joining freebsd to ad using samba/winbind

yeah i get it. the cool kids are all using sssd. but i tend to have problems with sssd and freebsd. i just wasted an hour of my life trying to get it working and it kept failing inside of a jail. so i set it up with samba / winbind instead by using the instructions from server-world.info to get it going.

i get worried that like my blogging, it will some day disappear so i’m going to put it here just in case i need it later. just a side note… it didn’t show this option which may come in handy so you don’t have to login as user+domain:

# smb4.conf

[global]
...
winbind use default domain = yes
...

 root@smb:~ # pkg install -y samba416 krb5 pam_mkhomedir

 root@smb:~ # vi /etc/krb5.conf
# create new

[libdefaults]
  # specify Realm
  default_realm = SRV.WORLD

# add to specify Realm and Hostname of AD
[realms]
  SRV.WORLD = {
    kdc = fd3s.srv.world
    admin_server = fd3s.srv.world
  }

root@smb:~ # vi /usr/local/etc/smb4.conf
# create new
# replace [realm] and [workgroup] for your environment

[global]
    kerberos method = secrets and keytab
    realm = SRV.WORLD
    workgroup = FD3S01
    security = ads
    template shell = /bin/sh
    winbind enum groups = Yes
    winbind enum users = Yes
    winbind separator = +
    idmap config * : rangesize = 1000000
    idmap config * : range = 1000000-19999999
    idmap config * : backend = autorid

root@smb:~ # vi /etc/nsswitch.conf
# change like follows

group: files winbind
group_compat: nis
hosts: files dns
netgroup: compat
networks: files
passwd: files winbind
passwd_compat: nis
shells: files
services: compat
services_compat: nis
protocols: files
rpc: files

root@smb:~ # vi /etc/resolv.conf
# change DNS setting to refer to AD

search srv.world
nameserver 10.0.0.100
root@smb:~ # vi /etc/pam.d/system
# add lines like follows

# auth
#auth           sufficient      pam_krb5.so             no_warn try_first_pass
#auth           sufficient      pam_ssh.so              no_warn try_first_pass
auth            sufficient      pam_winbind.so          try_first_pass
auth            required        pam_unix.so             no_warn try_first_pass nullok

# account
#account        required        pam_krb5.so
account         required        pam_login_access.so
account         sufficient      pam_winbind.so
account         required        pam_unix.so

# session
#session        optional        pam_ssh.so              want_agent
session         optional        pam_mkhomedir.so
session         required        pam_lastlog.so          no_fail

# password
#password       sufficient      pam_krb5.so             no_warn try_first_pass
password        required        pam_unix.so             no_warn try_first_pass

# set winbind auth for sshd, too

root@smb:~ # vi /etc/pam.d/sshd

# auth
#auth           sufficient      pam_krb5.so             no_warn try_first_pass
#auth           sufficient      pam_ssh.so              no_warn try_first_pass
auth            sufficient      pam_winbind.so          try_first_pass
auth            required        pam_unix.so             no_warn try_first_pass

# account
account         required        pam_nologin.so
#account        required        pam_krb5.so
account         required        pam_login_access.so
account         sufficient      pam_winbind.so
account         required        pam_unix.so

# session
#session        optional        pam_ssh.so              want_agent
session         optional        pam_mkhomedir.so
session         required        pam_permit.so

# password
#password       sufficient      pam_krb5.so             no_warn try_first_pass
password        required        pam_unix.so             no_warn try_first_pass

 # join in domain [-U (AD user)]

root@smb:~ # net ads join -U Administrator

Password for [FD3S01\Administrator]:
Using short domain name -- FD3S01
Joined 'SMB' to dns domain 'srv.world'
No DNS domain configured for smb. Unable to perform DNS Update.
DNS update failed: NT_STATUS_INVALID_PARAMETER
root@smb:~ # sysrc samba_server_enable="YES"

root@smb:~ # sysrc samba_enable="NO"

root@smb:~ # sysrc nmbd_enable="NO"

root@smb:~ # sysrc smbd_enable="NO"

root@smb:~ # sysrc winbindd_enable="YES"

root@smb:~ # service samba_server start

Performing sanity check on Samba configuration: OK
Starting winbindd.
# show domain info

root@smb:~ # net ads info

LDAP server: 10.0.0.100
LDAP server name: fd3s.srv.world
Realm: SRV.WORLD
Bind Path: dc=SRV,dc=WORLD
LDAP port: 389
Server time: Wed, 14 Feb 2024 14:35:28 JST
KDC server: 10.0.0.100
Server time offset: 2
Last machine account password change: Wed, 14 Feb 2024 14:16:16 JST

# show AD user list

root@smb:~ # wbinfo -u

FD3S01+administrator
FD3S01+guest
FD3S01+krbtgt
FD3S01+serverworld
FD3S01+aduser01

# create home root directory that name is the same with workgroup
# and verify possible to login with AD user

root@smb:~ # mkdir /home/FD3S01

root@smb:~ # exit


FreeBSD/amd64 (smb.srv.world) (ttyu0)

login: FD3S01+serverworld
Password:
FreeBSD 14.0-RELEASE (GENERIC) #0 releng/14.0-n265380-f9716eee8ab4: Fri Nov 10 05:57:23 UTC 2023

Welcome to FreeBSD!
.....
.....

FD3S01+serverworld@smb:/ $ id
uid=2001103(FD3S01+serverworld) gid=2000513(FD3S01+domain users) groups=2000513(FD3S01+domain users),2000512(FD3S01+domain admins),2000572(FD3S01+denied rodc password replication group),2001103(FD3S01+serverworld),2001104(FD3S01+esx admins)