微软输了反垄断案，被法院判决向samba项目贡献代码，samba与微软的战争结束，换来了samba4 十多年来的第一个正式版，完全兼容win2k至win8所有的客户端。

主流linux发行版里的samba4版本比较旧，debian wheezy用的也是beta2，其他都是alpha18，最新的fedora 18 自带了samba4正式版，但是使用的kerberos是MIT的，与samba4自带的heimdal kerberos有些出入，鉴于目前samba4的文档比较少，在redhat系的平台上，还是按照官方wiki说的做成功率比较高，也就是编译安装。

samba4内置了kerberos、dns和ldap，外加一个ntp就可以完成一个AD了。

环境：CentOS 6.3  x64

少废话，将经过测试和总结的精华写个脚本分享给大家，简单说明如下：

1、请根据需要修改【10-13行】，注意大小写；

2、主机名没有特别要求，非fqdn即可，不带域名的那种，比如samba；

3、samba4 AD 安装一步到位（加上启动脚本实际为2步，ntp请另行配置）

4、脚本可重复执行，除去下载，安装编译耗时约15分钟

5、配置文件位于/etc/samba，可执行文件和库文件都位于/usr/local/，

手册在/usr/share/samba，pid和lock都位于/var,日志位于/var/log/samba，做了日志轮转

#!/usr/bin/env bash # name = setup-samba4-ad.sh # author = purplegrape4@gmail.com # test under centos 6.3 mininal only , # at your own risk.  set -e  #------------------------------ realm=TEST.ORG domain=TEST adminpass="1q2w3edc4RFV" DomainName=test.org  #install development packages yum groupinstall "Development tools"  -y yum install python-devel ctdb-devel docbook-style-xsl libacl-devel readline-devel \     openssl-devel cups-devel libaio-devel pam-devel libtevent-devel libcap-devel \     expect libuuid-devel libtdb-devel quota-devel openldap-devel krb5-workstation -y  rm -rf samba-4.0.3*  #wget http://www.samba.org/ftp/samba/samba-4.0.3.tar.gz #wget http://192.168.122.1/pkg/samba-4.0.3.tar.gz  [ -f samba-4.0.3.tar.gz ] || wget http://www.samba.org/ftp/samba/samba-4.0.3.tar.gz [ -d samba-4.0.3 ] || tar zxvf samba-4.0.3.tar.gz  mkdir -p /etc/samba/private  cd samba-4.0.3 ./configure \     --enable-debug \     --enable-selftest \     --disable-cups \     --disable-gnutls \     --enable-fhs \     --prefix=/usr/local \     --sysconfdir=/etc \     --localstatedir=/var \     --datarootdir=/usr/share \     --with-privatedir=/etc/samba/private #   --with-aio-support make && make install  rm -rf /etc/samba/smb.conf samba-tool domain provision \     --realm=$realm \     --domain=$domain \     --workgroup=$DomainName \     --adminpass="$adminpass" \     --server-role=dc \     --use-rfc2307  cat /etc/samba/private/krb5.conf > /etc/krb5.conf echo "[kdc]" >>/etc/krb5.conf echo "check-ticket-address = false" >>/etc/krb5.conf  #/usr/sbin/samba -D #echo "/usr/local/sbin/samba -D" >>/etc/rc.local  curl http://192.168.122.1/samba4.init.sh >/etc/init.d/samba4 chmod 755 /etc/init.d/samba4 chkconfig --add samba4 chkconfig --level 2345 samba4 on /etc/init.d/samba4 start service iptables stop  echo domain $DomainName >/etc/resolv.conf echo nameserver 127.0.0.1 >>/etc/resolv.conf  #for rsyslog cat > /etc/rsyslog.d/samba.log <<SAMBA-LOG /var/log/samba/* {     notifempty     olddir /var/log/samba/old     missingok     sharedscripts     copytruncate } SAMBA-LOG  #DNS test host -t SRV _ldap._tcp.$DomainName. host -t SRV _kerberos._udp.$DomainName. host -t A $HOSTNAME.$DomainName.  service samba4 restart  sleep 10  #samba-client test smbclient --version smbclient -L localhost -U% smbclient //localhost/netlogon -U administrator -P $adminpass -c 'ls'  #kerberos test expect -c "    set timeout 5;    spawn kinit administrator@TEST.ORG    expect {        "Password*" {send \"$adminpass\r\";}    } expect eof;"  #echo please enter your passwd of administrator #kinit administrator@TEST.ORG klist  cat <<NOTE >&2#Warnning# #Remember to open the following ports in your iptables firewall #53         tcp/udp #88         tcp/udp #389        tcp/udp #464        tcp/udp #137        udp #138        udp #139        tcp #445        tcp #636        tcp #1024       tcp #3268       tcp #3269       tcp NOTE echo "Congratuations! everything done successful" #end of the script

samba4开机脚本/etc/init.d/samba4

#!/bin/sh # chkconfig: 2345 91 35 # description: Initialization script for Samba  #source function library . /etc/rc.d/init.d/functions  # Make sure the configuration file exists [ -f /etc/samba/smb.conf ] || exit 1  prog=samba pidfile=/var/run/samba/samba.pid lockfile=/var/lock/samba/samba RETVAL=0  samba_start() {     echo "Starting $prog: "     /usr/local/sbin/samba -D }  samba_stop() {     echo -n $"Stopping $prog: "     killproc -p ${pidfile} ${prog}     RETVAL=$?     echo     [ $RETVAL = 0 ] && rm -f ${lockfile} ${pidfile} }  samba_reload() {     echo -n \$"Reloading $prog: "     killproc -p ${pidfile} ${prog} -HUP     RETVAL=$?     echo }  # See how we were called case "$1" in     'start')         samba_start         ;;     'stop')         samba_stop         ;;     'restart')         samba_stop         sleep 1         samba_start         ;;     'reload')         samba_reload         ;;     *)         echo "Usage: $0 {start|stop|restart|reload}"          ;; esac

使用方法

chmod 755 /etc/init.d/samba4 chkconfig --add samba4 chkconfig --level 2345 samba4 on /etc/init.d/samba4 start

防火墙脚本也一并送上

#!/usr/bin/env bash # Name :firewall.sh # Authhor :purplegrape4@gmail.com # Description:setup a simple host-based iptables firewall  if [ "$(id -u)" != "0" ]; then    echo "This script is designed to run as root" 1>&2    exit 1 fi  #only one net card lan=192.168.0.0/16  # Load modules modprobe ip_tables modprobe iptable_filter modprobe ipt_REJECT modprobe ip_conntrack modprobe xt_limit modprobe xt_recent modprobe xt_state  # Flush the current iptables rules iptables -F iptables -X iptables -Z  # To prevent us blocked out of the server # Set the INPUT policy to ACCEPT for the moment iptables -P INPUT ACCEPT  # Allow related,established connection iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # Limit the speed of ping,1 package per second iptables -A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j ACCEPT  # Always trust lookback interface iptables -A INPUT -i lo -j ACCEPT  # Allow ssh but limit 10 new connections per minute # This will help to prevent too much password failure iptables -A INPUT -s $lan -p tcp --dport 22 -m recent --set --name ssh --rsource iptables -A INPUT -s $lan -p tcp --dport 22 -m recent ! --rcheck --seconds 60 --hitcount 10 --name ssh --rsource -j ACCEPT   # Open some port to local network only iptables -A INPUT -s $lan --dport 53 -j ACCEPT iptables -A INPUT -s $lan --dport 88 -j ACCEPT iptables -A INPUT -s $lan --dport 389 -j ACCEPT iptables -A INPUT -s $lan --dport 464 -j ACCEPT iptables -A INPUT -s $lan -p udp --dport 137 -j ACCEPT iptables -A INPUT -s $lan -p udp --dport 138 -j ACCEPTiptables -A INPUT -s $lan -p tcp --dport 135 -j ACCEPTiptables -A INPUT -s $lan -p tcp --dport 139 -j ACCEPT iptables -A INPUT -s $lan -p tcp --dport 445 -j ACCEPT iptables -A INPUT -s $lan -p tcp --dport 636 -j ACCEPT iptables -A INPUT -s $lan -p tcp --dport 1024 -j ACCEPT iptables -A INPUT -s $lan -p tcp --dport 3268 -j ACCEPT iptables -A INPUT -s $lan -p tcp --dport 3269 -j ACCEPT  iptables -A INPUT -s $lan -p udp --dport 123 -j ACCEPT   # Set the global polciy now iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT  # Drop some output request iptables -A OUTPUT -s 224.0.0.0/8 -j DROP iptables -A OUTPUT -d 224.0.0.0/8 -j DROP iptables -A OUTPUT -s 255.255.255.255/32 -j DROP iptables -A OUTPUT -m state --state INVALID -j DROP  # Save rules to /etc/sysconfig/iptables /etc/init.d/iptables save # Restart iptables service /etc/init.d/iptables restart # Show the final rules on the screen iptables -n -v -L

windows 客户端配置（以win2003为例）

"我的电脑" =>"属性" =>"计算机名" =>"更改" =>勾选"隶属于域"，填上test.org ,然后输入域管理员的用户名和密码即可。

linux客户端配置（以centos6为例）

在终端运行命令authconfig-tui，user information选择winbind，authentication选择winbind，但不要取消shadows passwords

Samba4 AD甚至可直接使用微软的工具进行管理，见samba官网wiki （点击进入）

顺带提点一下，本文仅为测试，实际环境中，会有潜在的风险，你懂的。

脚本运行结果，截图如下

update2013-02-27

更新samba版本为4.0.3

修正kerberos测试中的嵌入的expect脚本，从而消除脚本中唯一交互之处，实现完全自动。

update 2016-04-16

由于badlock漏洞，redhat已经将centos 6自带的samba4.0 升级至samba 4.2.10