Руководство по настройке Samba в режиме PDC с использованием LDAP

Примечание: Не решенной задачей осталось создание доверительных отношений между доменами и включение домена amber в лес global.com

Файл: /etc/openldap/slapd.conf

include /etc/openldap/schema/core.schema
 include /etc/openldap/schema/cosine.schema
 include /etc/openldap/schema/inetorgperson.schema
 include /etc/openldap/schema/misc.schema
 include /etc/openldap/schema/nis.schema
 include /etc/openldap/schema/openldap.schema
 include /etc/openldap/schema/samba.schema
 pidfile                        /var/run/openldap/slapd.pid
 argsfile               /var/run/openldap/slapd.args

 access to dn.base=""
                by self write
                by * auth
 access to attr=userPassword
                by self write
                by * auth
 access to attr=shadowLastChange
                by self write
                by * read
 access to *
                by * read
                by anonymous auth
 #loglevel 1
 database        ldbm
 suffix          "dc=amber,dc=global,dc=com"
 rootdn          "cn=Manager,dc=amber,dc=global,dc=com"
 # Пароль rootpw лучше всего указывать в зашифрованном виде.
 # Для генерации шифрованного пароля используйте утилиту slappasswd
 # Например: slappasswd -h {MD5}
 # rootpw = secret
 rootpw         {MD5}Xr4ilOzQ4PCOq3aQ0qbuaQ==
 directory      /var/lib/openldap-ldbm

 index objectClass           eq
 index cn                    eq,subinitial
 index sn                    eq,subinitial
 index uid                   eq,subinitial
 index displayName           eq,subinitial
 index uidNumber             eq
 index gidNumber             eq
 index memberUID             eq
 index sambaSID              eq
 index sambaPrimaryGroupSID  eq
 index sambaDomainName       eq

Файл: /etc/openldap/ldap.conf

HOST 127.0.0.1
BASE dc=sanaa,dc=global,dc=com

Файл: /etc/conf.d/slapd

# conf.d file for the openldap-2.1 series
#
# To enable both the standard unciphered server and the ssl encrypted
# one uncomment this line or set any other server starting options
# you may desire.
#
# OPTS="-h 'ldaps:// ldap:// ldapi://%2fvar%2frun%2fopenldap%2fslapd.sock'"
OPTS="-h 'ldap://127.0.0.1'"

Code: configure.pl

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
       smbldap-tools script configuration
       -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Before starting, check
 . if your samba controller is up and running.
 . if the domain SID is defined (you can get it with the 'net getlocalsid')

 . you can leave the configuration using the Crtl-c key combination
 . empty value can be set with the "." character
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Looking for configuration files...

Samba Configuration File Path [/etc/samba/smb.conf] > 
The default directory in which the smbldap configuration files are stored is shown.
If you need to change this, enter the full directory path, then press enter to continue.
Smbldap-tools Configuration Directory Path [/etc/smbldap-tools/] > 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Let's start configuring the smbldap-tools scripts ...

. workgroup name: name of the domain Samba act as a PDC
  workgroup name [amber] > 
. netbios name: netbios name of the samba controler
  netbios name [neptun] > 
. logon drive: local path to which the home directory will be connected 
 (for NT Workstations). Ex: 'H:'
  logon drive [U:] > 
. logon home: home directory location (for Win95/98 or NT Workstation).
  (use %U as username) Ex:'\\neptun\%U'
  logon home (press the "." character if you don't want homeDirectory) [\\%L\users\%U] > 
. logon path: directory where roaming profiles are stored. Ex:'\\neptun\profiles\%U'
  logon path (press the "." character if you don't 
  want roaming profile) [\\%L\Profiles\%a\%U] > 
. home directory prefix (use %U as username) [/home/%U] > 
. default users' homeDirectory mode [700] > 
. default user netlogon script (use %U as username) [] >
   default password validation time (time in days) [45] > 900
. ldap suffix [dc=amber,dc=global,dc=com] > 
. ldap group suffix [ou=Groups] > 
. ldap user suffix [ou=Users] > 
. ldap machine suffix [ou=Users] > 
. Idmap suffix [ou=Idmap] > 
. sambaUnixIdPooldn: object where you want to store the next uidNumber
  and gidNumber available for new users and groups
  sambaUnixIdPooldn object (relative to ${suffix}) [sambaDomainName=amber] > 
. ldap master server: IP adress or DNS name of the master (writable) ldap server
  ldap master server [127.0.0.1] > 
. ldap master port [389] > 
. ldap master bind dn [cn=Manager,dc=amber,dc=global,dc=com] > 
. ldap master bind password [] >  
. ldap slave server: IP adress or DNS name of the slave ldap server: can also 
  be the master one
  ldap slave server [127.0.0.1] > 
. ldap slave port [389] > 
. ldap slave bind dn [cn=Manager,dc=amber,dc=global,dc=com] > 
. ldap slave bind password [] >  
. ldap tls support (1/0) [0] > 
. SID for domain amber: SID of the domain (can be obtained with 'net getlocalsid neptun')
  SID for domain amber [S-1-5-21-1918777035-593721947-2697221154] > 
. unix password encryption: encryption used for unix passwords
  unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA) [SSHA] > MD5
. default user gidNumber [513] > 
. default computer gidNumber [515] > 
. default login shell [/bin/bash] > 
. default skeleton directory [/etc/skel] > 
. default domain name to append to mail adress [] > 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
backup old configuration files:
  /etc/smbldap-tools/smbldap.conf->/etc/smbldap-tools/smbldap.conf.old
  /etc/smbldap-tools/smbldap_bind.conf->/etc/smbldap-tools/smbldap_bind.conf.old
writing new configuration file:
  /etc/smbldap-tools/smbldap.conf done.
  /etc/smbldap-tools/smbldap_bind.conf done.

Файл: /etc/smbldap-tools/smbldap.conf

 ...
 userProfile=""
 ...
 

Файл: /etc/samba/smb.conf

[global]
        workgroup = amber
        netbios name = neptun
        realm = amber.global.com
        nt acl support = yes
        acl compatibility = win2k
        map acl inherit = yes
        server string = Samba Server %v
        interfaces = eth0
        bind interfaces only = yes
        hosts allow = 192.168.7. 127.
        log file = /var/log/samba/log.%m
        debug level = 9
        max log size = 500
        socket options = TCP_NODELAY SO_SNDBUF=8192 SO_RCVBUF=8192
        security = user
        os level = 250
        passdb backend = ldapsam:"ldap://127.0.0.1/"
        enable privileges = yes
        
        passwd program = /usr/sbin/smbldap-passwd "%u"
        passwd chat = *new*password* %n\n *new*password* %n\n *successfully*
        passdb expand explicit = no
        unix password sync = no
        ldap passwd sync = no
        
        ldap suffix = dc=amber,dc=global,dc=com
        ldap admin dn = cn=Manager,dc=amber,dc=global,dc=com
        ldap user suffix = ou=Users
        ldap group suffix = ou=Groups
# Т.к. для самбы компьютеры и пользователи - одно и то же,
# и искать она в дальнейшем записи компьютеров будет в пользователях,
# то для избежания дальнейших проблем при добавлении рабочих станций
# к домену мы вместо следующей строки
#
#       ldap machine suffix = ou=Computers
#
# напишем другую:
        ldap machine suffix = ou=Users
        ldap idmap suffix = ou=Idmap
        idmap backend = ldapsam:ldap://127.0.0.1/
        idmap uid = 10000-20000
        idmap gid = 10000-20000
        
        ldap delete dn = Yes
        ldap ssl = no
        
        
        add user script = /usr/sbin/smbldap-useradd -n -a "%u"
        delete user script = /usr/sbin/smbldap-userdel "%u"
        
        add group script = /usr/sbin/smbldap-groupadd -p "%g"
        delete group script = /usr/sbin/smbldap-userdel "%g"
        
        add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
        delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
        set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u"
        
        
        add machine script = /usr/sbin/smbldap-useradd -w "%u"
        
        #PDC
        domain master = yes
        preferred master = yes
        #BDC
#       domain master = no
#       preferred master = no
        domain logons = Yes
        

        logon script = 
# Если хотите, что бы профили всех пользователей были перемещаемыми
# и хранились на сервере (со всеми гигабайтами фильмов и личных фотографий)
# то укажите такое значение следующего параметра:
#
#       logon path = \\%L\Profiles\%a\%U
#
# Если вы не хотите гонять профили по сети, оставьте значение пустым, 
# (но ни в коем случае не комментируйте эту строку, она просто получит 
# значение по умолчанию), вот так:
        logon path =
        logon drive = U: 
        logon home = \\%L\users\%U
        
        
#============================ Share Definitions ==============================
[netlogon]
    comment = Network Logon Service
    path = /var/lib/samba/netlogon
    browseable = yes
    guest ok = yes
    writable = no
    share modes = no

[Profiles]
    admin users = admin
    create mode = 600
    directory mode = 700
    path = /var/lib/samba/profiles
    browseable = yes
    guest ok = yes
    writable = yes

[homes]
  comment = Home Directories
  browseable = no
  read only = no

[public]
  path = /pub
  guest ok = yes
  read only = no

[users]
  path = /home/users
  writable = yes
  printable = no
 

Файл: /etc/conf.d/samba

 ...
 daemon_list="smbd nmbd winbind"
 ...
 

Файл: /etc/ldap.conf

 host 127.0.0.1
 base dc=amber,dc=global,dc=com
 ldap_version 3
 rootbinddn cn=Manager,dc=amber,dc=global,dc=com
 bind_timelimit 10
 bind_policy soft
 pam_filter objectClass=posixAccount
 pam_password exop
 nss_base_passwd         ou=Users,dc=tty,dc=perm,dc=ru?one
 nss_base_shadow         ou=Users,dc=tty,dc=perm,dc=ru?one
 nss_base_group          ou=Groups,dc=tty,dc=perm,dc=ru?one
 nss_base_hosts          ou=Hosts,dc=tty,dc=perm,dc=ru?one
 nss_base_services       ou=Services,dc=tty,dc=perm,dc=ru?one
 nss_base_networks       ou=Networks,dc=tty,dc=perm,dc=ru?one
 nss_base_protocols      ou=Protocols,dc=tty,dc=perm,dc=ru?one
 nss_base_rpc            ou=Rpc,dc=tty,dc=perm,dc=ru?one
 nss_base_ethers         ou=Ethers,dc=tty,dc=perm,dc=ru?one
 nss_base_netmasks       ou=Networks,dc=tty,dc=perm,dc=ru?one
 nss_base_bootparams     ou=Ethers,dc=tty,dc=perm,dc=ru?one
 nss_base_aliases        ou=Aliases,dc=tty,dc=perm,dc=ru?one
 nss_base_netgroup       ou=Netgroup,dc=tty,dc=perm,dc=ru?one
 ssl off
 nss_reconnect_tries 4
 nss_reconnect_sleeptime 1
 nss_reconnect_maxsleeptime 16
 nss_reconnect_maxconntries 2
 

Файл: /etc/ldap.secret

secret

Code: Установка прав на файл /etc/ldap.secret

 #chmod 600 /etc/ldap.secret
 #chown root:wheel /etc/ldap.secret

Файл: /etc/pam.d/system-auth

 auth       required     pam_env.so
 auth       sufficient   pam_unix.so likeauth nullok
 auth       sufficient   pam_ldap.so use_first_pass
 auth       required     pam_deny.so

 account    sufficient   pam_ldap.so
 account    required     pam_unix.so

 password   required     pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
 password   sufficient   pam_unix.so nullok md5 shadow use_authtok
 password   sufficient   pam_ldap.so use_authtok
 password   required     pam_deny.so

 session    required     pam_limits.so
 session    required     pam_unix.so
 session    required     pam_mkhomedir.so skel=/etc/skel/ umask=077
 session    optional     pam_ldap.so
 

Файл: /etc/nsswitch.conf

 passwd:      files ldap
 shadow:      files ldap
 group:       files ldap

 hosts:       files dns
 networks:    files dns

 services:    db files
 protocols:   db files
 rpc:         ldap [NOTFOUND=return] db files
 ethers:      ldap [NOTFOUND=return] db files
 netmasks:    files
 netgroup:    ldap [NOTFOUND=return] files
 bootparams:  files

 automount:   files
 aliases:     files 

Предупреждение: Ни в коем случае не добавляйте значение ldap к следующим базам: hosts, networks, protocols, services. Иначе вы рискуете не дождаться следующей загрузки системы.