Ver código fuente

===== OpenLDAP Setup =====
Using your favorite [[Editors|ascii editor]], edit ''slapd.conf'' file in ''/etc/openldap'' directory and modify or add these lines to it ( i recommend you to build ''slapd.conf'' file from scratch ):
 # Defining schemas and schema file locations
 ################################################################
 include         /etc/openldap/schema/core.schema
 include         /etc/openldap/schema/cosine.schema
 include         /etc/openldap/schema/inetorgperson.schema
 include         /etc/openldap/schema/nis.schema
 include         /etc/openldap/schema/samba3.schema<br>
 pidfile         /var/run/slapd/slapd.pid
 argsfile        /var/run/slapd/slapd.args<br>
 # Defining our database and admin user + password
 ################################################################
 database        bdb
 suffix          "dc=foobar,dc=tld"
 rootdn          "cn=Manager,dc=foobar,dc=tld"
 rootpw          secret
 directory       /var/lib/ldap<br>
 # Indexing for faster queries ( bad indexes can slow things up )
 #################################################################
 index   objectClass     eq
 index cn                      pres,sub,eq
 index sn                      pres,sub,eq
 index uid                     pres,sub,eq
 index displayName             pres,sub,eq
 index uidNumber               eq
 index gidNumber               eq
 index memberUid               eq
 index   sambaSID              eq
 index   sambaPrimaryGroupSID  eq
 index   sambaDomainName       eq
 index   default               sub<br>
 # Defining Access Control Lists for access to various parts of our 
 # databse. We can live without ACL's aswell, but some security should 
 # be in place.
 # preventng users from viewing passwords, employee number ... etc
 ######################################################################
 access to attr=userpassword,clearpassword,ldappassword
    by anonymous auth
    by self write
    by dn="cn=Manager,dc=foobar,dc=tld" write
    by * none<br>
 access to *
     by dn="cn=Manager,dc=foobar,dc=tld" write
     by users read
     by self write
     by * read

Once you have modified file to look like the one presented above, make sure that you have ''samba3.schema'' file inside ''/etc/openldap/schema'' directory ( list the directory and see ). If you dont have it, install package named ''samba-client''.

Next step in our OpenLDAP backend configuration we need to create hierarchy of our OpenLDAP domain. We will use '''IDEALX''' scripts to populate '''LDAP''' tree, first thing u should do is create ''smbldap-tools'' directory inside ''/etc'' directory and copy ''smbldap.conf'', ''smbldap_bind.conf'' from ''/usr/share/doc/packages/samba/examples/LDAP/smbldap-tools-0.8.7/'' directory to it:
 # cd /usr/share/doc/packages/samba/examples/LDAP/smbldap-tools-0.8.7/
 # cp smbldap_bind.conf /etc/smbldap-tools
 # cp smbldap.conf /etc/smbldap-tools
 # cp smbldap_tools.pm /usr/local/sbin
 #chmod 644 /usr/local/sbin/smbldap_tools.pm
 # cd /etc/smbldap-tools
 # chmod 644 smbldap.conf
 # chmod 600 smbldap_bind.conf  

Using your favorite [[Editors|ascii editor]], edit ''smbldap.conf'' file in ''/etc/smbldap-tools'' directory and modify or add these lines to it ( i recommend you to build ''smbldap.conf'' file from scratch ):
 # To obtain you own '''SID''' number issue command ''net getlocalsid''
 # And put it below
 ###############################################################
 SID="S-1-5-21-2139989288-483860436-2398042574"<br>
 slaveLDAP="127.0.0.1"
 slavePort="389"
 masterLDAP="127.0.0.1"
 masterPort="389"
 ldapTLS="0"
 verify="require"
 cafile="/etc/smbldap-tools/ca.pem"
 clientcert="/etc/smbldap-tools/smbldap-tools.pem"
 clientkey="/etc/smbldap-tools/smbldap-tools.key" 
 suffix="dc=example,dc=tld"
 usersdn="ou=Users,${suffix}"
 computersdn="ou=Computers,${suffix}"
 groupsdn="ou=Groups,${suffix}"
 idmapdn="ou=Idmap,${suffix}"  
 sambaUnixIdPooldn="sambaDomainName=foobar.tld,${suffix}"
 scope="sub"
 hash_encrypt="SSHA"
 crypt_salt_format="%s"
 userLoginShell="/bin/bash"
 userHome="/home/%U"
 userGecos="System User"
 defaultUserGid="513"   
 defaultComputerGid="515"
 skeletonDir="/etc/skel"        
 defaultMaxPasswordAge="99"     
 userSmbHome="\\BAR\homes\%U"   
 userProfile="\\BAR\profiles\%U"
 userHomeDrive="H:"
 userScript="%U.cmd"
 mailDomain="foobar.tld"
 with_smbpasswd="0"
 smbpasswd="/usr/bin/smbpasswd"
 with_slappasswd="0"
 slappasswd="/usr/sbin/slappasswd"

Using your favorite [[Editors|ascii editor]], edit ''smbldap_tools.pm'' file in ''/usr/local/sbin'' directory and modify or add these lines to it:
 my $smbldap_conf="/etc/smbldap-tools/smbldap.conf";
 my $smbldap_bind_conf="/etc/smbldap-tools/smbldap_bind.conf";

Again using your favorite [[Editors|ascii editor]], edit ''smbldap_bind.conf'' file in ''/etc/smbldap-tools'' directory and modify or add these lines to it:
 slaveDN="cn=Manager,dc=example,dc=tld"
 slavePw="secret"
 masterDN="cn=Manager,dc=example,dc=tld"
 masterPw="secret"

And yet again using your favorite [[Editors|ascii editor]], edit ''smbldap-populate'' file in ''/usr/local/sbin'' directory and modify or add these lines to it ( the default is '''Administrator''', but i've had problems joining workstations to domain using that account because above in samba setup we map '''root''' to '''Administrator''' and you need user with '''uid=0''' to join workstations to domain. If you have a solution for using user with uid that is not 0 please feel free to contact me and ill modify the tutorial ):
 my $adminName = $Options{'a'};
 if (!defined($adminName)) {
   $adminName = "Admin";
 }

Once you have made changes to the ''smbldap-populate'' file, you need to run it from ''/usr/local/sbin'' directory, but before that start '''LDAP''' server ( you should see the output on the screen looking like this ):
 # rcldap start
 # /usr/local/sbin/smbldap-populate
 Using workgroup name from sambaUnixIdPooldn (smbldap.conf): sambaDomainName=foobar.tld
 Using builtin directory structure
 adding new entry: dc=fooobar,dc=tld
 adding new entry: ou=Users,dc=foobar,dc=tld
 adding new entry: ou=Groups,dc=foobar,dc=tld
 adding new entry: ou=Computers,dc=foobar,dc=tld
 adding new entry: ou=Idmap,dc=foobar,dc=tld
 adding new entry: sambaDomainName=foobar.tld,dc=foobar,dc=tld
 adding new entry: uid=Admin,ou=Users,dc=foobar,dc=tld
 adding new entry: uid=nobody,ou=Users,dc=foobar,dc=tld
 adding new entry: cn=Domain Admins,ou=Groups,dc=foobar,dc=tld
 adding new entry: cn=Domain Users,ou=Groups,dc=foobar,dc=tld
 adding new entry: cn=Domain Guests,ou=Groups,dc=foobar,dc=tld
 adding new entry: cn=Domain Computers,ou=Groups,dc=foobar,dc=tld
 adding new entry: cn=Administrators,ou=Groups,dc=foobar,dc=tld
 adding new entry: cn=Print Operators,ou=Groups,dc=foobar,dc=tld
 adding new entry: cn=Backup Operators,ou=Groups,dc=foobar,dc=tld

Before we move on cat the ldap database to ensure that entries have been made, you should get an output like this:

 # slapcat
 dn: dc=foobar,dc=tld
 objectClass: dcObject
 objectClass: organization
 o: foobar
 dc: foobar
 structuralObjectClass: organization
 entryUUID: fc296908-e259-1027-9686-c73f68847b0c
 creatorsName: cn=Manager,dc=foobar,dc=tld
 createTimestamp: 20040124014007Z
 entryCSN: 20040124014007Z#000001#00#000000
 modifiersName: cn=Manager,dc=foobar,dc=tld
 modifyTimestamp: 20040124014007Z<br>
 dn: ou=Users,dc=foobar,dc=tld
 objectClass: organizationalUnit
 ou: Users
 structuralObjectClass: organizationalUnit
 entryUUID: fc4bf504-e259-1027-9687-c73f68847b0c
 creatorsName: cn=Manager,dc=foobar,dc=tld
 createTimestamp: 20040124014007Z
 entryCSN: 20040124014007Z#000002#00#000000
 modifiersName: cn=Manager,dc=foobar,dc=tld
 modifyTimestamp: 20040124014007Z<br>
 dn: ou=Groups,dc=foobar,dc=tld
 objectClass: organizationalUnit
 ou: Groups
 structuralObjectClass: organizationalUnit
 entryUUID: fc4e6cb2-e259-1027-9688-c73f68847b0c
 creatorsName: cn=Manager,dc=foobar,dc=tld
 createTimestamp: 20040124014007Z
 entryCSN: 20040124014007Z#000003#00#000000
 modifiersName: cn=Manager,dc=foobar,dc=tld
 modifyTimestamp: 20040124014007Z<br>
 dn: ou=Computers,dc=foobar,dc=tld
 objectClass: organizationalUnit
 ou: Computers
 structuralObjectClass: organizationalUnit
 entryUUID: fc55504a-e259-1027-9689-c73f68847b0c
 creatorsName: cn=Manager,dc=foobar,dc=tld
 createTimestamp: 20040124014008Z
 entryCSN: 20040124014008Z#000001#00#000000
 modifiersName: cn=Manager,dc=foobar,dc=tld
 modifyTimestamp: 20040124014008Z<br>
 dn: ou=Idmap,dc=foobar,dc=tld
 objectClass: organizationalUnit
 ou: Idmap
 structuralObjectClass: organizationalUnit
 entryUUID: fc58a128-e259-1027-968a-c73f68847b0c
 creatorsName: cn=Manager,dc=foobar,dc=tld
 createTimestamp: 20040124014008Z
 entryCSN: 20040124014008Z#000002#00#000000
 modifiersName: cn=Manager,dc=foobar,dc=tld
 modifyTimestamp: 20040124014008Z<br>
 dn: sambaDomainName=efoobar.tld,dc=foobar,dc=tld
 objectClass: sambaDomain
 objectClass: sambaUnixIdPool
 sambaDomainName: example.tld
 sambaSID: S-1-5-21-2139989288-483860436-2398042574 
 uidNumber: 1000
 gidNumber: 1000
 structuralObjectClass: sambaDomain
 entryUUID: fc5fcfac-e259-1027-968b-c73f68847b0c
 creatorsName: cn=Manager,dc=foobar,dc=tld
 createTimestamp: 20040124014008Z
 entryCSN: 20040124014008Z#000003#00#000000
 modifiersName: cn=Manager,dc=foobar,dc=tld
 modifyTimestamp: 20040124014008Z<br>
 dn: uid=Admin,ou=Users,dc=foobar,dc=tld
 cn: Admin
 sn: Admin
 objectClass: inetOrgPerson
 objectClass: sambaSamAccount
 objectClass: posixAccount
 objectClass: shadowAccount
 gidNumber: 512
 uid: Admin
 uidNumber: 998
 homeDirectory: /home/Admin
 sambaPwdLastSet: 0
 sambaLogonTime: 0
 sambaLogoffTime: 2147483647
 sambaKickoffTime: 2147483647
 sambaPwdCanChange: 0
 sambaPwdMustChange: 2147483647
 sambaHomePath: \\bar\homes\Admin
 sambaHomeDrive: H:
 sambaProfilePath: \\bar\profiles\Admin\
 sambaPrimaryGroupSID: S-1-5-21-2139989288-483860436-2398042574-512
 sambaLMPassword: XXX
 sambaNTPassword: XXX
 sambaAcctFlags: [U          ]
 sambaSID: S-1-5-21-2139989288-483860436-2398042574-2996
 loginShell: /bin/false
 gecos: Netbios Domain Administrator
 structuralObjectClass: inetOrgPerson
 entryUUID: fc9199a6-e259-1027-968c-c73f68847b0c
 creatorsName: cn=Manager,dc=foobar,dc=tld
 createTimestamp: 20040124014008Z
 entryCSN: 20040124014008Z#000004#00#000000
 modifiersName: cn=Manager,dc=foobar,dc=tld
 modifyTimestamp: 20040124014008Z<br>
 dn: uid=nobody,ou=Users,dc=foobar,dc=tld
 cn: nobody
 sn: nobody
 objectClass: inetOrgPerson
 objectClass: sambaSamAccount
 objectClass: posixAccount
 objectClass: shadowAccount
 gidNumber: 514
 uid: nobody
 uidNumber: 999
 homeDirectory: /dev/null
 sambaPwdLastSet: 0
 sambaLogonTime: 0
 sambaLogoffTime: 2147483647
 sambaKickoffTime: 2147483647
 sambaPwdCanChange: 0
 sambaPwdMustChange: 2147483647
 sambaHomePath: \\bar\homes\nobody
 sambaHomeDrive: H:
 sambaProfilePath: \\bar\profiles\nobody
 sambaPrimaryGroupSID: S-1-5-21-2139989288-483860436-2398042574-514
 sambaLMPassword: NO PASSWORDXXXXXXXXXXXXXXXXXXXXX
 sambaNTPassword: NO PASSWORDXXXXXXXXXXXXXXXXXXXXX
 sambaAcctFlags: [NU         ]
 sambaSID: S-1-5-21-2139989288-483860436-2398042574-2998
 loginShell: /bin/false
 structuralObjectClass: inetOrgPerson
 entryUUID: fcbe3362-e259-1027-968d-c73f68847b0c
 creatorsName: cn=Manager,dc=foobar,dc=tld
 createTimestamp: 20040124014008Z
 entryCSN: 20040124014008Z#000005#00#000000
 modifiersName: cn=Manager,dc=foobar,dc=tld
 modifyTimestamp: 20040124014008Z<br>
 dn: cn=Domain Admins,ou=Groups,dc=foobar,dc=tld
 objectClass: posixGroup
 objectClass: sambaGroupMapping
 gidNumber: 512
 cn: Domain Admins
 memberUid: Admin
 description: Netbios Domain Administrators
 sambaSID: S-1-5-21-2139989288-483860436-2398042574-512
 sambaGroupType: 2
 displayName: Domain Admins
 structuralObjectClass: posixGroup
 entryUUID: fcc7222e-e259-1027-968e-c73f68847b0c
 creatorsName: cn=Manager,dc=foobar,dc=tld
 createTimestamp: 20040124014008Z
 entryCSN: 20040124014008Z#000006#00#000000
 modifiersName: cn=Manager,dc=foobar,dc=tld
 modifyTimestamp: 20040124014008Z<br>
 dn: cn=Domain Users,ou=Groups,dc=foobar,dc=tld
 objectClass: posixGroup
 objectClass: sambaGroupMapping
 gidNumber: 513
 cn: Domain Users
 description: Netbios Domain Users
 sambaSID: S-1-5-21-2139989288-483860436-2398042574-513
 sambaGroupType: 2
 displayName: Domain Users
 structuralObjectClass: posixGroup
 entryUUID: fceb2534-e259-1027-968f-c73f68847b0c
 creatorsName: cn=Manager,dc=foobar,dc=tld
 createTimestamp: 20040124014008Z
 entryCSN: 20040124014008Z#000007#00#000000
 modifiersName: cn=Manager,dc=foobar,dc=tld
 modifyTimestamp: 20040124014008Z<br>
 dn: cn=Domain Guests,ou=Groups,dc=foobar,dc=tld
 objectClass: posixGroup
 objectClass: sambaGroupMapping
 gidNumber: 514
 cn: Domain Guests
 description: Netbios Domain Guests Users
 sambaSID: S-1-5-21-2139989288-483860436-2398042574-514
 sambaGroupType: 2
 displayName: Domain Guests
 structuralObjectClass: posixGroup
 entryUUID: fcf449fc-e259-1027-9690-c73f68847b0c
 creatorsName: cn=Manager,dc=foobar,dc=tld
 createTimestamp: 20040124014009Z
 entryCSN: 20040124014009Z#000001#00#000000
 modifiersName: cn=Manager,dc=foobar,dc=tld
 modifyTimestamp: 20040124014009Z<br>
 dn: cn=Domain Computers,ou=Groups,dc=foobar,dc=tld
 objectClass: posixGroup
 objectClass: sambaGroupMapping
 gidNumber: 515
 cn: Domain Computers
 description: Netbios Domain Computers accounts
 sambaSID: S-1-5-21-2139989288-483860436-2398042574-515
 sambaGroupType: 2
 displayName: Domain Computers
 structuralObjectClass: posixGroup
 entryUUID: fcfe6612-e259-1027-9691-c73f68847b0c
 creatorsName: cn=Manager,dc=foobar,dc=tld
 createTimestamp: 20040124014009Z
 entryCSN: 20040124014009Z#000002#00#000000
 modifiersName: cn=Manager,dc=foobar,dc=tld
 modifyTimestamp: 20040124014009Z<br>
 dn: cn=Administrators,ou=Groups,dc=foobar,dc=tld
 objectClass: posixGroup
 objectClass: sambaGroupMapping
 gidNumber: 544
 cn: Administrators
 description: Netbios Domain Members can fully administer the 
 computer/sambaDomainName
 sambaSID: S-1-5-32-544
 sambaGroupType: 5
 displayName: Administrators
 structuralObjectClass: posixGroup
 entryUUID: fd077900-e259-1027-9692-c73f68847b0c
 creatorsName: cn=Manager,dc=foobar,dc=tld
 createTimestamp: 20040124014009Z
 entryCSN: 20040124014009Z#000003#00#000000
 modifiersName: cn=Manager,dc=foobar,dc=tld
 modifyTimestamp: 20040124014009Z<br>
 dn: cn=Print Operators,ou=Groups,dc=foobar,dc=tld
 objectClass: posixGroup
 objectClass: sambaGroupMapping
 gidNumber: 550
 cn: Print Operators
 description: Netbios Domain Print Operators
 sambaSID: S-1-5-32-550
 sambaGroupType: 5
 displayName: Print Operators
 structuralObjectClass: posixGroup
 entryUUID: fd1062c2-e259-1027-9693-c73f68847b0c
 creatorsName: cn=Manager,dc=foobar,dc=tld
 createTimestamp: 20040124014009Z
 entryCSN: 20040124014009Z#000004#00#000000
 modifiersName: cn=Manager,dc=foobar,dc=tld
 modifyTimestamp: 20040124014009Z<br>
 dn: cn=Backup Operators,ou=Groups,dc=foobar,dc=tld
 objectClass: posixGroup
 objectClass: sambaGroupMapping
 gidNumber: 551
 cn: Backup Operators
 description: Netbios Domain Members can bypass file security to back up files
 sambaSID: S-1-5-32-551
 sambaGroupType: 5
 displayName: Backup Operators
 structuralObjectClass: posixGroup
 entryUUID: fd181b16-e259-1027-9694-c73f68847b0c
 creatorsName: cn=Manager,dc=foobar,dc=tld
 createTimestamp: 20040124014009Z
 entryCSN: 20040124014009Z#000005#00#000000
 modifiersName: cn=Manager,dc=foobar,dc=tld
 modifyTimestamp: 20040124014009Z<br>
 dn: cn=Replicators,ou=Groups,dc=foobar,dc=tld
 objectClass: posixGroup
 objectClass: sambaGroupMapping
 gidNumber: 552
 cn: Replicators
 description: Netbios Domain Supports file replication in a sambaDomainName
 sambaSID: S-1-5-32-552
 sambaGroupType: 5
 displayName: Replicators
 structuralObjectClass: posixGroup
 entryUUID: fd211446-e259-1027-9695-c73f68847b0c
 creatorsName: cn=Manager,dc=foobar,dc=tld
 createTimestamp: 20040124014009Z
 entryCSN: 20040124014009Z#000006#00#000000
 modifiersName: cn=Manager,dc=foobar,dc=tld
 modifyTimestamp: 20040124014009Z

Now (re)start all daemons:
 # rcldap start
 # rcsmb start
 # rcnmb start

Lets add a few accounts to our '''LDAP''' database: first we need to add '''root''' account for '''SAMBA''' because adding client machine to domain requires usage of '''administrator''' account ( account with '''uid 0''' ) and second we need to add the '''LDAP''' password to the ''secrets.tdb'' file so that '''SAMBA''' can update the '''LDAP''' database:
 # smbpasswd -a root
 # smbpasswd -w secret
 Setting stored password for "cn=Manager,dc=foobar,dc=tld" in secrets.tdb

Note, the ''smbpasswd -w secret'' is what '''SAMBA''' will use to update the '''LDAP''' database, make it be the same as one defined in ''slapd.conf'' file under '''rootpw''' directive.

Use '''IDEALX''' scripts to add user/group ... etc accounts to '''LDAP''' which will be used with '''SAMBA''':
 # smbldap-useradd -a USERNAME

In order to get system to authenticate via '''LDAP''' and to use those posix accounts stored in '''LDAP''' for '''SAMBA''', you need to set you system to do authetication via '''LDAP''' for local and remote connections.

So use '''YaST''' to configure your system as '''LDAP''' client:

[[Image:Yastldap.png]]

Once you've got that covered, use your favorite [[Editors|ascii editor]], edit ''nsswitch.conf'' file in ''/etc/'' directory and modify or add following directive:
 passwd: files ldap
 group: files ldap

Now list entries in administrative database to see if your system indeed sees both local system and '''LDAP''' stored accounts ( if you havent added any account yet there should be at least two '''Admin''' and '''nobody''', i have included only the two even though the command will output all accounts ):
 # getent passwd
 +::0:0:::
 Admin:x:998:512:Netbios Domain Administrator:/home/Admin:/bin/false
 nobody:x:999:514:nobody:/dev/null:/bin/false

If everything is set as descried above you need to edit one two more file to ensure perfect automation, first create directory ''scripts'' inside ''/etc/samba'' directory:
 # echo session required pam_mkhomedir.so skel=/etc/skel umask=0022 >>/etc/pam.d/common-session

Phew, now that all of this is configured you may move on with tutorial :D !!