29.2.12

Linux takes control of Microsoft

The days of Microsoft domination in the corporate network market are severely numbered. The amazing technological achievement that is Samba 4 effectively puts to an abrupt end the monopoly that Microsoft have enjoyed in isolation since 1990. It allows Linux servers to take full control over what was once a lucrative, exclusive and unopposed marketplace.

But what's the key to all this? Answer: The domain. What's a domain? Answer: It's an after hours lock-in. Your safety is guaranteed whilst you're inside. Venture out and we'll still do our best to protect you but you'll have no safety net. There's a lot of confusion about how to join a domain, so let's have a look at what's involved.

In this example, our Samba4 DC is hh3.hh3.site at IP 192.168.1.3 and our w7 client has hostname SuSE-pc at IP 192.168.1.12. We'll join SuSE-pc to the domain we created when we installed our Samba4 DC after following the instructions in the official Samba4 HOWTO.

There are a few stages involved in this domain join process which we shall outline here. As you go through example, please bear in mind that there is not a single Microsoft networking component anywhere in the system.

Stage 1. As local admin.
Add 2 registry keys. On the start menu type regedit and hit enter. The keys we need live here:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManWorkstation\Parameters
DomainCompatibilityMode 1
DNSNameResolutionRequired 0
The Control Panel Network Connections screen
Use only one DNS server during the join
Set it to point at the same DNS that s4 uses
Don't waste time going beyond here if these tests do not work
Test DNS. We did name --> IP but you should also test IP --> name
Here, Bind can ping out, but this is not essential
Where do we tell it to join a domain?
The easy way to get here is rt-clik computer > properties > change settings
Enter your domain admin details and take a deep breath
Our Ubuntu server making a lot of noise during the join process
Here, SuSE-pc gets a machine account, becomes SuSE-pc$ and successfully obtains a ticket for the fileserver
There's something strangely satisfying about seeing this popup
It wouldn't be Microsoft without, erm, what does it say?
Ah, that's better. Restart.
 Of course
Stage 2. The Domain Administrator takes over
The Domain logon screen
They say it takes longer the first time ... zzz ... zzz ...
Admin locking a group into one of the shares using the acl editor
client <--> server dialogue in WireShark
You never understand what it's saying!
Install Google Chrome and download the M$ free gift
Then, 1/2 hour later  ... zzz ... zzz ...  choose the bits you want
You want the stuff that says AD
It's got to be around here somewhere
Now, in an attempt to do something useful, here are two users and two groups we posix-ified over on the Samba4 server
You don't have to point and click to get this going. But you can if you must.
ldbmodify at its very best


Now, everyone. Put your hands together for the Samba4 devs. What a piece of technology:-)