Bạn sửa file smbldap_bind.conf bằng lệnh
vim /etc/smbldap-tools/smbldap_bind.conf
slaveDN="cn=Manager,dc=dnson,dc=local"slavePw="123456"masterDN="cn=Manager,dc=dnson,dc=local"masterPw="123"
Sau đó bạn lại sửa file smbldap.conf bằng lệnh
vim /etc/smbldap-tools/smbldap.conf
sambaDomain="dnson.local"
################################################################################ LDAP Configuration###############################################################################
# Notes: to use to dual ldap servers backend for Samba, you must patch# Samba with the dual-head patch from IDEALX. If not using this patch# just use the same server for slaveLDAP and masterLDAP.# Those two servers declarations can also be used when you have# . one master LDAP server where all writing operations must be done# . one slave LDAP server where all reading operations must be done# (typically a replication directory)
# Slave LDAP server# Ex: slaveLDAP=127.0.0.1# If not defined, parameter is set to "127.0.0.1"slaveLDAP="slave.dnson.local"
# Slave LDAP port# If not defined, parameter is set to "389"slavePort="389"
# Master LDAP server: needed for write operations# Ex: masterLDAP=127.0.0.1# If not defined, parameter is set to "127.0.0.1"masterLDAP="ad.dnson.local"
# Master LDAP port# If not defined, parameter is set to "389"masterPort="389"
# Use TLS for LDAP# If set to 1, this option will use start_tls for connection# (you should also used the port 389)# If not defined, parameter is set to "1"ldapTLS="0"
# How to verify the server's certificate (none, optional or require)# see "man Net::LDAP" in start_tls section for more detailsverify="none"
# CA certificate# see "man Net::LDAP" in start_tls section for more detailscafile=""
# certificate to use to connect to the ldap server# see "man Net::LDAP" in start_tls section for more detailsclientcert=""
# key certificate to use to connect to the ldap server# see "man Net::LDAP" in start_tls section for more detailsclientkey=""
# LDAP Suffix# Ex: suffix=dc=IDEALX,dc=ORGsuffix="dc=dnson,dc=local"
# Where are stored Users# Ex: usersdn="ou=Users,dc=IDEALX,dc=ORG"# Warning: if 'suffix' is not set here, you must set the full dn for usersdnusersdn="ou=Users,${suffix}"
# Where are stored Computers# Ex: computersdn="ou=Computers,dc=IDEALX,dc=ORG"# Warning: if 'suffix' is not set here, you must set the full dn for computersdncomputersdn="ou=Computers,${suffix}"
# Where are stored Groups# Ex: groupsdn="ou=Groups,dc=IDEALX,dc=ORG"# Warning: if 'suffix' is not set here, you must set the full dn for groupsdngroupsdn="ou=Groups,${suffix}"
# Where are stored Idmap entries (used if samba is a domain member server)# Ex: groupsdn="ou=Idmap,dc=IDEALX,dc=ORG"# Warning: if 'suffix' is not set here, you must set the full dn for idmapdnidmapdn="ou=Idmap,${suffix}"
# Where to store next uidNumber and gidNumber available for new users and groups# If not defined, entries are stored in sambaDomainName object.# Ex: sambaUnixIdPooldn="sambaDomainName=${sambaDomain},${suffix}"# Ex: sambaUnixIdPooldn="cn=NextFreeUnixId,${suffix}"sambaUnixIdPooldn="sambaDomainName=${sambaDomain},${suffix}"
# Default scope Usedscope="sub"
# Unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA, CLEARTEXT)hash_encrypt="SSHA"
# if hash_encrypt is set to CRYPT, you may set a salt format.# default is "%s", but many systems will generate MD5 hashed# passwords if you use "$1$%.8s". This parameter is optional!crypt_salt_format=""
################################################################################ Unix Accounts Configuration###############################################################################
# Login defs# Default Login Shell# Ex: userLoginShell="/bin/bash" userLoginShell="/bin/bash"
# Home directory# Ex: userHome="/home/%U"userHome="/home/%U"
# Default mode used for user homeDirectoryuserHomeDirectoryMode="700"
# GecosuserGecos="System User"
# Default User (POSIX and Samba) GIDdefaultUserGid="513"
# Default Computer (Samba) GIDdefaultComputerGid="515"
# Skel dirskeletonDir="/etc/skel"
# Default password validation time (time in days) Comment the next line if# you don't want password to be enable for defaultMaxPasswordAge days (be# careful to the sambaPwdMustChange attribute's value)defaultMaxPasswordAge="45"
################################################################################ SAMBA Configuration###############################################################################
# The UNC path to home drives location (%U username substitution)# Just set it to a null string if you want to use the smb.conf 'logon home'# directive and/or disable roaming profiles# Ex: userSmbHome="\\PDC-SMB3\%U"userSmbHome="\\10.10.10.1\%U"
# The UNC path to profiles locations (%U username substitution)# Just set it to a null string if you want to use the smb.conf 'logon path'# directive and/or disable roaming profiles# Ex: userProfile="\\PDC-SMB3\profiles\%U"userProfile="\\10.10.10.1\profiles\%U"
# The default Home Drive Letter mapping# (will be automatically mapped at logon time if home directory exist)# Ex: userHomeDrive="H:"userHomeDrive="H:"
# The default user netlogon script name (%U username substitution)# if not used, will be automatically username.cmd# make sure script file is edited under dos# Ex: userScript="startup.cmd" # make sure script file is edited under dosuserScript="logon.bat"# Domain appended to the users "mail"-attribute# when smbldap-useradd -M is used# Ex: mailDomain="idealx.com"mailDomain="dnson.local"
################################################################################ SMBLDAP-TOOLS Configuration (default are ok for a RedHat)###############################################################################
# Allows not to use smbpasswd (if with_smbpasswd="0" in smbldap.conf) but# prefer Crypt::SmbHash librarywith_smbpasswd="0"smbpasswd="/usr/bin/smbpasswd"
# Allows not to use slappasswd (if with_slappasswd="0" in smbldap.conf)# but prefer Crypt:: librarieswith_slappasswd="0"slappasswd="/usr/sbin/slappasswd"
# comment out the following line to get rid of the default banner# no_banner="1"
Bạn dùng lệnh
mv /etc/samba/smb.conf /etc/samba/smb.conf.backup
để đổi tên file cấu hình samba đề phòng file cấu hình mới có hư thì dùng lại file này.
Bạn gõ lệnh
cp /usr/share/doc/smbldap-tools-0.9.6/smb.conf /etc/samba/
để coppy file cấu hình mới.cái file này dùng để cấu hình samba ldap đó.
Bạn mở file này lên bằng lệnh
vim /etc/samba/smb.conf
và sửa lại như sau.
[global]
ldap ssl = No
nt acl support = No
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
workgroup = dnson.local đây là cái mà ta nhập domain bên client để join
realm = dnson.local
netbios name = ldap
security = user
enable privileges = yes
server string = Samba Server %v
encrypt passwords = Yes
interfaces = eth0
bind interfaces only = yes
username map = /etc/samba/smbusers
unix password sync = yes
ldap passwd sync = Yes
passwd program = /usr/sbin/smbldap-passwd -u "%u"
passwd chat = "Changing *\nNew password*" %n\n "*Retype new password*" %n\n"
log level = 1
syslog = 0
log file = /var/log/samba/log.%U
max log size = 100000
time server = Yes
smb ports = 139 445
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
mangling method = hash2
Dos charset = 850
Unix charset = ISO8859-1
logon script = logon.bat
logon drive = H:
logon home = \\%L\%U
logon path = \\%L\profiles\%U
domain logons = Yes
domain master = Yes
os level = 65
preferred master = Yes
wins support = yes
passdb backend = ldapsam:ldap://10.10.10.1/
ldap admin dn = cn=Manager,dc=dnson,dc=local
ldap suffix = dc=dnson,dc=local
ldap group suffix = ou=Groups
ldap user suffix = ou=Users
ldap machine suffix = ou=Computers
add user script = /usr/sbin/smbldap-useradd -m "%u"
delete user script = /usr/sbin/smbldap-userdel "%u"
add machine script = /usr/sbin/smbldap-useradd -t 0 -w "%u"
add group script = /usr/sbin/smbldap-groupadd -p "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'
# printers configuration load printers = Yes
create mask = 0640
directory mask = 0750
nt acl support = No
printing = cups
printcap name = cups
deadtime = 10
guest account = nobody
map to guest = Bad User
dont descend = /proc,/dev,/etc,/lib,/lost+found,/initrd
show add printer wizard = yes
; to maintain capital letters in shortcuts in any of the profile folders:^M
preserve case = yes
short preserve case = yes
case sensitive = no idmap uid = 10000-20000
idmap gid = 10000-20000
[netlogon]
path = /home/netlogon/
comment = Network Logon Service
guest ok = No
locking = No
[profiles] comment = roaming profile share
path = /home/profiles
read only = No
create mask = 0600
directory mask = 0700
browseable = No
profile acls = yes
force user = %U
valid users = %U
csc policy = disable
[homes]
comment = Home Directory
browseable = No
valid users = %U
read only = no
create mask = 1770
directory mask = 1770
Sau khi lưu file này lại bạn tạo tiếp các thư mục sau nhé.
mkdir /home/netlogonmkdir /home/profiles
Bạn phân quyền lại thư mục /home/samba/profiles/ như sau.
chmod 1777 /home/profiles/
Bạn khởi động samba và cho samba chạy cùng hệ thống bằng lệnh
service smb startservice nmb startchkconfig smb onchkconfig nmb on
Đặt mật khẩu cho user quản trị samba ldap.
smbpasswd -w 123456
Sau đó bạn gõ lệnh
net getlocalsid
để lấy một mã số.nó sẽ bắt bạn nhập mật khẩu.bạn nhập mật khẩu y chang cái mật khẩu bạn lưu trong file /etc/smbldap-tools/smbldap_bind.conf.Như mình đã nói ở đầu.tốt nhất mật khẩu cứ giống nhau cả loạt đi cho nó nhanh, ít lỗi ,fix mệt.
Bạn coppy cái mã đó và mở file
vim /etc/smbldap-tools/smbldap.conf
Tìm đến dòng
SID ="thêm cái mã đó vô chỗ này."
VD : SID = "S-1-3-32432432432-4-324324324" (chỉ là ví dụ thôi)
Không có nhận xét nào:
Đăng nhận xét