Установить пакеты:
apt-get install krb5-user, libpam-krb5
Коннфигурируем Kerberos:
/etc/krb5.conf
#---------------------------------------
[libdefaults]
default_realm = NB.DOMAIN
krb4_config = /etc/krb.conf
krb4_realms = /etc/krb.realms
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
v4_instance_resolve = false
v4_name_convert = {
host = {
rcmd = host
ftp = ftp
}
plain = {
something = something-else
}
}
fcc-mit-ticketflags = true
[realms]
NB.DOMAIN = {
kdc = 192.168.0.10
admin_server = 192.168.0.10
dafault_domain = nb.domain
}
[domain_realm]
.nb.domain = NB.DOMAIN
nb.domain = NB.DOMAIN
[login]
krb4_convert = true
krb4_get_tickets = false
[pam]
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
clock_skew = 300
[logging]
default = FILE:/var/log/krb5.log
[kdc]
profile = /var/lib/kerberos/krb5kdc/kdc.conf
#---------------------------------------
Получаем билет:
kinit domainadmin@NB.DOMAIN
Проверяем наличие билета:
klist
Конфигурируем hosts:
/etc/hosts
#---------------------------------------
192.168.0.10 pdc.nb.domain
#---------------------------------------
Ставим Samba:
apt-get install samba, winbind, smbfs
Конфигурируем Samba:
/etc/samba/smb.conf
#---------------------------------------
[global]
workgroup = NB
netbios name = CLIENT
server string = Client
password server = pdc.nb.domain
realm = NB.DOMAIN
security = ads
local master = no
domain master = no
preferred master = no
os level = 0
socket options = SO_RCVBUF=65535 SO_SNDBUF=65535 TCP_NODELAY
log file = /var/log/samba/log.%m
debug level = 2
max log size = 50
#interfaces = 192.168.0.10/255.255.255.0
#hosts allow = 192.168.0. 127.0.0.1
encrypt passwords = yes
null passwords = no
idmap uid = 10000-20000
idmap gid = 10000-20000
wins proxy = no
wins server = 192.168.0.10
dns proxy = no
auth methods = winbind
winbind uid = 10000-20000
winbind use default domain =yes
winbind enum groups = yes
winbind enum users = yes
winbind gid = 10000-20000
winbind use default domain = yes
name resolve order = hosts wins bcast lmhosts
case sensitive = no
client use spnego = yes
use spnego = yes
client signing = yes
template homedir = /home/%D/%U
template shell = /bin/bash
# Charset settings
display charset = utf-8
unix charset = utf-8
dos charset = cp866
# Use extended attributes to store file modes
store dos attributes = yes
map hidden = yes
map system = yes
map archive = yes
# Use inherited ACLs for directories
nt acl support = yes
inherit acls = yes
map acl inherit = yes
#---------------------------------------
Проверяем конфиг
testparm
Перезапускаем службы:
service samba restart
service winbind restart
Подключаемся к домену
net ads join -S pdc.nb.domain -U domainadmin
Просмотр групп домена
wbinfo -g
Просмотр пользователей домена
wbinfo -u
