Page tree

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Code Block
apt-get install python-dev
apt-get install libldap2-dev
apt-get install pkg-config
apt-get install git
apt-get install gdb 
#Wenn man winbind-Unterstützung benötigt 
apt-get install libnss3-dev
apt-get install libpam-dev (oder libpam0g-dev) 

Installation

Wechseln sie in das Installationsverzeichnis (welches nach dem Auspacken des o.g. tar-Archives entstanden ist) und geben sie nach folgende Befehle ein.
Das konfigurieren und compilieren ist sehr aufwändig und kann je nach Systemgeschwindigkeit über 1 Stunde dauern.

...

Code Block
languagebash
title/etc/init.d/samba-ad-dc
collapsetrue
#! /bin/sh

### BEGIN INIT INFO
# Provides:          samba-ad-dc
# Required-Start:    $network $local_fs $remote_fs
# Required-Stop:     $network $local_fs $remote_fs
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: start Samba daemons for the AD DC
### END INIT INFO
#
# Start/stops the Samba daemon (samba).
# Adapted from the Samba 3 packages.
#

PIDDIR=/usr/local/samba/var/run

#PIDDIR=/var/run/samba

SAMBAPID=$PIDDIR/samba.pid
PATH=/usr/local/samba/sbin:/usr/local/samba/bin:$PATH
export PATH

# clear conflicting settings from the environment

unset TMPDIR

# See if the daemon and the config file are there

test -x /usr/local/samba/sbin/samba -a -r /etc/samba/smb.conf || exit 0

. /lib/lsb/init-functions

case "$1" in
        start)
                SERVER_ROLE=`samba-tool testparm --parameter-name="server role"  2>/dev/null | tail -1`
                if [ "$SERVER_ROLE" != "active directory domain controller" ]; then
                    exit 0
                fi

                #if init_is_upstart; then
                        #exit 1
                #fi

                # CVE-2013-4475

                KEYFILE=/var/lib/samba/private/tls/key.pem

                if [ -e $KEYFILE ]
                then
                                KEYPERMS=`stat -c %a $KEYFILE`
                                if [ "$KEYPERMS" != "600" ]
                                then
                                                echo "wrong permission on $KEYFILE, must be 600"
                                                echo "samba will not start (CVE-2013-4475)"
                                                echo "Removing all tls .pem files will cause an auto-regeneration with the correct permissions."
                                                exit 1
                                fi
                fi

                log_daemon_msg "Starting Samba AD DC daemon" "samba"

                # Make sure we have our PIDDIR, even if it's on a tmpfs

                install -o root -g root -m 755 -d $PIDDIR

                if ! start-stop-daemon --start --quiet --oknodo --exec /usr/local/samba/sbin/samba -- -D; then
                        log_end_msg 1
                        exit 1
                fi
                log_end_msg 0
                ;;
        stop)
                #if init_is_upstart; then
                        #exit 0
                #fi
                log_daemon_msg "Stopping Samba AD DC daemon" "samba"

                start-stop-daemon --stop --quiet --pidfile $SAMBAPID

                # Wait a little and remove stale PID file

                sleep 1

                if [ -f $SAMBAPID ] && ! ps h `cat $SAMBAPID` > /dev/null
                then
                        # Stale PID file (samba was succesfully stopped),
                        # remove it (should be removed by samba itself IMHO.)
                        rm -f $SAMBAPID
                fi

                log_end_msg 0
                ;;
        restart|force-reload)
                #if init_is_upstart; then
                        #exit 1
                #fi
                $0 stop
                sleep 1
                $0 start
                ;;
        status)
                status_of_proc -p $SAMBAPID /usr/local/samba/sbin/samba samba
                exit $?
                ;;
        *)
                echo "Usage: /etc/init.d/samba-ad-dc {start|stop|restart|force-reload|status}"
                exit 1
                ;;
esac

exit 0

Selbstverständlich müssen diese Scripte die passenden Berechtigungen aufweisen:

root@lemaker:d# l smbd nmbd samba samba-ad-dc -rwxr-xr-x 1 root root 2026 Nov 16 02:40 nmbd -rwxr-xr-x 1 root root 1266 Nov 16 02:40 samba -rwxr-xr-x 1 root root 2308 Nov 16 02:40 samba-ad-dc -rwxr-xr-x 1 root root 2069 Nov 16 02:40 smbd root@lemaker:/etc/init.d#
Code Block
Code Block
languagebash
title/etc/init.

Für den Betrieb wird noch eine Konfigurationsdatei benötigt.
Diese sollte aus Kompatibilitätsgründen im Verzeichnis /etc/samba gespeichert werden.

Code Block
languagebash
title/etc/samba/smb.conf
collapsetrue
[global]
   workgroup = WORKGROUP
   server string = %h server (Samba, Ubuntu)
   dns proxy = no
   log file = /var/log/samba/log.%m
   max log size = 1000
   syslog = 0
   panic action = /usr/share/samba/panic-action %d
   server role = standalone server
   passdb backend = tdbsam
   obey pam restrictions = yes
   unix password sync = yes
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
   pam password change = yes
   map to guest = bad user
   usershare allow guests = yes
[printers]
   comment = All Printers
   browseable = no
   path = /var/spool/samba
   printable = yes
   guest ok = no
   read only = yes
   create mask = 0700
[print$]
   comment = Printer Drivers
   path = /var/lib/samba/printers
   browseable = yes
   read only = yes
   guest ok = no
[myshare]
   comment = Persoenliche Freigabe fuer User myuser
   guest ok = yes
   browseable = yes
   path = /var2/ablage
   create mask = 0600 
   directory mask = 0700 
   valid users = myuser
   read only = no 

...

Code Block
root@lemaker:/usr/local/samba/etc# ln -s /etc/samba/smb.conf 
root@lemaker:/usr/local/samba/etc# l
total 8
drwxr-xr-x  2 root root 4096 Nov 16 02:53 .
drwxr-xr-x 10 root root 4096 Nov 16 02:17 ..
lrwxrwxrwx  1 root root   19 Nov 16 02:53 smb.conf -> /etc/samba/smb.conf
root@lemaker:/usr/local/samba/etc#

Dann benötigen wir noch ein log-Verzeichnis, sowie ein Verzeichnis für das Handling des Druckers:

Code Block
mkdir /var/log/samba
mkdir -p /var/lib/samba/printers 

Test der Installation

Wenn nun alles perfekt ist kann die Installation mit dem samba-eigenen Tool "testparm" getestet werden.

Code Block
titleAusgabe des Befehls "testparm"
collapsetrue
root@lemaker:/etc/samba# testparm

Load smb config files from /usr/local/samba/etc/smb.conf

rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[printers]"
Processing section "[print$]"
Processing section "[myshare]"
Loaded services file OK.
Server role: ROLE_STANDALONE
Press enter to see a dump of your service definitions

[global]
	server string = %h server (Samba, Ubuntu)
	server role = standalone server
	map to guest = Bad User
	obey pam restrictions = Yes
	pam password change = Yes
	passwd program = /usr/bin/passwd %u
	passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
	unix password sync = Yes
	syslog = 0
	log file = /var/log/samba/log.%m
	max log size = 1000
	dns proxy = No
	usershare allow guests = Yes
	panic action = /usr/share/samba/panic-action %d
	idmap config * : backend = tdb
[printers]
	comment = All Printers
	path = /var/spool/samba
	create mask = 0700
	printable = Yes
	print ok = Yes
	browseable = No
[print$]
	comment = Printer Drivers
	path = /var/lib/samba/printers
[myshare]
	comment = Persoenliche Freigabe fuer User myuser
	path = /var2/ablage
	valid users = myuser
	read only = No
	create mask = 0600
	directory mask = 0700
	guest ok = Yes
root@lemaker:/etc/samba#

Start der Anwendung

root@lemaker:/etc/init.d# service samba status * nmbd is not running * smbd is not running root@lemaker:/etc/init.d# service samba start * Starting NetBIOS name server nmbd
Code Block
d/winbind
collapsetrue
#!/bin/sh

### BEGIN INIT INFO
# Provides:          winbind
# Required-Start:    $network $remote_fs $syslog
# Required-Stop:     $network $remote_fs $syslog
# Should-Start:      samba
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: start Winbind daemon
### END INIT INFO

PATH=/usr/local/samba/sbin:/usr/local/samba/bin:$PATH
#PATH=/sbin:/bin:/usr/sbin:/usr/bin

[ -r /etc/default/winbind ] && . /etc/default/winbind

DAEMON=/usr/local/samba/sbin/winbindd
PIDDIR=/usr/local/samba/var/run
#PIDDIR=/var/run/samba
WINBINDPID=$PIDDIR/winbindd.pid

# clear conflicting settings from the environment

unset TMPDIR

# See if the daemon is there
test -x $DAEMON || exit 0
SERVER_ROLE=`samba-tool testparm --parameter-name="server role"  2>/dev/null | tail -1`

if [ "$SERVER_ROLE" = "active directory domain controller" ]; then
    exit 0
fi

. /lib/lsb/init-functions

case "$1" in
        start)
                #if init_is_upstart; then
                        #exit 1
                #fi
                log_daemon_msg "Starting the Winbind daemon" "winbind"
                mkdir -p $PIDDIR/winbindd_privileged || return 1
                chgrp winbindd_priv $PIDDIR/winbindd_privileged/ || return 1
                chmod 0750 $PIDDIR/winbindd_privileged/ || return 1
                start-stop-daemon --start --quiet --oknodo --exec $DAEMON -- $WINBINDD_OPTS
                log_end_msg $?
                ;;
        stop)
                #if init_is_upstart; then
                        #exit 0
                #fi
                log_daemon_msg "Stopping the Winbind daemon" "winbind"
                start-stop-daemon --stop --quiet --oknodo --exec $DAEMON
                log_end_msg $?
                ;;
        restart|force-reload)
                #if init_is_upstart; then
                        #exit 1
                #fi
                $0 stop && sleep 2 && $0 start
                ;;
        status)
            [ OK ] 
 * Starting SMB/CIFS daemon smbd      status_of_proc -p $WINBINDPID $DAEMON winbind && exit 0 || exit $?
                ;;
        *)
                echo "Usage: /etc/init.d/winbind {start|stop|restart|force-reload|status}"
                exit 1
                ;;
esac 

 

Selbstverständlich müssen diese Scripte die passenden Berechtigungen aufweisen:

Code Block
root@lemaker:/etc/init.d# l smbd nmbd samba samba-ad-dc
-rwxr-xr-x 1 root root    [ OK ] 
root@lemaker:/etc/init.d# service samba status
 * nmbd is running
 * smbd is running
root@lemaker:/etc/init.d#2026 Nov 16 02:40 nmbd
-rwxr-xr-x 1 root root 1266 Nov 16 02:40 samba
-rwxr-xr-x 1 root root 2308 Nov 16 02:40 samba-ad-dc
-rwxr-xr-x 1 root root 2069 Nov 16 02:40 smbd
-rwxr-xr-x 1 root root 1771 Nov 17 02:36 winbind
root@lemaker:/etc/init.d#

Für den Betrieb wird noch eine Konfigurationsdatei benötigt.
Diese sollte aus Kompatibilitätsgründen im Verzeichnis /etc/samba gespeichert werden.

Code Block
languagebash
title/etc/samba/smb.conf
collapsetrue
[global]
   workgroup = WORKGROUP
   server string = %h server (Samba, Ubuntu)
   dns proxy = no
   log file = /var/log/samba/log.%m
   max log size = 1000
   syslog = 0
   panic action = /usr/share/samba/panic-action %d
   server role = standalone server
   passdb backend = tdbsam
   obey pam restrictions = yes
   unix password sync = yes
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
   pam password change = yes
   map to guest = bad user
   usershare allow guests = yes
[printers]
   comment = All Printers
   browseable = no
   path = /var/spool/samba
   printable = yes
   guest ok = no
   read only = yes
   create mask = 0700
[print$]
   comment = Printer Drivers
   path = /var/lib/samba/printers
   browseable = yes
   read only = yes
   guest ok = no
[myshare]
   comment = Persoenliche Freigabe fuer User myuser
   guest ok = yes
   browseable = yes
   path = /var2/ablage
   create mask = 0600 
   directory mask = 0700 
   valid users = myuser
   read only = no 


Unsere manuelle Installation erwartet die Konfigurationsdatei aber in /usr/local/samba/etc/smb.conf
Hier kann ein symbolischer Link helfen. 

Code Block
root@lemaker:/usr/local/samba/etc# ln -s /etc/samba/smb.conf 
root@lemaker:/usr/local/samba/etc# l
total 8
drwxr-xr-x  2 root root 4096 Nov 16 02:53 .
drwxr-xr-x 10 root root 4096 Nov 16 02:17 ..
lrwxrwxrwx  1 root root   19 Nov 16 02:53 smb.conf -> /etc/samba/smb.conf
root@lemaker:/usr/local/samba/etc#

Dann benötigen wir noch ein log-Verzeichnis, sowie ein Verzeichnis für das Handling des Druckers und eine Winbind-Gruppe:

Code Block
mkdir /var/log/samba
mkdir -p /var/lib/samba/printers 
addgroup winbindd_priv

Test der Installation

Wenn nun alles perfekt ist kann die Installation mit dem samba-eigenen Tool "testparm" getestet werden.

Code Block
titleAusgabe des Befehls "testparm"
collapsetrue
root@lemaker:/etc/samba# testparm

Load smb config files from /usr/local/samba/etc/smb.conf

rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[printers]"
Processing section "[print$]"
Processing section "[myshare]"
Loaded services file OK.
Server role: ROLE_STANDALONE
Press enter to see a dump of your service definitions

[global]
	server string = %h server (Samba, Ubuntu)
	server role = standalone server
	map to guest = Bad User
	obey pam restrictions = Yes
	pam password change = Yes
	passwd program = /usr/bin/passwd %u
	passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
	unix password sync = Yes
	syslog = 0
	log file = /var/log/samba/log.%m
	max log size = 1000
	dns proxy = No
	usershare allow guests = Yes
	panic action = /usr/share/samba/panic-action %d
	idmap config * : backend = tdb
[printers]
	comment = All Printers
	path = /var/spool/samba
	create mask = 0700
	printable = Yes
	print ok = Yes
	browseable = No
[print$]
	comment = Printer Drivers
	path = /var/lib/samba/printers
[myshare]
	comment = Persoenliche Freigabe fuer User myuser
	path = /var2/ablage
	valid users = myuser
	read only = No
	create mask = 0600
	directory mask = 0700
	guest ok = Yes
root@lemaker:/etc/samba#

Start der Anwendung

Code Block
root@lemaker:/etc/init.d# service samba status
 * nmbd is not running
 * smbd is not running
root@lemaker:/etc/init.d# service samba start
 * Starting NetBIOS name server nmbd                                                                                      [ OK ] 
 * Starting SMB/CIFS daemon smbd                                                                                          [ OK ] 
root@lemaker:/etc/init.d# service samba status
 * nmbd is running
 * smbd is running
root@lemaker:/etc/init.d#

nss-Support

nss steht für Name-Switch-Service und bietet die Möglichkeit eine vollständige Liste aller Benutzer und Gruppen zu verwalten, unabhängig davon ob es lokale Benutzer/Gruppen sind oder Samba-Benutzer/Gruppen.

Im Normalbetrieb (also nicht als primärer Domaincontroller) wird nss in der Regel über den sogenannten "winbind"-Service bereitgestellt. (siehe Konfiguration winbind unter UBUNTU und Aufnahme in eine Domain )

Daher sind die u.a. Maßnahmen evtl. nicht erforderlich.

Code Block
cp /root/install/samba-4.1.6/bin/default/nsswitch/libnss-winbind.so /lib
cd /lib
mv libnss-winbind.so libnss_winbind.so
ldconfig -v
#nss testen
/root/install/samba-4.1.6/bin/nsstest