Windows server 2019 samba

Модераторы: SLEDopit, Модераторы разделов

[global]
        log file = /var/log/samba/log.%m
        netbios name = DEBIAN
        server string = Samba Server
        workgroup = WORKGROUP
        interfaces = enp5s0 lo
        hosts allow = 127.0.0.1 192.168.
        encrypt passwords = yes
        security = user
        max log size = 50

        server multi channel support = yes
        server min protocol = SMB3_00
        map to guest = Bad Password

[disk]
        path = /disk
        read only = no
        browseable = yes
        directory mask = 0770
        create mask = 0660
#        valid users = admo
        acl allow execute always = True

        guest ok = yes
        public = yes
        writeable = yes

Creating a Basic guest only smb.conf File

The following is a minimal configuration for a Samba standalone server that only allows guest access:

[global]
        map to guest = Bad User
        log file = /var/log/samba/%m
        log level = 1
        server role = standalone server

[guest]
        # This share allows anonymous (guest) access
        # without authentication!
        path = /srv/samba/guest/
        read only = no
        guest ok = yes
        guest only = yes

[global]
        log file = /var/log/samba/log.%m
#        smb passwd file = /etc/samba/smbpasswd
#        netbios name = DEBIAN
        server string = Samba Server
#        workgroup = WORKGROUP
        interfaces = enp5s0 lo
        hosts allow = 127.0.0.1 192.168.
#        encrypt passwords = yes
#        security = user
        max log size = 50

        server multi channel support = yes
        server min protocol = SMB3_00
        map to guest = Bad User
        server role = standalone server

[disk]
        path = /disk
        read only = no
#        browseable = yes
#        directory mask = 0770
#        create mask = 0660
#        valid users = admo
#        acl allow execute always = True

        guest ok = yes
        guest only = yes
#        public = yes
#        writeable = yes

 @Echo Off
 echo.
 net use z: \\IP.AD.DR.ES\share /user:vasya passwd
 REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##IP.AD.DR.ES#share /v _LabelFromReg /t REG_SZ /d "SHARE_ON_IPADDRES" /f
 echo.
 echo Off

Adding a Windows 2019 DC to Your Samba Domain

In this document MSAD 2016 or 2019 joins a Samba-AD with version 4.15.

This documentation is intended for system administrators that need an MS-AD domain controller in their Samba-AD domain for technical reasons (Azure-Sync, etc.).

❗Hint

Since version 4.12, Samba-AD manages a 2012R2 schema level but still with a functional level in 2008R2. It is therefore possible to join a Windows Server 2012R2 configured in 2008R2 functional level with a Samba-AD domain as an AD.

✅Important

Since version 4.12, Samba-AD manages a 2012R2 schema level but still with a functional level in 2008R2. It is therefore possible to join a Windows Server 2012R2 configured in 2008R2 functional level with a Samba-AD domain as an AD.

Microsoft Active Directory 2019

Preparing your Samba-AD for the future junction

• Backup the Samba-AD because irreversible changes will be made;
• Upgrade Samba to its latest 4.15 version;
• Install the required dependencies to join the Windows Server:

# RedHat8 and derived distributions
yum install python3-markdown
# Debian
apt install python3-markdown

• Then run the following commands, these will join the MS Server 2019 in your domain:

samba-tool domain schemaupgrade
samba-tool domain functionalprep --function-level=2012_R2 --forest-prep --domain-prep

• Set schema version to 2019

priv=$(smbd -b | grep -i private_dir | cut -d : -f 2 | xargs)
defaultNamingContext=$(ldbsearch -H ldap://127.0.0.1 -s base -b "" defaultNamingContext | grep defaultNamingContext | cut -d : -f 2 | xargs)
schemaNamingContext=$(ldbsearch -H ldap://127.0.0.1 -s base -b "" schemaNamingContext | grep schema | cut -d : -f 2 | xargs)
ldbedit -e "sed -i 's/objectVersion:.*/objectVersion: 88/g'" -H $priv/sam.ldb '(objectClass=dMD)' -b $schemaNamingContext

• Check the directory database:

samba-tool dbcheck --cross-ncs --fix --yes  --reset-well-known-acls 

☑️Note

It is possible that errors appear when launching the command the first time, just run it a second time.

• Enable schema updates in Samba AD:

if grep -q "dsdb:schema update allowed" /etc/samba/smb.conf; then     
    sed -i '/dsdb:schema update allowed=true/d' /etc/samba/smb.conf
fi
sed -i '/global/a dsdb:schema update allowed=true' /etc/samba/smb.conf
systemctl restart samba-ad-dc

Preparing and joining the Microsoft Active Directory 2019

☑️Note

It is recommended to use an English version of Windows Server for infrastructure services. This allows you to have logs in English and feel less lonely when searching on the Internet.

• If not already done, set the server to a fixed IP and configure the DNS redirector to point to the main AD;

• Force the activation of the Sysvol directory on the MS-AD:

  Set-ItemProperty -Path "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters"  -Name "SysVolReady" -Value  0
  Restart-Computer

• Install the Active Directory components. In a PowerShell console run the following commands:

Install-WindowsFeature AD-Domain-Services
Add-WindowsFeature RSAT-ADLDS
Add-WindowsFeature RSAT-ADDS-Tools
Add-WindowsFeature RSAT-DNS-Server
Add-WindowsFeature RSAT-DFS-Mgmt-Con
Add-WindowsFeature GPMC

• Now that the role is installed, promote the server to AD and set it up;

☑️Note

The following command will open a popup that will ask for the Domain Admins credentials to join the server (in graphical mode), then the credentials for the AD restore mode (in text mode).

☑️Note

• If not already done, synchronize the time between MS-AD domain controller in their Samba-AD domain with the following command:

w32tm /config /syncfromflags:manual /manualpeerlist:”NTP Server” /reliable:yes /update
w32tm /resync /force

☑️Note

Of course modify the values Credential, DomainName, SiteName and ReplicationSourceDC.

There is a back quote character at the end of each line. Do not remove it or PowerShell will interpret this command as multiple commands.

Install-ADDSDomainController  `
   -Credential (Get-Credential "MIGRATE\Administrator") `
   -DomainName 'migrate.lab' `
   -SiteName 'Default-First-Site-Name' `
   -ReplicationSourceDC smb-adds01.migrate.lab `
   -CreateDnsDelegation:$false  `
   -DatabasePath 'C:\Windows\NTDS' `
   -InstallDns:$true  `
   -LogPath 'C:\Windows\NTDS' `
   -NoGlobalCatalog:$false `
   -SysvolPath 'C:\Windows\SYSVOL'  `
   -NoRebootOnCompletion:$true  `
   -Force:$true
Restart-Computer

☑️Note

At this stage, the Windows Active Directory is properly attached to the domain. However, some options need to be adjusted on the sysvol, DNS and NTP parts.

• Force the activation of the Sysvol directory on the MS-AD:

  Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" -Name "SysvolReady" -Value "1"

• Copy the contents of the SYSVOL from the Samba-AD server. To do this, in a file explorer, type \\srvads\\sysvol, then go to the folder corresponding to your domain name (for example ad.mydomain.lan) and copy Policies and Scripts into C:windowsSYSVOLdomain (but not the domain name). After the copy we will have these two directories:

  • C:windowsSYSVOLdomainPolicies;
  • C:windowsSYSVOLdomainScripts;

⚠️Warning

Samba does not support DFS-R or FRS protocols.

Therefore, it will be necessary to manually synchronize the SYSVOL directory each time a GPO is created or modified.

☑️Note

There is a link from C:\windows\SYSVOL\sysvol\ad.mydomain.lan to C:\windows\SYSVOL\domain.

• Restart the MS-AD server:

  shutdown -r -t 0

• Reverse DNS servers on the network card. The primary DNS server must be itself (127.0.0.1), and the secondary DNS server is the Samba-AD server (Microsoft does the opposite when joining)

• In the DNS console, change the DNS redirector to the network recursor (by default Windows sets the first domain controller as the recursor when joining).

• The change the NTP configuration in the MS-AD registry:

  Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters" -Name "Type" -Value  "NTP"

• Then restart the NTP service with a command prompt on the MS-AD server:

  net stop w32time
  net start w32time

• Finally, update the DNS and Kerberos configuration of the Samba-AD server by updating the information about the new Windows server. To do this, modify the files /etc/hosts, /etc/resolv.conf and /etc/krb5.conf;

Final Checks

• Check the directory database in Samba-AD server:

samba-tool dbcheck --cross-ncs --fix --yes  --reset-well-known-acls 

Картинка с сайта: dev.to

Картинка с сайта: dev.to

1. Does Windows Server 2019 support SMB2?
2. How do I enable SMB 1 server 2019?
3. Is SMB enabled on server 2019?
4. What version of SMB does Windows Server 2019 use?
5. How do I enable Samba?
6. How do I create a shared file in Windows Server 2019?
7. What is the difference between SMB and Samba?

Does Windows Server 2019 support SMB2?

Thanks for your update. Guest access in SMB2 will be disabled by default in Windows Server 2019. Note: By enabling insecure guest logons, this setting reduces the security of Windows clients.

How do I enable SMB 1 server 2019?

Under Control Panel Home, select Turn Windows features on or off to open the Windows Features box. In the Windows Features box, scroll down the list, clear the check box for SMB 1.0/CIFS File Sharing Support and select OK. After Windows applies the change, on the confirmation page, select Restart now.

Is SMB enabled on server 2019?

What version of SMB does Windows Server 2019 use?

This topic describes the SMB 3 feature in Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, and Windows Server 2012—practical uses for the feature, the most significant new or updated functionality in this version compared to previous versions, and the hardware requirements.

How do I enable Samba?

How do I create a shared file in Windows Server 2019?

Right-Click the Folder you’d like to set Sharing and Open [Properties]. Next, move to [Sharing] tab and Click [Advanced Sharing] button. Check a box [Share this folder] and input any Share name you like on [Share name] field. Next, Click [Permissions] button.

What is the difference between SMB and Samba?

Samba is a free software re-implementation of the SMB networking protocol, and was originally developed by Andrew Tridgell. … The name Samba comes from SMB (Server Message Block), the name of the proprietary protocol used by the Microsoft Windows network file system.