Авторизация пользователей через AD (Samba + kerberos)

Sabayon, Calculate, Funtoo, Exherbo

Модератор: /dev/random

SkyKsandr
Сообщения: 32
ОС: Gentoo

Авторизация пользователей через AD

Сообщение SkyKsandr »

Здравствуйте, рыл интернет, но решения рабочего так и не нашел

Привожу конфиги:
smb.conf

Код:

#======================= Global Settings ===================================== [global] workgroup = AVA netbios name = FileServer server string = Samba Server %v log file = /var/log/samba/log.smbd max log size = 500 log level = 4 hosts allow = 192.168.1. 127. map to guest = bad user security = user realm = AVA.LOCAL encrypt passwords = yes unix password sync = Yes passwd program = /usr/bin/passwd %u passwd chat = *New*UNIX*password* %n\n *Re*ype*new*UNIX*password* %n\n \ socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 ;winbind separator =\ winbind use default domain = yes winbind uid = 10000-20000 winbind gid = 10000-20000 winbind enum groups = yes winbind enum users = yes username map = /etc/samba/smbusers socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 dns proxy = no dos charset = CP866 unix charset = KOI8-R display charset = KOI8-R use spnego = yes #============================ Share Definitions ============================== [homes] comment = Home Directories browseable = no writable = yes [printers] comment = All Printers path = /var/spool/samba browseable = no guest ok = no writable = no printable = yes [print$] path = /var/lib/samba/printers browseable = yes read only = yes write list = @adm root guest ok = yes [Distr] comment = Distributive path = /home/progr/Distr # valid users = public = yes guest ok = yes ;guest user = nobody read only = no writable = yes printable = no directory mask = 0777 create mask = 0666 create mask = 0765 [IT] comment = IT path = /home/progr/IT valid users = ava\progr dir1 dir2 dir3 ava\fin1 writeable = yes guest ok = no directory mask = 0777 create mask = 0666


krb5.conf

Код:

[logging] default=FILE:/var/log/krb5libs.log kdc=FILE:/var/log/krb5kdc.log admin_server=FILE:/var/log/kadmind.log [libdefaults] ticket_lifetime = 24000 default_realm = AVA.LOCAL kdc_timesync = 1 dns_lookup_realm = true dns_lookup_kdc = true [realms] AVA.LOCAL = { kdc = comp111.ava.local:88 admin_server = comp111.ava.local:749 default_domain = ava.local } [domain_realm] .domain.name.ru = AVA.LOCAL domain.name.ru = AVA.LOCAL [kdc] profile = /var/kerberos/krb5kdc/kdc.conf [appdefaults] pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false }


nsswitch.conf

Код:

# /etc/nsswitch.conf: # $Header: /var/cvsroot/gentoo/src/patchsets/glibc/extra/etc/nsswitch.conf,v 1.1 2006/09/29 23:52:23 vapier Exp $ passwd: files winbind shadow: files winbind group: files winbind # passwd: db files nis # shadow: db files nis #group: db files nis #hosts: file mdns4_minimal [NOTFOUND=return] dns mdns4 #networks: files dns #services: db files #protocols: db files #rpc: db files #ethers: db files #netmasks: files #netgroup: files #bootparams: files #automount: files #aliases: files


Пожалуйста, ПОМОГИТЕ!

З.Ы. Скрипт перезапуска winbindd не нашел. Использовал google

З.З.Ы. wbinfo -g
BUILTIN+administrators
BUILTIN+users

wbinfo -u
Error looking up domain users
Душа просит романтики, а ж*** - приключений
Спасибо сказали:
Аватара пользователя
Ariasp
Сообщения: 254
Статус: NixLander

Re: Авторизация пользователей через AD

Сообщение Ariasp »

SkyKsandr писал(а):
21.04.2009 14:13
security = user
passwd program = /usr/bin/passwd %u

Мягко говоря, с такими настройками рассчитывать на интеграцию самбы в AD не стоит. Для этого должно быть:
security = ads
password server = ip_или_имя_DC

А вообще говоря, плохо рыл инет. Вот пример с этого форума:
Samba + AD
Спасибо сказали: