root@freebsd:~ # samba-tool domain provision
\nRealm: TEST.JP
\n Domain [TEST]:
\n Server Role (dc, member, standalone) [dc]:
\n DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]:
\n DNS forwarder IP address (write ‘none’ to disable forwarding) [192.168.1.165]:
\nAdministrator password:
\nRetype password:
\nLooking up IPv4 addresses
\nLooking up IPv6 addresses
\nSetting up share.ldb
\nSetting up secrets.ldb
\nSetting up the registry
\nSetting up the privileges database
\nSetting up idmap db
\nSetting up SAM db
\nSetting up sam.ldb partitions and settings
\nSetting up sam.ldb rootDSE
\nPre-loading the Samba 4 and AD schema
\nUnable to determine the DomainSID, can not enforce uniqueness constraint on local domainSIDs<\/p>\n
Adding DomainDN: DC=test,DC=jp Issued Expires Principal root@freebsd:~ # samba-tool domain provision Realm: TEST.JP Domain [TEST]: Server Role (dc, member, standalone … \u7d9a\u304d\u3092\u8aad\u3080
\nAdding configuration container
\nSetting up sam.ldb schema
\nSetting up sam.ldb configuration data
\nSetting up display specifiers
\nModifying display specifiers and extended rights
\nAdding users container
\nModifying users container
\nAdding computers container
\nModifying computers container
\nSetting up sam.ldb data
\nSetting up well known security principals
\nSetting up sam.ldb users and groups
\nSetting up self join
\nAdding DNS accounts
\nCreating CN=MicrosoftDNS,CN=System,DC=test,DC=jp
\nCreating DomainDnsZones and ForestDnsZones partitions
\nPopulating DomainDnsZones and ForestDnsZones partitions
\nSetting up sam.ldb rootDSE marking as synchronized
\nFixing provision GUIDs
\nA Kerberos configuration suitable for Samba AD has been generated at \/var\/db\/samba4\/private\/krb5.conf
\nMerge the contents of this file with your system krb5.conf or replace it with this one. Do not create a symlink!
\nOnce the above files are installed, your Samba AD server will be ready to use
\nServer Role: active directory domain controller
\nHostname: freebsd
\nNetBIOS Domain: TEST
\nDNS Domain: test.jp
\nDOMAIN SID: S-1-5-21-1593849174-3160430826-2334651641
\nFreeBSD 13.0-CURRENT r349025 Samba4.8.12 Active Directory Domain Controller\u306e\u69cb\u7bc9<\/a>
\nroot@freebsd:~ # kinit administrator
\nadministrator@TEST.JP’s Password:
\nroot@freebsd:~ # klist
\nCredentials cache: FILE:\/tmp\/krb5cc_0
\n Principal: administrator@TEST.JP<\/p>\n
\nJun 17 19:47:20 2019 Jun 18 05:47:20 2019 krbtgt\/TEST.JP@TEST.JP
\nroot@freebsd:~ # samba-tool user add chibi
\nNote: samba-tool user add is deprecated. Please use samba-tool user create for the same function.
\nNew Password:
\nRetype Password:
\nUser ‘chibi’ created successfully
\nroot@freebsd:~ # wbinfo -u
\nTEST\\administrator
\nTEST\\guest
\nTEST\\krbtgt
\nTEST\\chibi
\nroot@freebsd:~ # wbinfo -n chibi
\nS-1-5-21-1593849174-3160430826-2334651641-1103 SID_USER (1)
\nroot@freebsd:~ # net ads info
\nLDAP server: 192.168.1.165
\nLDAP server name: freebsd.test.jp
\nRealm: TEST.JP
\nBind Path: dc=TEST,dc=JP
\nLDAP port: 389
\nServer time: Mon, 17 Jun 2019 19:48:09 JST
\nKDC server: 192.168.1.165
\nServer time offset: 0
\nLast machine account password change: Mon, 17 Jun 2019 19:46:18 JST
\nroot@freebsd:~ # host -4 freebsd
\nfreebsd.test.jp has address 192.168.1.165
\nfreebsd.test.jp has IPv6 address 2400:4052:46e0:b700:20c:29ff:fecf:8bce
\nroot@freebsd:~ # host -t SRV _ldap._tcp.test.jp
\n_ldap._tcp.test.jp has SRV record 0 100 389 freebsd.test.jp.
\nroot@freebsd:~ # host -t SRV _kerberos._udp.test.jp
\n_kerberos._udp.test.jp has SRV record 0 100 88 freebsd.test.jp.
\nroot@freebsd:~ # host -t A freebsd.test.jp.
\nfreebsd.test.jp has address 192.168.1.165
\nroot@freebsd:~ # smbclient -L localhost -U%
\nFreeBSD 13.0-CURRENT r349025 Samba4.8.12 Active Directory Domain Controller\u306e\u52d5\u4f5c\u78ba\u8a8d<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"