Вот на всякий случай мои конфиги (хотя врядле они нужны сам пиринцип важен).
krb5.conf
Код:
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = DT.PO
kdc_timesync = 1
forwardeble = true
proxiable = true
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
[realms]
DT.LOCAL = {
kdc = main.dt.po
kdc = main.dt.po
admin_server = main.dt.po
kdc = main.dt.po
}
[login]
krb4_convert = false
krb4_get_tickets = false
[domain_realm]
main.dt.po = DT.PO
.main.dt.po = dt.po
[kdc]
profile = /var/keberos/krb5kdc/kdc.conf
[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
smb.conf
Код:
[global]
log file = /var/log/samba/log.%m
socket options = TCP_NODELAY SO_SNDBUF=8192 SO_RCVBUF=8192
null passwords = yes
interfaces = eth0
hosts allow = 192.168.0.0 127.0.0.1
encrypt passwords = yes
idmap uid = 10000-20000
idmap gid = 10000-20000
auth methods = winbind
winbind enum groups = yes
winbind enum users = yes
winbind use default domain = yes
winbind cache time = 1800
winbind refresh tickets = yes
name resolve order = hosts wins bcast lmhosts
case sensitive = no
dns proxy = no
netbios name = BASESERVER
server string = baseserver
password server = main.dt.po
realm = DT.PO
client use spnego = yes
client signing = yes
local master = no
domain master = no
preferred master = no
workgroup = DT
debug level = 2
security = ads
dos charset = 866
unix charset = UTF-8
max log size = 50
os level = 0
# wins server = 10.12.0.5
template shell = /bin/bash
template homedir = /home/%U
system-auth
Код:
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_winbind.so use_first_pass
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_winbind.so
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password sufficient pam_winbind.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session required pam_mkhomedir.so skel=/etc/skel/ umask=0022
