When It's first installed, Samba4 autogenerates self-signed certificate
files(ca.pem, cert.pem, and key.pem). These files will be expired 700 days
after creation. With the following procedure, the certificate can be
renewed.
Suppose that the Domain Name is "example.lcl" and the fully qualified DC
hostname is "sambadc.example.lcl". I should also mention that the Linux
Distro I'm using is CentOS 8.
First, create certificate files using the openssl command;
# openssl req -newkey rsa:2048 -keyout EXLCL-Key.pem -nodes -x509 -days 730 -out EXLCL-Cert.pem
Generating a RSA private key
.........................................+++++
...........................................+++++
writing new private key to 'EXLCL-Key.pem' -----
You are about to be asked to enter information that
will be incorporated into your certificate request.
What you are about to enter is what is called a
Distinguished Name or a DN. There are quite a few
fields but you can leave some blank For some fields
there will be a default value, If you enter
'.', the field will be left blank. -----
Country Name (2 letter code) [AU]: TR
State or Province Name (full name) [Some-State]: Istanbul
Locality Name (eg, city) []: Istanbul
Organization Name (eg, company) [Internet Widgits Pty Ltd]: Example Ltd.
Organizational Unit Name (eg, section) []: Information Systems
Common Name (e.g. server FQDN or YOUR name) []: sambadc.example.lcl
Email Address []: admin@example.lcl
Copy certificate files to the location they should be;
# cp -fp EXTLC-*.pem /usr/local/samba/private/tls/
And the smb.conf file should look like this (pay particular attention to the tls parameters);
# cat /etc/samba/smb.conf
[global]
log level = 1
netbios name = SAMBADC
realm = EXAMPLE.LCL
server role = active directory domain controller
server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbindd, ntp_signd, kcc, dnsupdate
workgroup = EXAMPLE
tls enabled = yes
tls keyfile = tls/EXLCL-Key.pem
tls certfile = tls/EXLCL-Cert.pem
tls cafile =
[netlogon]
path = /usr/local/samba/var/locks/sysvol/example.lcl/scripts
read only = No
[sysvol]
path = /usr/local/samba/var/locks/sysvol
read only = No
Restart the Samba. Because I use systemd as the Service Manager;
# systemctl restart samba-ad-dc.service
Comments
Post a Comment