使用Samba将Linux主机加入AD域
研究了2个星期的一点小成，写出来供大家分享。所有功能都在as3下调试通过。为了图方便，as3采用默认安装。
在研究中经常看到下面这些东东，还是先了解下理论依据
PDC：主域控制器，一般用来做验证
BDC：备份域控制器，一般用于和主域做同步帐号等操作
KDC：密钥分发中心，说白了，就是kerbrose服务器。这个需要对kerbrose有一定的了解，这里不多说了
PAM：可插拔认证模块，这玩意就是使用不同的验证方法来验证你所需要的服务，比如sshd，login，ftp等。这些服务都对应一个配置文件，这个配置文件位于/etc/pam.d/下。而支持这些验证的动态库位于/lib/security/下。
SRV：服务器定位资源记录，要使活动目录正常工作，DNS必须支持SRV。活动目录客户端和域控制器使用SRV记录决定域控制器的ip地址。使用SRV记录决定域控制器的ip地址，具体请参见http://www.linuxidc.com/Linux/2009-12/23261p4.htm
下面言归正传，介绍如何将samba服务器加入到AD域中
(1)配置/etc/samba/smb.conf
workgroup = LIZL # 你要加入的域,比如你AD上建的域叫LIZL.COM,这里只需省略填入即可
# winbind
netbios name = leeldap #你的linux机器名,samba服务器
idmap uid = 15000-20000
idmap gid = 15000-20000
winbind enum groups = yes
winbind enum users = yes
winbind separator = /
; winbind use default domain = yes
template homedir = /home/%D/%U
template shell = /bin/bash
security = domain
password server = 192.168.115.128 #这里是你的安装ad的机器的ip
encrypt passwords = yes
hosts allow = 192.168.1. 192.168.2. 127. 192.168.115.
[homes]
comment = Home Directories
path = /home/%D/%U
browseable = no
writable = yes
valid users = %D/%U #这里记得把域名带上，否则你用ad帐号访问samba服务器时输入正确的ad帐号和密码仍然不能访问共享目录
create mode = 0777
directory mode = 0777
(2)配置/etc/nsswitch.conf
passwd: files winbind
shadow: files
group: files winbind(3)启用samba和winbind服务。
service smb reload #加这一句是用来解决有时候samba启动不了的问题
service smb start
service winbind start(4)使用net加入AD域
[root@leeldap pam.d]# net rpc join -S lee -U administrator
Password:
Joined domain LIZL.(5)测试是否加入成功
[root@leeldap pam.d]# net rpc testjoin
Join to 'LIZL' is OK
[root@leeldap pam.d]# wbinfo -t
checking the trust secret via RPC calls succeeded
[root@leeldap pam.d]# wbinfo -u
LIZL/Administrator
LIZL/brown
LIZL/bruce
LIZL/Guest
LIZL/jet
LIZL/krbtgt
LIZL/lee
LIZL/lili
LIZL/lizl
LIZL/samba
LIZL/SUPPORT_388945a0
LIZL/test
[root@leeldap pam.d]# wbinfo -g
BUILTIN/System Operators
BUILTIN/Replicators
BUILTIN/Guests
BUILTIN/Power Users
BUILTIN/Print Operators
BUILTIN/Administrators
BUILTIN/Account Operators
BUILTIN/Backup Operators
BUILTIN/Users
[root@leeldap pam.d]# getent passwd
root:x:0:0:root:/root:/bin/bash
。。。。。。。
LIZL/administrator:x:15000:15000::/home/LIZL/administrator:/bin/bash
LIZL/brown:x:15001:15000:Brown Lee:/home/LIZL/brown:/bin/bash
LIZL/bruce:x:15002:15000:Bruce Lee:/home/LIZL/bruce:/bin/bash
LIZL/guest:x:15003:15000::/home/LIZL/guest:/bin/bash
LIZL/jet:x:15004:15000:Jet Chen:/home/LIZL/jet:/bin/bash
LIZL/krbtgt:x:15005:15000::/home/LIZL/krbtgt:/bin/bash
LIZL/lee:x:15006:15000:Jackie Lee:/home/LIZL/lee:/bin/bash
LIZL/lili:x:15007:15000:lily:/home/LIZL/lili:/bin/bash
LIZL/lizl:x:15008:15000:lizhili:/home/LIZL/lizl:/bin/bash
LIZL/samba:x:15013:15000:samba:/home/LIZL/samba:/bin/bash
LIZL/support_388945a0:x:15009:15000:CN=Microsoft Corporation,L=Redmond,S=Washington,C=US:/home/LIZL/support_388945a0:/bin/bash
LIZL/test:x:15014:15000:test:/home/LIZL/test:/bin/bash
[root@leeldap pam.d]# getent group
root:x:0:root
。。。。。
BUILTIN/System Operators:x:15009:
BUILTIN/Replicators:x:15010:
BUILTIN/Guests:x:15011:
BUILTIN/Power Users:x:15012:
BUILTIN/Print Operators:x:15013:
BUILTIN/Administrators:x:15014:
BUILTIN/Account Operators:x:15015:
BUILTIN/Backup Operators:x:15016:
BUILTIN/Users:x:15017:
在研究中经常看到下面这些东东，还是先了解下理论依据
PDC：主域控制器，一般用来做验证
BDC：备份域控制器，一般用于和主域做同步帐号等操作
KDC：密钥分发中心，说白了，就是kerbrose服务器。这个需要对kerbrose有一定的了解，这里不多说了
PAM：可插拔认证模块，这玩意就是使用不同的验证方法来验证你所需要的服务，比如sshd，login，ftp等。这些服务都对应一个配置文件，这个配置文件位于/etc/pam.d/下。而支持这些验证的动态库位于/lib/security/下。
SRV：服务器定位资源记录，要使活动目录正常工作，DNS必须支持SRV。活动目录客户端和域控制器使用SRV记录决定域控制器的ip地址。使用SRV记录决定域控制器的ip地址，具体请参见http://www.linuxidc.com/Linux/2009-12/23261p4.htm
下面言归正传，介绍如何将samba服务器加入到AD域中
(1)配置/etc/samba/smb.conf
workgroup = LIZL # 你要加入的域,比如你AD上建的域叫LIZL.COM,这里只需省略填入即可# winbind netbios name = leeldap #你的linux机器名,samba服务器 idmap uid = 15000-20000 idmap gid = 15000-20000 winbind enum groups = yes winbind enum users = yes winbind separator = / ; winbind use default domain = yes template homedir = /home/%D/%U template shell = /bin/bash security = domain password server = 192.168.115.128 #这里是你的安装ad的机器的ip encrypt passwords = yeshosts allow = 192.168.1. 192.168.2. 127. 192.168.115.
[homes] comment = Home Directories path = /home/%D/%U browseable = no writable = yes valid users = %D/%U #这里记得把域名带上，否则你用ad帐号访问samba服务器时输入正确的ad帐号和密码仍然不能访问共享目录create mode = 0777
directory mode = 0777
passwd: files winbindshadow: filesgroup: files winbind service smb reload #加这一句是用来解决有时候samba启动不了的问题 service smb start
service winbind start
[root@leeldap pam.d]# net rpc join -S lee -U administratorPassword:Joined domain LIZL.[root@leeldap pam.d]# net rpc testjoinJoin to 'LIZL' is OK[root@leeldap pam.d]# wbinfo -tchecking the trust secret via RPC calls succeeded[root@leeldap pam.d]# wbinfo -uLIZL/AdministratorLIZL/brownLIZL/bruceLIZL/GuestLIZL/jetLIZL/krbtgtLIZL/leeLIZL/liliLIZL/lizlLIZL/sambaLIZL/SUPPORT_388945a0LIZL/test[root@leeldap pam.d]# wbinfo -gBUILTIN/System OperatorsBUILTIN/ReplicatorsBUILTIN/GuestsBUILTIN/Power UsersBUILTIN/Print OperatorsBUILTIN/AdministratorsBUILTIN/Account OperatorsBUILTIN/Backup OperatorsBUILTIN/Users[root@leeldap pam.d]# getent passwdroot:x:0:0:root:/root:/bin/bash。。。。。。。LIZL/administrator:x:15000:15000::/home/LIZL/administrator:/bin/bashLIZL/brown:x:15001:15000:Brown Lee:/home/LIZL/brown:/bin/bashLIZL/bruce:x:15002:15000:Bruce Lee:/home/LIZL/bruce:/bin/bashLIZL/guest:x:15003:15000::/home/LIZL/guest:/bin/bashLIZL/jet:x:15004:15000:Jet Chen:/home/LIZL/jet:/bin/bashLIZL/krbtgt:x:15005:15000::/home/LIZL/krbtgt:/bin/bashLIZL/lee:x:15006:15000:Jackie Lee:/home/LIZL/lee:/bin/bashLIZL/lili:x:15007:15000:lily:/home/LIZL/lili:/bin/bashLIZL/lizl:x:15008:15000:lizhili:/home/LIZL/lizl:/bin/bashLIZL/samba:x:15013:15000:samba:/home/LIZL/samba:/bin/bashLIZL/support_388945a0:x:15009:15000:CN=Microsoft Corporation,L=Redmond,S=Washington,C=US:/home/LIZL/support_388945a0:/bin/bashLIZL/test:x:15014:15000:test:/home/LIZL/test:/bin/bash[root@leeldap pam.d]# getent grouproot:x:0:root。。。。。BUILTIN/System Operators:x:15009:BUILTIN/Replicators:x:15010:BUILTIN/Guests:x:15011:BUILTIN/Power Users:x:15012:BUILTIN/Print Operators:x:15013:BUILTIN/Administrators:x:15014:BUILTIN/Account Operators:x:15015:BUILTIN/Backup Operators:x:15016:BUILTIN/Users:x:15017:相关推荐
bluecarrot 2020-11-23
Attend 2020-11-17
ZHAICAN 2020-11-16
codedecode 2020-11-14
zhangbingb 2020-11-12
ykmail 2020-11-11
futurezone 2020-11-06
rikeyone 2020-11-04
橄榄 2020-11-04
WenCoo 2020-10-31
farwang 2020-11-25
星愿心愿 2020-11-24
tianhuak 2020-11-24
zhjn0 2020-11-24
昭君出塞 2020-11-23
linuxwcj 2020-10-21
以梦为马不负韶华 2020-10-20