# alteratorctl components install samba-dc

# apt-get install task-samba-dc

# for service in smb nmb krb5kdc slapd bind; do systemctl disable $service; systemctl stop $service; done

# rm -f /etc/samba/smb.conf
# rm -rf /var/lib/samba
# rm -rf /var/cache/samba
# mkdir -p /var/lib/samba/sysvol

# hostnamectl set-hostname <имя узла>
# domainname <имя домена>

# hostnamectl set-hostname dc1.test.alt
# domainname test.alt

# samba-tool domain provision --realm=test.alt --domain=test \
--adminpass='Pa$$word' --dns-backend=SAMBA_INTERNAL \
--option="dns forwarder=8.8.8.8" --server-role=dc

# samba-tool domain provision --realm=test.alt --domain=test --adminpass='Pa$$word' --dns-backend=SAMBA_INTERNAL --option="dns forwarder=8.8.8.8" --option="ad dc functional level = 2016" --server-role=dc --function-level=2016

# samba-tool domain provision
Realm [TEST.ALT]:
Domain [TEST]:
Server Role (dc, member, standalone) [dc]:
DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]:
DNS forwarder IP address (write 'none' to disable forwarding) [127.0.0.1]: 8.8.8.8
Administrator password:
Retype password:
Looking up IPv4 addresses
Looking up IPv6 addresses
Setting up share.ldb
Setting up secrets.ldb
Setting up the registry
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
Adding DomainDN: DC=test,DC=alt
Adding configuration container
Setting up sam.ldb schema
Setting up sam.ldb configuration data
Setting up display specifiers
Modifying display specifiers and extended rights
Adding users container
Modifying users container
Adding computers container
Modifying computers container
Setting up sam.ldb data
Setting up well known security principals
Setting up sam.ldb users and groups
Setting up self join
Repacking database from v1 to v2 format (first record CN=Address-Book-Roots2,CN=Schema,CN=Configuration,DC=test,DC=alt)
Repack: re-packed 10000 records so far
Repacking database from v1 to v2 format (first record CN=nTFRSSettings-Display,CN=407,CN=DisplaySpecifiers,CN=Configuration,DC=test,DC=alt)
Repacking database from v1 to v2 format (first record CN=Remote Desktop Users,CN=Builtin,DC=test,DC=alt)
Adding DNS accounts
Creating CN=MicrosoftDNS,CN=System,DC=test,DC=alt
Creating DomainDnsZones and ForestDnsZones partitions
Populating DomainDnsZones and ForestDnsZones partitions
Repacking database from v1 to v2 format (first record DC=ForestDnsZones,DC=test.alt,CN=MicrosoftDNS,DC=DomainDnsZones,DC=test,DC=alt)
Repacking database from v1 to v2 format (first record CN=MicrosoftDNS,DC=ForestDnsZones,DC=test,DC=alt)
Setting up sam.ldb rootDSE marking as synchronized
Fixing provision GUIDs
A Kerberos configuration suitable for Samba AD has been generated at /var/lib/samba/private/krb5.conf
Merge the contents of this file with your system krb5.conf or replace it with this one. Do not create a symlink!
Once the above files are installed, your Samba AD server will be ready to use
Server Role:           active directory domain controller
Hostname:              dc1
NetBIOS Domain:        TEST
DNS Domain:            test.alt
DOMAIN SID:            S-1-5-21-1303430852-2161078951-3079987082

name_servers=127.0.0.1

# resolvconf -u

# systemctl enable --now samba

includedir /etc/krb5.conf.d/

[logging]
# default = FILE:/var/log/krb5libs.log
# kdc = FILE:/var/log/krb5kdc.log
# admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_kdc = true
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
 default_realm = TEST.ALT
# default_ccache_name = KEYRING:persistent:%{uid}

[realms]
TEST.ALT = {
  default_domain = test.alt
}

[domain_realm]
dc1 = TEST.ALT

# samba-tool domain info 127.0.0.1
Forest           : test.alt
Domain           : test.alt
Netbios domain   : TEST
DC name          : dc1.test.alt
DC netbios name  : DC
Server site      : Default-First-Site-Name
Client site      : Default-First-Site-Name

# smbclient -L localhost -Uadministrator
Password for [TEST\administrator]:

	Sharename       Type      Comment
	---------       ----      -------
	sysvol          Disk
	netlogon        Disk
	IPC$            IPC       IPC Service (Samba 4.20.8-alt1)
SMB1 disabled -- no workgroup available

# kinit administrator@TEST.ALT
Password for administrator@TEST.ALT:

# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: administrator@TEST.ALT

Valid starting       Expires              Service principal
25.03.2025 12:09:59  25.03.2025 22:09:59  krbtgt/TEST.ALT@TEST.ALT
	renew until 26.03.2025 12:09:56