Samba3.0(PDC)與Ldap整合運用

由Samba3.0模擬成NT4.0成為PDC(Primary Domain Controller),使windows Client端(Windows NT4,Win2000 server,Winxp,windows 2003server等)及Linux Client加入PDC,再藉由LDAP整合使用者帳號,電腦帳號及使用者密碼來達到(SSO:Single Sign On)單一簽入認證功能。

LAB架構圖

*本實驗先關閉SELinux及防火牆。

建置作業平台及需安裝套件

CentOS6
LDAP2.4.x
Samba3.0

修改LDAP設定檔(Slapd.conf)

安裝LDAP Server及新增人員名錄相關建立說明可以看Ldap2.4.x ON Centos6.0
安裝LDAP Client及修改設定檔相關建立說明可以看Ldap2.4.x ON Centos6.0
從Samba套件中複製Samba Schema(綱要)到LDAP存放綱要的目錄(/etc/openldap/schema)
```
cp -p /usr/share/doc/samba-3.5.10/LDAP/samba.schema /etc/openldap/schema/
```

修改slapd.conf設定檔。主要是加入samba綱要及一些samba參數

~略
include         /etc/openldap/schema/samba.schema //在include區段最後一行加入此行
index sambaSID,sambaSIDList,sambaGroupType    eq,pres //在index區端最後一行加入此行(主要是建立samba在ldap索引)
access to dn.subtree="dc=example,dc=com" attrs=userPassword,sambaLMPassword,sambaNTPassword //在ACL 區段加入sambaLMPassword,sambaNTPassword

重建Ldap綱要及重啟Ldap server

#rm -rf /etc/openldap/slapd.d/*
slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
chown -R ldap:ldap /etc/openldap/slapd.d
#/etc/init.d/slapd restart

Samba(PDC)建立及整合帳號(電腦名稱帳號及使用者)

在建立samba(PDC)之前,先完成LDAP Client的套件安裝及設定。

LDAP Client安裝

#yum install openldap nss-pam-ldapd openldap-clients pam_ldap

LDAP Client要修改設定檔很多,主要有/etc/nsswitch.conf,/etc/pam_ldap.conf,/etc/pam.d/system-auth,/etc/nslcd.conf。詳細設定可以參考為Client端建置LDAP Client及加入LDAP Server網域
另外一種方法用setup指令
```
#setup
```

測試是否抓取Ldap Server帳戶資訊

#getent passwd
~略
andy:x:500:500:andy:/home/andy:/bin/bash
utest1:x:501:501:utest1:/home/utest1:/bin/bash
utest2:x:502:502:utest2:/home/utest2:/bin/bash
utest4:x:503:503:utest4:/home/utest4:/bin/bash
utest5:x:504:504:utest5:/home/utest5:/bin/bash
utest6:x:505:505:utest6:/home/utest6:/bin/bash
utest7:x:506:506:utest7:/home/utest7:/bin/bash
utest8:x:507:507:utest8:/home/utest8:/bin/bash
~略

修改 Samba 設定檔 smb.conf

[global]
        server string = Samba Server Version %v
        workgroup = example   #設定Domain Name(PDC部份)
        netbios name = test1  #設定電腦名稱(PDC部份)
        ldap passwd sync = yes #系統使用者密碼與 Samba 使用者密碼(ldap部份)
        Dos charset = CP950
        Unix charset = UTF-8
        //底下則是設定能否利用 PDC 登入，且登入需要進行哪些動作：
        domain logons = yes  
        logon drive   = K:      #登入後家目錄掛載成 Windows 哪一槽(PDC部份)
        logon home = \\%N\%U    #使用者的家目錄位置(PDC部份)
        logon path = \\%N\%U\profiles  #使用者的個人化設定 (PDC部份)
        time server   = yes      #自動調整 Windows 時間與 Samba 同步(PDC部份)
        admin users   = root    #預設的管理員帳號！預設為 root(PDC部份)
        
        
        passdb backend = ldapsam:ldap://192.168.0.76   #由lLdap Server 驗證使用者帳號及密碼(ldap部份)
        ldap admin dn = cn=Manager,dc=example,dc=com  #Samba服務連接LDAP 時所使用的 DN(ldap部份)
        ldap suffix = dc=example,dc=com  //Samba查尋 LDAP 時的尾碼(ldap部份)
        ldap group suffix = ou=groups   #Samba 查尋 LDAP 使用者的 OU(ldap部份)
        ldap user suffix = ou=people    #Samba 查尋 LDAP 群組的 OU(ldap部份)

        # logs split per machine
        log file = /var/log/samba/log.%m
        # max 50KB per log file, then rotate
        max log size = 50
        security = user

        ldap ssl = no #ldap通訊不用ssl(ldap部份)
        load printers = No #沒有要做印表機伺服器
        # 底下幾個設定值處理成為本區域網路內的主要名稱解析器(ldap部份)
        preferred master = yes
        domain master    = yes
        local master     = yes
        wins support     = yes
     
        os level      = 100 #作業系統 (OS) 等級越高才能成為主網域的控制者,但不可超過 255(PDC部份)
     #使用者登入網域的加目錄(PDC部份)
     [homes]
     comment   = Home Directories
     path          = /home/%U
     browsable = no
     read only   = no
     valid users = %S
     #這個在指定登入者能夠進行的工作,裡面主要是具有許多執行程式,與前面的 logon script 有關，該程式放置在這裡(PDC部份)
     [netlogon]
     path            = /home/sambPDC/netlogon/
     browseable = No
     read only     = yes
     guest ok      = yes

測試設定檔是否正確,正確後並啟動samba

# testparm
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[homes]"
Processing section "[netlogon]"
Loaded services file OK.
Server role: ROLE_DOMAIN_PDC  //ROLE_DOMAIN_PDC有顯示此字,表示PDC設定無誤
Press enter to see a dump of your service definitions
#/etc/init.d/smb start
#/etc/init.d/nmb start

建立網域登入時,分享的目錄及執行的批次檔

#mkdir -p /home/sambaPDC22/netlogon

#cat /home/sambaPDC/netlogon/logon.bat
net time \\home /set /yes
net use K: \\test1\homes

轉成DOS格式的斷行

#unix2dos  /home/sambaPDC/netlogon/logon.bat
unix2dos: converting file /home/sambaPDC/netlogon/logon.bat to DOS format ...

整合帳號(電腦名稱帳號及使用者)到LDAP Server

將LDAP管理者(cn=Manager,dc=example,dc=com)的密碼存入 Samba secrets.tdb內

#smbpasswd -w secret(鍵入當初LDAP Server建立Manager的密碼 )
Setting stored password for "cn=Manager,dc=example,dc=com" in secrets.tdb

將SambaAccount root加入LDAP Server目錄資料庫中(只有root權限才可以將電腦帳號加入網域)

#smbpasswd -a root

可以在Samba Server或LDAP Server裡,用ldapsearch測試(表示root帳戶已寫入Ldap 資料庫)

# ldapsearch -x -b "uid=root,ou=people,dc=example,dc=com"
# extended LDIF
#
# LDAPv3
# base <uid=root,ou=people,dc=example,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# root, people, example.com
dn: uid=root,ou=people,dc=example,dc=com
uid: root
sambaSID: S-1-5-21-1509746186-2792219885-2583361272-1003
displayName: root
objectClass: sambaSamAccount
objectClass: account
sambaPasswordHistory: 00000000000000000000000000000000000000000000000000000000
 00000000
sambaAcctFlags: [U          ]
sambaPwdLastSet: 1351319290
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1

將使用者帳戶加入Ldap Server資料庫中

#smbpasswd -a utest6 
New SMB password:
Retype new SMB password:
Added user utest6.

用ldapsearch測試

#ldapsearch -x -b "uid=root,ou=people,dc=example,dc=com"
~略~
dn: uid=root,ou=people,dc=example,dc=com
uid: root
sambaSID: S-1-5-21-1509746186-2792219885-2583361272-1003
displayName: root
objectClass: sambaSamAccount
objectClass: account
sambaPasswordHistory: 00000000000000000000000000000000000000000000000000000000
 00000000
sambaAcctFlags: [U          ]
sambaPwdLastSet: 1351319290
~略~

到Ldap Server先新增一個組織單位ou=Computer,再為此組織建立電腦帳戶

#vim computer.ldif
dn: ou=Computer,dc=example,dc=com
ou: Computer
objectClass: top
objectClass: organizationalUnit

#ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f computer.ldif
此時要輸入Ldap Server管理者(Manager)的密碼

#vim memberComputer.ldif
dn: uid=win2003$,ou=Computer,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: win2003$
sn: win2003$
givenName: win2003$
cn: win2003$
displayName: win2003$
uidNumber: 1000
gidNumber: 1000
gecos: win2003$
loginShell: /sbin/nologin
homeDirectory: /dev/null
shadowExpire: -1
shadowFlag: 0
shadowWarning: 7
shadowMin: 0
shadowMax: 99999
shadowLastChange: 15453

#ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f memberComputer.ldif

再回到samba server中,用getent測試有無找到剛新增的win2003$

#getent passwd
~略~
utest5:x:504:504:utest5:/home/utest5:/bin/bash
utest6:x:505:505:utest6:/home/utest6:/bin/bash
utest7:x:506:506:utest7:/home/utest7:/bin/bash
utest8:x:507:507:utest8:/home/utest8:/bin/bash
win2003$:x:1000:1000:win2003$:/dev/null:/sbin/nologin

將win2003$電腦帳戶加入Ldap Server資料庫並信任win2003$

#smbpasswd -m -a win2003$

測試檢查

ldapsearch -x -b "uid=win2003$,ou=Computer,dc=example,dc=com"
~略~
 win2003$, Computer, example.com
dn: uid=win2003$,ou=Computer,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
objectClass: sambaSamAccount
uid: win2003$
sn: win2003$
givenName: win2003$
cn: win2003$
displayName: win2003$
uidNumber: 1000
gidNumber: 1000
gecos: win2003$
loginShell: /sbin/nologin
homeDirectory: /dev/null
shadowExpire: -1
shadowFlag: 0
shadowWarning: 7
shadowMin: 0
shadowMax: 99999
shadowLastChange: 15453
sambaSID: S-1-5-21-1509746186-2792219885-2583361272-1004
sambaAcctFlags: [W          ]
sambaPwdLastSet: 1351693785
~略~