NAME

       sadms - turn a Linux box into a domain controller
              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SADMS

       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

       What   to  do  ?   \fB-install  the  package's  dependencies  (this  may  be  carried  out
       automatically through apt, yum, urpmi and the likes) \fB-run precheck to ensure everything
       went  well  \fB-detect  the  data  \fB-fill  in  the remaining data \fB-optionally run the
       network,dns,Kerberos diagnostics \fB-run install \fB-you'll have to  wait  for  some  time
       until  Active  Directory  users are imported \fB-run install PAM if Active Directory users
       are        to        interactively        log        in        to        the         host.
       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

PRETESTS

       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

               This series of tests determine:

               - if Samba 3 is present on the host
               - if krb5-workstation package is present
               - if pam_mount is installed

               Note that the ./START script can guide you
               into installing the required libraries.
       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

DATA

       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

       DNS : This is the DNS suffix that your Active Directory operates on.

       realm : This is the Kerberos realm, usually the same as the DNS domain but in uppercase.

       kdc  :  This is a Domain Controller that delivers Kerberos tickets used in authentication.
       In case it is not found through DNS.  Also referred to as the  KDC  the  Key  Distribution
       Center.

       netbios  domain name : This is the (short) name for the domain, the way domains were named
       before Active Directory.

       netbios server name : This is the Netbios  name  of  the  Samba  host  you  are  currently
       configuring.  Though  this  is  by no means compulsory, it makes sense to provide the same
       name as the DNS, to be on the safe side.

       domain users group : The container for Domain Users. This  is  localized  and  is  'Domain
       users' in English, ´Utilisa. du domaine´ in French.

       hosts  allow  :  This points at the network that is allowed to access the Samba host being
       configured.  This parameter is a comma, space, or tab delimited set  of  hosts  which  are
       permitted  to  access  the Samba services. You can specify the hosts by name or IP number.
       You can also specify hosts by  network/netmask  pairs  and  by  netgroup  names.  See  man
       smb.conf for further reference.

       OU  to place host in : This is the Organizational Unit container the host to be configured
       will be placed in in Active Directory. This may vary with languages and is ´Computers´  in
       English.

       WINS  server  :  This specifies the IP address (or DNS name: IP address for preference) of
       the WINS server that the host should register with. This is optional and the data will  be
       placed  into  smb.conf  if  the  data  is non\fB-null. The line in smb.conf should then be
       commented out for the  parameter  to  be  disabled.domain  administrator  login  :  Active
       Directory  administrator login you are operating as. This is necessary for a host to enter
       a domain.

       domain administrator password : Active Directory administrator password.

       domain users group : The container for Domain Users. This  is  localized  and  is  'Domain
       users'       in       English,       ´Utilisa.       du      domaine´      in      French.
       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

PAM

       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

               This will configure system authentication
               (/etc/pam.d/system-auth) to use
                       - pam_winbind : use Active Directory
                         authentication, so the user does not have
                         to have a local account to login to this
                         host.
                       - pam_mkhomedir : create a local home
                         directory footprint for Active Directory
                         user that does not have a local home.
                       - pam_mount : connect to a Samba or Windows
                         remote share that could contain a domain
                         home. The share will be mounted on the local
                         file system (/mnt/net).

       Important note: Tampering with the /etc/pam.d service files  may  result  in  the  machine
       being  unable  to accept any authentication even from root. Should such a situation occur,
       reboot the system in administrative mode  (single)  and  use  an  editor  to  restore  the
       /etc/pam.d/system\fB-auth  to  its  previous contents : remove the pam_winbind, pam_mount,
       pam_Mkhomedir lines and remove use_first\fB-pass in pam_unix line.  It is recommended that
       the system administrator leave a console session open while carrying out the tests.

       Home  server  :  This  is  the  Samba or Windows server that hosts the share the user will
       connect to and will be mounted at /mnt/net.

       Home share : This is the name of the share (without any leading server name). If the share
       is to be determined at run time and is user- dependent, use * as a place\fB-holder for the
       logged\fB-on user name. Tests with more than one level have so far failed (eg users/*).

       Client signing : If you connect to a Windows 2003 server client signing my  be  necessary.
       smbfs  does  not  support  client  signing.   So use the cifs file system.  See the end of
       /etc/psecurity/pammount.conf.

                                        February 02, 2008                                sadms(1)