Ubuntu15.04とSamba4.3.0を使って、AD DCを構築する方法【その①】

$ tar xzvf samba-4.3.0.tar.gz
$ cd samba-4.3.0
$ ./configure
$ make
$ sudo make install

$ sudo ln -s /usr/local/samba/bin/samba-tool /usr/bin 
$ sudo mv /usr/bin/smbclient /usr/bin/smbclient3　//必要に応じて
$ sudo ln -s /usr/local/samba/bin/smbclient /usr/bin
$ sudo samba-tool domain provision

$ sudo apt-get install bind9
でbind9をインストールします。設定ファイルは/etc/bindに入っています。このうち、named.confの中身を次のようにします。
// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the
// structure of BIND configuration files in Debian, *BEFORE* you customize
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.default-zones";
include "/etc/bind/named.conf.local";
include "/usr/local/samba/private/named.conf";
include "/etc/bind/rndc.key";

$ sudo chown root:bind /usr/local/samba/private/named.conf
$ sudo chown root:bind -R /usr/local/samba/private/dns
または、sudo chown root:bind -R /usr/local/samba/privateで良いと思います。

tkey-gssapi-keytab "/usr/local/samba/private/dns.keytab"; //←必須①
allow-query { any; };
allow-recursion { any; };
forwarders { 192.168.1.1; }; //ルーターのアドレス、外部へのnameserverのIPアドレス
//dnssec-validation no;

michiaki@ubuntu01:~$ cat /etc/resolv.conf
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
# domain		it-ishin.com
nameserver 	127.0.0.1
nameserver 	192.168.1.2 //ホストのIPアドレス。必ず必要と言うものでもない。
nameserver 	192.168.1.1 //宅内のルーターのIPアドレス
search flets-east.jp iptvf.jp

● bind9.service - BIND Domain Name Server
   Loaded: loaded (/lib/systemd/system/bind9.service; enabled; vendor preset: enabled)
  Drop-In: /run/systemd/generator/bind9.service.d
           └─50-insserv.conf-$named.conf
   Active: active (running) since Tue 2015-10-20 13:04:29 JST; 3s ago
     Docs: man:named(8)
  Process: 4256 ExecStop=/usr/sbin/rndc stop (code=exited, status=0/SUCCESS)
  Main PID: 4261 (named)
  CGroup: /system.slice/bind9.service
           └─4261 /usr/sbin/named -f -u bind

Oct 20 13:04:29 ubuntu01 named[4261]: command channel listening on ::1#953
Oct 20 13:04:29 ubuntu01 named[4261]: managed-keys-zone: journal file is ou...le
Oct 20 13:04:29 ubuntu01 named[4261]: managed-keys-zone: loaded serial 53
Oct 20 13:04:29 ubuntu01 named[4261]: zone 0.in-addr.arpa/IN: loaded serial 1
Oct 20 13:04:29 ubuntu01 named[4261]: zone 127.in-addr.arpa/IN: loaded serial 1
Oct 20 13:04:29 ubuntu01 named[4261]: zone 255.in-addr.arpa/IN: loaded serial 1
Oct 20 13:04:29 ubuntu01 named[4261]: zone it-ishin.com/IN: loaded serial 2...17
Oct 20 13:04:29 ubuntu01 named[4261]: zone localhost/IN: loaded serial 2
Oct 20 13:04:29 ubuntu01 named[4261]: all zones loaded
Oct 20 13:04:29 ubuntu01 named[4261]: running

$ sudo service bind9 restart
$ host -t SRV _ldap._tcp.it-ishin.com.
_ldap._tcp.it-ishin.com has SRV record 0 100 389 ubuntu.it-ishin.com.
$ host -t SRV _ldap._tcp.dc._msdcs.it-ishin.com.
_ldap._tcp.dc._msdcs.it-ishin.com has SRV record 0 100 389 ubuntu.it-ishin.com.
$ host -t SRV _kerberos._udp.it-ishin.com.
_kerberos._udp.it-ishin.com has SRV record 0 100 88 ubuntu.it-ishin.com.
$ host -t A ubuntu01.it-ishin.com.
ubuntu.it-ishin.com has address 192.168.1.2

# vim:syntax=apparmor
# Last Modified: Fri Jun  1 16:43:22 2007
#include <tunables/global>

/usr/sbin/named {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  capability net_bind_service,
  capability setgid,
  capability setuid,
  capability sys_chroot,
  capability sys_resource,

  # /etc/bind should be read-only for bind
  # /var/lib/bind is for dynamically updated zone (and journal) files.
  # /var/cache/bind is for slave/stub data, since we're not the origin of it.
  # See /usr/share/doc/bind9/README.Debian.gz
  /etc/bind/** r,
  /var/lib/bind/** rw,
  /var/lib/bind/ rw,
  /var/cache/bind/** lrw,
  /var/cache/bind/ rw,

  # gssapi
  /etc/krb5.keytab kr,
  /etc/bind/krb5.keytab kr,

  # ssl
  /etc/ssl/openssl.cnf r,

  # GeoIP data files for GeoIP ACLs
  /usr/share/GeoIP/** r,

  # dnscvsutil package
  /var/lib/dnscvsutil/compiled/** rw,

  /proc/net/if_inet6 r,
  /proc/*/net/if_inet6 r,
  /usr/sbin/named mr,
  /{,var/}run/named/named.pid w,
  /{,var/}run/named/session.key w,
  # support for resolvconf
  /{,var/}run/named/named.options r,

  # some people like to put logs in /var/log/named/ instead of having
  # syslog do the heavy lifting.
  /var/log/named/** rw,
  /var/log/named/ rw,

  # Site-specific additions and overrides. See local/README for details.
  #include <local/usr.sbin.named>

  # Samba4 FLATFILE and Active Directory Zones (default source installation)
  /usr/local/samba/lib/** rw,
  /usr/local/samba/private/dns.keytab r,
  /usr/local/samba/private/named.conf r,
  /usr/local/samba/private/named.conf.update r,
  /usr/local/samba/private/dns/** rwk,
}

$ sudo kinit Administrator@IT-ISHIN.COM
Password for Administrator@IT-ISHIN.COM:
Warning: Your password will expire in 41 days on Wed Aug 28 02:44:10 2013
$ sudo klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: Administrator@it-ishin.com
Valid starting Expires Service principal 17/07/2013 09:32 17/07/2013 19:32 krbtgt
it-ishin.com@it-ishin.com
renew until 18/07/2013 09:32

#!/bin/bash
if [ -f /usr/local/samba/var/run/samba.pid ]; then
　　　　/bin/rm /usr/local/samba/var/run/samba.pid
　　　　killall samba　
fi
/usr/bin/sudo service bind9 stop
/usr/local/samba/sbin/samba
# service nmbd restart
sleep 5
/usr/bin/sudo service bind9 start