Настройка связки openldap и samba

Для начала включим поддержку acl. Нужно для того, чтобы на расшаренных дисках наследовались права windows. Для этого в fstab добавить надо один параметр - acl:

/dev/md0	/home	ext3	defaults,acl	1 2

include		/etc/openldap/schema/core.schema
include		/etc/openldap/schema/cosine.schema
include		/etc/openldap/schema/inetorgperson.schema
include		/etc/openldap/schema/nis.schema
include		/etc/openldap/schema/samba.schema			//добавлена строка

allow bind_v2

pidfile		/var/run/openldap/slapd.pid
argsfile	/var/run/openldap/slapd.args

access to attrs=userPassword,sambaNTPassword,sambaLMPassword,sambaPwdLastSet,sambaPwdMustChange //добавлены параметры
	by dn="cn=root,dc=corp" write
	by self write
	by anonymous auth
	by * none
access to *
	by dn="cn=root,dc=corp" write
	by * read

loglevel	256

database	bdb
suffix		"dc=corp"
rootdn		"cn=root,dc=corp"

rootpw	{SSHA}s9I8oj/q+vBhpzff/xORexVWcZTV1ri1		//результат работы команды slappasswd

directory	/var/lib/ldap

index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub
index sambaSID				eq				//добавлена строка
index sambaPrimaryGroupSID		eq				//добавлена строка
index sambaDomainName			eq				//добавлена строка
index default				sub

[root@server]# slappasswd

BASE dc=corp
URI ldap://127.0.0.1/

base dc=corp
uri ldap://127.0.0.1/

[root@server]# chown ldap:ldap /var/lib/ldap/DB_CONFIG
[root@server]# chmod 600 /var/lib/ldap/DB_CONFIG

dn: dc=corp
objectClass: dcObject
objectClass: organization
o: kontora
dc: corp

dn: cn=root,dc=corp
objectClass: organizationalRole
cn: root

[root@server]# slapadd -l /etc/openldap/start.ldif

[root@server]# chown -R ldap:ldap /var/lib/ldap
[root@server]# chmod 600 /var/lib/ldap/*

[global]
	workgroup = CORP
	netbios name = PDC-SRV
	security = user
	enable privileges = yes
	server string = Server linux
	encrypt passwords = Yes
	unix password sync = yes
	ldap passwd sync = yes
	passwd program = /usr/sbin/smbldap-passwd -u "%u"
	passwd chat = "Changing *\nNew password*" %n\n "*Retype new password*" %n\n"

	ldap ssl = off
	acl map full control = True
	acl compatibility = auto
	map acl inherit = Yes
	nt acl support = Yes
	acl group control = Yes
	nt status support = Yes
	log level = 3
	syslog = 0
	log file = /var/log/samba/log.user%U
	max log size = 100000
	time server = Yes
	socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 SO_KEEPALIVE
	mangling method = hash2
	Dos charset = cp866
	Unix charset = utf8
	display charset = utf8

	logon script = logon.bat
	logon drive = H:
        logon home = \\PDC-SRV\public
        logon path = 

	domain logons = Yes
	domain master = Yes
	os level = 65
	preferred master = Yes
	wins support = yes
	passdb backend = ldapsam:ldap://127.0.0.1/
	ldap admin dn = cn=root,dc=corp
	ldap suffix = dc=corp
        ldap group suffix = ou=Groups
        ldap user suffix = ou=Users
	ldap machine suffix = ou=Users
	ldap idmap suffix = ou=Idmap
        add user script = /usr/sbin/smbldap-useradd -m "%u"
        delete user script = /usr/sbin/smbldap-userdel "%u"
        add machine script = /usr/sbin/smbldap-useradd -t 0 -w "%u"
        add group script = /usr/sbin/smbldap-groupadd -p "%g" 
        add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
        delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
	set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'

	load printers = Yes
	create mask = 0640
	directory mask = 0750
	printing = cups
	printcap name = cups
	deadtime = 10
	guest account = nobody
	map to guest = Bad User
	dont descend = /proc,/dev,/etc,/lib,/lost+found,/initrd
	preserve case = yes
	short preserve case = yes
	case sensitive = no

[homes]
	comment = Home Directories
	browseable = no
	writable = yes
	msdfs root = Yes

[netlogon]
	path = /home/netlogon/
	browseable = No
	read only = yes
	root preexec = /opt/start %m %M %u %U %T	//об этом чуть ниже...
	root postexec = /opt/stop %m %M %u %U %T

[public]
	path = /home/public
	guest ok = yes
	browseable = Yes
	writable = yes
	create mask = 0660
	directory mask = 0770

[root@server]# testparm

#!/bin/sh
#start
a1=$1
a2=$2
a3=$3
a4=$4
a5=$5
name=`date '+%y-%m'`
echo "in $a1 $a2 $a3 $a4 $a5 `date`" >> /var/log/samba/$name-logs.log

#!/bin/sh
#stop
a1=$1
a2=$2
a3=$3
a4=$4
a5=$5
name=`date '+%y-%m'`
echo "out $a1 $a2 $a3 $a4 $a5 `date`" >> /var/log/samba/$name-logs.log

[root@server]# net getlocalsid

slaveDN="cn=root,dc=corp"
slavePw="Ваш пароль"
masterDN="cn=root,dc=corp"
masterPw="Ваш пароль"

[root@server]# chmod 644 /etc/smbldap-tools/smbldap.conf
[root@server]# chmod 600 /etc/smbldap-tools/smbldap_bind.conf

[root@server]# smbpasswd -W

[root@server]# smbldap-populate

passwd:     files ldap
shadow:     files ldap
group:      files ldap

auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_ldap.so use_first_pass			//изменения
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so	//изменения
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
password    sufficient    pam_ldap.so use_authtok			//изменения
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     optional      pam_mkhomedir.so				//изменения
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_ldap.so					//изменения

[root@server]# net groupmap list

Domain Admins (S-1-5-21-2067875449-1876125111-693129624-512) -> Domain Admins
Domain Users (S-1-5-21-2067875449-1876125111-693129624-513) -> users
Domain Guests (S-1-5-21-2067875449-1876125111-693129624-514) -> Domain Guests
Domain Computers (S-1-5-21-2067875449-1876125111-693129624-515) -> Domain Computers
Administrators (S-1-5-32-544) -> Administrators
Account Operators (S-1-5-32-548) -> Account Operators
Print Operators (S-1-5-32-550) -> Print Operators
Backup Operators (S-1-5-32-551) -> Backup Operators
Replicators (S-1-5-32-552) -> Replicators

[root@server]# net rpc join -S PDC-SRV -U root

Теперь нужны удобные утилиты для управлением домена. Скачиваем с сайта Microsoft Windows Server 2003 Resource Kit Tools. Набор средств Windows Server 2003 Resource Kit Tools включает в себя набор инструментов для администраторов, разработчиков и опытных пользователей для управления службой Active Directory, групповыми политиками, сетями TCP/IP, реестрами, безопасностью, масштабируемостью и множеством других областей операционной системы Windows Server 2003.