...
| Code Block |
|---|
[global]
security = ads
realm = LEMAKER.FRITZ.BOX
#Der folgende Eintrag wird nicht benötigt
#password server = IPADRESSE #IP des Domain Controllers
workgroup = MB
idmap uid = 10000-20000
idmap gid = 10000-20000
winbind enum users = yes
winbind enum groups = yes
winbind cache time = 10
winbind use default domain = yes
template homedir = /home/%U
template shell = /bin/bash
client use spnego = yes
client ntlmv2 auth = yes
encrypt passwords = yes
restrict anonymous = 2
domain master = no
local master = no
preferred master = no
os level = 0
server string = %h server (Samba, Ubuntu)
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
syslog = 0
panic action = /usr/share/samba/panic-action %d
server role = member server
passdb backend = tdbsam
obey pam restrictions = yes
unix password sync = yes
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
pam password change = yes
map to guest = bad user
usershare allow guests = yes
[printers]
comment = All Printers
browseable = no
path = /var/spool/samba
printable = yes
guest ok = no
read only = yes
create mask = 0700
[print$]
comment = Printer Drivers
path = /var/lib/samba/printers
browseable = yes
read only = yes
guest ok = no |
Dann den Service samba starten, aber winbind noch nicht.
Ggf. kann man die samba-Konfiguration mit dem Befehl "testparm" testen.
Domain beitreten
| Code Block |
|---|
root@ubu:~# net ads join -U Administrator
Enter Administrator's password:
Using short domain name -- MB
Joined 'UBU' to dns domain 'lemaker.fritz.box'
root@ubu:~# |
Danach winbind-Service starten
| Code Block |
|---|
root@ubu:~# service winbind start
winbind start/running, process 1485
root@ubu:~# |
Erste Tests mit winbind
| Code Block |
|---|
root@ubu:~# wbinfo -u
administrator
krbtgt
guest
root@ubu:~# |
| Code Block |
|---|
root@ubu:~# wbinfo -g
allowed rodc password replication group
enterprise read-only domain controllers
denied rodc password replication group
read-only domain controllers
group policy creator owners
ras and ias servers
domain controllers
enterprise admins
domain computers
cert publishers
dnsupdateproxy
domain admins
domain guests
schema admins
domain users
dnsadmins
root@ubu:~# |
Nameservice switch konfigurieren
| Code Block |
|---|
|
#Folgende Einträge anpassen
passwd: compat winbind
group: compat winbind
shadow: compat |
Danach winbind-Service neu starten
Userliste anzeigen
Es sollten lokale UNIX_Benutzer und Domainuser angezeigt werden
| Code Block |
|---|
root@ubu:~# getent passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
libuuid:x:100:101::/var/lib/libuuid:
syslog:x:101:104::/home/syslog:/bin/false
messagebus:x:102:106::/var/run/dbus:/bin/false
landscape:x:103:109::/var/lib/landscape:/bin/false
sshd:x:104:65534::/var/run/sshd:/usr/sbin/nologin
klaus:x:1000:1000:klaus,,,:/home/klaus:/bin/bash
#Ab hier Domainbenutzer
administrator:*:10000:10000:Administrator:/home/administrator:/bin/bash
krbtgt:*:10001:10000:krbtgt:/home/krbtgt:/bin/bash
guest:*:10002:10001:Guest:/home/guest:/bin/bash
root@ubu:~# |
Gruppenliste anzeigen
| Code Block |
|---|
root@ubu:~# getent group
root:x:0:
daemon:x:1:
bin:x:2:
sys:x:3:
adm:x:4:syslog,klaus
tty:x:5:
disk:x:6:
lp:x:7:
mail:x:8:
news:x:9:
uucp:x:10:
man:x:12:
proxy:x:13:
kmem:x:15:
dialout:x:20:
fax:x:21:
voice:x:22:
cdrom:x:24:klaus
floppy:x:25:
tape:x:26:
sudo:x:27:klaus
audio:x:29:
dip:x:30:klaus
www-data:x:33:
backup:x:34:
operator:x:37:
list:x:38:
irc:x:39:
src:x:40:
gnats:x:41:
shadow:x:42:
utmp:x:43:
video:x:44:
sasl:x:45:
plugdev:x:46:klaus
staff:x:50:
games:x:60:
users:x:100:
nogroup:x:65534:
libuuid:x:101:
netdev:x:102:
crontab:x:103:
syslog:x:104:
fuse:x:105:
messagebus:x:106:
mlocate:x:107:
ssh:x:108:
landscape:x:109:
klaus:x:1000:
lpadmin:x:110:klaus
sambashare:x:111:klaus
winbindd_priv:x:112:
#Ab hier Domaingruppen
allowed rodc password replication group:x:10002:
enterprise read-only domain controllers:x:10003:
denied rodc password replication group:x:10004:krbtgt
read-only domain controllers:x:10005:
group policy creator owners:x:10006:administrator
ras and ias servers:x:10007:
domain controllers:x:10008:
enterprise admins:x:10009:administrator
domain computers:x:10010:
cert publishers:x:10011:
dnsupdateproxy:x:10012:
domain admins:x:10013:administrator
domain guests:x:10001:
schema admins:x:10014:administrator
domain users:x:10000:
dnsadmins:x:10015: |
