Настройка LDAP (Проблемы.)

yamah · Сообщение **yamah** » 28.11.2008 10:27

Есть сервер с Debian GNU/Linux 4.03 Etch x86_64

Пытаюсь настроить LDAP. Документацию брал отсюда
Успешно дошел до этого пункта

Код: Выделить всё

smbldap-populate -u 30000 -g 30000

И все застопориваеться из-за ошибки:

Код:

smbldap-populate -u 30000 -g 30000
Populating LDAP directory for domain sgshm (S-1-5-21-4005224139-4166151995-3057652387)
(using builtin directory structure)

adding new entry: dc=sgshm,dc=ru
failed to add entry: no global superior knowledge at /usr/sbin/smbldap-populate line 495, <GEN1> line 2.
adding new entry: ou=Users,dc=sgshm,dc=ru
failed to add entry: no global superior knowledge at /usr/sbin/smbldap-populate line 495, <GEN1> line 3.
adding new entry: ou=Groups,dc=sgshm,dc=ru
failed to add entry: no global superior knowledge at /usr/sbin/smbldap-populate line 495, <GEN1> line 4.
adding new entry: ou=Computers,dc=sgshm,dc=ru
failed to add entry: no global superior knowledge at /usr/sbin/smbldap-populate line 495, <GEN1> line 5.
adding new entry: ou=Idmap,dc=sgshm,dc=ru
failed to add entry: no global superior knowledge at /usr/sbin/smbldap-populate line 495, <GEN1> line 6.
adding new entry: uid=admin,ou=Users,dc=sgshm,dc=ru
failed to add entry: no global superior knowledge at /usr/sbin/smbldap-populate line 495, <GEN1> line 7.
adding new entry: uid=nobody,ou=Users,dc=sgshm,dc=ru
failed to add entry: no global superior knowledge at /usr/sbin/smbldap-populate line 495, <GEN1> line 8.
adding new entry: cn=Domain Admins,ou=Groups,dc=sgshm,dc=ru
failed to add entry: no global superior knowledge at /usr/sbin/smbldap-populate line 495, <GEN1> line 9.
adding new entry: cn=Domain Users,ou=Groups,dc=sgshm,dc=ru
failed to add entry: no global superior knowledge at /usr/sbin/smbldap-populate line 495, <GEN1> line 10.
adding new entry: cn=Domain Guests,ou=Groups,dc=sgshm,dc=ru
failed to add entry: no global superior knowledge at /usr/sbin/smbldap-populate line 495, <GEN1> line 11.
adding new entry: cn=Domain Computers,ou=Groups,dc=sgshm,dc=ru
failed to add entry: no global superior knowledge at /usr/sbin/smbldap-populate line 495, <GEN1> line 12.
adding new entry: cn=Administrators,ou=Groups,dc=sgshm,dc=ru
failed to add entry: no global superior knowledge at /usr/sbin/smbldap-populate line 495, <GEN1> line 16.
adding new entry: cn=Account Operators,ou=Groups,dc=sgshm,dc=ru
failed to add entry: no global superior knowledge at /usr/sbin/smbldap-populate line 495, <GEN1> line 18.
adding new entry: cn=Print Operators,ou=Groups,dc=sgshm,dc=ru
failed to add entry: no global superior knowledge at /usr/sbin/smbldap-populate line 495, <GEN1> line 19.
adding new entry: cn=Backup Operators,ou=Groups,dc=sgshm,dc=ru
failed to add entry: no global superior knowledge at /usr/sbin/smbldap-populate line 495, <GEN1> line 20.
adding new entry: cn=Replicators,ou=Groups,dc=sgshm,dc=ru
failed to add entry: no global superior knowledge at /usr/sbin/smbldap-populate line 495, <GEN1> line 21.
adding new entry: sambaDomainName=sgshm,dc=sgshm,dc=ru
failed to add entry: no global superior knowledge at /usr/sbin/smbldap-populate line 495, <GEN1> line 21.

Please provide a password for the domain root:
No such object at /usr/share/perl5/smbldap_tools.pm line 353.

В сислоге на запуск демона выводит следующее:

Код: Выделить всё

Nov 28 13:07:25 localhost slapd[24145]: @(#) $OpenLDAP: slapd 2.3.30 (Oct  5 2008 22:27:50) $ ^Ibuildd@excelsior:/build/buildd/openldap2.3-2.3.30/debian/build/servers/slapd

Других записей относящихся к ldap, bind, samba за сегодня не было.

В аттаче конфиги.

Заранее спасибо.

sdukshis · Сообщение **sdukshis** » 28.11.2008 12:10

Могу предположить следующее:
Неправильно заданы учётная запись администратора LDAP или его пароль в /etc/smbldap-tools/smbldap_bind.conf

yamah · Сообщение **yamah** » 28.11.2008 12:23

sdukshis писал(а): ↑
28.11.2008 12:10
Могу предположить следующее:
Неправильно заданы учётная запись администратора LDAP или его пароль в /etc/smbldap-tools/smbldap_bind.conf

Пароль для LDAP я везде один прописывал.
Имя для учетки админа у меня вообще никто не спрашивал. Все оставлял по дефолту.

28.11.2008 12:33

smbpasswd -w
точно сделали? и с правильным паролем?

вообще любые проблемы с лдапом проще всего решаются так:
включаете логи лдапа в slapd.conf (man slapd.conf /LogLevel)
делаете то, что не получается и смотрите там, куда он логи у вас пишет (syslog?)
что происходит - ошибки там будут, если логи правильно выбрали.

обычно это либо отсутствие должной схемы, нужной для импорта объекта.
либо нехавтка прав конкретного сервиса(самбы) для работы с лдапом.
либо недопустимые вещи пытаетесь втянуть. например нет родительского элемента или типа того.

sdukshis · Сообщение **sdukshis** » 28.11.2008 13:10

На правильный путь может так же натолкнуть строка 495 из /usr/sbin/smbldap-populate. К сожалению у меня похоже другая версия smbldap-tools, поскольку на этой строке "}". Приведете что там у Вас.

yamah · Сообщение **yamah** » 28.11.2008 13:31

sdukshis писал(а): ↑
28.11.2008 13:10
На правильный путь может так же натолкнуть строка 495 из /usr/sbin/smbldap-populate. К сожалению у меня похоже другая версия smbldap-tools, поскольку на этой строке "}". Приведете что там у Вас.

Код: Выделить всё

        $result->code && warn "failed to add entry: ", $result->error;

yamah · Сообщение **yamah** » 28.11.2008 13:41

JIeHb писал(а): ↑
28.11.2008 12:33
smbpasswd -w
точно сделали? и с правильным паролем?

вообще любые проблемы с лдапом проще всего решаются так:
включаете логи лдапа в slapd.conf (man slapd.conf /LogLevel)
делаете то, что не получается и смотрите там, куда он логи у вас пишет (syslog?)
что происходит - ошибки там будут, если логи правильно выбрали.

обычно это либо отсутствие должной схемы, нужной для импорта объекта.
либо нехавтка прав конкретного сервиса(самбы) для работы с лдапом.
либо недопустимые вещи пытаетесь втянуть. например нет родительского элемента или типа того.

На выполнение команды

Код: Выделить всё

smbldap-populate -u 30000 -g 30000

В сислоге пишет:

Код:

Nov 28 16:36:36 localhost slapd[25193]: conn=0 fd=14 ACCEPT from IP=127.0.0.1:49680 (IP=0.0.0.0:389)
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=0 BIND dn="cn=server,dc=sgshm,dc=ru" method=128
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=0 RESULT tag=97 err=49 text=
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=1 SRCH base="dc=sgshm,dc=ru" scope=0 deref=2 filter="(objectClass=*)"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text=
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=2 ADD dn="dc=sgshm,dc=ru"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=2 RESULT tag=105 err=53 text=no global superior knowledge
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=3 SRCH base="ou=Users,dc=sgshm,dc=ru" scope=0 deref=2 filter="(objectClass=*)"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=3 SEARCH RESULT tag=101 err=32 nentries=0 text=
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=4 ADD dn="ou=Users,dc=sgshm,dc=ru"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=4 RESULT tag=105 err=53 text=no global superior knowledge
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=5 SRCH base="ou=Groups,dc=sgshm,dc=ru" scope=0 deref=2 filter="(objectClass=*)"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=5 SEARCH RESULT tag=101 err=32 nentries=0 text=
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=6 ADD dn="ou=Groups,dc=sgshm,dc=ru"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=6 RESULT tag=105 err=53 text=no global superior knowledge
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=7 SRCH base="ou=Computers,dc=sgshm,dc=ru" scope=0 deref=2 filter="(objectClass=*)"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=7 SEARCH RESULT tag=101 err=32 nentries=0 text=
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=8 ADD dn="ou=Computers,dc=sgshm,dc=ru"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=8 RESULT tag=105 err=53 text=no global superior knowledge
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=9 SRCH base="ou=Idmap,dc=sgshm,dc=ru" scope=0 deref=2 filter="(objectClass=*)"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=9 SEARCH RESULT tag=101 err=32 nentries=0 text=
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=10 ADD dn="ou=Idmap,dc=sgshm,dc=ru"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=10 RESULT tag=105 err=53 text=no global superior knowledge
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=11 SRCH base="uid=root,ou=Users,dc=sgshm,dc=ru" scope=0 deref=2 filter="(objectClass=*)"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=11 SEARCH RESULT tag=101 err=32 nentries=0 text=
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=12 ADD dn="uid=root,ou=Users,dc=sgshm,dc=ru"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=12 RESULT tag=105 err=53 text=no global superior knowledge
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=13 SRCH base="uid=nobody,ou=Users,dc=sgshm,dc=ru" scope=0 deref=2 filter="(objectClass=*)"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=13 SEARCH RESULT tag=101 err=32 nentries=0 text=
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=14 ADD dn="uid=nobody,ou=Users,dc=sgshm,dc=ru"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=14 RESULT tag=105 err=53 text=no global superior knowledge
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=15 SRCH base="cn=Domain Admins,ou=Groups,dc=sgshm,dc=ru" scope=0 deref=2 filter="(objectClass=*)"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=15 SEARCH RESULT tag=101 err=32 nentries=0 text=
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=16 ADD dn="cn=Domain Admins,ou=Groups,dc=sgshm,dc=ru"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=16 RESULT tag=105 err=53 text=no global superior knowledge
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=17 SRCH base="cn=Domain Users,ou=Groups,dc=sgshm,dc=ru" scope=0 deref=2 filter="(objectClass=*)"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=17 SEARCH RESULT tag=101 err=32 nentries=0 text=
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=18 ADD dn="cn=Domain Users,ou=Groups,dc=sgshm,dc=ru"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=18 RESULT tag=105 err=53 text=no global superior knowledge
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=19 SRCH base="cn=Domain Guests,ou=Groups,dc=sgshm,dc=ru" scope=0 deref=2 filter="(objectClass=*)"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=19 SEARCH RESULT tag=101 err=32 nentries=0 text=
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=20 ADD dn="cn=Domain Guests,ou=Groups,dc=sgshm,dc=ru"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=20 RESULT tag=105 err=53 text=no global superior knowledge
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=21 SRCH base="cn=Domain Computers,ou=Groups,dc=sgshm,dc=ru" scope=0 deref=2 filter="(objectClass=*)"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=21 SEARCH RESULT tag=101 err=32 nentries=0 text=
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=22 ADD dn="cn=Domain Computers,ou=Groups,dc=sgshm,dc=ru"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=22 RESULT tag=105 err=53 text=no global superior knowledge
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=23 SRCH base="cn=Administrators,ou=Groups,dc=sgshm,dc=ru" scope=0 deref=2 filter="(objectClass=*)"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=23 SEARCH RESULT tag=101 err=32 nentries=0 text=
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=24 ADD dn="cn=Administrators,ou=Groups,dc=sgshm,dc=ru"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=24 RESULT tag=105 err=53 text=no global superior knowledge
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=25 SRCH base="cn=Account Operators,ou=Groups,dc=sgshm,dc=ru" scope=0 deref=2 filter="(objectClass=*)"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=25 SEARCH RESULT tag=101 err=32 nentries=0 text=
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=26 ADD dn="cn=Account Operators,ou=Groups,dc=sgshm,dc=ru"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=26 RESULT tag=105 err=53 text=no global superior knowledge
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=27 SRCH base="cn=Print Operators,ou=Groups,dc=sgshm,dc=ru" scope=0 deref=2 filter="(objectClass=*)"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=27 SEARCH RESULT tag=101 err=32 nentries=0 text=
Nov 28 16t slapd[25193]: conn=0 op=28 ADD dn="cn=Print Operators,ou=Groups,dc=sgshm,dc=ru"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=28 RESULT tag=105 err=53 text=no global superior knowledge
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=29 SRCH base="cn=Backup Operators,ou=Groups,dc=sgshm,dc=ru" scope=0 deref=2 filter="(objectClass=*)"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=29 SEARCH RESULT tag=101 err=32 nentries=0 text=
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=30 ADD dn="cn=Backup Operators,ou=Groups,dc=sgshm,dc=ru"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=30 RESULT tag=105 err=53 text=no global superior knowledge
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=31 SRCH base="cn=Replicators,ou=Groups,dc=sgshm,dc=ru" scope=0 deref=2 filter="(objectClass=*)"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=31 SEARCH RESULT tag=101 err=32 nentries=0 text=
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=32 ADD dn="cn=Replicators,ou=Groups,dc=sgshm,dc=ru"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=32 RESULT tag=105 err=53 text=no global superior knowledge
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=33 SRCH base="sambaDomainName=sgshm,dc=sgshm,dc=ru" scope=0 deref=2 filter="(objectClass=*)"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=33 SEARCH RESULT tag=101 err=32 nentries=0 text=
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=34 ADD dn="sambaDomainName=sgshm,dc=sgshm,dc=ru"
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=34 RESULT tag=105 err=53 text=no global superior knowledge
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=35 UNBIND
Nov 28 16:36:36 localhost slapd[25193]: conn=0 fd=14 closed
Nov 28 16:36:36 localhost slapd[25193]: conn=1 fd=14 ACCEPT from IP=127.0.0.1:49681 (IP=0.0.0.0:389)
Nov 28 16:36:36 localhost slapd[25193]: conn=1 op=0 BIND dn="cn=server,dc=sgshm,dc=ru" method=128
Nov 28 16:36:36 localhost slapd[25193]: conn=1 op=0 RESULT tag=97 err=49 text=
Nov 28 16:36:36 localhost slapd[25193]: conn=1 op=1 SRCH base="dc=sgshm,dc=ru" scope=2 deref=2 filter="(&(objectClass=posixAccount)(uid=root))"
Nov 28 16:36:36 localhost slapd[25193]: conn=1 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text=
Nov 28 16:36:36 localhost slapd[25193]: conn=1 fd=14 closed (connection lost)

Пока, что DNS-сервер сам себе раздает адреса. То есть доменной зоны у нас нет. На сервере сейчас доступ к сети интернет только через прокси на удаленной машине.

ford1813 · Сообщение **ford1813** » 28.11.2008 13:49

Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=13 SEARCH RESULT tag=101 err=32 nentries=0 text=

err 32
))
смотрим ldap.conf
почему uri закоментирован?
лучше бы еще в ldap.conf прописать host
и в /etc/hosts
еще покажите ldapsearch
с нужными параметрами.

28.11.2008 14:38

для начала:

Код: Выделить всё

Nov 28 16:36:36 localhost slapd[25193]: conn=0 fd=14 ACCEPT from IP=127.0.0.1:49680 (IP=0.0.0.0:389)
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=0 BIND dn="cn=server,dc=sgshm,dc=ru" method=128
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=0 RESULT tag=97 err=49 text=

49 - это Invalid credentials

ваша самба не подключается к ладпу как надо. пароль не тот или принципал или еще что.

yamah · Сообщение **yamah** » 28.11.2008 18:47

Спасибо! В понедельник на работе посмотрю.

yamah · Сообщение **yamah** » 01.12.2008 08:04

wertik писал(а): ↑
28.11.2008 13:49
еще покажите ldapsearch
с нужными параметрами.

Код: Выделить всё

ldapsearch -x -b dc=sgshm,dc=ru | less
ldap_bind: Can't contact LDAP server (-1)

yamah · Сообщение **yamah** » 01.12.2008 08:29

JIeHb писал(а): ↑
28.11.2008 14:38
для начала:
Код: Выделить всё
Nov 28 16:36:36 localhost slapd[25193]: conn=0 fd=14 ACCEPT from IP=127.0.0.1:49680 (IP=0.0.0.0:389)
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=0 BIND dn="cn=server,dc=sgshm,dc=ru" method=128
Nov 28 16:36:36 localhost slapd[25193]: conn=0 op=0 RESULT tag=97 err=49 text=
49 - это Invalid credentials

ваша самба не подключается к ладпу как надо. пароль не тот или принципал или еще что.

Текущий конфиг самбы, без персональной информации об учетах пользователей.

Код:

cat smb.conf
#======================= Global Settings =======================
[global]

## Browsing/Identification ###

# Change this to the workgroup/NT-domain name your Samba server will part of
   workgroup = sgshm

# server string is the equivalent of the NT Description field
   server string = %h server

  bind interfaces only = yes
  # interfaces = eth0 192.58.7.1 192.58.7.16 127.0.0.1
  #hosts deny = ALL
  #hosts allow = 192.58.7.16 192.58.7.1 127.0.0.1
  printcap name = /etc/printcap
  printing = cups
  cups options = raw
  log file = /var/log/samba/log.smbd
  max log size = 50
  security = user
  encrypt passwords = true
  smb passwd file = /etc/samba/smbpasswd
  socket options = TCP_NODELAY SO_SNDBUF=8192 SO_RCVBUF=8192
  local master = yes
  preferred master = yes
  domain master = yes
  wins support = no
  dns proxy = no
  guest ok = yes
  guest account = nobody
  unix charset = utf8
  dos charset = cp1251
  display charset = cp1251

  passdb backend = ldapsam:ldap://localhost/
  obey pam restrictions = no


#       Begin: Custom LDAP Entries
#
ldap admin dn = cn=server,dc=sgshm,dc=ru
ldap suffix = dc=sgshm, dc=ru
ldap group suffix = ou=Groups
ldap user suffix = ou=Users
ldap machine suffix = ou=Computers
ldap idmap suffix = ou=Users
; Do ldap passwd sync
ldap passwd sync = Yes
passwd program = /usr/sbin/smbldap-passwd %u
passwd chat = *New*password* %n\n *Retype*new*password* %n\n *all*authentication*tokens*updated*
add user script = /usr/sbin/smbldap-useradd -m "%u"
ldap delete dn = Yes
delete user script = /usr/sbin/smbldap-userdel "%u"
add machine script = /usr/sbin/smbldap-useradd -w "%u"
add group script = /usr/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/sbin/smbldap-groupdel "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u"
domain logons = yes
#
#       End: Custom LDAP Entries
#




# Windows Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable its WINS Server
#;   wins support = no

# WINS Server - Tells the NMBD components of Samba to be a WINS Client
# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
#;   wins server = w.x.y.z

# This will prevent nmbd to search for NetBIOS names through DNS.
#   dns proxy = no

# What naming service and in what order should we use to resolve host names
# to IP addresses
;   name resolve order = lmhosts host wins bcast

#### Networking ####

# The specific set of interfaces / networks to bind to
# This can be either the interface name or an IP address/netmask;
# interface names are normally preferred
;   interfaces = 127.0.0.0/8 eth0

# Only bind to the named interfaces and/or networks; you must use the
# 'interfaces' option above to use this.
# It is recommended that you enable this feature if your Samba machine is
# not protected by a firewall or is a firewall itself.  However, this
# option cannot handle dynamic or non-broadcast interfaces correctly.
;   bind interfaces only = true



#### Debugging/Accounting ####

# This tells Samba to use a separate log file for each machine
# that connects
#   log file = /var/log/samba/log.%m

# Put a capping on the size of the log files (in Kb).
#   max log size = 1000

# If you want Samba to only log through syslog then set the following
# parameter to 'yes'.
;   syslog only = no

# We want Samba to log a minimum amount of information to syslog. Everything
# should go to /var/log/samba/log.{smbd,nmbd} instead. If you want to log
# through syslog you should set the following parameter to something higher.
   syslog = 0

# Do something sensible when Samba crashes: mail the admin a backtrace
   panic action = /usr/share/samba/panic-action %d


####### Authentication #######

# "security = user" is always a good idea. This will require a Unix account
# in this server for every user accessing the server. See
# /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/ServerType.html
# in the samba-doc package for details.
#   security = user

# You may wish to use password encryption.  See the section on
# 'encrypt passwords' in the smb.conf(5) manpage before enabling.
   encrypt passwords = true

# If you are using encrypted passwords, Samba will need to know what
# password database type you are using.
   passdb backend = tdbsam

   obey pam restrictions = yes

;   guest account = nobody
   invalid users = root

logon path =

# This boolean parameter controls whether Samba attempts to sync the Unix
# password with the SMB password when the encrypted SMB password in the
# passdb is changed.
;   unix password sync = no

# For Unix password sync to work on a Debian GNU/Linux system, the following
# parameters must be set (thanks to Ian Kahan <<kahan@informatik.tu-muenchen.de> for
# sending the correct chat script for the passwd program in Debian Sarge).
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n *password\supdated\ssuccessfully* .

# This boolean controls whether PAM will be used for password changes
# when requested by an SMB client instead of the program listed in
# 'passwd program'. The default is 'no'.
;   pam password change = no

########## Domains ###########

# Is this machine able to authenticate users. Both PDC and BDC
# must have this setting enabled. If you are the BDC you must
# change the 'domain master' setting to no
#
;   domain logons = yes
#
# The following setting only takes effect if 'domain logons' is set
# It specifies the location of the user's profile directory
# from the client point of view)
# The following required a [profiles] share to be setup on the
# samba server (see below)
;   logon path = \\%N\profiles\%U
# Another common choice is storing the profile in the user's home directory
;   logon path = \\%N\%U\profile

# The following setting only takes effect if 'domain logons' is set
# It specifies the location of a user's home directory (from the client
# point of view)
;   logon drive = H:
;   logon home = \\%N\%U

# The following setting only takes effect if 'domain logons' is set
# It specifies the script to run during logon. The script must be stored
# in the [netlogon] share
# NOTE: Must be store in 'DOS' file format convention
;   logon script = logon.cmd

# This allows Unix users to be created on the domain controller via the SAMR
# RPC pipe.  The example command creates a user account with a disabled Unix
# password; please adapt to your needs
; add user script = /usr/sbin/adduser --quiet --disabled-password --gecos "" %u

########## Printing ##########

# If you want to automatically load your printer list rather
# than setting them up individually then you'll need this
;   load printers = yes

# lpr(ng) printing. You may wish to override the location of the
# printcap file
;   printing = bsd
;   printcap name = /etc/printcap

# CUPS printing.  See also the cupsaddsmb(8) manpage in the
# cupsys-client package.
;   printing = cups
;   printcap name = cups

# When using [print$], root is implicitly a 'printer admin', but you can
# also give this right to other users to add drivers and set printer
# properties
;   printer admin = @ntadmin


############ Misc ############

# Using the following line enables you to customise your configuration
# on a per machine basis. The %m gets replaced with the netbios name
# of the machine that is connecting
;   include = /home/samba/etc/smb.conf.%m

# Most people will find that this option gives better performance.
# See smb.conf(5) and /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/speed.html
# for details
# You may want to add the following on a Linux system:
#         SO_RCVBUF=8192 SO_SNDBUF=8192
   socket options = TCP_NODELAY

# The following parameter is useful only if you have the linpopup package
# installed. The samba maintainer and the linpopup maintainer are
# working to ease installation and configuration of linpopup and samba.
;   message command = /bin/sh -c '/usr/bin/linpopup "%f" "%m" %s; rm %s' &

# Domain Master specifies Samba to be the Domain Master Browser. If this
# machine will be configured as a BDC (a secondary logon server), you
# must set this to 'no'; otherwise, the default behavior is recommended.
;   domain master = auto

# Some defaults for winbind (make sure you're not using the ranges
# for something else.)
;   idmap uid = 10000-20000
;   idmap gid = 10000-20000
;   template shell = /bin/bash
;
; The following was the default behaviour in sarge
; but samba upstream reverted the default because it might induce
; performance issues in large organizations
; See #368251 for some of the consequences of *not* having
; this setting and smb.conf(5) for all details
;
;   winbind enum groups = yes
;   winbind enum users = yes

#======================= Share Definitions =======================

[User]
        comment = Network Folder User
        path = /srv/samba/User
        writeable = yes
        guest ok = no
        valid users = user
        create mask = 0666
        directory mask = 0770
        read only = no

[SGSHM]
        comment = Network folder for all group SGSHM
        path = /srv/samba/SGSHM
        writeable = yes
        guest ok = yes
        create mask = 0777
        directory mask = 0777
        read only = no

[2GIS]
        comment = Network version of DubleGIS
        path = /srv/samba/2GIS
        writeable = no
        guest ok = yes
        create mask = 0666
        directory mask = 0754
        read only = yes

[homes]
   comment = Home Directories
   browseable = no

# By default, the home directories are exported read-only. Change next
# parameter to 'yes' if you want to be able to write to them.
   writable = no

# File creation mask is set to 0700 for security reasons. If you want to
# create files with group=rw permissions, set next parameter to 0775.
   create mask = 0700

# Directory creation mask is set to 0700 for security reasons. If you want to
# create dirs. with group=rw permissions, set next parameter to 0775.
   directory mask = 0700

# Restrict access to home directories
# to the one of the authenticated user
# This might need tweaking when using external authentication schemes
   valid users = %S

# Un-comment the following and create the netlogon directory for Domain Logons
# (you need to configure Samba to act as a domain controller too.)
;[netlogon]
;   comment = Network Logon Service
;   path = /home/samba/netlogon
;   guest ok = yes
;   writable = no
;   share modes = no

# Un-comment the following and create the profiles directory to store
# users profiles (see the "logon path" option above)
# (you need to configure Samba to act as a domain controller too.)
# The path below should be writable by all users so that their
# profile directory may be created the first time they log on
;[profiles]
;   comment = Users profiles
;   path = /home/samba/profiles
;   guest ok = no
;   browseable = no
;   create mask = 0600
;   directory mask = 0700

[printers]
   comment = All Printers
   browseable = no
   path = /var/spool/samba
   printable = yes
   public = no
   writabler this share name as a source of downloadable
# printer drivers
[print$]
   comment = Printer Drivers
   path = /var/lib/samba/printers
   browseable = yes
   read only = yes
   guest ok = no
# Uncomment to allow remote administration of Windows print drivers.
# Replace 'ntadmin' with the name of the group your admin users are
# members of.
;   write list = root, @ntadmin

# A sample share for sharing your CD-ROM with others.
[cdrom]
   comment = Samba server's CD-ROM
   writable = no
   locking = no
   path = /cdrom
   public = yes

# The next two parameters show how to auto-mount a CD-ROM when the
#       cdrom share is accesed. For this to work /etc/fstab must contain
#       an entry like this:
#
#       /dev/scd0   /cdrom  iso9660 defaults,noauto,ro,user   0 0
#
# The CD-ROM gets unmounted automatically after the connection to the
#
# If you don't want to use auto-mounting/unmounting make sure the CD
#       is mounted on /cdrom
#
;   preexec = /bin/mount /cdrom
;   postexec = /bin/umount /cdrom

smbpasswd -w делел с паролем, который при инсталяции настройки LDAP-а вводил.

ford1813 · Сообщение **ford1813** » 01.12.2008 09:42

yamah писал(а): ↑
01.12.2008 08:04
wertik писал(а): ↑
28.11.2008 13:49
еще покажите ldapsearch
с нужными параметрами.
Код: Выделить всё
ldapsearch -x -b dc=sgshm,dc=ru | less
ldap_bind: Can't contact LDAP server (-1)

ldapsearch -x -b dc=sgshm,dc=ru -h 127.0.0.1
можно так?

yamah · Сообщение **yamah** » 01.12.2008 12:08

wertik писал(а): ↑
01.12.2008 09:42
ldapsearch -x -b dc=sgshm,dc=ru -h 127.0.0.1
можно так?

Код: Выделить всё

ldapsearch -x -b dc=sgshm,dc=ru -h 127.0.0.1
# extended LDIF
#
# LDAPv3
# base <dc=sgshm,dc=ru> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# search result
search: 2
result: 32 No such object

# numResponses: 1

Сейчас на сервере крутиться еще BIND.
Его останавливал и перезапускал slapd но ничего не изменялось. Ошибка как вылетала так и вылетает.

ford1813 · Сообщение **ford1813** » 01.12.2008 12:23

yamah писал(а): ↑
01.12.2008 12:08
wertik писал(а): ↑
01.12.2008 09:42
ldapsearch -x -b dc=sgshm,dc=ru -h 127.0.0.1
можно так?
Код: Выделить всё
ldapsearch -x -b dc=sgshm,dc=ru -h 127.0.0.1
# extended LDIF
#
# LDAPv3
# base <dc=sgshm,dc=ru> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# search result
search: 2
result: 32 No such object

# numResponses: 1
Сейчас на сервере крутиться еще BIND.
Его останавливал и перезапускал slapd но ничего не изменялось. Ошибка как вылетала так и вылетает.

Теперь по порядку.

в файле
ldap.con у вас

#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

#BASE dc=example, dc=com
#URI ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
werti@werti:~$
Должно быть типо этого

HOST 127.0.0.1
BASE dc=sgshm, dc=ru
URI ldap://ldap.sgshm.ru ldap://ldap-master.sgshm.ru:666

Дальше , покажите slapd.conf
Дальше
ldapsearch -h 127.0.0.1 -x -w pass -D "cn=manager,dc=sgshm,dc=ru"
в зависимости от того что у вас там в конфиге slapd

Базу первоначальную вы судя по всему не добавили , или задаёте неверные параметры при поиске.
Следовательно и все объекты которые вы пытаетесь туда добавить , он может из за отсутствия строчек
BASE dc=sgshm, dc=ru
URI ldap://ldap.sgshm.ru ldap://ldap-master.sgshm.ru:666
не понимать куда ему данные засовывать.

Далее если было как вы говорите верно выполнено smbpasswd -w
то убедитесь в логе самбы что она подключилась нормально к ldap.

Если более подробно хотите , стучите в аську , я реализовывал связку samba + ldap .

yamah · Сообщение **yamah** » 01.12.2008 13:15

wertik писал(а): ↑
01.12.2008 12:23
Теперь по порядку.
Дальше , покажите slapd.conf
Дальше
ldapsearch -h 127.0.0.1 -x -w pass -D "cn=manager,dc=sgshm,dc=ru"
в зависимости от того что у вас там в конфиге slapd

Базу первоначальную вы судя по всему не добавили , или задаёте неверные параметры при поиске.
Следовательно и все объекты которые вы пытаетесь туда добавить , он может из за отсутствия строчек
BASE dc=sgshm, dc=ru
URI ldap://ldap.sgshm.ru ldap://ldap-master.sgshm.ru:666
не понимать куда ему данные засовывать.

Далее если было как вы говорите верно выполнено smbpasswd -w
то убедитесь в логе самбы что она подключилась нормально к ldap.

Если более подробно хотите , стучите в аську , я реализовывал связку samba + ldap .

ldap.conf привел к этому виду.

Код: Выделить всё

ldapsearch -h 127.0.0.1 -x -w pass -D "cn=server,dc=sgshm,dc=ru"
ldap_bind: Invalid credentials (49)

Файл sldap.conf подправил, по аналогии замещая примеры моими данными. Но на сколько я понял, что все равно что-то не так сделал.

Код:

# This is the main slapd configuration file. See slapd.conf(5) for more
# info on the configuration options.

#######################################################################
# Global Directives:

# Features to permit
#allow bind_v2

# Schema and objectClass definitions
include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/nis.schema
include         /etc/ldap/schema/inetorgperson.schema
include         /etc/ldap/schema/samba.schema
include         /etc/ldap/schema/misc.schema

# Where the pid file is put. The init.d script
# will not stop the server if you change this.
pidfile         /var/run/slapd/slapd.pid

# List of arguments that were passed to the server
argsfile        /var/run/slapd/slapd.args

# Read slapd.conf(5) for possible values
loglevel        256

# Where the dynamically loaded modules are stored
modulepath	/usr/lib/ldap
moduleload	back_bdb

# The maximum number of entries that is returned for a search operation
sizelimit 500

# The tool-threads parameter sets the actual amount of cpu's that is used
# for indexing.
tool-threads 1

#######################################################################
# Specific Backend Directives for bdb:
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
backend		bdb
checkpoint 512 30

#######################################################################
# Specific Backend Directives for 'other':
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
#backend		<other>

#######################################################################
# Specific Directives for database #1, of type bdb:
# Database specific directives apply to this databasse until another
# 'database' directive occurs
database        bdb

# The base of your directory in database #1
suffix          "dc=sgshm"

# rootdn directive for specifying a superuser on the database. This is needed
# for syncrepl.
# rootdn          "cn=admin,dc=nodomain"

# Where the database file are physically stored for database #1
directory       "/var/lib/ldap"

# For the Debian package we use 2MB as default but be sure to update this
# value if you have plenty of RAM
dbconfig set_cachesize 0 2097152 0

# Sven Hartge reported that he had to set this value incredibly high
# to get slapd running at all. See http://bugs.debian.org/303057
# for more information.

# Number of objects that can be locked at the same time.
dbconfig set_lk_max_objects 1500
# Number of locks (both requested and granted)
dbconfig set_lk_max_locks 1500
# Number of lockers
dbconfig set_lk_max_lockers 1500

# Indexing options for database #1
index           objectClass eq

# Save the time that the entry gets modified, for database #1
lastmod         on

# Where to store the replica logs for database #1
# replogfile	/var/lib/ldap/replog

# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below
# These access lines apply to database #1 only
access to attrs=userPassword,sambaNTPassword,sambaLMPassword
        by dn="cn=server,dc=sgshm" write
        by anonymous auth
        by self write
        by * none

# Ensure read access to the base for things like
# supportedSASLMechanisms.  Without this you may
# have problems with SASL not knowing what
# mechanisms are available and the like.
# Note that this is covered by the 'access to *'
# ACL below too but if you change that as people
# are wont to do you'll still need this if you
# want SASL (and possible other things) to work
# happily.
access to dn.base="" by * read

# The admin dn has full write access, everyone else
# can read everything.
access to *
        by dn="cn=server,dc=sgshm" write
        by * read

# For Netscape Roaming support, each user gets a roaming
# profile for which they have write access to
#access to dn=".*,ou=Roaming,o=morsnet"
#        by dn="cn=admin,dc=nodomain" write
#        by dnattr=owner write

#######################################################################
# Specific Directives for database #2, of type 'other' (can be bdb too):
# Database specific directives apply to this databasse until another
# 'database' directive occurs
#database        <other>

# The base of your directory for database #2
#suffix		"dc=debian,dc=org"

ford1813 · Сообщение **ford1813** » 01.12.2008 13:30

yamah писал(а): ↑
01.12.2008 13:15
wertik писал(а): ↑
01.12.2008 12:23
Теперь по порядку.
Дальше , покажите slapd.conf
Дальше
ldapsearch -h 127.0.0.1 -x -w pass -D "cn=manager,dc=sgshm,dc=ru"
в зависимости от того что у вас там в конфиге slapd

Базу первоначальную вы судя по всему не добавили , или задаёте неверные параметры при поиске.
Следовательно и все объекты которые вы пытаетесь туда добавить , он может из за отсутствия строчек
BASE dc=sgshm, dc=ru
URI ldap://ldap.sgshm.ru ldap://ldap-master.sgshm.ru:666
не понимать куда ему данные засовывать.

Далее если было как вы говорите верно выполнено smbpasswd -w
то убедитесь в логе самбы что она подключилась нормально к ldap.

Если более подробно хотите , стучите в аську , я реализовывал связку samba + ldap .

ldap.conf привел к этому виду.
Код: Выделить всё
ldapsearch -h 127.0.0.1 -x -w pass -D "cn=server,dc=sgshm,dc=ru"
ldap_bind: Invalid credentials (49)
Файл sldap.conf подправил, по аналогии замещая примеры моими данными. Но на сколько я понял, что все равно что-то не так сделал.

Код:
# This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options. ####################################################################### # Global Directives: # Features to permit #allow bind_v2 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/misc.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel 256 # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_bdb # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 ####################################################################### # Specific Backend Directives for bdb: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend bdb checkpoint 512 30 ####################################################################### # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs #backend <other> ####################################################################### # Specific Directives for database #1, of type bdb: # Database specific directives apply to this databasse until another # 'database' directive occurs database bdb # The base of your directory in database #1 suffix "dc=sgshm" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. # rootdn "cn=admin,dc=nodomain" # Where the database file are physically stored for database #1 directory "/var/lib/ldap" # For the Debian package we use 2MB as default but be sure to update this # value if you have plenty of RAM dbconfig set_cachesize 0 2097152 0 # Sven Hartge reported that he had to set this value incredibly high # to get slapd running at all. See http://bugs.debian.org/303057 # for more information. # Number of objects that can be locked at the same time. dbconfig set_lk_max_objects 1500 # Number of locks (both requested and granted) dbconfig set_lk_max_locks 1500 # Number of lockers dbconfig set_lk_max_lockers 1500 # Indexing options for database #1 index objectClass eq # Save the time that the entry gets modified, for database #1 lastmod on # Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog # The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only access to attrs=userPassword,sambaNTPassword,sambaLMPassword by dn="cn=server,dc=sgshm" write by anonymous auth by self write by * none # Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. access to dn.base="" by * read # The admin dn has full write access, everyone else # can read everything. access to * by dn="cn=server,dc=sgshm" write by * read # For Netscape Roaming support, each user gets a roaming # profile for which they have write access to #access to dn=".*,ou=Roaming,o=morsnet" # by dn="cn=admin,dc=nodomain" write # by dnattr=owner write ####################################################################### # Specific Directives for database #2, of type 'other' (can be bdb too): # Database specific directives apply to this databasse until another # 'database' directive occurs #database <other> # The base of your directory for database #2 #suffix "dc=debian,dc=org"

# rootdn "cn=admin,dc=nodomain"
Он не должен быть закоментирован.
к примеру
rootdn "cn=manager,dc=sgshm,dc=ru"
то строка для поиска будет выглядеть так
ldapsearch -h 127.0.0.1 -x -w pass -D "cn=manager,dc=sgshm,dc=ru"

yamah · Сообщение **yamah** » 01.12.2008 14:54

wertik писал(а): ↑
01.12.2008 13:30
# rootdn "cn=admin,dc=nodomain"
Он не должен быть закоментирован.
к примеру
rootdn "cn=manager,dc=sgshm,dc=ru"
то строка для поиска будет выглядеть так
ldapsearch -h 127.0.0.1 -x -w pass -D "cn=manager,dc=sgshm,dc=ru"

Подкорректировал slapd.conf.
Но ошибка так и вылезает.

Код: Выделить всё

ldapsearch -h 127.0.0.1 -x -w pass -D "cn=server,dc=sgshm,dc=ru"
ldap_bind: Invalid credentials (49)

Понятное дело, что вместо "pass", я подставляю свой пароль. Кстати он у меня состоит из букв в разных регистрах и цифр.

ford1813 · Сообщение **ford1813** » 01.12.2008 14:57

yamah писал(а): ↑
01.12.2008 14:54
wertik писал(а): ↑
01.12.2008 13:30
# rootdn "cn=admin,dc=nodomain"
Он не должен быть закоментирован.
к примеру
rootdn "cn=manager,dc=sgshm,dc=ru"
то строка для поиска будет выглядеть так
ldapsearch -h 127.0.0.1 -x -w pass -D "cn=manager,dc=sgshm,dc=ru"

Подкорректировал slapd.conf.
Но ошибка так и вылезает.
Код: Выделить всё
ldapsearch -h 127.0.0.1 -x -w pass -D "cn=server,dc=sgshm,dc=ru"
ldap_bind: Invalid credentials (49)
Понятное дело, что вместо "pass", я подставляю свой пароль. Кстати он у меня состоит из букв в разных регистрах и цифр.

У вас в slapd.conf
rootdn
rootdn "cn=manager,dc=sgshm,dc=ru"
?
а вы почему то упорно ставите.
-D "cn=server,dc=sgshm,dc=ru"
разницу видно?
откуда cn=server взялся?
От того у вас и ошибка ldap_bind: Invalid credentials (49)
.

yamah · Сообщение **yamah** » 01.12.2008 15:05

wertik писал(а): ↑
01.12.2008 14:57
У вас в slapd.conf
rootdn
rootdn "cn=manager,dc=sgshm,dc=ru"
?

Вроде я везде писал cn=server

wertik писал(а): ↑
01.12.2008 14:57
а вы почему то упорно ставите.
-D "cn=server,dc=sgshm,dc=ru"
разницу видно?
откуда cn=server взялся?
От того у вас и ошибка ldap_bind: Invalid credentials (49)
.

Как только вы мне сказали раскомментировать rootdn, я там сразу сменил на server.
Причем у меня ВЕЗДЕ вместо "cn=manager" или "cn=admin" стоит "cn=server".
Или я чего-то не понял в правилах настройки?

Код:

# This is the main slapd configuration file. See slapd.conf(5) for more
# info on the configuration options.

#######################################################################
# Global Directives:

# Features to permit
#allow bind_v2

# Schema and objectClass definitions
include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/nis.schema
include         /etc/ldap/schema/inetorgperson.schema
include         /etc/ldap/schema/samba.schema
include         /etc/ldap/schema/misc.schema

# Where the pid file is put. The init.d script
# will not stop the server if you change this.
pidfile         /var/run/slapd/slapd.pid

# List of arguments that were passed to the server
argsfile        /var/run/slapd/slapd.args

# Read slapd.conf(5) for possible values
loglevel        256

# Where the dynamically loaded modules are stored
modulepath	/usr/lib/ldap
moduleload	back_bdb

# The maximum number of entries that is returned for a search operation
sizelimit 500

# The tool-threads parameter sets the actual amount of cpu's that is used
# for indexing.
tool-threads 1

#######################################################################
# Specific Backend Directives for bdb:
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
backend		bdb
checkpoint 512 30

#######################################################################
# Specific Backend Directives for 'other':
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
#backend		<other>

#######################################################################
# Specific Directives for database #1, of type bdb:
# Database specific directives apply to this databasse until another
# 'database' directive occurs
database        bdb

# The base of your directory in database #1
suffix          "dc=sgshm"

# rootdn directive for specifying a superuser on the database. This is needed
# for syncrepl.
rootdn "cn=server,dc=sgshm,dc=ru"

# Where the database file are physically stored for database #1
directory       "/var/lib/ldap"

# For the Debian package we use 2MB as default but be sure to update this
# value if you have plenty of RAM
dbconfig set_cachesize 0 2097152 0

# Sven Hartge reported that he had to set this value incredibly high
# to get slapd running at all. See http://bugs.debian.org/303057
# for more information.

# Number of objects that can be locked at the same time.
dbconfig set_lk_max_objects 1500
# Number of locks (both requested and granted)
dbconfig set_lk_max_locks 1500
# Number of lockers
dbconfig set_lk_max_lockers 1500

# Indexing options for database #1
index           objectClass eq

# Save the time that the entry gets modified, for database #1
lastmod         on

# Where to store the replica logs for database #1
# replogfile	/var/lib/ldap/replog

# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below
# These access lines apply to database #1 only
access to attrs=userPassword,sambaNTPassword,sambaLMPassword
        by dn="cn=server,dc=sgshm" write
        by anonymous auth
        by self write
        by * none

# Ensure read access to the base for things like
# supportedSASLMechanisms.  Without this you may
# have problems with SASL not knowing what
# mechanisms are available and the like.
# Note that this is covered by the 'access to *'
# ACL below too but if you change that as people
# are wont to do you'll still need this if you
# want SASL (and possible other things) to work
# happily.
access to dn.base="" by * read

# The admin dn has full write access, everyone else
# can read everything.
access to *
        by dn="cn=server,dc=sgshm" write
        by * read

# For Netscape Roaming support, each user gets a roaming
# profile for which they have write access to
#access to dn=".*,ou=Roaming,o=morsnet"
#        by dn="cn=admin,dc=nodomain" write
#        by dnattr=owner write

#######################################################################
# Specific Directives for database #2, of type 'other' (can be bdb too):
# Database specific directives apply to this databasse until another
# 'database' directive occurs
#database        <other>

# The base of your directory for database #2
#suffix		"dc=debian,dc=org"

ford1813 · Сообщение **ford1813** » 01.12.2008 15:11

yamah писал(а): ↑
01.12.2008 15:05
wertik писал(а): ↑
01.12.2008 14:57
У вас в slapd.conf
rootdn
rootdn "cn=manager,dc=sgshm,dc=ru"
?

Вроде я везде писал cn=server

wertik писал(а): ↑
01.12.2008 14:57
а вы почему то упорно ставите.
-D "cn=server,dc=sgshm,dc=ru"
разницу видно?
откуда cn=server взялся?
От того у вас и ошибка ldap_bind: Invalid credentials (49)
.

Как только вы мне сказали раскомментировать rootdn, я там сразу сменил на server.
Причем у меня ВЕЗДЕ вместо "cn=manager" или "cn=admin" стоит "cn=server".
Или я чего-то не понял в правилах настройки?

Код:
# This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options. ####################################################################### # Global Directives: # Features to permit #allow bind_v2 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/misc.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel 256 # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_bdb # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 ####################################################################### # Specific Backend Directives for bdb: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend bdb checkpoint 512 30 ####################################################################### # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs #backend <other> ####################################################################### # Specific Directives for database #1, of type bdb: # Database specific directives apply to this databasse until another # 'database' directive occurs database bdb # The base of your directory in database #1 suffix "dc=sgshm" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. rootdn "cn=server,dc=sgshm,dc=ru" # Where the database file are physically stored for database #1 directory "/var/lib/ldap" # For the Debian package we use 2MB as default but be sure to update this # value if you have plenty of RAM dbconfig set_cachesize 0 2097152 0 # Sven Hartge reported that he had to set this value incredibly high # to get slapd running at all. See http://bugs.debian.org/303057 # for more information. # Number of objects that can be locked at the same time. dbconfig set_lk_max_objects 1500 # Number of locks (both requested and granted) dbconfig set_lk_max_locks 1500 # Number of lockers dbconfig set_lk_max_lockers 1500 # Indexing options for database #1 index objectClass eq # Save the time that the entry gets modified, for database #1 lastmod on # Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog # The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only access to attrs=userPassword,sambaNTPassword,sambaLMPassword by dn="cn=server,dc=sgshm" write by anonymous auth by self write by * none # Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. access to dn.base="" by * read # The admin dn has full write access, everyone else # can read everything. access to * by dn="cn=server,dc=sgshm" write by * read # For Netscape Roaming support, each user gets a roaming # profile for which they have write access to #access to dn=".*,ou=Roaming,o=morsnet" # by dn="cn=admin,dc=nodomain" write # by dnattr=owner write ####################################################################### # Specific Directives for database #2, of type 'other' (can be bdb too): # Database specific directives apply to this databasse until another # 'database' directive occurs #database <other> # The base of your directory for database #2 #suffix "dc=debian,dc=org"

Другое дело , тогда смотрите

ldapsearch в ней дебаг используйте.
-d level set LDAP debugging level to `level'

yamah · Сообщение **yamah** » 02.12.2008 09:14

wertik писал(а): ↑
01.12.2008 15:11
ldapsearch в ней дебаг используйте.
-d level set LDAP debugging level to `level'

Если я вас правильно понял, то яя должен был выполнить следующее:

Код: Выделить всё

server:~# ldapsearch -d 256
ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)

?

У меня не настроена ldap-авторизация. Может в этом проблема?
В руководстве это было только следующим пунктом, как раз за моей проблемой.

ford1813 · Сообщение **ford1813** » 02.12.2008 09:19

yamah писал(а): ↑
02.12.2008 09:14
wertik писал(а): ↑
01.12.2008 15:11
ldapsearch в ней дебаг используйте.
-d level set LDAP debugging level to `level'

Если я вас правильно понял, то яя должен был выполнить следующее:
Код: Выделить всё
server:~# ldapsearch -d 256
ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)
?

У меня не настроена ldap-авторизация. Может в этом проблема?
В руководстве это было только следующим пунктом, как раз за моей проблемой.

Нет вы меня неверно поняли.
ldapsearch -h 127.0.0.1 -x -w pass -D "cn=server,dc=sgshm,dc=ru" -d 256
Я вообще не могу понять есть ли у вас костяк базы уже в ldap ?
Судя по всему нету , значит и всё остальное не может быть добавлено.
ковыряйтесь. я увиливаю.

yamah · Сообщение **yamah** » 02.12.2008 09:58

wertik писал(а): ↑
02.12.2008 09:19
Нет вы меня неверно поняли.
ldapsearch -h 127.0.0.1 -x -w pass -D "cn=server,dc=sgshm,dc=ru" -d 256
Я вообще не могу понять есть ли у вас костяк базы уже в ldap ?
Судя по всему нету , значит и всё остальное не может быть добавлено.
ковыряйтесь. я увиливаю.

Выполнил и получил:

Код: Выделить всё

ldapsearch -h 127.0.0.1 -x -w pass -D "cn=server,dc=sgshm,dc=ru" -d 25
request done: ld 0x510220 msgid 1
ldap_bind: Invalid credentials (49)

Спасибо за помощь!

ford1813 · Сообщение **ford1813** » 02.12.2008 10:51

yamah писал(а): ↑
02.12.2008 09:58
wertik писал(а): ↑
02.12.2008 09:19
Нет вы меня неверно поняли.
ldapsearch -h 127.0.0.1 -x -w pass -D "cn=server,dc=sgshm,dc=ru" -d 256
Я вообще не могу понять есть ли у вас костяк базы уже в ldap ?
Судя по всему нету , значит и всё остальное не может быть добавлено.
ковыряйтесь. я увиливаю.

Выполнил и получил:
Код: Выделить всё
ldapsearch -h 127.0.0.1 -x -w pass -D "cn=server,dc=sgshm,dc=ru" -d 25
request done: ld 0x510220 msgid 1
ldap_bind: Invalid credentials (49)
Спасибо за помощь!

До собственно не за что , проблему вы там и не решили.

yamah · Сообщение **yamah** » 02.12.2008 12:05

Загнал вывод команды slapd -d 16383 в файл.

Там же вывод реакции slapd-а на команду smbldap-populate -u 30000 -g 30000.

Крайне заинтересовал такой факт:
И в конфиге и в выводе dn.base=""

Код: Выделить всё

access to dn.base="" by * read

Так и должно быть?

02.12.2008 18:52

Так и должно быть?

а зачем оно вам там?
что вы хотите сделать?

access to dn.base="" by * read из конфига лучше уберите нафиг.

поставте себе какой-нить браузер лдап
(luma, gq, я бы рекомендовал phpldapadmin поставить)
и посмотрите - что у вас там в нем таки (в лдапе) творится.

при установке в дебиане openldap создается дефолтная база - она у вас есть сейчас?

главное понять - элемент cn=server,dc=sgshm,dc=ru и все его родители у вас в лдапе есть вообще или где?
(он там правда не обязан быть, но родители то уж обязаны).
вы их создавали? или так и живете с дебиановской дефолтной базой?

line 44 (checkpoint 512 30)^M
/etc/ldap/slapd.conf: line 44: unknown directive <checkpoint> inside backend database definition (ignored).^M
line 56 (database bdb)^M

начерта она вам, кстати? вы реплики собирАетесь делать? если нет - тогда уберайте checkpoint.

/etc/ldap/slapd.conf: line 101: rootdn is always granted unlimited privileges.^M

это говорит о том, что лдап у вас свежий - acl

Код: Выделить всё

access to *
by dn="cn=server,dc=sgshm" write
by * read

сокращаем до:

Код: Выделить всё

access to *
by * read

я бы кстати так не делал - там же пароли, всякая супер-секретная инфа и т.п.
вот как у меня:

Код: Выделить всё

access to dn.children="cn=Root"    # это верхний корневой элемент
        attrs=entry,objectClass,cn,sn,displayName,givenName,initials #тут перечислены атрибуты
        attrs=o,ou,title,mail,telephoneNumber,jpegPhoto  # которые можно читать всем
        attrs=uid,inksMailOpt,inksMemberSender,inksMemberReceiver
        attrs=inksOperStatus,street,postalAddress,postalCode,facsimileTelephoneNumb
er,l
                by dn.subtree="cn=admin,cn=Root" write # это контейнер, в котором лежат админы ЛДАПА (их много)
                by dn="cn=update,cn=Root" write # это учетка для обновления (реплики и т.п.)
                by users read  #читать можно
                by anonymous read

ldap_read: want=8 error=Resource temporarily unavailable^M
ber_get_next on fd 11 failed errno=11 (Resource temporarily unavailable)^M
ber_scanf fmt ({imt) ber:^M

нету таки у вас похоже в лдапе нужной базы.
ибо:

<<< dnPrettyNormal: <cn=manager,dc=example,dc=net>, <cn=manager,dc=example,dc=net>^M
do_bind: version=3 dn="cn=manager,dc=example,dc=net" method=128^M
conn=0 op=0 BIND dn="cn=manager,dc=example,dc=net" method=128^M

это шито?
я про cn=manager,dc=example,dc=net

могу еще посоветовать man slapcat, чтобы понять таки что у вас там творится.

yamah · Сообщение **yamah** » 02.12.2008 18:56

JIeHb
Честно скажу, я в настройке LDAP-а новичок. Руководство по установке брал отсюда.
Все делал по порядку, как и было написано в руководстве.

Спасибо за советы, завтра попробую на работе.

02.12.2008 19:07

ок, ждемс результатов ;-)

yamah · Сообщение **yamah** » 03.12.2008 10:52

JIeHb писал(а): ↑
02.12.2008 19:07
ок, ждемс результатов ;-)

Кажется, у меня так и осталась дефолтовая база. Хотя dpkg-reconfigure slapd я делал.
Но, судя по всему изменений в базе нет!
Вывод команды

Код:

lapcat
/etc/ldap/slapd.conf: line 102: rootdn is always granted unlimited privileges.
/etc/ldap/slapd.conf: line 117: warning: no by clause(s) specified in access line (ignored).
dn: dc=nodomain
objectClass: top
objectClass: dcObject
objectClass: organization
o: nodomain
dc: nodomain
structuralObjectClass: organization
entryUUID: 9a91c9ba-5496-102d-8ed4-1583eee70032
creatorsName:
modifiersName:
createTimestamp: 20081202082604Z
modifyTimestamp: 20081202082604Z
entryCSN: 20081202082604Z#000000#00#000000

dn: cn=admin,dc=nodomain
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin
description: LDAP administrator
userPassword:: e2NyeXB0fW5QQjh3TWh3WnZYZWc=
structuralObjectClass: organizationalRole
entryUUID: 9a9505b2-5496-102d-8ed5-1583eee70032
creatorsName:
modifiersName:
createTimestamp: 20081202082604Z
modifyTimestamp: 20081202082604Z
entryCSN: 20081202082604Z#000001#00#000000

phpLDAPadmin не подключается к серверу.

LDAP ответил: Undefined attribute type
Номер ошибки: 0x11 (LDAP_UNDEFINED_TYPE)
Описание: The attribute type specified is invalid.

Текущие конфиги, которые я правил:
slapd.conf

Код:

# This is the main slapd configuration file. See slapd.conf(5) for more
# info on the configuration options.

#######################################################################
# Global Directives:

# Features to permit
#allow bind_v2

# Schema and objectClass definitions
include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/nis.schema
include         /etc/ldap/schema/inetorgperson.schema
include         /etc/ldap/schema/samba.schema
include         /etc/ldap/schema/misc.schema

# Where the pid file is put. The init.d script
# will not stop the server if you change this.
pidfile         /var/run/slapd/slapd.pid

# List of arguments that were passed to the server
argsfile        /var/run/slapd/slapd.args

# Read slapd.conf(5) for possible values
loglevel        0

# Where the dynamically loaded modules are stored
modulepath	/usr/lib/ldap
moduleload	back_bdb

# The maximum number of entries that is returned for a search operation
sizelimit 500

# The tool-threads parameter sets the actual amount of cpu's that is used
# for indexing.
tool-threads 1

#######################################################################
# Specific Backend Directives for bdb:
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
backend		bdb
# checkpoint 512 30

#######################################################################
# Specific Backend Directives for 'other':
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
#backend		<other>

#######################################################################
# Specific Directives for database #1, of type bdb:
# Database specific directives apply to this databasse until another
# 'database' directive occurs
database        bdb

# The base of your directory in database #1
suffix          "dc=sgshm,dc=ru"

# rootdn directive for specifying a superuser on the database. This is needed
# for syncrepl.
rootdn          "cn=server,dc=sgshm"
# rootdn          "cn=admin,dc=nodomain"

# Where the database file are physically stored for database #1
directory       "/var/lib/ldap"

# For the Debian package we use 2MB as default but be sure to update this
# value if you have plenty of RAM
dbconfig set_cachesize 0 2097152 0

# Sven Hartge reported that he had to set this value incredibly high
# to get slapd running at all. See http://bugs.debian.org/303057
# for more information.

# Number of objects that can be locked at the same time.
dbconfig set_lk_max_objects 1500
# Number of locks (both requested and granted)
dbconfig set_lk_max_locks 1500
# Number of lockers
dbconfig set_lk_max_lockers 1500

# Indexing options for database #1
index           objectClass eq

# Save the time that the entry gets modified, for database #1
lastmod         on

# Where to store the replica logs for database #1
# replogfile	/var/lib/ldap/replog

# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below
# These access lines apply to database #1 only
access to attrs=userPassword,sambaNTPassword,sambaLMPassword,shadowLastChange
        by dn="cn=server,dc=sgshm" write
        by anonymous auth
        by self write
        by * none

# Ensure read access to the base for things like
# supportedSASLMechanisms.  Without this you may
# have problems with SASL not knowing what
# mechanisms are available and the like.
# Note that this is covered by the 'access to *'
# ACL below too but if you change that as people
# are wont to do you'll still need this if you
# want SASL (and possible other things) to work
# happily.
access to dn.base="" by * read

# The admin dn has full write access, everyone else
# can read everything.
access to *
#        by dn="cn=server,dc=sgshm,dc=ru" write
        by * read

#access to dn.children="cn=Root"    # это верхний корневой элемент
#        attrs=entry,objectClass,cn,sn,displayName,givenName,initials #тут перечислены атрибуты
#        attrs=o,ou,title,mail,telephoneNumber,jpegPhoto  # которые можно читать всем
#        attrs=uid,inksMailOpt,inksMemberSender,inksMemberReceiver
#        attrs=inksOperStatus,street,postalAddress,postalCode,facsimileTelephoneNumber,l
#                by dn.subtree="cn=admin,cn=Root" write # это контейнер, в котором лежат админы ЛДАПА (их много)
#                by dn="cn=update,cn=Root" write # это учетка для обновления (реплики и т.п.)
#                by users read  #читать можно
#                by anonymous read

# For Netscape Roaming support, each user gets a roaming
# profile for which they have write access to
#access to dn=".*,ou=Roaming,o=morsnet"
#        by dn="cn=admin,dc=sgshm" write
#        by dnattr=owner write

#######################################################################
# Specific Directives for database #2, of type 'other' (can be bdb too):
# Database specific directives apply to this databasse until another
# 'database' directive occurs
#database        <other>

# The base of your directory for database #2
#suffix		"dc=debian,dc=org"

ldap.conf

Код: Выделить всё

# $OpenLDAP: pkg/ldap/libraries/libldap/ldap.conf,v 1.9 2000/09/04 19:57:01 kurt Exp $
HOST 127.0.0.1
BASE    dc=sgshm, dc=ru
URI    ldap://ldap.sgshm.ru ldap://ldap-master.sgshm.ru:666

#SIZELIMIT    12
#TIMELIMIT    15
#DEREF        never

smbldap.conf

Код:

# $Source: /opt/cvs/samba/smbldap-tools/smbldap.conf,v $
# $Id: smbldap.conf,v 1.18 2005/05/27 14:28:47 jtournier Exp $
#
# smbldap-tools.conf : Q & D configuration file for smbldap-tools

#  This code was developped by IDEALX (http://IDEALX.org/) and
#  contributors (their names can be found in the CONTRIBUTORS file).
#
#                 Copyright © 2001-2002 IDEALX
#
#  This program is free software; you can redistribute it and/or
#  modify it under the terms of the GNU General Public License
#  as published by the Free Software Foundation; either version 2
#  of the License, or (at your option) any later version.
#
#  This program is distributed in the hope that it will be useful,
#  but WITHOUT ANY WARRANTY; without even the implied warranty of
#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#  GNU General Public License for more details.
#
#  You should have received a copy of the GNU General Public License
#  along with this program; if not, write to the Free Software
#  Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
#  USA.

#  Purpose :
#       . be the configuration file for all smbldap-tools scripts

##############################################################################
#
# General Configuration
#
##############################################################################

# Put your own SID. To obtain this number do: "net getlocalsid".
# If not defined, parameter is taking from "net getlocalsid" return
SID="S-1-5-21-4005224139-4166151995-3057652387"

# Domain name the Samba server is in charged.
# If not defined, parameter is taking from smb.conf configuration file
# Ex: sambaDomain="IDEALX-NT"
sambaDomain="sgshm"

##############################################################################
#
# LDAP Configuration
#
##############################################################################

# Notes: to use to dual ldap servers backend for Samba, you must patch
# Samba with the dual-head patch from IDEALX. If not using this patch
# just use the same server for slaveLDAP and masterLDAP.
# Those two servers declarations can also be used when you have
# . one master LDAP server where all writing operations must be done
# . one slave LDAP server where all reading operations must be done
#   (typically a replication directory)

# Slave LDAP server
# Ex: slaveLDAP=127.0.0.1
# If not defined, parameter is set to "127.0.0.1"
slaveLDAP="127.0.0.1"

# Slave LDAP port
# If not defined, parameter is set to "389"
slavePort="389"

# Master LDAP server: needed for write operations
# Ex: masterLDAP=127.0.0.1
# If not defined, parameter is set to "127.0.0.1"
masterLDAP="127.0.0.1"

# Master LDAP port
# If not defined, parameter is set to "389"
masterPort="389"

# Use TLS for LDAP
# If set to 1, this option will use start_tls for connection
# (you should also used the port 389)
# If not defined, parameter is set to "1"
ldapTLS="0"

# How to verify the server's certificate (none, optional or require)
# see "man Net::LDAP" in start_tls section for more details
verify="require"

# CA certificate
# see "man Net::LDAP" in start_tls section for more details
cafile="/etc/opt/IDEALX/smbldap-tools/ca.pem"

# certificate to use to connect to the ldap server
# see "man Net::LDAP" in start_tls section for more details
clientcert="/etc/opt/IDEALX/smbldap-tools/smbldap-tools.pem"

# key certificate to use to connect to the ldap server
# see "man Net::LDAP" in start_tls section for more details
clientkey="/etc/opt/IDEALX/smbldap-tools/smbldap-tools.key"

# LDAP Suffix
# Ex: suffix=dc=IDEALX,dc=ORG
suffix="dc=sgshm,dc=ru"

# Where are stored Users
# Ex: usersdn="ou=Users,dc=IDEALX,dc=ORG"
# Warning: if 'suffix' is not set here, you must set the full dn for usersdn
usersdn="ou=Users,${suffix}"

# Where are stored Computers
# Ex: computersdn="ou=Computers,dc=IDEALX,dc=ORG"
# Warning: if 'suffix' is not set here, you must set the full dn for computersdn
computersdn="ou=Computers,${suffix}"

# Where are stored Groups
# Ex: groupsdn="ou=Groups,dc=IDEALX,dc=ORG"
# Warning: if 'suffix' is not set here, you must set the full dn for groupsdn
groupsdn="ou=Groups,${suffix}"

# Where are stored Idmap entries (used if samba is a domain member server)
# Ex: groupsdn="ou=Idmap,dc=IDEALX,dc=ORG"
# Warning: if 'suffix' is not set here, you must set the full dn for idmapdn
idmapdn="ou=Idmap,${suffix}"

# Where to store next uidNumber and gidNumber available for new users and groups
# If not defined, entries are stored in sambaDomainName object.
# Ex: sambaUnixIdPooldn="sambaDomainName=${sambaDomain},${suffix}"
# Ex: sambaUnixIdPooldn="cn=NextFreeUnixId,${suffix}"
sambaUnixIdPooldn="sambaDomainName=sgshm,${suffix}"

# Default scope Used
scope="sub"

# Unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA, CLEARTEXT)
hash_encrypt="SSHA"

# if hash_encrypt is set to CRYPT, you may set a salt format.
# default is "%s", but many systems will generate MD5 hashed
# passwords if you use "$1$%.8s". This parameter is optional!
crypt_salt_format="%s"

##############################################################################
#
# Unix Accounts Configuration
#
##############################################################################

# Login defs
# Default Login Shell
# Ex: userLoginShell="/bin/bash"
userLoginShell="/bin/bash"

# Home directory
# Ex: userHome="/home/%U"
userHome="/home/%U"

# Default mode used for user homeDirectory
userHomeDirectoryMode="700"

# Gecos
userGecos="System User"

# Default User (POSIX and Samba) GID
defaultUserGid="513"

# Default Computer (Samba) GID
defaultComputerGid="515"

# Skel dir
skeletonDir="/etc/skel"

# Default password validation time (time in days) Comment the next line if
# you don't want password to be enable for defaultMaxPasswordAge days (be
# careful to the sambaPwdMustChange attribute's value)
defaultMaxPasswordAge="45"

##############################################################################
#
# SAMBA Configuration
#
##############################################################################

# The UNC path to home drives location (%U username substitution)
# Just set it to a null string if you want to use the smb.conf 'logon home'
# directive and/or disable roaming profiles
# Ex: userSmbHome="\\PDC-SMB3\%U"
# userSmbHome="\\PDC-SRV\%U"
userSmbHome=

# The UNC path to profiles locations (%U username substitution)
# Just set it to a null string if you want to use the smb.conf 'logon path'
# directive and/or disable roaming profiles
# Ex: userProfile="\\PDC-SMB3\profiles\%U"
# userProfile="\\PDC-SRV\profiles\%U"
userProfile=

# The default Home Drive Letter mapping
# (will be automatically mapped at logon time if home directory exist)
# Ex: userHomeDrive="H:"
# userHomeDrive="H:"
userHomeDrive=

# The default user netlogon script name (%U username substitution)
# if not used, will be automatically username.cmd
# make sure script file is edited under dos
# Ex: userScript="startup.cmd" # make sure script file is edited under dos
# userScript="logon.bat"
userScript=

# Domain appended to the users "mail"-attribute
# when smbldap-useradd -M is used
# Ex: mailDomain="idealx.com"
mailDomain="sgshm.ru"

##############################################################################
#
# SMBLDAP-TOOLS Configuration (default are ok for a RedHat)
#
##############################################################################

# Allows not to use smbpasswd (if with_smbpasswd == 0 in smbldap_conf.pm) but
# prefer Crypt::SmbHash library
with_smbpasswd="0"
smbpasswd="/usr/bin/smbpasswd"

# Allows not to use slappasswd (if with_slappasswd == 0 in smbldap_conf.pm)
# but prefer Crypt:: libraries
with_slappasswd="0"
slappasswd="/usr/sbin/slappasswd"

# comment out the following line to get rid of the default banner
# no_banner="1"

smbldap_bind.conf

Код: Выделить всё

slaveDN="cn=server,dc=sgshm,dc=ru"
slavePw="Patr10t"
masterDN="cn=server,dc=sgshm,dc=ru"
masterPw="Patr10t"

smb.conf (без расшаренных ресурсов)

Код:

[global]

## Browsing/Identification ###

# Change this to the workgroup/NT-domain name your Samba server will part of
   workgroup = sgshm

# server string is the equivalent of the NT Description field
   server string = %h server

  bind interfaces only = yes
  # interfaces = eth0 192.58.7.1 192.58.7.16 127.0.0.1
  #hosts deny = ALL
  #hosts allow = 192.58.7.16 192.58.7.1 127.0.0.1
  printcap name = /etc/printcap
  printing = cups
  cups options = raw
  log file = /var/log/samba/log.smbd
  max log size = 50
  security = user
  encrypt passwords = true
  smb passwd file = /etc/samba/smbpasswd
  socket options = TCP_NODELAY SO_SNDBUF=8192 SO_RCVBUF=8192
  local master = yes
  preferred master = yes
  domain master = yes
  wins support = no
  dns proxy = no
  guest ok = yes
  guest account = nobody
  unix charset = utf8
  dos charset = cp1251
  display charset = cp1251

  passdb backend = ldapsam:ldap://localhost/
  obey pam restrictions = no


#	Begin: Custom LDAP Entries
#
ldap admin dn = cn=server,dc=sgshm,dc=ru
ldap suffix = dc=sgshm,dc=ru
ldap group suffix = ou=Groups
ldap user suffix = ou=Users
ldap machine suffix = ou=Computers
ldap idmap suffix = ou=Users
; Do ldap passwd sync
ldap passwd sync = Yes
passwd program = /usr/sbin/smbldap-passwd %u
passwd chat = *New*password* %n\n *Retype*new*password* %n\n *all*authentication*tokens*updated*
add user script = /usr/sbin/smbldap-useradd -m "%u"
ldap delete dn = Yes
delete user script = /usr/sbin/smbldap-userdel "%u"
add machine script = /usr/sbin/smbldap-useradd -w "%u"
add group script = /usr/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/sbin/smbldap-groupdel "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u"
domain logons = yes
#
#	End: Custom LDAP Entries
#

# Windows Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable its WINS Server
#;   wins support = no

# WINS Server - Tells the NMBD components of Samba to be a WINS Client
# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
#;   wins server = w.x.y.z

# This will prevent nmbd to search for NetBIOS names through DNS.
#   dns proxy = no

# What naming service and in what order should we use to resolve host names
# to IP addresses
;   name resolve order = lmhosts host wins bcast

#### Networking ####

# The specific set of interfaces / networks to bind to
# This can be either the interface name or an IP address/netmask;
# interface names are normally preferred
;   interfaces = 127.0.0.0/8 eth0

# Only bind to the named interfaces and/or networks; you must use the
# 'interfaces' option above to use this.
# It is recommended that you enable this feature if your Samba machine is
# not protected by a firewall or is a firewall itself.  However, this
# option cannot handle dynamic or non-broadcast interfaces correctly.
;   bind interfaces only = true

#### Debugging/Accounting ####

# This tells Samba to use a separate log file for each machine
# that connects
#   log file = /var/log/samba/log.%m

# Put a capping on the size of the log files (in Kb).
#   max log size = 1000

# If you want Samba to only log through syslog then set the following
# parameter to 'yes'.
;   syslog only = no

# We want Samba to log a minimum amount of information to syslog. Everything
# should go to /var/log/samba/log.{smbd,nmbd} instead. If you want to log
# through syslog you should set the following parameter to something higher.
   syslog = 0

# Do something sensible when Samba crashes: mail the admin a backtrace
   panic action = /usr/share/samba/panic-action %d


####### Authentication #######

# "security = user" is always a good idea. This will require a Unix account
# in this server for every user accessing the server. See
# /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/ServerType.html
# in the samba-doc package for details.
#   security = user

# You may wish to use password encryption.  See the section on
# 'encrypt passwords' in the smb.conf(5) manpage before enabling.
   encrypt passwords = true

# If you are using encrypted passwords, Samba will need to know what
# password database type you are using.
   passdb backend = tdbsam

   obey pam restrictions = yes

;   guest account = nobody
   invalid users = root

logon path =

# This boolean parameter controls whether Samba attempts to sync the Unix
# password with the SMB password when the encrypted SMB password in the
# passdb is changed.
;   unix password sync = no

# For Unix password sync to work on a Debian GNU/Linux system, the following
# parameters must be set (thanks to Ian Kahan <<kahan@informatik.tu-muenchen.de> for
# sending the correct chat script for the passwd program in Debian Sarge).
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n *password\supdated\ssuccessfully* .

# This boolean controls whether PAM will be used for password changes
# when requested by an SMB client instead of the program listed in
# 'passwd program'. The default is 'no'.
;   pam password change = no

########## Domains ###########

# Is this machine able to authenticate users. Both PDC and BDC
# must have this setting enabled. If you are the BDC you must
# change the 'domain master' setting to no
#
;   domain logons = yes
#
# The following setting only takes effect if 'domain logons' is set
# It specifies the location of the user's profile directory
# from the client point of view)
# The following required a [profiles] share to be setup on the
# samba server (see below)
;   logon path = \\%N\profiles\%U
# Another common choice is storing the profile in the user's home directory
;   logon path = \\%N\%U\profile

# The following setting only takes effect if 'domain logons' is set
# It specifies the location of a user's home directory (from the client
# point of view)
;   logon drive = H:
;   logon home = \\%N\%U

# The following setting only takes effect if 'domain logons' is set
# It specifies the script to run during logon. The script must be stored
# in the [netlogon] share
# NOTE: Must be store in 'DOS' file format convention
;   logon script = logon.cmd

# This allows Unix users to be created on the domain controller via the SAMR
# RPC pipe.  The example command creates a user account with a disabled Unix
# password; please adapt to your needs
; add user script = /usr/sbin/adduser --quiet --disabled-password --gecos "" %u

########## Printing ##########

# If you want to automatically load your printer list rather
# than setting them up individually then you'll need this
;   load printers = yes

# lpr(ng) printing. You may wish to override the location of the
# printcap file
;   printing = bsd
;   printcap name = /etc/printcap

# CUPS printing.  See also the cupsaddsmb(8) manpage in the
# cupsys-client package.
;   printing = cups
;   printcap name = cups

# When using [print$], root is implicitly a 'printer admin', but you can
# also give this right to other users to add drivers and set printer
# properties
;   printer admin = @ntadmin


############ Misc ############

# Using the following line enables you to customise your configuration
# on a per machine basis. The %m gets replaced with the netbios name
# of the machine that is connecting
;   include = /home/samba/etc/smb.conf.%m

# Most people will find that this option gives better performance.
# See smb.conf(5) and /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/speed.html
# for details
# You may want to add the following on a Linux system:
#         SO_RCVBUF=8192 SO_SNDBUF=8192
   socket options = TCP_NODELAY

# The following parameter is useful only if you have the linpopup package
# installed. The samba maintainer and the linpopup maintainer are
# working to ease installation and configuration of linpopup and samba.
;   message command = /bin/sh -c '/usr/bin/linpopup "%f" "%m" %s; rm %s' &

# Domain Master specifies Samba to be the Domain Master Browser. If this
# machine will be configured as a BDC (a secondary logon server), you
# must set this to 'no'; otherwise, the default behavior is recommended.
;   domain master = auto

# Some defaults for winbind (make sure you're not using the ranges
# for something else.)
;   idmap uid = 10000-20000
;   idmap gid = 10000-20000
;   template shell = /bin/bash
;
; The following was the default behaviour in sarge
; but samba upstream reverted the default because it might induce
; performance issues in large organizations
; See #368251 for some of the consequences of *not* having
; this setting and smb.conf(5) for all details
;
;   winbind enum groups = yes
;   winbind enum users = yes

#======================= Share Definitions =======================

[SGSHM]
        comment = Network folder for all group SGSHM
        path = /srv/samba/SGSHM
        writeable = yes
        guest ok = yes
        create mask = 0777
        directory mask = 0777
        read only = no

[2GIS]
        comment = Network version of DubleGIS
        path = /srv/samba/2GIS
        writeable = no
        guest ok = yes
        create mask = 0666
        directory mask = 0754
        read only = yes

[homes]
   comment = Home Directories
   browseable = no

# By default, the home directories are exported read-only. Change next
# parameter to 'yes' if you want to be able to write to them.
   writable = no

# File creation mask is set to 0700 for security reasons. If you want to
# create files with group=rw permissions, set next parameter to 0775.
   create mask = 0700

# Directory creation mask is set to 0700 for security reasons. If you want to
# create dirs. with group=rw permissions, set next parameter to 0775.
   directory mask = 0700

# Restrict access to home directories
# to the one of the authenticated user
# This might need tweaking when using external authentication schemes
   valid users = %S

# Un-comment the following and create the netlogon directory for Domain Logons
# (you need to configure Samba to act as a domain controller too.)
;[netlogon]
;   comment = Network Logon Service
;   path = /home/samba/netlogon
;   guest ok = yes
;   writable = no
;   share modes = no


;[profiles]
;   comment = Users profiles
;   path = /home/samba/profiles
;   guest ok = no
;   browseable = no
;   create mask = 0600
;   directory mask = 0700

[printers]
   comment = All Printers
   browseable = no
   path = /var/spool/samba
   printable = yes
   public = no
   writable = no
   create mode = 0700

# Windows clients look for this share name as a source of downloadable
# printer drivers
[print$]
   comment = Printer Drivers
   path = /var/lib/samba/printers
   browseable = yes
   read only = yes
   guest ok = no
# Uncomment to allow remote administration of Windows print drivers.
# Replace 'ntadmin' with the name of the group your admin users are
# members of.
;   write list = root, @ntadmin

# A sample share for sharing your CD-ROM with others.
[cdrom]
   comment = Samba server's CD-ROM
   writable = no
   locking = no
   path = /cdrom
   public = yes

# The CD-ROM gets unmounted automatically after the connection to the

#
;   preexec = /bin/mount /cdrom
;   postexec = /bin/umount /cdrom

Может я еще что-то не отредактировал. Или гдде-то в конфигах параметр пропустил?

unixforum.org

Настройка LDAP (Проблемы.)

Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP

Re: Настройка LDAP