GNU/Linux ile, Microsoft domain ortamına Samba ile Active Directory uyumu ve desteği sağlamaktadır. CentOS 10 Stream üzerinden görelim…
CentOS Stream 10 ile Samba 4 Active Directory Domain Controller (AD DC) Kurulum Teknik Dokümanı:
Önemli Notlar: Bir DC kurulumuna başlamadan önce;
Minimal bir kurulum yapalım GUI olmadan
Kuruluma başlamadan önce test ortamımızın ağ ve kimlik bilgileri şu şekilde yapılandırılmıştır:
sudo timedatectl set-timezone Europe/Istanbul && timedatectl
DİKKAT! Network ve sistem mimarisi açısından son derece kritik ve haklı bir uyarı vardır. Oda birçok sistem yöneticisi geçmiş alışkanlıklarla iç ağlarda .local uzantısını kullansa da, modern network yapılarında bu durum ciddi protokol çakışmalarına ve ağda kararsızlıklara yol açar.
Bu durumun teknik nedenlerini ve perde arkasında ne tür sorunlara yol açtığını şu şekilde açabiliriz:
İnternet Mühendisliği Görev Gücü (IETF), RFC 6762 standartı ile .local uzantısını resmi olarak mDNS (Multicast DNS) protokolüne tahsis etmiştir.
Linux dünyasında mDNS/DNS-SD (Service Discovery) standartlarını uygulayan arka plan servisinin adı Avahi'dir (Windows'taki mDNS servisleri veya Apple'daki Bonjour ile aynı mantıkta çalışır).
Eğer Active Directory domain adınızı sirket.local yaparsanız, ağdaki işletim sistemleri (özellikle Linux istemciler, Mac'ler ve hatta güncel Windows 10/11 sürümleri) bir kafa karışıklığı yaşar:
Microsoft ve Linux toplulukları, iç ağlarda (internal) bağımsız ve çakışmayacak şu suffix'lerin (uzantıların) kullanılmasını önerir:
Özetle; Active Directory kurulumunda .local kullanmak, temeli baştan mDNS protokolüyle kavgalı bir altyapı kurmak anlamına gelir. Laboratuvar ortamımızda bu riski sıfırlamak için dokümandaki gibi abc.lcl veya abc.lan üzerinden ilerlemek en doğru yaklaşımdır.
CentOS 10'da varsayılan olarak etkin gelen NetworkManager’ın nmtui aracıyla (komutuyla) bu IP, network, DNS, hostname ayarlarını yapabilir ve ardından systemctl restart NetworkManager komutuyla servisi yeniden başlatarak etkinleştirebilirsiniz.
1- Samba gibi rollerin paket ve bağımlılıklarının yüklenebilmesi için gerekli içeriğe sahip EPEL ve CRB (PowerTools olarak da bilinir) adlı repoları aktif edin ve Development Tools’u yükleyin. (Bunlara, varsa subscription-manager’ı, kendi config dosyasından kapatarak başlayabilirsiniz.)
sudo nano /etc/yum/pluginconf.d/subscription-manager.conf
enabled=0
sudo dnf update -y && sudo dnf install epel-release -y && dnf config-manager --set-enabled crb && sudo dnf update -y && sudo dnf groups install "Development Tools" -y
Samba AD DC mimarisinde DNS çözünürlüğü ve zaman senkronizasyonu (NTP) hayati önem taşır. Kerberos protokolü, sunucular arasında 5 dakikadan fazla zaman farkı olması durumunda kimlik doğrulamayı reddeder.
Bash
sudo hostnamectl set-hostname dc1.abc.lcl
Ağ arabirimi düşse bile yerel isim çözümlemenin çalışması için dosyayı şu şekilde düzenleyin:
Bash
sudo nano /etc/hosts
İçerik aşağıdaki gibi olmalıdır:
Plaintext
127.0.0.1 localhost localhost.localdomain
172.16.1.30 dc1.abc.lcl dc1
CentOS Stream 10 üzerinde nmtui arayüzünü veya doğrudan nmcli komutlarını kullanarak ağınızı yapılandırın. DNS satırında sunucunun kendi IP'sinin ilk sırada olduğundan emin olun:
Bash
# Bağlantı adını öğrenin (Örn: ens160 veya eth0)
nmcli connection show
# Statik IP, Gateway ve DNS yapılandırmasını uygulayın
sudo nmcli connection modify ens160 ipv4.addresses 172.16.1.30/24
sudo nmcli connection modify ens160 ipv4.gateway 172.16.1.1
sudo nmcli connection modify ens160 ipv4.dns "172.16.1.30 1.1.1.1"
sudo nmcli connection modify ens160 ipv4.method manual
sudo nmcli connection up ens160
[root@dclnx ~]# timedatectl
Local time: Mon 2026-06-01 23:02:00 +03
Universal time: Mon 2026-06-01 20:02:00 UTC
RTC time: Mon 2026-06-01 20:02:00
Time zone: Europe/Istanbul (+03, +0300)
System clock synchronized: yes
NTP service: active
RTC in local TZ: no
sudo timedatectl set-timezone Europe/Istanbul
[root@dclnx ~]# dnf install epel-release -y
Last metadata expiration check: 0:18:07 ago on Mon 01 Jun 2026 10:34:57 PM +03.
Dependencies resolved.
=======================================================================
Package Arch Version Repository Size
=======================================================================
Installing:
epel-release noarch 10-5.el10s extras-common 18 k
Transaction Summary
=======================================================================
Install 1 Package
Total download size: 18 k
Installed size: 25 k
Downloading Packages:
epel-release-10-5.el10s.noarch.rpm 54 kB/s | 18 kB 00:00
-----------------------------------------------------------------------
Total 17 kB/s | 18 kB 00:01
CentOS Stream 10 - Extras packages 2.1 MB/s | 2.1 kB 00:00
Importing GPG key 0x1D997668:
Userid : "CentOS Extras SIG (https://wiki.centos.org/SpecialInterestGroup) <security@centos.org>"
Fingerprint: 363F C097 2F64 B699 AED3 968E 1FF6 A217 1D99 7668
From : /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Extras-SHA512
warning: Certificate 1FF6A2171D997668:
Policy rejects subkey 8B5C8111FCA5D0FF: Policy rejected non-revocation signature (PrimaryKeyBinding) requiring second pre-image resistance, bec
ause SHA1 is not considered secure
Key imported successfully
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : epel-release-10-5.el10s.noarch 1/1
Running scriptlet: epel-release-10-5.el10s.noarch 1/1
Many EPEL packages require the CodeReady Builder (CRB) repository.
It is recommended that you run /usr/bin/crb enable to enable the CRB repository.
Installed:
epel-release-10-5.el10s.noarch
Complete!
Epel-release deposunu aktif hale getirelim.
[root@dclnx ~]# dnf update -y
Extra Packages for Enterprise Linux 10 - x86_64 2.5 MB/s | 6.8 MB 00:02
Last metadata expiration check: 0:00:01 ago on Mon 01 Jun 2026 10:54:37 PM +03.
Dependencies resolved.
=================================================================================================================================================
Package Architecture Version Repository Size
=================================================================================================================================================
Installing:
kernel x86_64 6.12.0-233.el10 baseos 418 k
Upgrading:
crypto-policies noarch 20260525-1.gitf5f5370.el10 baseos 96 k
crypto-policies-scripts noarch 20260525-1.gitf5f5370.el10 baseos 129 k
epel-release noarch 10-7.el10_1 epel 19 k
ipset x86_64 7.22-11.el10 baseos 44 k
ipset-libs x86_64 7.22-11.el10 baseos 68 k
iptables-libs x86_64 1.8.11-14.el10 baseos 448 k
iptables-nft x86_64 1.8.11-14.el10 appstream 200 k
kernel-tools x86_64 6.12.0-233.el10 baseos 1.0 M
kernel-tools-libs x86_64 6.12.0-233.el10 baseos 434 k
libsolv x86_64 0.7.33-5.el10 baseos 428 k
libtasn1 x86_64 4.20.0-5.el10 baseos 74 k
libxml2 x86_64 2.12.5-11.el10 baseos 691 k
policycoreutils x86_64 3.10-3.el10 baseos 270 k
qemu-guest-agent x86_64 18:10.1.0-19.el10 appstream 470 k
vim-data noarch 2:9.1.083-13.el10 baseos 17 k
vim-minimal x86_64 2:9.1.083-13.el10 baseos 798 k
Installing dependencies:
kernel-core x86_64 6.12.0-233.el10 baseos 18 M
kernel-modules x86_64 6.12.0-233.el10 baseos 41 M
kernel-modules-core x86_64 6.12.0-233.el10 baseos 29 M
kernel-modules-extra x86_64 6.12.0-233.el10 baseos 1.9 M
Transaction Summary
=================================================================================================================================================
Install 5 Packages
Upgrade 16 Packages
Total download size: 95 M
Downloading Packages:
(1/21): kernel-6.12.0-233.el10.x86_64.rpm 665 kB/s | 418 kB 00:00
(2/21): kernel-core-6.12.0-233.el10.x86_64.rpm 2.4 MB/s | 18 MB 00:07
(3/21): kernel-modules-core-6.12.0-233.el10.x86_64.rpm 3.8 MB/s | 29 MB 00:07
(4/21): kernel-modules-extra-6.12.0-233.el10.x86_64.rpm 2.0 MB/s | 1.9 MB 00:00
(5/21): crypto-policies-20260525-1.gitf5f5370.el10.noarch.rpm 828 kB/s | 96 kB 00:00
(6/21): crypto-policies-scripts-20260525-1.gitf5f5370.el10.noarch.rpm 970 kB/s | 129 kB 00:00
(7/21): ipset-7.22-11.el10.x86_64.rpm 361 kB/s | 44 kB 00:00
(8/21): ipset-libs-7.22-11.el10.x86_64.rpm 588 kB/s | 68 kB 00:00
(9/21): iptables-libs-1.8.11-14.el10.x86_64.rpm 2.1 MB/s | 448 kB 00:00
(10/21): kernel-tools-libs-6.12.0-233.el10.x86_64.rpm 2.6 MB/s | 434 kB 00:00
(11/21): kernel-modules-6.12.0-233.el10.x86_64.rpm 4.4 MB/s | 41 MB 00:09
(12/21): kernel-tools-6.12.0-233.el10.x86_64.rpm 1.7 MB/s | 1.0 MB 00:00
(13/21): libsolv-0.7.33-5.el10.x86_64.rpm 1.4 MB/s | 428 kB 00:00
(14/21): libtasn1-4.20.0-5.el10.x86_64.rpm 603 kB/s | 74 kB 00:00
(15/21): vim-data-9.1.083-13.el10.noarch.rpm 133 kB/s | 17 kB 00:00
(16/21): libxml2-2.12.5-11.el10.x86_64.rpm 2.6 MB/s | 691 kB 00:00
(17/21): policycoreutils-3.10-3.el10.x86_64.rpm 1.0 MB/s | 270 kB 00:00
(18/21): vim-minimal-9.1.083-13.el10.x86_64.rpm 3.9 MB/s | 798 kB 00:00
(19/21): epel-release-10-7.el10_1.noarch.rpm 54 kB/s | 19 kB 00:00
[MIRROR] qemu-guest-agent-10.1.0-19.el10.x86_64.rpm: Status code: 404 for https://mirror.netzwerge.de/centos-stream/10-stream/AppStream/x86_64/os
/Packages/qemu-guest-agent-10.1.0-19.el10.x86_64.rpm (IP: 185.41.106.155)
[MIRROR] iptables-nft-1.8.11-14.el10.x86_64.rpm: Status code: 404 for https://mirror.netzwerge.de/centos-stream/10-stream/AppStream/x86_64/os/Pac
kages/iptables-nft-1.8.11-14.el10.x86_64.rpm (IP: 185.41.106.155)
[MIRROR] qemu-guest-agent-10.1.0-19.el10.x86_64.rpm: Status code: 404 for http://mirror.netzwerge.de/centos-stream/10-stream/AppStream/x86_64/os/
Packages/qemu-guest-agent-10.1.0-19.el10.x86_64.rpm (IP: 185.41.106.155)
[MIRROR] iptables-nft-1.8.11-14.el10.x86_64.rpm: Status code: 404 for http://mirror.netzwerge.de/centos-stream/10-stream/AppStream/x86_64/os/Pack
ages/iptables-nft-1.8.11-14.el10.x86_64.rpm (IP: 185.41.106.155)
(20/21): iptables-nft-1.8.11-14.el10.x86_64.rpm 142 kB/s | 200 kB 00:01
(21/21): qemu-guest-agent-10.1.0-19.el10.x86_64.rpm 326 kB/s | 470 kB 00:01
-------------------------------------------------------------------------------------------------------------------------------------------------
Total 7.8 MB/s | 95 MB 00:12
Extra Packages for Enterprise Linux 10 - x86_64 1.6 MB/s | 1.6 kB 00:00
Importing GPG key 0xE37ED158:
Userid : "Fedora (epel10) <epel@fedoraproject.org>"
Fingerprint: 7D8D 15CB FC4E 6268 8591 FB26 33D9 8517 E37E D158
From : /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-10
Key imported successfully
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : kernel-modules-core-6.12.0-233.el10.x86_64 1/37
Installing : kernel-core-6.12.0-233.el10.x86_64 2/37
Running scriptlet: kernel-core-6.12.0-233.el10.x86_64 2/37
Installing : kernel-modules-6.12.0-233.el10.x86_64 3/37
Running scriptlet: kernel-modules-6.12.0-233.el10.x86_64 3/37
Installing : kernel-modules-extra-6.12.0-233.el10.x86_64 4/37
Running scriptlet: kernel-modules-extra-6.12.0-233.el10.x86_64 4/37
Upgrading : vim-data-2:9.1.083-13.el10.noarch 5/37
Upgrading : libxml2-2.12.5-11.el10.x86_64 6/37
Upgrading : kernel-tools-libs-6.12.0-233.el10.x86_64 7/37
Running scriptlet: kernel-tools-libs-6.12.0-233.el10.x86_64 7/37
Upgrading : iptables-libs-1.8.11-14.el10.x86_64 8/37
Upgrading : ipset-libs-7.22-11.el10.x86_64 9/37
Running scriptlet: crypto-policies-20260525-1.gitf5f5370.el10.noarch 10/37
Upgrading : crypto-policies-20260525-1.gitf5f5370.el10.noarch 10/37
Running scriptlet: crypto-policies-20260525-1.gitf5f5370.el10.noarch 10/37
Upgrading : crypto-policies-scripts-20260525-1.gitf5f5370.el10.noarch 11/37
Upgrading : ipset-7.22-11.el10.x86_64 12/37
Upgrading : iptables-nft-1.8.11-14.el10.x86_64 13/37
Running scriptlet: iptables-nft-1.8.11-14.el10.x86_64 13/37
Upgrading : kernel-tools-6.12.0-233.el10.x86_64 14/37
Upgrading : libsolv-0.7.33-5.el10.x86_64 15/37
Upgrading : vim-minimal-2:9.1.083-13.el10.x86_64 16/37
Installing : kernel-6.12.0-233.el10.x86_64 17/37
Upgrading : epel-release-10-7.el10_1.noarch 18/37
Running scriptlet: epel-release-10-7.el10_1.noarch 18/37
Upgrading : qemu-guest-agent-18:10.1.0-19.el10.x86_64 19/37
Running scriptlet: qemu-guest-agent-18:10.1.0-19.el10.x86_64 19/37
Upgrading : policycoreutils-3.10-3.el10.x86_64 20/37
Running scriptlet: policycoreutils-3.10-3.el10.x86_64 20/37
Upgrading : libtasn1-4.20.0-5.el10.x86_64 21/37
Cleanup : crypto-policies-scripts-20260216-1.git0e54016.el10.noarch 22/37
Running scriptlet: ipset-7.22-10.el10.x86_64 23/37
Cleanup : ipset-7.22-10.el10.x86_64 23/37
Cleanup : libsolv-0.7.33-2.el10.x86_64 24/37
Cleanup : iptables-nft-1.8.11-13.el10.x86_64 25/37
Running scriptlet: iptables-nft-1.8.11-13.el10.x86_64 25/37
Cleanup : kernel-tools-6.12.0-231.el10.x86_64 26/37
Cleanup : vim-minimal-2:9.1.083-11.el10.x86_64 27/37
Cleanup : vim-data-2:9.1.083-11.el10.noarch 28/37
Cleanup : crypto-policies-20260216-1.git0e54016.el10.noarch 29/37
Cleanup : epel-release-10-5.el10s.noarch 30/37
Cleanup : kernel-tools-libs-6.12.0-231.el10.x86_64 31/37
Running scriptlet: kernel-tools-libs-6.12.0-231.el10.x86_64 31/37
Cleanup : iptables-libs-1.8.11-13.el10.x86_64 32/37
Cleanup : libxml2-2.12.5-10.el10.x86_64 33/37
Cleanup : ipset-libs-7.22-10.el10.x86_64 34/37
Running scriptlet: qemu-guest-agent-18:10.1.0-18.el10.x86_64 35/37
Cleanup : qemu-guest-agent-18:10.1.0-18.el10.x86_64 35/37
Running scriptlet: qemu-guest-agent-18:10.1.0-18.el10.x86_64 35/37
Running scriptlet: policycoreutils-3.10-2.el10.x86_64 36/37
Cleanup : policycoreutils-3.10-2.el10.x86_64 36/37
Cleanup : libtasn1-4.20.0-1.el10.x86_64 37/37
Running scriptlet: kernel-modules-core-6.12.0-233.el10.x86_64 37/37
Running scriptlet: kernel-core-6.12.0-233.el10.x86_64 37/37
Running scriptlet: kernel-modules-6.12.0-233.el10.x86_64 37/37
Running scriptlet: crypto-policies-scripts-20260525-1.gitf5f5370.el10.noarch 37/37
Running scriptlet: libtasn1-4.20.0-1.el10.x86_64 37/37
Upgraded:
crypto-policies-20260525-1.gitf5f5370.el10.noarch crypto-policies-scripts-20260525-1.gitf5f5370.el10.noarch
epel-release-10-7.el10_1.noarch ipset-7.22-11.el10.x86_64
ipset-libs-7.22-11.el10.x86_64 iptables-libs-1.8.11-14.el10.x86_64
iptables-nft-1.8.11-14.el10.x86_64 kernel-tools-6.12.0-233.el10.x86_64
kernel-tools-libs-6.12.0-233.el10.x86_64 libsolv-0.7.33-5.el10.x86_64
libtasn1-4.20.0-5.el10.x86_64 libxml2-2.12.5-11.el10.x86_64
policycoreutils-3.10-3.el10.x86_64 qemu-guest-agent-18:10.1.0-19.el10.x86_64
vim-data-2:9.1.083-13.el10.noarch vim-minimal-2:9.1.083-13.el10.x86_64
Installed:
kernel-6.12.0-233.el10.x86_64 kernel-core-6.12.0-233.el10.x86_64 kernel-modules-6.12.0-233.el10.x86_64
kernel-modules-core-6.12.0-233.el10.x86_64 kernel-modules-extra-6.12.0-233.el10.x86_64
Complete!
[root@dclnx ~]# cat /etc/resolv.conf
# Generated by NetworkManager
search dclnx.salvador.lan salvador.lan
nameserver 192.168.0.25
nameserver 8.8.8.8 # burası ikinci bir dns neden gerekli internetten gerekli paketlerin yüklenmesi ve güncellenmesi için lazımdır.
2- Repolar hazır olduğuna göre Samba’nın bağımlılıklarını içeren paketleri yükleyebilirsiniz.
[root@dclnx ~]# dnf repolist
repo id repo name
appstream CentOS Stream 10 - AppStream
baseos CentOS Stream 10 - BaseOS
epel Extra Packages for Enterprise Linux 10 - x86_64
extras-common CentOS Stream 10 - Extras packages
[root@dclnx ~]# dnf config-manager --set-enabled crb
[root@dclnx ~]# dnf update -y
CentOS Stream 10 - BaseOS 21 kB/s | 15 kB 00:00
CentOS Stream 10 - AppStream 40 kB/s | 15 kB 00:00
CentOS Stream 10 - CRB 567 kB/s | 840 kB 00:01
Dependencies resolved.
Nothing to do.
Complete!
[root@dclnx ~]# dnf install epel-release -y
Last metadata expiration check: 0:00:27 ago on Mon 01 Jun 2026 11:09:02 PM +03.
Package epel-release-10-7.el10_1.noarch is already installed.
Dependencies resolved.
Nothing to do.
Complete!
[root@dclnx ~]# dnf update -y
Last metadata expiration check: 0:00:29 ago on Mon 01 Jun 2026 11:09:02 PM +03.
Dependencies resolved.
Nothing to do.
Complete!
dnf groups install "Development Tools" -y
sudo dnf install krb5-devel krb5-workstation cups-devel iniparser python-devel gnutls-devel libacl-devel openldap-devel pam-devel readline-devel gpgme-devel jansson-devel keyutils-libs-devel libaio-devel libarchive-devel libattr-devel libblkid-devel libtasn1 libtasn1-tools libxml2-devel libxslt lmdb-devel perl perl-ExtUtils-MakeMaker perl-Parse-Yapp popt-devel python3-cryptography python3-dns python3-gpg python3-markdown rpcgen systemd-devel zlib-devel dbus-devel perl-JSON tar -y
Not: Paketler zaman içerisinde isim veya durum (var/yok) değişikliği yaşayabilirler.
3- Samba’nın son versiyonunu /opt veya /tmp gibi bir dizine, wget ile indirin ve inen arşiv dosyasını extract edin (açın). Extract edildikten sonra samba-x.y.z adlı dizine girin. (Komutlardaki Samba versiyonu 4.18.4'tür. Varsa, daha yenisini indirmek için değiştirebilirsiniz.)
cd /opt && sudo wget https://download.samba.org/pub/samba/stable/samba-4.18.4.tar.gz && sudo tar xzfv samba-4.18.4.tar.gz && cd samba-4.18.4/
Samba 4 AD DC kurarken iki seçeneğimiz vardır: Kaynak koddan derlemek veya Resmi repolardan kurmak. Kurumsal ortamlarda güvenlik güncellemelerini kolay yönetebilmek adına güncel DNF paket havuzunu kullanmak en sağlıklı yöntemdir. CentOS Stream 10 üzerinde gerekli paketler EPEL ve CRB depolarında yer alır.
Bash
sudo dnf install epel-release -y
sudo dnf config-manager --set-enabled crb
sudo dnf update -y
CentOS Stream 10 (RHEL 10 mimarisi) üzerinde Samba'yı doğrudan AD Domain Controller modunda çalıştıracak tüm servis ve kütüphaneleri yüklüyoruz:
Bash
sudo dnf install samba samba-dc samba-client krb5-workstation krb5-server bind-utils -y
4- Samba dizinindeyken aşağıdaki adımlarla Samba’nın yüklemesine (compile edilmesine) başlayın.
sudo ./configure && sudo make -j 2 && sudo make install
Samba paketleri kurulduğunda varsayılan olarak standart bir dosya paylaşım (file server) konfigürasyonu ile gelir. Bunu tamamen temizleyip sıfırdan bir Active Directory yapısı inşa edeceğiz.
Bash
sudo systemctl stop samba smb nmb winbind 2>/dev/null
sudo rm -f /etc/samba/smb.conf
Aşağıdaki komutu çalıştırarak Samba'nın sihirbazını başlatın:
Bash
sudo samba-tool domain provision --use-rfc2307 --interactive
Sihirbaz Esnasında Girilecek Değerler:
5- Kurulumlardan sonra samba-tool gibi komutların path’siz belirtilebilmesi/bulunabilmesi için kullandığınız shell’e, Samba’nın lokasyonlarını öğretin. Yani ortam değişkenlerini tanımlayın. Kalıcı olmaları adına, komutları kullanacak olan kullanıcının shell profiline ekleyin.
Samba provision esnasında bizim için en doğru Kerberos ayarlarını üretir. Sistem genelindeki eski dosyanın yerine bunu sembolik link (veya kopyalama) ile yerleştiriyoruz:
Bash
sudo mv /etc/krb5.conf /etc/krb5.conf.bak
sudo cp /var/lib/samba/private/krb5.conf /etc/krb5.conf
Geleneksel smb ve nmb servisleri dosya paylaşımı içindir. Bir Domain Controller mimarisinde bu servisler maskelenmeli ve sadece ana samba servisi çalıştırılmalıdır:
Bash
sudo systemctl mask smb nmb winbind
sudo systemctl enable --now samba
sudo nano ~/.bashrc
export PATH=/usr/local/samba/bin/:/usr/local/samba/sbin/:$PATH
Press enter or click to view image in full size
sudo source ~/.bashrc
6- Artık Samba’nın bir domain için yapılandırılmasına başlayabilirsiniz. İlk komut katılımsız (hazır cevaplı) kurulum içindir. Katılımlı (soru-cevaplı) kurulum için ikinciyi kullanabilirsiniz. İlk komutu kendinize özgü değiştirmeniz gerektiğini unutmayınız.
samba-tool domain provision --realm=ABC.LCL --domain=ABC --server-role=dc --dns-backend=SAMBA_INTERNAL --adminpass=1234-Aaa --use-rfc2307
samba-tool domain provision --use-rfc2307 --interactive
Press enter or click to view image in full size
Not: samba-tool komutu bulunamıyorsa beşinci adım doğru uygulanamamıştır.
Active Directory; LDAP, Kerberos, DNS, SAMBA ve Kpasswd gibi birçok farklı porta ihtiyaç duyar. Lab ortamında sorun yaşamamak için gerekli tüm servis izinlerini tanımlıyoruz:
Bash
sudo firewall-cmd --permanent --add-service={samba,dns,kerberos,kpasswd,ldap,ldaps}
# RPC ve ek AD portları için port aralıklarını açalım
sudo firewall-cmd --permanent --add-port=1024-5000/tcp
sudo firewall-cmd --reload
7- Yapılandırma sırasında, Samba’nın, seçeneklerimize uygun olarak oluşturduğu Kerberos config dosyasını /etc dizinine kopyalayınız. Kopyalama onay isteyecektir. (Y)
sudo cp /usr/local/samba/private/krb5.conf /etc/krb5.conf
Bash
smbclient -L localhost -U%
Çıktıda sysvol ve netlogon klasörlerini görmelisiniz.
Bash
kinit administrator@ABC.LCL
Şifrenizi girdikten sonra hata vermeden alt satıra geçiyorsa Kerberos biletiniz başarıyla alınmıştır. klist komutuyla aktif bileti görebilirsiniz.
Bash
host -t SRV _ldap._tcp.abc.lcl.
host -t SRV _kerberos._udp.abc.lcl.
Bu komutlar karşılığında dc1.abc.lcl adresini ve 172.16.1.30 IP'sini yanıt olarak dönmelidir.
8- Aşağıdaki komutlarla samba servisini çalıştırın ve kurulumunun tamamlandığını doğrulayın.
samba && testparm && smbclient –version
Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0
Rsat.ServerManager.Tools~~~~0.0.1.0
Rsat.Dns.Tools~~~~0.0.1.0
Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0
Get-WindowsCapability -Name RSAT* -Online | Select-Object -Property DisplayName, State
Get-WindowsCapability -Name RSAT* -Online | Add-WindowsCapability -Online
DISM.exe /Online /add-capability /CapabilityName:Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0
DISM.exe /Online /add-capability /CapabilityName:Rsat.ServerManager.Tools~~~~0.0.1.0
DISM.exe /Online /add-capability /CapabilityName:Rsat.Dns.Tools~~~~0.0.1.0
DISM.exe /Online /add-capability /CapabilityName:Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0
Deployment Image Servicing and Management tool
Version: 10.0.19041.3636
Image Version: 10.0.19045.4474
Capability listing:
Capability Identity : Accessibility.Braille~~~~0.0.1.0
State : Not Present
Capability Identity : Analog.Holographic.Desktop~~~~0.0.1.0
State : Not Present
Capability Identity : App.StepsRecorder~~~~0.0.1.0
State : Installed
Capability Identity : App.Support.QuickAssist~~~~0.0.1.0
State : Installed
Capability Identity : App.WirelessDisplay.Connect~~~~0.0.1.0
State : Not Present
Capability Identity : Browser.InternetExplorer~~~~0.0.11.0
State : Installed
Capability Identity : DirectX.Configuration.Database~~~~0.0.1.0
State : Installed
Capability Identity : Hello.Face.18967~~~~0.0.1.0
State : Installed
Capability Identity : Hello.Face.Migration.18967~~~~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~af-ZA~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~ar-SA~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~as-IN~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~az-LATN-AZ~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~ba-RU~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~be-BY~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~bg-BG~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~bn-BD~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~bn-IN~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~bs-LATN-BA~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~ca-ES~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~cs-CZ~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~cy-GB~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~da-DK~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~de-CH~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~de-DE~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~el-GR~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~en-AU~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~en-CA~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~en-GB~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~en-IN~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~en-US~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~es-ES~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~es-MX~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~es-US~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~et-EE~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~eu-ES~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~fa-IR~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~fi-FI~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~fil-PH~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~fr-BE~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~fr-CA~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~fr-CH~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~fr-FR~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~ga-IE~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~gd-GB~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~gl-ES~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~gu-IN~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~ha-LATN-NG~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~haw-US~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~he-IL~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~hi-IN~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~hr-HR~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~hu-HU~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~hy-AM~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~id-ID~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~ig-NG~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~is-IS~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~it-IT~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~ja-JP~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~ka-GE~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~kk-KZ~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~kl-GL~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~kn-IN~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~ko-KR~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~kok-DEVA-IN~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~ky-KG~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~lb-LU~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~lt-LT~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~lv-LV~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~mi-NZ~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~mk-MK~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~ml-IN~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~mn-MN~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~mr-IN~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~ms-BN~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~ms-MY~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~mt-MT~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~nb-NO~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~ne-NP~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~nl-NL~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~nn-NO~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~nso-ZA~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~or-IN~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~pa-IN~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~pl-PL~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~ps-AF~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~pt-BR~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~pt-PT~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~rm-CH~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~ro-RO~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~ru-RU~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~rw-RW~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~sah-RU~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~si-LK~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~sk-SK~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~sl-SI~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~sq-AL~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~sr-CYRL-RS~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~sr-LATN-RS~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~sv-SE~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~sw-KE~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~ta-IN~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~te-IN~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~tg-CYRL-TJ~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~th-TH~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~tk-TM~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~tn-ZA~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~tr-TR~0.0.1.0
State : Installed
Capability Identity : Language.Basic~~~tt-RU~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~ug-CN~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~uk-UA~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~ur-PK~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~uz-LATN-UZ~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~vi-VN~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~wo-SN~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~xh-ZA~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~yo-NG~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~zh-CN~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~zh-HK~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~zh-TW~0.0.1.0
State : Not Present
Capability Identity : Language.Basic~~~zu-ZA~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Arab~~~und-ARAB~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Beng~~~und-BENG~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Cans~~~und-CANS~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Cher~~~und-CHER~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Deva~~~und-DEVA~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Ethi~~~und-ETHI~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Gujr~~~und-GUJR~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Guru~~~und-GURU~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Hans~~~und-HANS~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Hant~~~und-HANT~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Hebr~~~und-HEBR~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Jpan~~~und-JPAN~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Khmr~~~und-KHMR~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Knda~~~und-KNDA~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Kore~~~und-KORE~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Laoo~~~und-LAOO~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Mlym~~~und-MLYM~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Orya~~~und-ORYA~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.PanEuropeanSupplementalFonts~~~~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Sinh~~~und-SINH~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Syrc~~~und-SYRC~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Taml~~~und-TAML~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Telu~~~und-TELU~0.0.1.0
State : Not Present
Capability Identity : Language.Fonts.Thai~~~und-THAI~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~af-ZA~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~bs-LATN-BA~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~ca-ES~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~cs-CZ~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~cy-GB~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~da-DK~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~de-DE~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~el-GR~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~en-GB~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~en-US~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~es-ES~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~es-MX~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~eu-ES~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~fi-FI~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~fr-FR~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~ga-IE~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~gd-GB~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~gl-ES~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~hi-IN~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~hr-HR~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~id-ID~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~it-IT~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~ja-JP~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~ko-KR~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~lb-LU~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~mi-NZ~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~ms-BN~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~ms-MY~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~nb-NO~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~nl-NL~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~nn-NO~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~nso-ZA~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~pl-PL~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~pt-BR~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~pt-PT~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~rm-CH~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~ro-RO~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~ru-RU~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~rw-RW~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~sk-SK~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~sl-SI~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~sq-AL~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~sr-CYRL-RS~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~sr-LATN-RS~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~sv-SE~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~sw-KE~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~tn-ZA~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~tr-TR~0.0.1.0
State : Installed
Capability Identity : Language.Handwriting~~~wo-SN~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~xh-ZA~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~zh-CN~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~zh-HK~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~zh-TW~0.0.1.0
State : Not Present
Capability Identity : Language.Handwriting~~~zu-ZA~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~ar-SA~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~bg-BG~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~bs-LATN-BA~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~cs-CZ~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~da-DK~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~de-DE~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~el-GR~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~en-GB~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~en-US~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~es-ES~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~es-MX~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~fi-FI~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~fr-CA~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~fr-FR~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~hr-HR~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~hu-HU~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~it-IT~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~ja-JP~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~ko-KR~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~nb-NO~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~nl-NL~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~pl-PL~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~pt-BR~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~pt-PT~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~ro-RO~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~ru-RU~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~sk-SK~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~sl-SI~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~sr-CYRL-RS~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~sr-LATN-RS~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~sv-SE~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~tr-TR~0.0.1.0
State : Installed
Capability Identity : Language.OCR~~~zh-CN~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~zh-HK~0.0.1.0
State : Not Present
Capability Identity : Language.OCR~~~zh-TW~0.0.1.0
State : Not Present
Capability Identity : Language.Speech~~~da-DK~0.0.1.0
State : Not Present
Capability Identity : Language.Speech~~~de-DE~0.0.1.0
State : Not Present
Capability Identity : Language.Speech~~~en-AU~0.0.1.0
State : Not Present
Capability Identity : Language.Speech~~~en-CA~0.0.1.0
State : Not Present
Capability Identity : Language.Speech~~~en-GB~0.0.1.0
State : Not Present
Capability Identity : Language.Speech~~~en-IN~0.0.1.0
State : Not Present
Capability Identity : Language.Speech~~~en-US~0.0.1.0
State : Not Present
Capability Identity : Language.Speech~~~es-ES~0.0.1.0
State : Not Present
Capability Identity : Language.Speech~~~es-MX~0.0.1.0
State : Not Present
Capability Identity : Language.Speech~~~fr-CA~0.0.1.0
State : Not Present
Capability Identity : Language.Speech~~~fr-FR~0.0.1.0
State : Not Present
Capability Identity : Language.Speech~~~it-IT~0.0.1.0
State : Not Present
Capability Identity : Language.Speech~~~ja-JP~0.0.1.0
State : Not Present
Capability Identity : Language.Speech~~~pt-BR~0.0.1.0
State : Not Present
Capability Identity : Language.Speech~~~zh-CN~0.0.1.0
State : Not Present
Capability Identity : Language.Speech~~~zh-HK~0.0.1.0
State : Not Present
Capability Identity : Language.Speech~~~zh-TW~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~ar-EG~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~ar-SA~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~bg-BG~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~ca-ES~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~cs-CZ~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~da-DK~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~de-AT~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~de-CH~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~de-DE~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~el-GR~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~en-AU~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~en-CA~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~en-GB~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~en-IE~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~en-IN~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~en-US~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~es-ES~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~es-MX~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~fi-FI~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~fr-CA~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~fr-CH~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~fr-FR~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~he-IL~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~hi-IN~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~hr-HR~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~hu-HU~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~id-ID~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~it-IT~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~ja-JP~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~ko-KR~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~ms-MY~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~nb-NO~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~nl-BE~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~nl-NL~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~pl-PL~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~pt-BR~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~pt-PT~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~ro-RO~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~ru-RU~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~sk-SK~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~sl-SI~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~sv-SE~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~ta-IN~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~th-TH~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~tr-TR~0.0.1.0
State : Installed
Capability Identity : Language.TextToSpeech~~~vi-VN~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~zh-CN~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~zh-HK~0.0.1.0
State : Not Present
Capability Identity : Language.TextToSpeech~~~zh-TW~0.0.1.0
State : Not Present
Capability Identity : MathRecognizer~~~~0.0.1.0
State : Installed
Capability Identity : Media.WindowsMediaPlayer~~~~0.0.12.0
State : Installed
Capability Identity : Microsoft.Onecore.StorageManagement~~~~0.0.1.0
State : Not Present
Capability Identity : Microsoft.WebDriver~~~~0.0.1.0
State : Not Present
Capability Identity : Microsoft.Windows.MSPaint~~~~0.0.1.0
State : Installed
Capability Identity : Microsoft.Windows.Notepad~~~~0.0.1.0
State : Installed
Capability Identity : Microsoft.Windows.PowerShell.ISE~~~~0.0.1.0
State : Installed
Capability Identity : Microsoft.Windows.StorageManagement~~~~0.0.1.0
State : Not Present
Capability Identity : Microsoft.Windows.WordPad~~~~0.0.1.0
State : Installed
Capability Identity : Msix.PackagingTool.Driver~~~~0.0.1.0
State : Not Present
Capability Identity : NetFX3~~~~
State : Not Present
Capability Identity : Network.Irda~~~~0.0.1.0
State : Not Present
Capability Identity : OneCoreUAP.OneSync~~~~0.0.1.0
State : Installed
Capability Identity : OpenSSH.Client~~~~0.0.1.0
State : Installed
Capability Identity : OpenSSH.Server~~~~0.0.1.0
State : Not Present
Capability Identity : Print.Fax.Scan~~~~0.0.1.0
State : Installed
Capability Identity : Print.Management.Console~~~~0.0.1.0
State : Installed
Capability Identity : RasCMAK.Client~~~~0.0.1.0
State : Not Present
Capability Identity : RIP.Listener~~~~0.0.1.0
State : Not Present
Capability Identity : Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0
State : Not Present
Capability Identity : Rsat.BitLocker.Recovery.Tools~~~~0.0.1.0
State : Not Present
Capability Identity : Rsat.CertificateServices.Tools~~~~0.0.1.0
State : Not Present
Capability Identity : Rsat.DHCP.Tools~~~~0.0.1.0
State : Not Present
Capability Identity : Rsat.Dns.Tools~~~~0.0.1.0
State : Not Present
Capability Identity : Rsat.FailoverCluster.Management.Tools~~~~0.0.1.0
State : Not Present
Capability Identity : Rsat.FileServices.Tools~~~~0.0.1.0
State : Not Present
Capability Identity : Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0
State : Installed
Capability Identity : Rsat.IPAM.Client.Tools~~~~0.0.1.0
State : Not Present
Capability Identity : Rsat.LLDP.Tools~~~~0.0.1.0
State : Not Present
Capability Identity : Rsat.NetworkController.Tools~~~~0.0.1.0
State : Not Present
Capability Identity : Rsat.NetworkLoadBalancing.Tools~~~~0.0.1.0
State : Not Present
Capability Identity : Rsat.RemoteAccess.Management.Tools~~~~0.0.1.0
State : Not Present
Capability Identity : Rsat.RemoteDesktop.Services.Tools~~~~0.0.1.0
State : Not Present
Capability Identity : Rsat.ServerManager.Tools~~~~0.0.1.0
State : Installed
Capability Identity : Rsat.Shielded.VM.Tools~~~~0.0.1.0
State : Not Present
Capability Identity : Rsat.StorageMigrationService.Management.Tools~~~~0.0.1.0
State : Not Present
Capability Identity : Rsat.StorageReplica.Tools~~~~0.0.1.0
State : Not Present
Capability Identity : Rsat.SystemInsights.Management.Tools~~~~0.0.1.0
State : Not Present
Capability Identity : Rsat.VolumeActivation.Tools~~~~0.0.1.0
State : Not Present
Capability Identity : Rsat.WSUS.Tools~~~~0.0.1.0
State : Not Present
Capability Identity : SNMP.Client~~~~0.0.1.0
State : Not Present
Capability Identity : Tools.DeveloperMode.Core~~~~0.0.1.0
State : Not Present
Capability Identity : Tools.Graphics.DirectX~~~~0.0.1.0
State : Not Present
Capability Identity : Windows.Client.ShellComponents~~~~0.0.1.0
State : Installed
Capability Identity : Windows.Desktop.EMS-SAC.Tools~~~~0.0.1.0
State : Not Present
Capability Identity : WMI-SNMP-Provider.Client~~~~0.0.1.0
State : Not Present
Capability Identity : XPS.Viewer~~~~0.0.1.0
State : Not Present
The operation completed successfully.
Bu teknik döküman, CentOS Stream 10 laboratuvarınızda kurumsal, stabil ve tamamen güncel bir Samba 4 AD DC yapısı oluşturmanızı sağlayacaktır. Temiz kurulum esnasında takıldığınız veya genişletmek istediğiniz bir adım olursa üzerinden beraber geçebiliriz.
Not: Samba servisi, bu kurulum yönteminde (source’tan kurulumda) varsayılan olarak samba komutuyla etkinleştirilir. Servis etkin değilken isim çözümleme ve domaine katılım gibi fonksiyonlar da çalışmaz. Sorun anında kontrol etmeyi veya tetiklemeyi unutmayın. Açılışta çalışabilmesi/tetiklenebilmesi için cronjob olarak tanımlamak da isteyebilirsiniz. Otomatik tanımlamak için aşağıdaki; manuel tanımlamak için crontab -e komutunu kullanabilirsiniz.
crontab -l | { cat; echo "@reboot /usr/local/samba/sbin/samba"; } | crontab -
9- Samba’nın, domain ortamı için gerekli paylaşımları oluşturduğunu ve Administrator kullanıcısıyla netlogon paylaşımına giriş yapılabildiğini doğrulayın. Komuttaki parola, kurulum sırasında belirtilen 1234-Aaa ’dır.
smbclient -L localhost -U%
smbclient //localhost/netlogon -Uadministrator%1234-Aaa -c 'ls'
Press enter or click to view image in full size
10- Samba’nın, domain ortamı için gerekli DNS kayıtlarına sahip olduğunu doğrulayın ve bir reverse lookup zone oluşturun. Komutların domain ve network’e özgü olduğunu unutmayınız.
host -t SRV _ldap._tcp.abc.lcl.
host -t SRV _kerberos._udp.abc.lcl.
samba-tool dns zonecreate 172.16.1.30 1.16.172.in-addr.arpa -U administrator
Not: Bu adımlar aşağıdaki gibi olumlu çıktı vermezse kurulum başarısızdır.
Press enter or click to view image in full size
11- DC’de, Samba erişimleri için gereken firewall izinlerini veriniz.
sudo firewall-cmd --add-service={samba,samba-dc,dns,ldap,ldaps,kerberos,kpasswd,ntp} --perm && sudo firewall-cmd --reload
Not: Domaine katılım sırasındaki, “domaini bulamama”, “isim çözememe” ve “yavaşlık” gibi sorunlardan büyük oranda firewall sorumlu olabilmektedir. Sorun anında teşhis için sudo systemctl stop firewalld komutuyla firewall servisini kapatarak denemeyi düşünebilirsiniz. Servisi kapatmak sorunları çözüyorusa, firewall komutundaki eklenen servisleri kontrol ediniz.
Kapanış: Artık bir Windows/Linux işletim sistemini abc.lcl domain’ine join edebilirsiniz (katabilirsiniz). DNS adresi olarak DC’yi görmesi gerektiklerini unutmayınız.
Press enter or click to view image in full size
Ayrıca Windows üzerine kurabileceğiniz Microsoft’un RSAT aracı ile, Samba DC’yi ve üzerindeki DNS gibi servisleri; kullanıcı/grupları ve GPO’ları da yönetebilirsiniz.
Kayhan Kırbaş'ın hazırladığı bu değerli makale, kurumsal Linux dünyasında kaynak koddan (source) Samba derleyerek bir Domain Controller ayağa kaldırmanın klasik ve harika bir mantığını anlatıyor.
Ancak hedefimiz CentOS Stream 10 ve güncel Samba 4 mimarisi olduğunda, bu dokümandaki bazı adımların güncellenmesi gerekir. Özellikle CentOS Stream 10 ile birlikte gelen Python 3.12+ geçişleri, bazı eski bağımlılık paketlerinin isim değişiklikleri ve kaynak kod yerine kurumsal sürdürülebilirlik için güncel repo paketlerinin (DNF) tercih edilmesi lab ortamımızı çok daha modern hale getirecektir.
İşte test ortamınız için hazırladığım, kurumsal standartlara uygun, güncel ve scannable CentOS Stream 10 ile Samba 4 Active Directory Domain Controller (AD DC) Kurulum Teknik Dokümanı:
Kuruluma başlamadan önce test ortamımızın ağ ve kimlik bilgileri şu şekilde yapılandırılmıştır:
Samba AD DC mimarisinde DNS çözünürlüğü ve zaman senkronizasyonu (NTP) hayati önem taşır. Kerberos protokolü, sunucular arasında 5 dakikadan fazla zaman farkı olması durumunda kimlik doğrulamayı reddeder.
sudo hostnamectl set-hostname dc1.abc.lcl
Ağ arabirimi düşse bile yerel isim çözümlemenin çalışması için dosyayı şu şekilde düzenleyin:
sudo nano /etc/hosts
İçerik aşağıdaki gibi olmalıdır:
Plaintext
127.0.0.1 localhost localhost.localdomain
172.16.1.30 dc1.abc.lcl dc1
CentOS Stream 10 üzerinde nmtui arayüzünü veya doğrudan nmcli komutlarını kullanarak ağınızı yapılandırın. DNS satırında sunucunun kendi IP'sinin ilk sırada olduğundan emin olun:
# Bağlantı adını öğrenin (Örn: ens160 veya eth0)
nmcli connection show
# Statik IP, Gateway ve DNS yapılandırmasını uygulayın
sudo nmcli connection modify ens160 ipv4.addresses 172.16.1.30/24
sudo nmcli connection modify ens160 ipv4.gateway 172.16.1.1
sudo nmcli connection modify ens160 ipv4.dns "172.16.1.30 1.1.1.1"
sudo nmcli connection modify ens160 ipv4.method manual
sudo nmcli connection up ens160
sudo timedatectl set-timezone Europe/Istanbul
Samba 4 AD DC kurarken iki seçeneğimiz vardır: Kaynak koddan derlemek veya Resmi repolardan kurmak. Kurumsal ortamlarda güvenlik güncellemelerini kolay yönetebilmek adına güncel DNF paket havuzunu kullanmak en sağlıklı yöntemdir. CentOS Stream 10 üzerinde gerekli paketler EPEL ve CRB depolarında yer alır.
sudo dnf install epel-release -y
sudo dnf config-manager --set-enabled crb
sudo dnf update -y
CentOS Stream 10 (RHEL 10 mimarisi) üzerinde Samba'yı doğrudan AD Domain Controller modunda çalıştıracak tüm servis ve kütüphaneleri yüklüyoruz:
sudo dnf install samba samba-dc samba-client krb5-workstation krb5-server bind-utils -y
Samba paketleri kurulduğunda varsayılan olarak standart bir dosya paylaşım (file server) konfigürasyonu ile gelir. Bunu tamamen temizleyip sıfırdan bir Active Directory yapısı inşa edeceğiz.
sudo systemctl stop samba smb nmb winbind 2>/dev/null
sudo rm -f /etc/samba/smb.conf
Aşağıdaki komutu çalıştırarak Samba'nın sihirbazını başlatın:
Bash
sudo samba-tool domain provision --use-rfc2307 --interactive
Sihirbaz Esnasında Girilecek Değerler:
Samba provision esnasında bizim için en doğru Kerberos ayarlarını üretir. Sistem genelindeki eski dosyanın yerine bunu sembolik link (veya kopyalama) ile yerleştiriyoruz:
sudo mv /etc/krb5.conf /etc/krb5.conf.bak
sudo cp /var/lib/samba/private/krb5.conf /etc/krb5.conf
Geleneksel smb ve nmb servisleri dosya paylaşımı içindir. Bir Domain Controller mimarisinde bu servisler maskelenmeli ve sadece ana samba servisi çalıştırılmalıdır:
sudo systemctl mask smb nmb winbind
sudo systemctl enable --now samba
Active Directory; LDAP, Kerberos, DNS, SAMBA ve Kpasswd gibi birçok farklı porta ihtiyaç duyar. Lab ortamında sorun yaşamamak için gerekli tüm servis izinlerini tanımlıyoruz:
sudo firewall-cmd --permanent --add-service={samba,dns,kerberos,kpasswd,ldap,ldaps}
# RPC ve ek AD portları için port aralıklarını açalım
sudo firewall-cmd --permanent --add-port=1024-5000/tcp
sudo firewall-cmd --reload
smbclient -L localhost -U%
Çıktıda sysvol ve netlogon klasörlerini görmelisiniz.
kinit administrator@ABC.LCL
Şifrenizi girdikten sonra hata vermeden alt satıra geçiyorsa Kerberos biletiniz başarıyla alınmıştır. klist komutuyla aktif bileti görebilirsiniz.
host -t SRV _ldap._tcp.abc.lcl.
host -t SRV _kerberos._udp.abc.lcl.
Bu komutlar karşılığında dc1.abc.lcl adresini ve 172.16.1.30 IP'sini yanıt olarak dönmelidir.
Bu teknik döküman, CentOS Stream 10 laboratuvarınızda kurumsal, stabil ve tamamen güncel bir Samba 4 AD DC yapısı oluşturmanızı sağlayacaktır. Temiz kurulum esnasında takıldığınız veya genişletmek istediğiniz bir adım olursa üzerinden beraber geçebiliriz.
dnf install epel-release -y dnf config-manager --set-enabled crb
dnf groups install "Development Tools" -y
dnf install krb5-devel krb5-workstation cups-devel iniparser python-devel gnutls-devel libacl-devel openldap-devel pam-devel readline-devel gpgme-devel jansson-devel keyutils-libs-devel libaio-devel libarchive-devel libattr-devel libblkid-devel libtasn1 libtasn1-tools libxml2-devel libxslt lmdb-devel perl perl-ExtUtils-MakeMaker perl-Parse-Yapp popt-devel python3-cryptography python3-dns python3-gpg python3-markdown rpcgen systemd-devel zlib-devel dbus-devel perl-JSON tar wget -y
cd /opt
wget https://download.samba.org/pub/samba/stable/samba-4.24.2.tar.gz
tar xzfv samba-4.24.2.tar.gz cd samba-4.24.2/
sudo ./configure
sudo make -j 4 sudo make install
sudo nano ~/.bashrc
echo 'export PATH=/usr/local/samba/bin/:/usr/local/samba/sbin/:$PATH' >> ~/.bashrc source ~/.bashrc
export PATH=/usr/local/samba/bin/:/usr/local/samba/sbin/:$PATH
source ~/.bashrc
samba-tool domain provision --use-rfc2307 --interactive
samba-tool domain provision --use-rfc2307 --interactive
samba-tool domain provision
--realm=ZNG.LCL
--domain=ZNG
--server-role=dc
--dns-backend=SAMBA_INTERNAL
--adminpass='Zonguldak67!2026'
--use-rfc2307
INFO 2026-05-15 11:28:34,579 pid:1020 /usr/local/samba/lib64/python3.9/site-packages/samba/provision/init.py #2419: gkdi/gmsa root key added with guid 2f3d5f4a-de62-6f3a-5ca5-e5a117b99296 INFO 2026-05-15 11:28:34,579 pid:1020 /usr/local/samba/lib64/python3.9/site-packages/samba/provision/init.py #2430: A Kerberos configuration suitable for Samba AD has been generated at /usr/local/samba/private/krb5.conf INFO 2026-05-15 11:28:34,579 pid:1020 /usr/local/samba/lib64/python3.9/site-packages/samba/provision/init.py #2432: Merge the contents of this file with your system krb5.conf or replace it with this one. Do not create a symlink! INFO 2026-05-15 11:28:35,484 pid:1020 /usr/local/samba/lib64/python3.9/site-packages/samba/provision/init.py #2091: Setting up fake yp server settings INFO 2026-05-15 11:28:35,858 pid:1020 /usr/local/samba/lib64/python3.9/site-packages/samba/provision/init.py #492: Once the above files are installed, your Samba AD server will be ready to use INFO 2026-05-15 11:28:35,858 pid:1020 /usr/local/samba/lib64/python3.9/site-packages/samba/provision/init.py #497: Server Role: active directory domain controller INFO 2026-05-15 11:28:35,858 pid:1020 /usr/local/samba/lib64/python3.9/site-packages/samba/provision/init.py #498: Hostname: dclnx INFO 2026-05-15 11:28:35,858 pid:1020 /usr/local/samba/lib64/python3.9/site-packages/samba/provision/init.py #499: NetBIOS Domain: ZNG INFO 2026-05-15 11:28:35,858 pid:1020 /usr/local/samba/lib64/python3.9/site-packages/samba/provision/init.py #500: DNS Domain: zng.lcl INFO 2026-05-15 11:28:35,858 pid:1020 /usr/local/samba/lib64/python3.9/site-packages/samba/provision/init.py #501: DOMAIN SID: S-1-5-21-1506224143-2151790827-977541992
cp /usr/local/samba/private/krb5.conf /etc/krb5.conf GNU nano 5.6.1 /usr/local/samba/private/krb5.conf [libdefaults] default_realm = ZNG.LCL dns_lookup_realm = false dns_lookup_kdc = true
[realms] ZNG.LCL = { default_domain = zng.lcl }
[domain_realm] dclnx = ZNG.LCL
samba && testparm && smbclient --version
[global] dns forwarder = 10.67.232.31 netbios name = DCLNX realm = ZNG.LCL server role = active directory domain controller workgroup = ZNG idmap_ldb:use rfc2307 = yes
[sysvol] path = /usr/local/samba/var/locks/sysvol read only = No
[netlogon] path = /usr/local/samba/var/locks/sysvol/zng.lcl/scripts read only = No
[root@dclnx ~]# nano /usr/local/samba/etc/smb.conf [root@dclnx ~]# samba && testparm && smbclient --version Load smb config files from /usr/local/samba/etc/smb.conf Loaded services file OK. Weak crypto is allowed by GnuTLS (e.g. NTLM as a compatibility fallback)
Server role: ROLE_ACTIVE_DIRECTORY_DC
Press enter to see a dump of your service definitions
[global] dns forwarder = 10.67.232.31 passdb backend = samba_dsdb realm = ZNG.LCL server role = active directory domain controller workgroup = ZNG rpc_server:tcpip = no rpc_daemon:spoolssd = embedded rpc_server:spoolss = embedded rpc_server:winreg = embedded rpc_server:ntsvcs = embedded rpc_server:eventlog = embedded rpc_server:srvsvc = embedded rpc_server:svcctl = embedded rpc_server:default = external winbindd:use external pipes = true idmap_ldb:use rfc2307 = yes idmap config * : backend = tdb map archive = No vfs objects = dfs_samba4 acl_xattr
[sysvol] path = /usr/local/samba/var/locks/sysvol read only = No
[netlogon] path = /usr/local/samba/var/locks/sysvol/zng.lcl/scripts read only = No Version 4.24.2
Samba’nın, domain ortamı için gerekli paylaşımları oluşturduğunu ve Administrator kullanıcısıyla netlogon paylaşımına giriş yapılabildiğini doğrulayın. Komuttaki parola, kurulum sırasında belirtilen 1234-Aaa ’dır.
smbclient -L localhost -U% smbclient -L localhost -U%
[root@dclnx ~]# smbclient -L localhost -U%
Sharename Type Comment
--------- ---- -------
sysvol Disk
netlogon Disk
IPC$ IPC IPC Service (Samba 4.24.2)
SMB1 disabled -- no workgroup available
smbclient //localhost/netlogon -Uadministrator%Zonguldak67!2026 -c 'ls' smbclient //localhost/netlogon -U'administrator%Zonguldak67!2026' -c 'ls' ok
[root@dclnx ~]#
smbclient //localhost/netlogon -U'administrator%Zonguldak67!2026' -c 'ls' . D 0 Fri May 15 11:28:23 2026 .. D 0 Fri May 15 11:28:23 2026
73334784 blocks of size 1024. 68452960 blocks available
sudo dnf install bind-utils -y ok
host -t SRV _ldap._tcp.zng.lcl. host -t SRV _kerberos._udp.zng.lcl.
Installed: bind-libs-32:9.16.23-43.el9.x86_64 bind-license-32:9.16.23-43.el9.noarch bind-utils-32:9.16.23-43.el9.x86_64 fstrm-0.6.1-3.el9.x86_64 libmaxminddb-1.5.2-4.el9.x86_64 libuv-1:1.42.0-2.el9.x86_64
Complete! [root@dclnx ~]# host -t SRV _ldap._tcp.zng.lcl. _ldap._tcp.zng.lcl has SRV record 0 100 389 dclnx.zng.lcl. [root@dclnx ~]# host -t SRV _kerberos._udp.zng.lcl. _kerberos._udp.zng.lcl has SRV record 0 100 88 dclnx.zng.lcl.
samba-tool dns add 10.67.0.40 0.67.10.in-addr.arpa 40 PTR dclnx.zng.lcl -U administrator
[root@dclnx ~]# samba-tool dns zonecreate 10.67.0.40 0.67.10.in-addr.arpa -U administrator Password for [ZNG\administrator]: Zone 0.67.10.in-addr.arpa created successfully
[root@dclnx ~]# sudo firewall-cmd --add-service={samba,dns,kerberos,ldap,ldaps,ntp} --permanent sudo firewall-cmd --reload success success
firewall-cmd --add-service={samba,samba-dc,dns,ldap,ldaps,kerberos,kpasswd,ntp} --perm && sudo firewall-cmd --reload
[root@dclnx ~]# samba-tool dns add 10.67.0.40 0.67.10.in-addr.arpa 40 PTR dclnx.zng.lcl -U administrator Password for [ZNG\administrator]: Record added successfully [root@dclnx ~]# host 10.67.0.40 40.0.67.10.in-addr.arpa domain name pointer dclnx.zng.lcl.
mkdir -p /home/samba/data
chmod -R 0775 /home/samba/data chown -R root:"domain users" /home/samba/data chown -R root:"domain users" /home/samba/data chown -R root:domain\ users /home/samba/data chown -R root:"ZNG\domain users" /home/samba/data
dnf install epel-release -y dnf config-manager --set-enabled crb
dnf groups install "Development Tools" -y
dnf install krb5-devel krb5-workstation cups-devel iniparser python-devel gnutls-devel libacl-devel openldap-devel pam-devel readline-devel gpgme-devel jansson-devel keyutils-libs-devel libaio-devel libarchive-devel libattr-devel libblkid-devel libtasn1 libtasn1-tools libxml2-devel libxslt lmdb-devel perl perl-ExtUtils-MakeMaker perl-Parse-Yapp popt-devel python3-cryptography python3-dns python3-gpg python3-markdown rpcgen systemd-devel zlib-devel dbus-devel perl-JSON tar wget -y
cd /opt wget https://download.samba.org/pub/samba/stable/samba-4.24.2.tar.gz tar xzfv samba-4.24.2.tar.gz cd samba-4.24.2/
sudo ./configure
sudo make -j 4 sudo make install
echo 'export PATH=/usr/local/samba/bin/:/usr/local/samba/sbin/:$PATH' >> ~/.bashrc source ~/.bashrc
source .bashrc
samba-tool domain provision --use-rfc2307 --interactive
samba-tool domain provision --use-rfc2307 --interactive
samba-tool domain provision
--realm=ZNG.LCL
--domain=ZNG
--server-role=dc
--dns-backend=SAMBA_INTERNAL
--adminpass='Zonguldak67!2026'
--use-rfc2307
INFO 2026-05-15 11:28:34,579 pid:1020 /usr/local/samba/lib64/python3.9/site-packages/samba/provision/init.py #2419: gkdi/gmsa root key added with guid 2f3d5f4a-de62-6f3a-5ca5-e5a117b99296 INFO 2026-05-15 11:28:34,579 pid:1020 /usr/local/samba/lib64/python3.9/site-packages/samba/provision/init.py #2430: A Kerberos configuration suitable for Samba AD has been generated at /usr/local/samba/private/krb5.conf INFO 2026-05-15 11:28:34,579 pid:1020 /usr/local/samba/lib64/python3.9/site-packages/samba/provision/init.py #2432: Merge the contents of this file with your system krb5.conf or replace it with this one. Do not create a symlink! INFO 2026-05-15 11:28:35,484 pid:1020 /usr/local/samba/lib64/python3.9/site-packages/samba/provision/init.py #2091: Setting up fake yp server settings INFO 2026-05-15 11:28:35,858 pid:1020 /usr/local/samba/lib64/python3.9/site-packages/samba/provision/init.py #492: Once the above files are installed, your Samba AD server will be ready to use INFO 2026-05-15 11:28:35,858 pid:1020 /usr/local/samba/lib64/python3.9/site-packages/samba/provision/init.py #497: Server Role: active directory domain controller INFO 2026-05-15 11:28:35,858 pid:1020 /usr/local/samba/lib64/python3.9/site-packages/samba/provision/init.py #498: Hostname: dclnx INFO 2026-05-15 11:28:35,858 pid:1020 /usr/local/samba/lib64/python3.9/site-packages/samba/provision/init.py #499: NetBIOS Domain: ZNG INFO 2026-05-15 11:28:35,858 pid:1020 /usr/local/samba/lib64/python3.9/site-packages/samba/provision/init.py #500: DNS Domain: zng.lcl INFO 2026-05-15 11:28:35,858 pid:1020 /usr/local/samba/lib64/python3.9/site-packages/samba/provision/init.py #501: DOMAIN SID: S-1-5-21-1506224143-2151790827-977541992
cp /usr/local/samba/private/krb5.conf /etc/krb5.conf GNU nano 5.6.1 /usr/local/samba/private/krb5.conf [libdefaults] default_realm = ZNG.LCL dns_lookup_realm = false dns_lookup_kdc = true
[realms] ZNG.LCL = { default_domain = zng.lcl }
[domain_realm] dclnx = ZNG.LCL
samba && testparm && smbclient --version
[global] dns forwarder = 10.67.232.31 netbios name = DCLNX realm = ZNG.LCL server role = active directory domain controller workgroup = ZNG idmap_ldb:use rfc2307 = yes
[sysvol] path = /usr/local/samba/var/locks/sysvol read only = No
[netlogon] path = /usr/local/samba/var/locks/sysvol/zng.lcl/scripts read only = No
[root@dclnx ~]# nano /usr/local/samba/etc/smb.conf [root@dclnx ~]# samba && testparm && smbclient --version Load smb config files from /usr/local/samba/etc/smb.conf Loaded services file OK. Weak crypto is allowed by GnuTLS (e.g. NTLM as a compatibility fallback)
Server role: ROLE_ACTIVE_DIRECTORY_DC
Press enter to see a dump of your service definitions
[global] dns forwarder = 10.67.232.31 passdb backend = samba_dsdb realm = ZNG.LCL server role = active directory domain controller workgroup = ZNG rpc_server:tcpip = no rpc_daemon:spoolssd = embedded rpc_server:spoolss = embedded rpc_server:winreg = embedded rpc_server:ntsvcs = embedded rpc_server:eventlog = embedded rpc_server:srvsvc = embedded rpc_server:svcctl = embedded rpc_server:default = external winbindd:use external pipes = true idmap_ldb:use rfc2307 = yes idmap config * : backend = tdb map archive = No vfs objects = dfs_samba4 acl_xattr
[sysvol] path = /usr/local/samba/var/locks/sysvol read only = No
[netlogon] path = /usr/local/samba/var/locks/sysvol/zng.lcl/scripts read only = No Version 4.24.2
Samba’nın, domain ortamı için gerekli paylaşımları oluşturduğunu ve Administrator kullanıcısıyla netlogon paylaşımına giriş yapılabildiğini doğrulayın. Komuttaki parola, kurulum sırasında belirtilen 1234-Aaa ’dır.
smbclient -L localhost -U% smbclient -L localhost -U%
[root@dclnx ~]# smbclient -L localhost -U%
Sharename Type Comment
--------- ---- -------
sysvol Disk
netlogon Disk
IPC$ IPC IPC Service (Samba 4.24.2)
SMB1 disabled -- no workgroup available
smbclient //localhost/netlogon -Uadministrator%Zonguldak67!2026 -c 'ls' smbclient //localhost/netlogon -U'administrator%Zonguldak67!2026' -c 'ls' ok
[root@dclnx ~]# smbclient //localhost/netlogon -U'administrator%Zonguldak67!2026' -c 'ls' . D 0 Fri May 15 11:28:23 2026 .. D 0 Fri May 15 11:28:23 2026
73334784 blocks of size 1024. 68452960 blocks available
sudo dnf install bind-utils -y ok
host -t SRV _ldap._tcp.zng.lcl. host -t SRV _kerberos._udp.zng.lcl.
Installed: bind-libs-32:9.16.23-43.el9.x86_64 bind-license-32:9.16.23-43.el9.noarch bind-utils-32:9.16.23-43.el9.x86_64 fstrm-0.6.1-3.el9.x86_64 libmaxminddb-1.5.2-4.el9.x86_64 libuv-1:1.42.0-2.el9.x86_64
Complete! [root@dclnx ~]# host -t SRV _ldap._tcp.zng.lcl. _ldap._tcp.zng.lcl has SRV record 0 100 389 dclnx.zng.lcl. [root@dclnx ~]# host -t SRV _kerberos._udp.zng.lcl. _kerberos._udp.zng.lcl has SRV record 0 100 88 dclnx.zng.lcl.
samba-tool dns add 10.67.0.40 0.67.10.in-addr.arpa 40 PTR dclnx.zng.lcl -U administrator
[root@dclnx ~]# samba-tool dns zonecreate 10.67.0.40 0.67.10.in-addr.arpa -U administrator Password for [ZNG\administrator]: Zone 0.67.10.in-addr.arpa created successfully
[root@dclnx ~]# sudo firewall-cmd --add-service={samba,dns,kerberos,ldap,ldaps,ntp} --permanent sudo firewall-cmd --reload success success
firewall-cmd --add-service={samba,samba-dc,dns,ldap,ldaps,kerberos,kpasswd,ntp} --perm && sudo firewall-cmd --reload
[root@dclnx ~]# samba-tool dns add 10.67.0.40 0.67.10.in-addr.arpa 40 PTR dclnx.zng.lcl -U administrator Password for [ZNG\administrator]: Record added successfully [root@dclnx ~]# host 10.67.0.40 40.0.67.10.in-addr.arpa domain name pointer dclnx.zng.lcl.
mkdir -p /home/samba/data
chmod -R 0775 /home/samba/data chown -R root:"domain users" /home/samba/data chown -R root:"domain users" /home/samba/data chown -R root:domain\ users /home/samba/data chown -R root:"ZNG\domain users" /home/samba/data
İşlem başarıyla tamamlandı. Samba Active Directory Domain Controller yapınız arka planda tüm nesneleri v2 formatında başarıyla paketledi, indeksledi ve Active Directory kurulumunuzu (Provision) sorunsuz bir şekilde bitirdi.
Şu andan itibaren sunucunun körlüğünü gidermek, servisleri kalıcı hale getirmek ve Active Directory ortamınızı test etmek için aşağıdaki son adımları sırasıyla uygulayalım:
Samba'nın ürettiği güncel ve doğru Kerberos konfigürasyonunu işletim sistemine tanıtıyoruz:
Bash
sudo mv /etc/krb5.conf /etc/krb5.conf.bak
sudo cp /usr/local/samba/private/krb5.conf /etc/krb5.conf
Ağdaki isim çözümleme hatasını (NXDOMAIN) çözmek için sunucunun DNS isteklerinde artık tamamen kendisine (Samba Internal DNS'e) bakmasını sağlıyoruz:
Bash
echo "nameserver 127.0.0.1" > /etc/resolv.conf
Kaynak koddan kurduğumuz için ana servisi elinizle arka planda başlatın:
Bash
/usr/local/samba/sbin/samba
Her şeyin kusursuz çalıştığını doğrulamak için şu komutları sırasıyla çalıştırın. Az önce hata aldığınız komutların artık nasıl olumlu sonuçlar verdiğini göreceksiniz:
Bash
host -t SRV _ldap._tcp.salvador.lan.
host -t SRV _kerberos._udp.salvador.lan.
Bu komutlar artık hata vermemeli; karşılığında dclnx.salvador.lan sunucu adını ve IP adresinizi başarıyla ekrana basmalıdır.
Bash
kinit administrator@SALVADOR.LAN
Şifrenizi (Zonguldak67!2026) girdiğinizde hata vermeden alt satıra geçmelidir. Ardından klist komutunu çalıştırarak sistemden aldığınız aktif Active Directory biletini görebilirsiniz.
Bash
/usr/local/samba/bin/smbclient --version
/usr/local/samba/bin/smbclient -L localhost -U%
Çıktıda hem Samba sürümünüzü görmeli hem de sysvol ile netlogon klasörlerinin ağda paylaşıma açıldığını teyit etmelisiniz.
Sunucu her yeniden başladığında Samba servisinin otomatik olarak devreye girmesi için crontab üzerine küçük bir tetikleyici ekleyelim:
Bash
crontab -l | { cat; echo "@reboot /usr/local/samba/sbin/samba"; } | crontab -
Tebrikler! CentOS Stream 10 üzerinde, en güncel kaynak kod mimarisiyle sıfırdan güvenlik duvarı ve SELinux engellerinden arındırılmış, taş gibi sağlam bir Samba 4 Active Directory Domain Controller kurdunuz. Artık test ortamınızdaki herhangi bir Windows veya Linux istemciyi DNS adresini bu sunucuya yönlendirerek SALVADOR.LAN domainine join edebilirsiniz.
host -t SRV _ldap._tcp.salvador.lan. host -t SRV _kerberos._udp.salvador.lan.
[root@dclnx samba-4.24.2]# sudo mv /etc/krb5.conf /etc/krb5.conf.bak
sudo cp /usr/local/samba/private/krb5.conf /etc/krb5.conf
[root@dclnx samba-4.24.2]# echo "nameserver 127.0.0.1" > /etc/resolv.conf
[root@dclnx samba-4.24.2]# /usr/local/samba/sbin/samba
[root@dclnx samba-4.24.2]# host -t SRV _ldap._tcp.salvador.lan.
host -t SRV _kerberos._udp.salvador.lan.
_ldap._tcp.salvador.lan has SRV record 0 100 389 dclnx.salvador.lan.
_kerberos._udp.salvador.lan has SRV record 0 100 88 dclnx.salvador.lan.
[root@dclnx samba-4.24.2]# kinit administrator@SALVADOR.LAN
Password for administrator@SALVADOR.LAN:
Warning: Your password will expire in 41 days on Mon 13 Jul 2026 11:46:32 PM +03
[root@dclnx samba-4.24.2]# /usr/local/samba/bin/smbclient --version
/usr/local/samba/bin/smbclient -L localhost -U%
Version 4.24.2
Sharename Type Comment
--------- ---- -------
sysvol Disk
netlogon Disk
IPC$ IPC IPC Service (Samba 4.24.2)
SMB1 disabled -- no workgroup available
[root@dclnx samba-4.24.2]# crontab -l
@reboot /usr/local/samba/sbin/samba
[root@dclnx samba-4.24.2]# host -t SRV _ldap._tcp.salvador.lan.
_ldap._tcp.salvador.lan has SRV record 0 100 389 dclnx.salvador.lan.
[root@dclnx samba-4.24.2]# kinit administrator@SALVADOR.LAN
Password for administrator@SALVADOR.LAN:
Warning: Your password will expire in 41 days on Mon 13 Jul 2026 11:46:32 PM +03
[root@dclnx samba-4.24.2]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: administrator@SALVADOR.LAN
Valid starting Expires Service principal
06/02/2026 00:12:05 06/02/2026 10:12:05 krbtgt/SALVADOR.LAN@SALVADOR.LAN
renew until 06/03/2026 00:11:59
Hiç sorun değil, bu bir hata değil sadece bir bilgilendirme mesajıdır. no crontab for root uyarısı, sistemde root kullanıcısına ait daha önceden oluşturulmuş hiçbir zamanlanmış görev (cronjob) bulunmadığını söylüyor.
Bizim kullandığımız komut, eski görevlerin listesini (crontab -l) alıp üzerine yeni @reboot satırını eklemeye çalıştığı için, sistem eski bir liste bulamayınca bu uyarıyı verdi ama yeni görevi başarıyla oluşturdu.
Görevin düzgün eklenip eklenmediğini doğrulamak için şu komutu çalıştırın:
Bash
crontab -l
Eğer çıktı olarak sadece şu satırı görüyorsanız işlem tamamen başarılı olmuştur ve sunucu her açıldığında Samba otomatik olarak başlayacaktır:
Plaintext
@reboot /usr/local/samba/sbin/samba
Repack işlemi ve crontab adımı bittiğine göre, az önce konuştuğumuz kritik doğrulama testlerine geçebiliriz:
1. DNS Durumunu Kontrol Edin:
Bash
host -t SRV _ldap._tcp.salvador.lan.
2. Kerberos Biletini Test Edin:
Bash
kinit administrator@SALVADOR.LAN
(Şifre olarak provision esnasında belirlediğiniz kurumsal şifreyi girin. Başarılı olursa klist ile biletinizi görebilirsiniz).
Testlerin çıktıları ne durumdadır, DNS kayıtlarını başarıyla çözebiliyor muyuz?
Muazzam bir iş çıkardınız! Terminal çıktılarınız, kurduğumuz yapının kılçıksız, hatasız ve kurumsal standartlarda 10 numara 5 yıldız çalıştığını gösteriyor.
Şu an elinizde ne olduğunu adım adım doğrulayalım:
Laboratuvarınız şu an testlere tamamen hazır. Bundan sonraki adımda şunları deneyebilirsiniz:
Bir Windows 10/11 test makinesinin ağ ayarlarına girip, Birincil DNS olarak bu CentOS sunucunuzun IP'sini yazın. Ardından bilgisayarı SALVADOR.LAN domainine kolayca join edebilirsiniz.
Domaine kattığınız Windows makineye Microsoft'un RSAT (Remote Server Administration Tools) paketini kurarak, Linux sunucunuzdaki kullanıcıları, grupları ve DNS kayıtlarını tamamen Windows'un o bildiğimiz klasik grafik arayüzleri (Active Directory Users and Computers, DNS Manager) üzerinden sanki arkada bir Windows Server varmış gibi yönetebilirsiniz.
Eğer her şeyi Linux terminalinden yönetmek isterseniz, artık şu güçlü komutları kullanabilirsiniz:
Bash
# Yeni bir AD kullanıcısı eklemek için:
samba-tool user create yeni_kullanici
# Yeni bir AD grubu eklemek için:
samba-tool group add yeni_grup
# Bir kullanıcıyı gruba dahil etmek için:
samba-tool group addmembers yeni_grup yeni_kullanici
CentOS Stream 10 gibi en güncel ve agresif bir dağıtımda, kaynak kod kütüphanelerini Python 3.12 ile evlendirerek bu DC'yi ayağa kaldırmak gerçekten harika bir pratik oldu. Süreçle ilgili aklınıza takılan veya test etmek istediğiniz başka bir senaryo var mı?
Muazzam bir iş çıkardınız! Terminal çıktılarınız, kurduğumuz yapının kılçıksız, hatasız ve kurumsal standartlarda 10 numara 5 yıldız çalıştığını gösteriyor.
Şu an elinizde ne olduğunu adım adım doğrulayalım:
Laboratuvarınız şu an testlere tamamen hazır. Bundan sonraki adımda şunları deneyebilirsiniz:
Bir Windows 10/11 test makinesinin ağ ayarlarına girip, Birincil DNS olarak bu CentOS sunucunuzun IP'sini yazın. Ardından bilgisayarı SALVADOR.LAN domainine kolayca join edebilirsiniz.
Domaine kattığınız Windows makineye Microsoft'un RSAT (Remote Server Administration Tools) paketini kurarak, Linux sunucunuzdaki kullanıcıları, grupları ve DNS kayıtlarını tamamen Windows'un o bildiğimiz klasik grafik arayüzleri (Active Directory Users and Computers, DNS Manager) üzerinden sanki arkada bir Windows Server varmış gibi yönetebilirsiniz.
Eğer her şeyi Linux terminalinden yönetmek isterseniz, artık şu güçlü komutları kullanabilirsiniz:
Bash
# Yeni bir AD kullanıcısı eklemek için:
samba-tool user create yeni_kullanici
# Yeni bir AD grubu eklemek için:
samba-tool group add yeni_grup
# Bir kullanıcıyı gruba dahil etmek için:
samba-tool group addmembers yeni_grup yeni_kullanici
CentOS Stream 10 gibi en güncel ve agresif bir dağıtımda, kaynak kod kütüphanelerini Python 3.12 ile evlendirerek bu DC'yi ayağa kaldırmak gerçekten harika bir pratik oldu. Süreçle ilgili aklınıza takılan veya test etmek istediğiniz başka bir senaryo var mı?
[root@dclnx samba-4.24.2]# # Yeni bir AD kullanıcısı eklemek için:
samba-tool user create yeni_kullanici
# Yeni bir AD grubu eklemek için:
samba-tool group add yeni_grup
# Bir kullanıcıyı gruba dahil etmek için:
samba-tool group addmembers yeni_grup yeni_kullanici
New Password:
Retype Password:
Sorry, passwords do not match.
New Password:
Retype Password:
User 'yeni_kullanici' added successfully
Added group yeni_grup
Added members to group yeni_grup
[root@dclnx samba-4.24.2]#
[root@dclnx samba-4.24.2]#
[root@dclnx samba-4.24.2]#
[root@dclnx samba-4.24.2]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: administrator@SALVADOR.LAN
Valid starting Expires Service principal
06/02/2026 00:12:05 06/02/2026 10:12:05 krbtgt/SALVADOR.LAN@SALVADOR.LAN
renew until 06/03/2026 00:11:59
[root@dclnx ~]# history
1 nmtui
2 cat /etc/hosts
3 exit
4 cat /etc/hostname
5 nmtui
6 nano /etc/hosts
7 dnf install nano -y
8 nano /etc/hosts
9 systemctl restart NetworkManager
10 ping dclnx.salvador.lan
11 ping 8.8.8.8
12 sestatus
13 cat /etc/hosts
14 sestatus
15 systemctl status firewalld
16 systemctl stop firewalld
17 systemctl disable firewalld
18 setenforce 0
19 cat /etc/selinux/config
20 reboot
21 cat /etc/selinux/config
22 nano /etc/selinux/config
23 reboot
24 cat /etc/selinux/config
25 sestatus
26 nano /etc/hostname
27 nano /etc/hosts
28 systemctl status firewalld
29 systemctl restart NetworkManager
30 ip a
31 nmcli connection show
32 dnf install epel-release -y
33 dnf update -y
34 cat /etc/resolv.conf
35 timedatectl
36 dnf repolist
37 dnf config-manager --set-enabled crb
38 dnf update -y
39 dnf install epel-release -y
40 dnf update -y
41 dnf groups install "Development Tools" -y
42 dnf install krb5-devel krb5-workstation cups-devel iniparser python-devel gnutls-devel libacl-devel openldap-devel pam-devel readline-deve
l gpgme-devel jansson-devel keyutils-libs-devel libaio-devel libarchive-devel libattr-devel libblkid-devel libtasn1 libtasn1-tools libxml2-devel
libxslt lmdb-devel perl perl-ExtUtils-MakeMaker perl-Parse-Yapp popt-devel python3-cryptography python3-dns python3-gpg python3-markdown rpcgen s
ystemd-devel zlib-devel dbus-devel perl-JSON tar wget -y
43 cd /opt wget https://download.samba.org/pub/samba/stable/samba-4.24.2.tar.gz tar xzfv samba-4.24.2.tar.gz cd samba-4.24.2/
44 dnf install wget tar
45 cd /opt wget https://download.samba.org/pub/samba/stable/samba-4.24.2.tar.gz
46 cd //
47 cd opt/
48 wget https://download.samba.org/pub/samba/stable/samba-4.24.2.tar.gz
49 tar xzfv samba-4.24.2.tar.gz cd samba-4.24.2/
50 tar xzfv samba-4.24.2.tar.gz cd samba-4.24.2.tar.gz
51 ls
52 tar xzfv samba-4.24.2.tar.gz
53 cd samba-4.24.2
54 ls
55 sudo ./configure
56 sudo make -j 4 sudo make install
57 sudo nano ~/.bashrc
58 sudo source ~/.bashrc
59 source .bashrc
60 samba-tool domain provision --use-rfc2307 --interactive
61 source ~/.bashrc
62 source .bashrc
63 samba-tool domain provision --use-rfc2307 --interactive
64 sudo dnf install samba samba-dc samba-client krb5-workstation krb5-server bind-utils -y
65 sudo systemctl stop samba smb nmb winbind 2>/dev/null
66 sudo rm -f /etc/samba/smb.conf
67 sudo samba-tool domain provision --use-rfc2307 --interactive
68 cd /opt/samba-4.24.2/
69 # Eski hatalı derleme kalıntılarını temizleyin
70 sudo make clean
71 # Yapılandırmayı yeniden tetikleyin
72 sudo ./configure
73 # Derlemeyi ve yüklemeyi hatasız olarak yeniden başlatın
74 sudo make -j2
75 sudo make install
76 sudo ln -s /usr/local/samba/lib/python3.12/site-packages/samba /usr/lib64/python3.12/site-packages/samba
77 echo 'export PATH=/usr/local/samba/bin/:/usr/local/samba/sbin/:$PATH' >> ~/.bashrc
78 source ~/.bashrc
79 sudo nano ~/.bashrc
80 source ~/.bashrc
81 samba-tool domain provision --use-rfc2307 --interactive
82 cp /usr/local/samba/private/krb5.conf /etc/krb5.conf
83 nano /usr/local/samba/private/krb5.conf
84 samba && testparm && smbclient --version
85 nano /usr/local/samba/etc/smb.conf
86 samba && testparm && smbclient --version
87 smbclient -L localhost -U%
88 smbclient //localhost/netlogon -U'administrator%Zonguldak67!2026' -c 'ls'
89 dnf install bind-utils -y
90 host -t SRV _ldap._tcp.salvador.lan.
91 echo "nameserver 1.1.1.1" > /etc/resolv.conf
92 sudo dnf install bind-utils -y
93 host -t SRV _ldap._tcp.salvador.lan.
94 smbclient //localhost/netlogon -U'administrator%Zonguldak67!2026' -c 'ls'
95 host -t SRV _kerberos._udp.salvador.lan.
96 samba-tool domain provision --use-rfc2307 --interactive
97 sudo mv /etc/krb5.conf /etc/krb5.conf.bak
98 sudo cp /usr/local/samba/private/krb5.conf /etc/krb5.conf
99 echo "nameserver 127.0.0.1" > /etc/resolv.conf
100 /usr/local/samba/sbin/samba
101 host -t SRV _ldap._tcp.salvador.lan.
102 host -t SRV _kerberos._udp.salvador.lan.
103 kinit administrator@SALVADOR.LAN
104 /usr/local/samba/bin/smbclient --version
105 /usr/local/samba/bin/smbclient -L localhost -U%
106 crontab -l | { cat; echo "@reboot /usr/local/samba/sbin/samba"; } | crontab -
107 crontab -l
108 host -t SRV _ldap._tcp.salvador.lan.
109 kinit administrator@SALVADOR.LAN
110 klist
111 # Yeni bir AD kullanıcısı eklemek için:
112 samba-tool user create yeni_kullanici
113 # Yeni bir AD grubu eklemek için:
114 samba-tool group add yeni_grup
115 # Bir kullanıcıyı gruba dahil etmek için:
116 samba-tool group addmembers yeni_grup yeni_kullanici
117 klist
118 samba-tool dns add 192.168.0.25 0.168.192.in-addr.arpa 40 PTR dclnx.salvador.lan -U administrator
119 # 1. Önce Reverse Zone'u oluşturun (Sunucu gerçek IP'nizi yazın, örn: 172.16.1.30 veya 127.0.0.1)
120 samba-tool dns zonecreate 127.0.0.1 0.168.192.in-addr.arpa -U administrator
121 # 2. Şimdi PTR kaydını hedef olarak localhost'u göstererek ekleyin
122 samba-tool dns add 127.0.0.1 0.168.192.in-addr.arpa 40 PTR dclnx.salvador.lan -U administrator
123 samba-tool dns zonecreate 192.168.0.25 0.168.192.in-addr.arpa -U administrator
124 klist
125 reboot
126 klist
127 host -t SRV _ldap._tcp.salvador.lan.
128 smbclient //localhost/netlogon -U'administrator%Zonguldak67!2026' -c 'ls'
129 ls
130 df -h
131 systemctl status samba
132 systemctl status smb
133 systemctl status smbd
134 # LDAP servis kaydının kontrolü
135 host -t SRV _ldap._tcp.salvador.lan.
136 # Kerberos (Kimlik Doğrulama) servis kaydının kontrolü
137 host -t SRV _kerberos._udp.salvador.lan.
138 # Sunucunun kendi ismini çözebildiğinin kontrolü
139 host dclnx.salvador.lan.
140 # Administrator kullanıcısı için Kerberos bileti talep edin
141 kinit administrator@SALVADOR.LAN
142 # Alınan aktif biletleri listeleyin
143 klist
144 # Anonim olarak yerel paylaşımları listeleyin
145 /usr/local/samba/bin/smbclient -L localhost -U%
146 # Administrator yetkisiyle netlogon klasörünün içeriğini listeleyin
147 /usr/local/samba/bin/smbclient //localhost/netlogon -U'administrator' -c 'ls'
148 # Domain seviyesini ve operasyonel modunu kontrol edin
149 samba-tool domain level show
150 # Sunucunun üzerindeki FSMO (Master) rollerini listeleyin
151 samba-tool fsmo show
152 # Veri tabanının (LDAP) tutarlılık ve sağlık kontrolünü yapın
153 samba-tool dbcheck
154 samba-tool dbcheck --fix
155 samba-tool dbcheck
156 history
