN = System, DC = contoso, DC = com

Rndc: neither/etc/rndc. conf nor/etc/rndc. key was found

Rndc: neither/etc/rndc. conf nor/etc/rndc. key was found

See/usr/local/samba/private/named. conf for an example configuration include file for BIND

And/usr/local/samba/private/named.txt for further documentation required for secure DNS updates

Setting up sam. ldb rootDSE marking as synchronized

Fixing provision GUIDs

A Kerberos configuration suitable for Samba 4 has been generated at/usr/local/samba/private/krb5.conf

Once the above files are installed, your Samba4 server will be ready to use

Server Role: active directory domain controller

Hostname: DC1

NetBIOS Domain: CONTOSO

DNS Domain: contoso.com

Domain sid: S-1-5-21-3366851103-1622988557-2824442447

[Root @ DC1 bin] #

The domain sid must be viewed before configuration is successful.

Start samba
[Root @ DC1 bin] #/usr/local/samba/sbin/samba

View version

[Root @ DC1 bin] #/usr/local/samba/bin/smbclient -- version

Version 4.2.1

Test

[Root @ DC1 bin] #/usr/local/samba/bin/smbclient-L localhost-U %

Domain = [CONTOSO]

OS = [Unix]

Server = [Samba 4.2.1]

Sharename Type Comment

--------------------

Netlogon Disk

Sysvol Disk

IPC $ IPC Service (Samba 4.2.1)

Domain = [CONTOSO] OS = [Unix] Server = [Samba 4.2.1]

Server Comment

----------------

Workgroup Master

----------------

[Root @ DC1 bin] #/usr/local/samba/bin/smbclient // localhost/netlogon-Uadministrator

Enter administrator's password:

Domain = [CONTOSO] OS = [Unix] Server = [Samba 4.2.1]

Smb: \> q

[Root @ DC1 bin] #

Check BIND

[Root @ DC1 bin] # rpm-qa | grep bind

Bind-libs-lite-9.9.4-18.el7.x86_64

Bind-license-9.9.4-18.el7.noarch

Bind-libs-9.9.4-18.el7.x86_64

Bind-9.9.4-18.el7.x86_64

In the/etc/named. conf file, you can see that the bind9 directory is/var/named and enter this directory:
[Root @ DC1 etc] # cd/var/named


Copy named. localhost as contoso.com. zone and modify it as the forward parsing file of contoso.com.

[Root @ DC1 named] # cp named. localhost contoso.com. zone

[Root @ DC1 named] # vim contoso.com. zone

$ TTL 1D @ in soa @ contoso.com .(

0; serial

1D; refresh

1 H; retry

1 W; expire

3 H); minimum

In ns DC1.contoso.com.

@ In a 192.168.6.3

DC1 in a 192.168.6.3

The preceding figure shows the modified IP address of the dual-nic VM.


Copy the later part of the DNS file generated by samba. But do not copy the gc. _ msdcs. I reported an error in the test and deleted the bind.

[Root @ DC1 ~] # Cd/usr/local/samba/private/dns

[Root @ DC1 dns] # ls

Contoso.com. zone

[Root @ DC1 dns] # vim contoso.com. zone

Copy the following parts

79aef472-c658-49c0-a2b4-3988bc00338a. _ msdcs in cname DC1

;

; Global catalog servers

_ Gc. _ tcp in srv 0 100 3268 DC1

_ Gc. _ tcp. Default-First-Site-Name. _ sites in srv 0 100 3268 DC1

_ Ldap. _ tcp. gc. _ msdcs in srv 0 100 3268 DC1

_ Ldap. _ tcp. Default-First-Site-Name. _ sites. gc. _ msdcs in srv 0 100 3268 DC1

;

; Ldap servers_ldap. _ tcp in srv 0 100 389 DC1

_ Ldap. _ tcp. dc. _ msdcs in srv 0 100 389 DC1

_ Ldap. _ tcp. pdc. _ msdcs in srv 0 100 389 DC1

_ Ldap. _ tcp.8b2afba7-4d3a-4b88-8b45-381cf145c623.domains. _ msdcs in srv 0 100 389 DC1

_ Ldap. _ tcp. Default-First-Site-Name. _ sites in srv 0 100 389 DC1

_ Ldap. _ tcp. Default-First-Site-Name. _ sites. dc. _ msdcs in srv 0 100 389 DC1

;

; Krb5 servers_kerberos. _ tcp in srv 0 100 88 DC1

_ Kerberos. _ tcp. dc. _ msdcs in srv 0 100 88 DC1

_ Kerberos. _ tcp. Default-First-Site-Name. _ sites in srv 0 100 88 DC1

_ Kerberos. _ tcp. Default-First-Site-Name. _ sites. dc. _ msdcs in srv 0 100 88 DC1_kerberos. _ udp in srv 0 100 88 DC1

; MIT kpasswd likes to lookup this name on password change

_ Kerberos-master. _ tcp in srv 0 100 88 DC1

_ Kerberos-master. _ udp in srv 0 100 88 DC1

;

; Kpasswd_kpasswd. _ tcp in srv 0 100 464 DC1

_ Kpasswd. _ udp in srv 0 100 464 DC1

;

; Heimdal 'Find realm for host' hack

_ Kerberos in txt contoso. COM

Paste the modified content to/var/named/contoso.com. zone. In the specific operation, you can clone the session in SecureCRT, enter the directory, open the file, drag and select the one to copy, then right-click the original session and paste it, and then press ESC ,: wq is saved and exited.


Open/etc/named. rfc1912.zones and add the following fields to add the forward resolution area.

[Root @ DC1 etc] # vim/etc/named. rfc1912.zones

Zone "contoso.com" IN {

Type master;

File "contoso.com. zone ";

Allow-update {none ;};

};

Start the BIND service. If an error is reported, check the configuration of the etc/named. rfc1912.zones and contoso.com. zone files.

[Root @ DC1 dns] # systemctl start named. service

[Root @ DC1 dns] # systemctl status named. service

Test parsing. The host command is required. Not installed by default.

[Root @ DC1 named] # host-t SRV _ ldap. _ tcp.contoso.com.

-Bash: host: Command not found

Re-mount the CD to install it.

[Root @ DC1 named] # mount/dev/cdrom/mnt

Mount:/dev/sr0 write protection, which will be mounted in read-only mode

[Root @ DC1 named] # yum-y install bind-utils


Then test

[Root @ DC1 ~] # Host-t SRV _ ldap. _ tcp.contoso.com

_ Ldap. _ tcp.contoso.com has SRV record 0 100 389 DC1.contoso.com.

[Root @ DC1 ~] # Host-t SRV _ kerberos. _ udp.contoso.com _ kerberos. _ udp.contoso.com has SRV record 0 100 88 DC1.contoso.com.

[Root @ DC1 ~] # Host-t A dc1.contoso.com.

Dc1.contoso.com has address 192.168.6.3

Then enable the WIN7 virtual machine, configure the IP address of the same network segment such as 192.168.6.5, and configure DNS 192.168.6.3. Use PING to test whether the domain name can be pinged. If the domain name cannot be pinged, try to clear IPTABLES firewall rules:

[Root @ DC1 ~] # Iptables-F

After all the configurations on this server end are completed, you can download the WINDOWS Server Remote Management Toolkit from WINDOWS 7.
After installation, add the component. In the control panel-management tools, you can view the domain control management tools and manage them remotely.