---

References:
http://www.howtoforge.com/centos-5.x-samba-domain-controller-with-ldap-backend-p2
http://www.rainingpackets.com/wiki/doku.php?id=setting_up_a_samba_pdc_setup_using_openldap_on_centos
http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/

 
1. Initial Config:
-Setelah install CentOS 5.7 lanjutkan install repositori dag dan epel
-Ip Address: 192.168.88.10
-Hostname: pdc.example.net

-Update server
# yum -y update

-Edit /etc/hosts:
# vi /etc/hosts

192.168.88.10 pdc.example.net pdc

-Install paket openldap dan samba
# yum install openldap openldap-clients openldap-servers nss_ldap samba samba-client samba-common

-Install paket smbldap-tools
# yum --enablerepo=epel install smbldap-tools

2. Konfigurasi OpenLdap:
-Generate a master password and set up ldap
# slappasswd
Note: Masukkan hasil dari slappasswd ke slapd.conf pada parameter rootpw

-Edit /etc/openldap/slapd.conf

# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/samba.schema

# Allow LDAPv2 client connections. This is NOT the default.
 allow bind_v2

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral ldap://root.openldap.org

pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args

access to dn.base=""
by self write
by * auth

access to attrs=userPassword
by self write
by * auth

access to attrs=shadowLastChange
by self write
by * read

access to *
by * read
by anonymous auth

#######################################################################
# ldbm and/or bdb database definitions
#######################################################################

database bdb
suffix "dc=example,dc=net"
rootdn "cn=Manager,dc=example,dc=net"
# Cleartext passwords, especially for the rootdn, should
# be avoided. See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
# rootpw qwerty
rootpw {SSHA}tcJGWhPo+NbMNh+DVpG8DvfcfzWu5euP

# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory /var/lib/ldap

# Indices to maintain for this database
index objectClass eq
index cn pres,sub,eq
index sn pres,sub,eq
index uid pres,sub,eq
index displayName pres,sub,eq
index uidNumber eq
index gidNumber eq
index memberUID eq
index sambaSID eq
index sambaPrimaryGroupSID eq
index sambaDomainName eq
index default sub

# Replicas of this database
#replogfile /var/lib/ldap/openldap-master-replog
#replica host=ldap-1.example.com:389 starttls=critical
# bindmethod=sasl saslmech=GSSAPI
# authcId=host/ldap-master.example.com@EXAMPLE.COM

 
-Copy the Samba LDAP schema file(samba.schema) to the openldap schema directory:
# cp /usr/share/doc/samba-3.*/LDAP/samba.schema /etc/openldap/schema/samba.schema
# cp /etc/openldap/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
# chown -R ldap:ldap /var/lib/ldap/DB_CONFIG
# chmod 600 /var/lib/ldap/DB_CONFIG

-LDAP database preparation
# touch /etc/openldap/init.ldif
# vi /etc/openldap/init.ldif

dn: dc=example,dc=net
objectclass: dcObject
objectclass: organization
dc: example
o: EXAMPLE
description: Samba LDAP Identity Database

dn: cn=Manager,dc=example,dc=net
objectClass: organizationalRole
cn: Manager
description: Directory Manager

 
-Start service:
# service ldap start
# chkconfig ldap on

-Load the ldif file:
# ldapadd -v -D "cn=Manager,dc=example,dc=net" -x -w qwerty -f /etc/openldap/init.ldif
# chown -R ldap:ldap /var/lib/ldap/
# chmod -R 600 /var/lib/ldap/*
# slapcat

-Tes ldapsearch:
# ldapsearch -x -b "dc=example,dc=net"

3. Configuring user lookup and authentication
# authconfig-tui
1.Select Cache Indormation
2.Select Use LDAP
3.Select Use LDAP Authentication
4.Next
5.Blank Use TLS
6.Leave server to default.Server: ldap://127.0.0.1/
7.Base DN: dc=example,dc=net
8.Click OK

4. Konfigurasi Samba Server:
-Backup and edit /etc/samba/smb.conf
# mv /etc/samba/smb.conf /etc/samba/smb.conf.asli
# cp /usr/share/doc/smbldap-tools-0.9.6/smb.conf /etc/samba/smb.conf
# vi /etc/samba/smb.conf

# Global parameters
[global]
workgroup = EXAMPLE
netbios name = PDC
interfaces = eth0
bind interfaces only = No
passdb backend = ldapsam:ldap://localhost
client NTLMv2 auth = Yes
client lanman auth = No
client plaintext auth = No
log level = 2
syslog = 1
log file = /var/log/samba/%m
max log size = 0
smb ports = 139 445
#name resolve order = wins bcast hosts
name resolve order = wins
time server = Yes
server signing = auto
add user script = /usr/sbin/smbldap-useradd -m '%u'
add group script = /usr/sbin/smbldap-groupadd '%g'
add user to group script = /usr/sbin/smbldap-groupmod -m '%u' '%g'
set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'
add machine script = /usr/sbin/smbldap-useradd -w '%u'
logon path =
logon home =
domain logons = Yes
os level = 34
preferred master = Yes
domain master = Yes
wins support = Yes
ldap admin dn = "cn=Manager,dc=example,dc=net"
ldap user suffix = ou=People
ldap group suffix = ou=Group
ldap idmap suffix = ou=Idmap
ldap machine suffix = ou=Hosts
ldap passwd sync = Yes
ldap suffix = dc=example,dc=net
ldap ssl = no
ldap timeout = 100
idmap backend = ldap:ldap://localhost
idmap uid = 15000-20000
idmap gid = 15000-20000
winbind nested groups = Yes
ea support = Yes
#map acl inherit = Yes
inherit acls = Yes
nt acl support = Yes
#force unknown acl user = Yes
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 SO_KEEPALIVE</code>

[printers]
comment = SMB Print Spool
path = /var/spool/samba
guest ok = Yes
printable = Yes
browseable = No
use client driver = Yes

[public]
comment = folder for everyone
path = /datasamba/public
read only = No
force create mode = 0777
force directory mode = 0777
browsable = yes
veto files = /*.mp3/*.wmv/*.avi/*.wma/*.wav/*.ogg/*.asf/*.divx/*.mov/*.moov/*.aif/*.aiff/*.aac/*.mpa/*.mpg/*.mpeg/*.mp4/*.qt/*.rm/*.ram/*.vob/*.bmp/*.rmvb/*.mid/*.ra/*.pst/*.MP3/*.WMV/*.AVI/*.WMA/*.WAV/*.OGG/*.ASF/*.DIVX/*.MOV/*.MOOV/*.AIF/*.AIFF/*.AAC/*.MPA/*.MPG/*.MPEG/*.MP4/*.QT/*.RM/*.RAM/*.VOB/*.BMP/*.RMVB/*.MID/*.RA/*.PST/

[private]
comment = folder for private
path = /datasamba/private
read only = No
force create mode = 0777
force directory mode = 0777
browsable = yes

 
-Edit /etc/samba/smbusers
# vi /etc/samba/smbusers

# Unix_name = SMB_name1 SMB_name2 ...
root = administrator Administrator admin
nobody = guest pcguest smbguest

 
-Set Samba’s LDAP password so it can update the LDAP database
# smbpasswd -w qwerty

-Start Service and make run at startup:
# service smb restart
# service winbind restart
# chkconfig smb on
# chkconfig winbind on

-Check the Samba configuration:
# testparm

 
5. Konfigurasi smbldap-tools:
# cp /etc/smbldap-tools/smbldap.conf /etc/smbldap-tools/smbldap.conf.asli
# net getlocalsid
Note: Copy the result to smbldap.conf,to parameter SID=”S-1-5-21-2287761505-2794392696-1855321027″

-Edit /etc/smbldap-tools/smbldap.conf
# vi /etc/smbldap-tools/smbldap.conf

# $Source: $
# $Id: smbldap.conf,v 1.18 2005/05/27 14:28:47 jtournier Exp $
#
# smbldap-tools.conf : Q &amp; D configuration file for smbldap-tools</code>

# This code was developped by IDEALX (http://IDEALX.org/) and
# contributors (their names can be found in the CONTRIBUTORS file).
#
# Copyright (C) 2001-2002 IDEALX
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
# USA.

# Purpose :
# . be the configuration file for all smbldap-tools scripts

##############################################################################
#
# General Configuration
#
##############################################################################

# Put your own SID. To obtain this number do: "net getlocalsid".
# If not defined, parameter is taking from "net getlocalsid" return
SID="S-1-5-21-2287761505-2794392696-1855321027"

# Domain name the Samba server is in charged.
# If not defined, parameter is taking from smb.conf configuration file
# Ex: sambaDomain="IDEALX-NT"
sambaDomain="EXAMPLE"

##############################################################################
#
# LDAP Configuration
#
##############################################################################

# Notes: to use to dual ldap servers backend for Samba, you must patch
# Samba with the dual-head patch from IDEALX. If not using this patch
# just use the same server for slaveLDAP and masterLDAP.
# Those two servers declarations can also be used when you have
# . one master LDAP server where all writing operations must be done
# . one slave LDAP server where all reading operations must be done
# (typically a replication directory)

# Slave LDAP server
# Ex: slaveLDAP=127.0.0.1
# If not defined, parameter is set to "127.0.0.1"
slaveLDAP="127.0.0.1"

# Slave LDAP port
# If not defined, parameter is set to "389"
slavePort="389"

# Master LDAP server: needed for write operations
# Ex: masterLDAP=127.0.0.1
# If not defined, parameter is set to "127.0.0.1"
masterLDAP="127.0.0.1"

# Master LDAP port
# If not defined, parameter is set to "389"
#masterPort="389"
masterPort="389"

# Use TLS for LDAP
# If set to 1, this option will use start_tls for connection
# (you should also used the port 389)
# If not defined, parameter is set to "0"
ldapTLS="0"

# Use SSL for LDAP
# If set to 1, this option will use SSL for connection
# (standard port for ldaps is 636)
# If not defined, parameter is set to "0"
ldapSSL="0"

# How to verify the server's certificate (none, optional or require)
# see "man Net::LDAP" in start_tls section for more details
verify="require"

# CA certificate
# see "man Net::LDAP" in start_tls section for more details
cafile="/etc/smbldap-tools/ca.pem"

# certificate to use to connect to the ldap server
# see "man Net::LDAP" in start_tls section for more details
clientcert="/etc/smbldap-tools/smbldap-tools.iallanis.info.pem"

# key certificate to use to connect to the ldap server
# see "man Net::LDAP" in start_tls section for more details
clientkey="/etc/smbldap-tools/smbldap-tools.iallanis.info.key"

# LDAP Suffix
# Ex: suffix=dc=IDEALX,dc=ORG
suffix="dc=example,dc=net"

# Where are stored Users
# Ex: usersdn="ou=Users,dc=IDEALX,dc=ORG"
# Warning: if 'suffix' is not set here, you must set the full dn for usersdn
usersdn="ou=People,${suffix}"

# Where are stored Computers
# Ex: computersdn="ou=Computers,dc=IDEALX,dc=ORG"
# Warning: if 'suffix' is not set here, you must set the full dn for computersdn
computersdn="ou=Hosts,${suffix}"

# Where are stored Groups
# Ex: groupsdn="ou=Groups,dc=IDEALX,dc=ORG"
# Warning: if 'suffix' is not set here, you must set the full dn for groupsdn
groupsdn="ou=Group,${suffix}"

# Where are stored Idmap entries (used if samba is a domain member server)
# Ex: groupsdn="ou=Idmap,dc=IDEALX,dc=ORG"
# Warning: if 'suffix' is not set here, you must set the full dn for idmapdn
idmapdn="ou=Idmap,${suffix}"

# Where to store next uidNumber and gidNumber available for new users and groups
# If not defined, entries are stored in sambaDomainName object.
# Ex: sambaUnixIdPooldn="sambaDomainName=${sambaDomain},${suffix}"
# Ex: sambaUnixIdPooldn="cn=NextFreeUnixId,${suffix}"
sambaUnixIdPooldn="sambaDomainName=EXAMPLE,${suffix}"

# Default scope Used
scope="sub"

# Unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA, CLEARTEXT)
hash_encrypt="SSHA"

# if hash_encrypt is set to CRYPT, you may set a salt format.
# default is "%s", but many systems will generate MD5 hashed
# passwords if you use "$1$%.8s". This parameter is optional!
crypt_salt_format="%s"

##############################################################################
#
# Unix Accounts Configuration
#
##############################################################################

# Login defs
# Default Login Shell
# Ex: userLoginShell="/bin/bash"
userLoginShell="/bin/bash"

# Home directory
# Ex: userHome="/home/%U"
userHome="/home/%U"

# Default mode used for user homeDirectory
userHomeDirectoryMode="700"

# Gecos
userGecos="System User"

# Default User (POSIX and Samba) GID
defaultUserGid="513"

# Default Computer (Samba) GID
defaultComputerGid="515"

# Skel dir
skeletonDir="/etc/skel"

# Default password validation time (time in days) Comment the next line if
# you don't want password to be enable for defaultMaxPasswordAge days (be
# careful to the sambaPwdMustChange attribute's value)
defaultMaxPasswordAge="180"

##############################################################################
#
# SAMBA Configuration
#
##############################################################################

# The UNC path to home drives location (%U username substitution)
# Just set it to a null string if you want to use the smb.conf 'logon home'
# directive and/or disable roaming profiles
# Ex: userSmbHome="\\PDC-SMB3\%U"
userSmbHome=""

# The UNC path to profiles locations (%U username substitution)
# Just set it to a null string if you want to use the smb.conf 'logon path'
# directive and/or disable roaming profiles
# Ex: userProfile="\\PDC-SMB3\profiles\%U"
userProfile=""

# The default Home Drive Letter mapping
# (will be automatically mapped at logon time if home directory exist)
# Ex: userHomeDrive="H:"
userHomeDrive="Y:"

# The default user netlogon script name (%U username substitution)
# if not used, will be automatically username.cmd
# make sure script file is edited under dos
# Ex: userScript="startup.cmd" # make sure script file is edited under dos
userScript="logon.bat"

# Domain appended to the users "mail"-attribute
# when smbldap-useradd -M is used
# Ex: mailDomain="idealx.com"
mailDomain="example.net"

##############################################################################
#
# SMBLDAP-TOOLS Configuration (default are ok for a RedHat)
#
##############################################################################

# Allows not to use smbpasswd (if with_smbpasswd == 0 in smbldap_conf.pm) but
# prefer Crypt::SmbHash library
with_smbpasswd="0"
smbpasswd="/usr/bin/smbpasswd"

# Allows not to use slappasswd (if with_slappasswd == 0 in smbldap_conf.pm)
# but prefer Crypt:: libraries
with_slappasswd="0"
slappasswd="/usr/sbin/slappasswd"

# comment out the following line to get rid of the default banner
# no_banner="1"

 
-Edit /etc/smbldap-tools/smbldap_bind.conf:
# vi /etc/smbldap-tools/smbldap_bind.conf

############################
# Credential Configuration #
############################
# Notes: you can specify two differents configuration if you use a
# master ldap for writing access and a slave ldap server for reading access
# By default, we will use the same DN (so it will work for standard Samba
# release)
slaveDN="cn=Manager,dc=example,dc=net"
slavePw="qwerty"
masterDN="cn=Manager,dc=example,dc=net"
masterPw="qwerty"

 
-Make sure the file is only readable by root:
# chmod -R 600 /etc/smbldap-tools/smbldap_bind.conf

-Preparing the LDAP database for Samba and will ask for the password, enter it:
# smbldap-populate

-Preparing the Samba directories
# mkdir /datasamba/
# mkdir /datasamba/public
# mkdir /datasamba/private
# chmod -R 777 /datasamba/*
# chgrp ‘Domain Users’ /datasamba/*

-Create Samba LDAP User:
# smbldap-useradd -a -m “test1”
# smbldap-passwd test1
# smbldap-groupmod -m test1 “Domain Users”

-Tes Search User:
# ldapsearch -b "ou=People,dc=example,dc=net" -x "(uid=test1)"

-Reboot the server and testing join domain from Windows XP.
Note: Until Part-3 just work for Windows XP join domain,for windows 7 can join domain see additional configuration on Part-4

6. Upgrade samba 3.0x to samba 3.3x so Windows 7 computer can join Domain
# cd /etc/yum.repos.d/
# wget http://ftp.sernet.de/pub/samba/3.3/centos/5/sernet-samba.repo
# yum -y update

Your samba packages will update from the Sernet repo.
Since the upgrade,CentOS service for samba disappeared; let’s re-add it:
# chkconfig --add smb
# chkconfig smb on

Now join your Windows 7 PC to the domain using this official Samba mini guide:
http://wiki.samba.org/index.php/Windows7

-Download Windows7 Registry Patch from here:
https://bugzilla.samba.org/attachment.cgi?id=4988&action=view

-Note: in my experiences:
If computer with Windows7 fresh install with no update is going to join domain, first I’m install hotfix from here:
http://support.microsoft.com/hotfix/KBHotfix.aspx?kbnum=2171571&kbln=en-us then run registry patch Win7_Samba3DomainMember.reg => Restart PC => Join Domain => Restart PC => successful login with domain users

If Computer with Windows7 SP1, I just run registry patch Win7_Samba3DomainMember.reg => Restart PC => Join Domain => Restart PC => Successful login with domain users

Error Message Windows7 fresh Install with no update try to join domain: