Access Control For Linux Shares

You're going to have to do 2 things:
 1) Join the server to the ADS domain, and
 2) Configure Samba to use the ADS credentials

Step 1: Joining the domain (ADS or NT Domain)
In the example below, you SHOULD be able to figure out the parts you'll need to change... but at a minimum:
MYDOMAIN=your ADS domain name
adroot=some ADS Domain Admin username
adrootpw=the above account's password
# net ads join -Uadroot%adrootpw

NOTE: the % between the username / password is required (no spaces! the % instead of a space!)

You should get a message back saying
Joined SERVERNAME to realm MYDOMAIN

If not, consult the help files at: http://us4.samba.org/samba/docs/man/Samba-HOWTO-Collection/domain-member.html

Step 2: Making Samba actually USE the ADS server
You'll need to insert (or change) the following entries in your smb.conf file (usually found in /etc/samba/smb.conf):
security = ads
realm = MYDOMAIN
workgroup = MYDOMAIN
encrypt passwords = yes
password server = YOUR.ADS.SERVER.NAME

Now, before you actually restart your Samba server, you may (will) ALSO have to modify your Kerberos settings (ADS is a "kind of" Kerberos authentication/encryption). Edit the file /etc/krb5.conf:

[libdefaults]
      default_realm = MYDOMAIN

[realms]
      MYDOMAIN = {
      kdc = YOUR.ADS.SERVER.NAME
      }

[domain_realms]
      .kerberos.server = YOUR.ADS.SERVER.NAME


You'll want to TEST this (after joining the ADS) with the command:
# kinit adroot%adrootpw



Good Luck!!!

I hope this helps... someone!

Dan McAllister
IT4SOHO, LLC