Configuring the Solaris SMB Server Operation Mode (Task Map)

The following table points to the tasks that you can use to configure the operation mode of the Solaris SMB server.

How to Configure the Solaris SMB Server in Domain Mode

This procedure describes how to use the smbadm join command to join an AD domain. To instead use the kclient command to manually join the domain, see How to Configure a Kerberos Client for an Active Directory Server in System Administration Guide: Security Services.

After successfully joining an AD domain, you can enable the Solaris SMB server to publish SMB shares in the AD directory. To do so, create or update SMB shares and specify the share container for each share that you want to publish. To create SMB shares, see How to Create an SMB Share (zfs).

Before You Begin

If the Samba service is running on the Oracle Solaris system, you must disable it. See How to Disable the Samba Service.

The Active Directory (AD) service is a Windows 2000 namespace that is integrated with the Domain Name Service (DNS). AD runs only on domain controllers. In addition to storing and making data available, AD protects network objects from unauthorized access and replicates objects across a network so that data is not lost if one domain controller fails.

For the Solaris SMB server to integrate seamlessly into a Windows AD environment, the following must exist on the network:

• A Windows AD domain controller

• An optional Active Directory DNS server that permits dynamic updates to use the dynamic DNS (DDNS) capability

The AD and DDNS clients rely on the Kerberos protocol to acquire the Kerberos ticket-granting ticket (TGT) for the specified AD domain. The system must be configured to use DNS for host lookup.

In order to participate in an AD domain, the system must be configured to use DNS for host lookup. Ensure that the /etc/nsswitch.conf and /etc/resolv.conf files are configured correctly for the appropriate AD domain.

In the /etc/krb5/krb5.conf file, specify the fully qualified AD domain name, in uppercase characters, as the default realm. Also, specify the fully qualified host name of the domain controller as the value for the kdc, admin_server, and kpasswd_server parameters.

The following example /etc/krb5/krb5.conf file is for an AD domain called EXAMPLE.COM, and the AD domain controller system is called dc.example.com. The fully qualified names are used for the domain and the domain controller.

[libdefaults]
   default_realm = EXAMPLE.COM

[realms]
   EXAMPLE.COM = {
       kdc = dc.example.com
       admin_server = dc.example.com
       kpasswd_server = dc.example.com
       kpasswd_protocol = SET_CHANGE
   }

[domain_realm]
   .example.com = EXAMPLE.COM

For descriptions of the sections and parameters used in this sample file, see the krb5.conf(4) man page and Configuring Kerberos Clients (Task Map) in System Administration Guide: Security Services.

1. Become an administrator, obtain the solaris.smf.value.shares and solaris.smf.manage.shares RBAC authorizations, or use the SMB Management RBAC profile.

   For more information, see How to Obtain Administrative Rights in System Administration Guide: Security Services.

2. Enable the Solaris SMB service.

   # svcadm enable -r smb/server

   When you specify the -r option, all services on which smb/server depends are started if they are not already running.

3. To successfully complete the join process, ensure that the system clock on the Oracle Solaris system is within five minutes of the system clock of the domain controller (DC).

   You can accomplish this task in one of these ways:

   • Manually adjust the system clock on either the Oracle Solaris system or the DC to match the other.
   • Configure both the Oracle Solaris system and the DC to use the same time source (NTP server).
   • Synchronize the system clock on the Oracle Solaris system with the system clock of the DC by running the following command on the Oracle Solaris system:

     # ntpdate DC-hostname

     For example, to synchronize with the DC called dc.westsales.example.com, type:

     # ntpdate dc.westsales.example.com

4. Join the Windows domain.

   # smbadm join -u username domain-name

   where username is the domain administrator or a user with Domain Administrator privileges, and domain-name is a fully qualified NetBIOS or DNS domain name.

Example 3-1 Configuring the Solaris SMB Server in Domain Mode

This example shows the steps taken to configure the Solaris SMB server in domain mode. User dana has Domain Administrator privileges. The name of the domain being joined is westsales.example.com.

# svcadm enable -r smb/server
# smbadm join -u dana westsales.example.com
After joining westsales.example.com the smb service will be restarted automatically.
Would you like to continue? [no]:
Enter domain password:
Joining 'westsales.example.com' ... this may take a minute ...
Successfully joined domain 'westsales.example.com'

How to Configure the Solaris SMB Server in Workgroup Mode

To create SMB shares, see How to Create an SMB Share (zfs).

If you change from workgroup mode to domain mode, or from domain mode to workgroup mode, you must restart the Solaris SMB server. To restart the server, run the svcadm restart smb/server command.

Before You Begin

If the Samba service is running on the Oracle Solaris system, you must disable it. See How to Disable the Samba Service.

1. Become an administrator, obtain the solaris.smf.value.shares and solaris.smf.manage.shares RBAC authorizations, or use the SMB Management RBAC profile.

   For more information, see How to Obtain Administrative Rights in System Administration Guide: Security Services.

2. Enable the Solaris SMB service.

   # svcadm enable -r smb/server

   This command enables the Solaris SMB server and any service on which it depends, such as the idmap service.

3. (Optional) Change the Solaris SMB server to operate in a different workgroup.

   By default, the Solaris SMB server operates in a workgroup called WORKGROUP.

   # smbadm join -w workgroup-name

4. Edit the /etc/pam.conf file to support creation of an encrypted version of the user's password for SMB.

   Add the following line to the end of the file:

   other    password required    pam_smb_passwd.so.1    nowarn

   See the pam_smb_passwd(5) man page.

5. Specify the password for existing local users.

   The Solaris SMB server cannot use the Oracle Solaris encrypted version of the local user's password for authentication. Therefore, you must generate an encrypted version of the local user's password for the Solaris SMB server to use. When the SMB PAM module is installed, the passwd command generates such an encrypted version of the password.

   # passwd username

Example 3-2 Configuring the Solaris SMB Server in Workgroup Mode

This example shows how to configure the Solaris SMB server in workgroup mode. The name of the workgroup being joined is myworkgroup.

# svcadm enable -r smb/server
# smbadm join -w myworkgroup

Then, create a share. See How to Create an SMB Share (zfs).

Finally, install the PAM module and generate the password for user cal.

# passwd cal

Now, you are ready to have SMB clients access the SMB shares on your Solaris SMB server.