1 . https:\/\/bugzilla.samba.org\/show_bug.cgi?id=10265
\nIt\u2019s necessary to manually lower the domain and forest functional levels on the Windows 2012 server first, via Powershell:
\nSet-ADForestMode -Identity \u201cmydom.local\u201d -ForestMode Windows2008R2Forest
\nSet-ADDomainMode -Identity \u201cmydom.local\u201d -DomainMode Windows2008R2Domain
\n2. Need a fresh installed minimal CentOS 6.x OS . Disable SELinux and firewall . Update software packages .
\nPlease check above notes and do as it is . Lets start ,
\nPrimary AD ( Microsoft ) : 192.168.1.10 \/ ad.rmohan.com
\nSecondary DC (CentOS ) : 192.168.1.11 \/ ldap.rmohan.com
\nLogin to Linux server ,
\n# cat \/etc\/resolv.conf
\nsearch rmohan.com
\nnameserver 192.168.1.10
\nnameserver 192.168.1.11
\n# yum groupinstall \u201cdevelopment tools\u201d -y
\n# yum install python-devel libgnutls-dev gnutls-devel libacl1-dev libacl-devel libldap2-dev openldap-devel wget gcc gcc-c++ krb5-server krb5-workstation -y
\n# wget https:\/\/download.samba.org\/pub\/samba\/stable\/samba-4.5.0.tar.gz
\n# tar -xvzf samba-4.5.0.tar.gz
\n# cd samba-4.5.0
\n# .\/configure
\n# make
\n# make install
\nNow we successfully compiled Samba source package . We need to remove default samba configuration first then remount file system ( Some times AD join will popup an ACL error ) .
\n# rm -rf \/usr\/local\/samba\/etc\/smb.conf
\n# mount -o remount,acl,user_xattr \/dev\/mapper\/vg_ldap-lv_root
\nNow we are ready to add our Linux machine to Windows AD .
\n# \/usr\/local\/samba\/bin\/samba-tool domain join rmohan.com DC -Uadministrator \u2013realm=rmohan.com
\nNow we successfully added our linux system to Active directory as a Secondary DC . But we need to configure some more settings . Lets check authentication .
\nBefore that check both systems time (NTP) . If its not same authentication will get error .
\n# yum install ntp -y
\n# service ntpd start
\n# chkconfig ntpd on
\nAdd Our primary DC as NTP server .
\n# vi \/etc\/ntp.conf
\nserver ad.rmohan.com iburst
\n# service ntpd restart
\nNow we need to change Kerberos configuration file .
\n# rm -rf \/etc\/krb5.conf
\n# cp -vr \/usr\/local\/samba\/private\/krb5.conf \/etc\/krb5.conf
\n# kinit administrator@rmohan.com
\n# klist
\nFor successful AD replication we need to Add A record and CNAME record in Microsoft AD .
\n# \/usr\/local\/samba\/bin\/ldbsearch -H \/usr\/local\/samba\/private\/sam.ldb \u2018(invocationid=*)\u2019 \u2013cross-ncs objectguid
\n# record 1
\ndn: CN=NTDS Settings,CN=LDAP,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=example,DC=com
\nobjectGUID: 640bcd46-cbc3-4451-8d82-cb37a255cbe1
\n# record 2
\ndn: CN=NTDS Settings,CN=AD,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=example,DC=com
\nobjectGUID: 89f017ee-dacf-4d51-a19b-fe54da97a79a<\/p>\n
Copy that ObjectGUID and goto Microsoft Active directory .
\nFirst create A record for ldap.rmohan.com .
\nThen goto Forward Lookup Zone > _msdcs.rmohan.com .
\nCreate a CNAME here with our host objectGUID . In my case it is like below ,<\/p>\n
640bcd46-cbc3-4451-8d82-cb37a255cbe1 Alias(CNAME) ldap.rmohan.com
\nNow authentication is working fine .Now we need to start DC replication . Every user created by master or slave need to replicated .
\n# \/usr\/local\/samba\/sbin\/samba
\n# \/usr\/local\/samba\/bin\/samba-tool drs showrepl
\nDefault-First-Site-Name\\LDAP
\nDSA Options: 0x00000001
\nDSA object GUID: 640bcd46-cbc3-4451-8d82-cb37a255cbe1
\nDSA invocationId: 4c115875-28b5-4c91-bcf0-66f4d74d935b
\n==== INBOUND NEIGHBORS ====
\nDC=DomainDnsZones,DC=example,DC=com
\nDefault-First-Site-Name\\AD01 via RPC
\nDSA object GUID: 89f017ee-dacf-4d51-a19b-fe54da97a79a
\nLast attempt @ Tue Oct 11 03:13:07 2016 EDT was successful
\n0 consecutive failure(s).
\nLast success @ Tue Oct 11 03:13:07 2016 EDT
\nNow we can see that replication is working fine . Lets check now ,
\nList all AD users.
\n# \/usr\/local\/samba\/bin\/samba-tool user list
\nCreate new user in Active directory and check again . If its showing all is good. Your secondary server is ready to go .
\nList all member computers .
\n# \/usr\/local\/samba\/bin\/pdbedit -L -w | grep \u2018\\[[WI]\u2019<\/p>\n
This setup is very useful if you have single windows license and you need Active Directory replica . This is for you .
\nEnjoy .<\/p>\n","protected":false},"excerpt":{"rendered":"
1 . https:\/\/bugzilla.samba.org\/show_bug.cgi?id=10265 It\u2019s necessary to manually lower the domain and forest functional levels on the Windows 2012 server first, via Powershell: Set-ADForestMode -Identity \u201cmydom.local\u201d -ForestMode Windows2008R2Forest Set-ADDomainMode -Identity \u201cmydom.local\u201d -DomainMode Windows2008R2Domain 2. Need a fresh installed minimal CentOS 6.x OS . Disable SELinux and firewall . Update software packages . Please check above notes […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,59],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/6603"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6603"}],"version-history":[{"count":1,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/6603\/revisions"}],"predecessor-version":[{"id":6604,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/6603\/revisions\/6604"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6603"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6603"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6603"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}