1. The key config of smb.conf :<\/p>\n
client use spnego = yes
\nclient signing = yes
\nrealm = YOUR.ADS.DOMAIN
\nsecurity = ADS<\/p>\n
;only used if the ads user will login the samba member\r\n;winbind uid = 10000-20000\r\n;winbind gid = 10000-20000\r\n;winbind enum groups = yes\r\n;winbind enum users = yes<\/pre>\n2. The \/etc\/krb5.conf<\/p>\n
[libdefaults]
\ndefault_realm = IEPCLAN.IE.CUHK.EDU.HK
\ndns_lookup_realm = false
\ndns_lookup_kdc = false
\nticket_lifetime = 24h
\nforwardable = yes<\/p>\n[realms]
\nYOUR.ADS.DOMAIN = {
\nkdc = ip.of.your.dc
\ndefault_domain = your.ads.domain
\n}<\/p>\n[domain_realm]
\n.your.ads.domain = YOUR.ADS.DOMAIN
\nyour.ads.domain = YOUR.ADS.DOMAIN<\/p>\n3. kinit administrator (enter the administrator password when prompted). The klist command should then list a ticket.<\/p>\n
4. edit \/etc\/hosts file, add your host ip and your.ads.domain if you got the below error :<\/p>\n
Using short domain name — YOURADDOMAIN
\nFailed to set servicePrincipalNames. Please ensure that
\nthe DNS domain of this server matches the AD domain,
\nOr rejoin with using Domain Admin credentials.
\nDeleted account for ‘HOSTNAME’ in realm ‘YOUR.AD.DOMAIN’
\nFailed to join domain: Type or value exists<\/p>\n5. net ads join -U Administrator<\/p>\n
6. store your winbind credentials with : net setauthuser -U winbind (enter winbind password in AD)<\/p>\n
7. restart samba and winbindd<\/p>\n
8. use wbinfo -u to check the winbindd works or not<\/p>\n
References :<\/p>\n