Samba 加入 Windows 域控制器 (PDC/AD) 完整實戰

前置條件

• Linux 主機已安裝 samba、winbind、krb5-client、oddjob-mkhomedir。
• 時間同步：域環境極度敏感，chronyd/ntpd 必須與 DC 時間差 < 5 分鐘。
• DNS 指向域控制器：/etc/resolv.conf nameserver 設為 DC IP。

核心配置文件

/etc/samba/smb.conf

[global]
    workgroup = EXAMPLE        # NetBIOS 域名 (短名)
    realm = EXAMPLE.COM        # Kerberos Realm (大寫)
    security = ads             # Active Directory 模式
    dedicated keytab file = /etc/krb5.keytab
    kerberos method = secrets and keytab
    winbind use default domain = yes
    winbind enum users = yes
    winbind enum groups = yes
    winbind nested groups = yes
    winbind refresh tickets = yes
    template shell = /bin/bash
    template homedir = /home/%U
    idmap config * : backend = tdb
    idmap config * : range = 10000-20000
    idmap config EXAMPLE : backend = rid
    idmap config EXAMPLE : range = 1000000-2000000
    # 可選：AD 站點優化
    # socket options = TCP_NODELAY IPTOS_LOWDELAY

/etc/krb5.conf

[libdefaults]
    default_realm = EXAMPLE.COM
    dns_lookup_realm = true
    dns_lookup_kdc = true
    ticket_lifetime = 24h
    renew_lifetime = 7d
    forwardable = true

[realms]
    EXAMPLE.COM = {
        kdc = dc1.example.com
        kdc = dc2.example.com
        admin_server = dc1.example.com
        default_domain = example.com
    }

[domain_realm]
    .example.com = EXAMPLE.COM
    example.com = EXAMPLE.COM

/etc/nsswitch.conf

passwd:     files winbind
group:      files winbind
shadow:     files winbind
hosts:      files dns

/etc/pam.d/system-auth (或 password-auth, common-auth)

auth        sufficient    pam_winbind.so use_first_pass krb5_auth krb5_ccache_type=FILE
auth        required      pam_deny.so
account     sufficient    pam_winbind.so
account     required      pam_permit.so
password    sufficient    pam_winbind.so use_authtok
password    required      pam_deny.so
session     required      pam_mkhomedir.so skel=/etc/skel umask=0077
session     optional      pam_winbind.so

加域操作步驟

# 1. 測試 Kerberos 認證
kinit administrator@EXAMPLE.COM
klist

# 2. 加入域 (Samba 4.13+ 推薦 net ads join)
net ads join -U administrator -D EXAMPLE.COM
# 輸入域管理員密碼，提示 "Joined 'EXAMPLE' domain" 即成功

# 3. 重啟服務
systemctl restart smb nmb winbind
systemctl enable --now smb nmb winbind oddjobd

# 4. 驗證
wbinfo -u | head           # 列出域用戶
wbinfo -g | head           # 列出域組
getent passwd administrator
id administrator@EXAMPLE.COM
net ads testjoin           # 測試信任關係

常見問題排查

進階：加入 AD 域並作為文件服務器

[data]
    path = /srv/data
    read only = no
    browsable = yes
    valid users = @"EXAMPLE\Domain Users"
    force group = +"EXAMPLE\DataGroup"
    create mask = 0660
    directory mask = 2770
    vfs objects = acl_xattr
    map acl inherit = yes

總結

關鍵五件套：時間同步 + DNS 指向 DC + kerberos 認證 (kinit) + net ads join + winbind/nsswitch/pam 串聯。配置完成後，Linux 即成為域信任成員，支持域用戶登錄、文件權限映射、Kerberos 單點登錄，實現異構環境無縫融合。