Настраивается контроллер домена.
Но в процессе вылазят ошибки:
При получении SID-а вылазила ошибка:
Код: Выделить всё
net getlocalsid MYDOMEN
[2012/03/13 13:59:15.491347, 0] lib/smbldap.c:731(smb_ldap_start_tls)
Failed to issue the StartTLS instruction: Protocol errorНо SID я получил.
Код: Выделить всё
slapcat | grep sambaDomainName
UNKNOWN attributeDescription "SAMBALOGONTIME" inserted.
UNKNOWN attributeDescription "SAMBALOGOFFTIME" inserted.
UNKNOWN attributeDescription "SAMBAKICKOFFTIME" inserted.
UNKNOWN attributeDescription "SAMBAPWDCANCHANGE" inserted.
UNKNOWN attributeDescription "SAMBAHOMEPATH" inserted.
UNKNOWN attributeDescription "SAMBAHOMEDRIVE" inserted.
UNKNOWN attributeDescription "SAMBAPROFILEPATH" inserted.
UNKNOWN attributeDescription "SAMBAPRIMARYGROUPSID" inserted.
UNKNOWN attributeDescription "SAMBASID" inserted.
UNKNOWN attributeDescription "SAMBALMPASSWORD" inserted.
UNKNOWN attributeDescription "SAMBAACCTFLAGS" inserted.
UNKNOWN attributeDescription "SAMBANTPASSWORD" inserted.
UNKNOWN attributeDescription "SAMBAPWDLASTSET" inserted.
UNKNOWN attributeDescription "SAMBAPWDMUSTCHANGE" inserted.
UNKNOWN attributeDescription "SAMBAGROUPTYPE" inserted.
UNKNOWN attributeDescription "SAMBADOMAINNAME" inserted.
UNKNOWN attributeDescription "SAMBANEXTRID" inserted.
description: Netbios Domain Supports file replication in a sambaDomainName
dn: sambaDomainName=MYDOMEN,dc=mydomen,dc=ruА вслед за ней в процессе настройки:
Код: Выделить всё
net -U Administrator rpc rights grant 'MYDOMEN\Domain Admins' SeMachineAccountPrivilege
Enter Administrator's password:
Receiving SMB: Server stopped responding
Could not connect to server 127.0.0.1
Connection failed: NT_STATUS_IO_TIMEOUTА после переделывания всех шагов:
Код: Выделить всё
net -U Administrator rpc rights grant 'MYDOMEN\Domain Admins' SeMachineAccountPrivilege
Enter Administrator's password:
Could not connect to server 127.0.0.1
Connection failed: NT_STATUS_CONNECTION_REFUSEDЛог запроса:
Код: Выделить всё
Mar 13 14:39:01 common-server slapd[4029]: conn=1009 fd=18 ACCEPT from IP=127.0.0.1:49953 (IP=0.0.0.0:389)
Mar 13 14:39:01 common-server slapd[4029]: conn=1009 op=0 BIND dn="cn=admin,dc=mydomen,dc=ru" method=128
Mar 13 14:39:01 common-server slapd[4029]: conn=1009 op=0 BIND dn="cn=admin,dc=mydomen,dc=ru" mech=SIMPLE ssf=0
Mar 13 14:39:01 common-server slapd[4029]: conn=1009 op=0 RESULT tag=97 err=0 text=
Mar 13 14:39:01 common-server slapd[4029]: conn=1009 op=1 SRCH base="dc=mydomen,dc=ru" scope=2 deref=0 filter="(uid=root)"
Mar 13 14:39:01 common-server slapd[4029]: conn=1009 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text=
Mar 13 14:39:01 common-server slapd[4029]: conn=1009 op=2 UNBIND
Mar 13 14:39:01 common-server slapd[4029]: conn=1009 fd=18 closedКонфиги:
Spoiler
slapd.conf
ldap.conf
smb.conf
smbldap.conf
/etc/pam.d/common-account
/etc/pam.d/common-auth
/etc/pam.d/common-password
/etc/pam.d/common-session
Код: Выделить всё
cat slapd.conf | grep -v "#"
include /etc/ldap/schema/core.schema
include /etc/ldap/schema/cosine.schema
include /etc/ldap/schema/nis.schema
include /etc/ldap/schema/inetorgperson.schema
include /etc/ldap/schema/samba.schema
include /etc/ldap/schema/mmc.schema
include /etc/ldap/schema/mail.schema
include /etc/ldap/schema/printer.schema
include /etc/ldap/schema/dnszone.schema
include /etc/ldap/schema/dhcp.schema
pidfile /var/run/slapd/slapd.pid
argsfile /var/run/slapd/slapd.args
loglevel 256
modulepath /usr/lib/ldap
moduleload back_bdb
sizelimit 500
tool-threads 1
backend bdb
database bdb
suffix "dc=mydomen,dc=ru"
rootdn "cn=admin,dc=mydomen,dc=ru"
rootpw {SSHA}<PASSWORD>
directory "/var/lib/ldap"
dbconfig set_cachesize 0 2097152 0
dbconfig set_lk_max_objects 1500
dbconfig set_lk_max_locks 1500
dbconfig set_lk_max_lockers 1500
index objectClass,uidNumber,gidNumber eq
index cn,sn,uid,displayName pres,sub,eq
index memberUid,mail,givenname eq,subinitial
index sambaSID,sambaPrimaryGroupSID,sambaDomainName eq
index zoneName,relativeDomainName eq
index dhcpHWAddress,dhcpClassData eq
lastmod on
access to attrs=userPassword,sambaLMPassword,sambaNTPassword
by dn="cn=admin,dc=mydomen,dc=ru" write
by anonymous auth
by self write
by * none
access to dn.base="" by * read
access to *
by dn="cn=admin,dc=mydomen,dc=ru" write
by * readldap.conf
Код: Выделить всё
cat ldap.conf | grep -v "#"
host 127.0.0.1
base dc=mydomen,dc=rusmb.conf
Код: Выделить всё
cat smb.conf
[global]
workgroup = MYDOMEN
netbiosname = PDC-SRV-MYDOMEN
preferred master = yes
os level = 65
wins support = yes
enable privileges = yes
timeserver = yes
socket options = SO_KEEPALIVE IPTOS_LOWDELAY SO_SNDBUF=8192 SO_RCVBUF=8192
log level = 3
null passwords = yes
security = user
# unix charset = ISO8859-1
name resolve order = bcast host
domain logons = yes
domain master = yes
printing = cups
printcap name = cups
logon path = \\%N\profiles\%U
logon script = logon.bat
logon drive = H:
map acl inherit = yes
nt acl support = yes
passdb backend = ldapsam:ldap://127.0.0.1/
obey pam restrictions = no
ldap admin dn = cn=admin,dc=mydomen,dc=ru
ldap suffix = dc=mydomen,dc=ru
ldap group suffix = ou=Groups
ldap user suffix = ou=Users
ldap machine suffix = ou=Computers
ldap idmap suffix = ou=Users
ldap passwd sync = yes
passwd program = /usr/sbin/smbldap-passwd -u %u
passwd chat = "Changing password for*\nNew password*" %n\n "*Retype new password*" %n\n
add user script = /usr/sbin/smbldap-useradd -m "%u"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u"
add group script = /usr/sbin/smbldap-groupadd -p "%g"
add machine script = /usr/lib/mmc/add_machine_script '%u'
delete user script = /usr/sbin/smbldap-userdel "%u"
delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
delete group script = /usr/sbin/smbldap-groupdel "%g"
[homes]
comment = Home directories
browseable = no
writeable = yes
create mask = 0700
directory mask = 0700
hide files = /Maildir/
...smbldap.conf
Код: Выделить всё
SID="<SID>"
sambaDomain="MYDOMEN"
ldapTLS="0"
suffix="dc=mydomen,dc=ru"
usersdn="ou=User,${suffix}"
computersdn="ou=Computers,${suffix}"
groupsdn="ou=Groups,${suffix}"
idmapdn="ou=Idmap,${suffix}"
sambaUnixIdPooldn="sambaDomainName=MYDOMEN,${suffix}"
scope="sub"
hash_encrypt="SSHA"
userLoginShell="/bin/bash"
userHome="/home/%U"
userHomeDirectoryMode="700"
userGecos="System User"
defaultUserGid="513"
defaultComputerGid="515"
skeletonDir="/etc/skel"
defaultMaxPasswordAge="45"
userSmbHome="\\PDC-SRV-MYDOMEN\%U"
userProfile="\\PDC-SRV-MYDOMEN\profiles\%U"
userHomeDrive="H:"
userScript="logon.bat"
mailDomain="mydomen.ru"
smbpasswd="/usr/bin/smbpasswd"/etc/pam.d/common-account
Код: Выделить всё
account required pam_unix.so
account sufficient pam_ldap.so/etc/pam.d/common-auth
Код: Выделить всё
auth sufficient pam_unix.so nullok_secure
auth sufficient pam_ldap.so use_first_pass
auth required pam_deny.so/etc/pam.d/common-password
Код: Выделить всё
password sufficient pam_unix.so nullok obscure min=4 max=8 md5
password sufficient pam_ldap.so use_first_pass use_authtok
password required pam_deny.so/etc/pam.d/common-session
Код: Выделить всё
session required pam_unix.so
session required pam_unix.so
session optional pam_ldap.soГде искать проблему?