202RodcServer - amagerard/Samba-AD GitHub Wiki
RedHat10/RodcServer.
| 01- Network | 02- RodcServer | 03- Settings | |
|---|---|---|---|
| 05- Software | 06- UsersShare | ||
| 10- GnomeShell | 11- TroubleShoots | 12- Selinux |
2. RodcServer.
An RODC is a read-only domain controller.
It will be used as a file server.
I need security groups for share permissions.
I was unable to retrieve the security groups from a file server integrated into the Samba-AD domain.
The rodc server correctly retrieves the UID and GID of Samba Ad users and groups.
2.1 Repository.
The installation made by samba.tranquil.it.
It's version 4.25 September, 2026.
https://samba.tranquil.it/redhat10/
The documentation is on the site.
https://samba.tranquil.it/doc/en/samba_config_server-server_rodc_redhat.html
Retrieve the RPM signature key and configure a YUM repository (sic):
wget -O /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-10 https://samba.tranquil.it/RPM-GPG-KEY-TISSAMBA-10
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-10
Edit tissamba.repo.
vi /etc/yum.repos.d/tissamba.repo
Add these lines.
[tis-samba]
name=tis-samba
baseurl=https://samba.tranquil.it/redhat10/samba-4.25/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-TISSAMBA-10
dnf update --allowerasing
2.2 Installation of RodcServer.
2.2.1 Install RodcServer.
dnf install samba samba-dc samba-winbind samba-winbind-clients krb5-workstation ldb-tools bind chrony bind-utils samba-client python3-markdown
Make a backup of samba
cp /etc/samba/smb.conf /etc/samba/smb.conf_ori
Delete smb.conf.
rm /etc/samba/smb.conf
Join the machine to the domain:
samba-tool domain join dw.learn.lan RODC -U DW.LEARN\\administrator
Edit /etc/samba/smb.conf, add the DNS forwarder:
vi /etc/samba/smb.conf
[global]
dns forwarder = 192.168.90.41
Restrict the RPC port range.
vi /etc/samba/smb.conf
[global]
rpc server dynamic port range = 50000-50500
Edit /etc/resolv.conf.
Delete all servername.
vi /etc/resolv.conf
nameserver 127.0.0.1
Change the DNS server permanently.
nmcli con mod eth0 ipv4.dns 127.0.0.1
Start the Samba service at startup.
systemctl enable samba
systemctl restart samba
Restart the machine.
reboot
2.2.2 Krb5.
FileServer Adjustment.
Settings kerberos.
Domain Name: dw.learn.lan.
Make a backup of krb5.conf.
cp /etc/krb5.conf /etc/krb5.conf_ori
Erase krb5.conf.
> /etc/krb5.conf
Edit krb5.conf.
vi /etc/krb5.conf
[libdefaults]
default_realm = DW.LEARN.LAN
dns_lookup_realm = false
dns_lookup_kdc = true
The Samba Domain Creation Script creates a /var/lib/samba/private/krb5.conf useless file.
It must be deleted and replaced by a symbolic link to the /etc/krb5.conf file.
rm -f /var/lib/samba/private/krb5.conf
ln -s /etc/krb5.conf /var/lib/samba/private/krb5.conf
Check samba AD.
kinit administrator
Password for [email protected]:
klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: [email protected]
Valid starting Expires Service principal
06/28/2026 00:44:13 06/28/2026 10:44:13 krbtgt/[email protected]
renew until 06/29/2026 00:44:08
nslookup thot.dw.learn.lan
Server: 192.168.40.47
Address: 192.168.40.47#53
Name: thot.dw.learn.lan
Address: 192.168.40.47
nslookup google.fr
Server: 192.168.40.47
Address: 192.168.40.47#53
Non-authoritative answer:
Name: google.fr
Address: 142.250.180.3
Name: google.fr
Address: 2a00:1450:400e:809::2003
2.2.3 Settings nsswicht.
vi /etc/nsswitch.conf
Add "winbind" for theses lines.
passwd: files systemd winbind
shadow: files systemd winbind
group: files systemd winbind
2.2.4 Disable netlogon and sysvol shares.
vi /etc/samba/smb.conf
[sysvol]
# path = /var/lib/samba/sysvol
# read only = No
[netlogon]
# path = /var/lib/samba/sysvol/dw.learn.lan/scripts
# read only = No
2.2.5 Provision domain users and groups.
Edit smb.conf.
vi /etc/samba/smb.conf
[global]
# Windows ACLs
acl_xattr:ignore system acls = yes
acl_xattr:default acl style = windows
# Activation of Windows ACL support
vfs objects = dfs_samba4, acl_xattr
map acl inherit = yes
store dos attributes = yes
Restart samba service.
systemctl restart samba
Find builtin group.
id "builtin\administrators"
uid=3000000(BUILTIN\administrators) gid=3000000(BUILTIN\administrators) groups=3000000(BUILTIN\administrators)
Find domain group.
id "DW.LEARN\administrators"
uid=3000017(DW.LEARN\administrators) gid=3000017(DW.LEARN\administrators) groups=3000017(DW.LEARN\administrators)
Find security group.
id "NT Authority\authenticated users"
uid=3000013(NT Authority\authenticated users) gid=3000013(NT Authority\authenticated users) groups=3000013(NT Authority\authenticated users)
id "NT Authority\system"
uid=3000053(NT Authority\system) gid=3000053(NT Authority\system) groups=3000053(NT Authority\system)
net rpc group list -U administrator
Domain Admins
Group Policy Creator Owners
Domain Controllers
Enterprise Read-only Domain Controllers
Enterprise Admins
Protected Users
Domain Computers
DnsUpdateProxy
Cert Publishers
RAS and IAS Servers
...
From a computer joined to the domain dw.learn.lan.
Open Active Directory Users and Computers.
Search OU Domain Controllers.
You have AOLES.
Open DNS.
Search in thot.dw.learn.lan and Forward Lookup Zones dw.learn.lan.
You have aoles Host(A) 192.168.60.49.
That means everything is ok.
Demote RodcServer.
A crash of the RODC server results in the loss of user UIDs and group GIDs.
Rebuilding the new RODC server will create new user UIDs and group GIDs.
Share permissions will be assigned to other users or groups.
Unless you previously backed up /var/lib/samba.
cd /var/lib
tar -cvf /home/teacher/samba.tar samba
But I haven't checked.
I recommend performing a full backup of the RODC server.
The command to remove an RODC.
Please note: this command must be executed on the server that is to be deleted.
samba-tool domain demote -Uadministrator