Samba Autenticando no Active Directory
### Instale os Pacotes necessários:
# aptitude install samba ntpdate smbclient krb5-config krb5-user libam-krb5 krb5-kdc winbind
- Resolução de Nomes
Edite o arquivo /etc/hosts
127.0.0.1 localhost.localdomain localhost
192.168.1.2 srvwindows.dominio.local windows
192.168.1.3 srvlinux
Faça os teste de ping nos nomes configurados.
- Configuração do DNS
Edite o arquivo /etc/resolv.conf
domain dominio.local
search domínio.local
nameserver 192.168.1.2 # IP do Servidor do Dominio
- Configuração do Kerberos
Edite o arquivo /etc/krb5.conf
# wget https://www.dropbox.com/s/dakxachn6zs8q32/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = DOMINIO.LOCAL
dns_lookup_realm = false
dns_lookup_kdc = true
[realms]
DOMINIO.LOCAL = {
admin_server = srvwindows.dominio.local
default_domain = domínio.local
kdc = 192.168.1.2
}
[domain_realm]
.dominio.local = DOMINIO.LOCAL
domínio.local = DOMINIO.LOCAL
[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf
[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
- Configuração do Samba
Edite o arquivo /etc/samba/smb.conf
# wget https://www.dropbox.com/s/6swcxt56nfu2q8b/smb.conf
[global]
workgroup = DOMINIO
server string = Samba Server
netbios name = srvlinux
realm = DOMNIO.LOCAL
passdb backend = tdbsam
password server = 192.168.1.2
idmap uid = 600-20000
idmap gid = 600-20000
winbind enum users = yes
winbind enum groups = yes
winbind use default domain = yes
winbind nested groups = yes
winbind cache time = 86400
max connections = 0
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
unix charset = iso-8859-1
template shell = /bin/false
template homedir = /dev/null
enhanced browsing = no
log file = /var/log/samba/%m.log
max log size = 1000
syslog = 0
encrypt passwords = true
security = ads
password server = 192.168.1.2
preferred master = no
wins server = srvwindows.dominio.local
dns proxy = no
load printers = no
map to guest = bad user
[geral]
comment = Compartilhamento Geral para todos os usuarios
path = /home/geral
read only = no
browseable = yes
[TI]
path = /home/ti
read only = no
valid users = @DOMNIO\ti #@DOMINIO\grupo
guest ok = no
browseable = yes
force group = ti
- Configurando a Autenticação
Edite o arquivo /etc/nsswitch.conf (modifique somente as linha abaixo, as demais não devem ser apagadas)
# wget https://www.dropbox.com/s/4wnrwkm455lrb4c/nsswitch.conf
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.
passwd: files winbind
group: files winbind
shadow: files winbind
hosts: files dns
networks: files
protocols: files winbind
services: files winbind
ethers: db files
rpc: db files
netgroup: files winbind
automount: files winbind
Adicionando a Máquina ao Domínio
- Restart o Samba e o Winbind:
# /etc/init.d/smb restart
# /etc/init.d/winbind restart
- Acerte a hora o servidor:
ntpdate master.empresa.com.br
- Adicione ao domínio:
# net ads join -U Administrador
:::: Informe a senha do Administrador do AD, o comando deve informar a seguinte saída:
Using Short domain name - EMPRESA
Joined 'ALPHA' to realm 'EMPRESA.COM.BR'
- Use o comando wbinfo para fazer os teste necessários.
# wbinfo –u # Lista os usuários
# Wbinfo –g # Lista os Grupos
# Caso de algum erro na hora de verificar os usuários e grupos do ad reinicie o winbind.
- Edite o arquivo /etc/pam.d/system-auth e deixe-o da seguinte forma:
# wget https://www.dropbox.com/s/risy1ud1k9l0jr0/system-auth
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth sufficient pam_krb5.so use_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_succeed_if.so uid < 500 quiet
account sufficient pam_krb5.so
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password sufficient pam_krb5.so use_authtok
password sufficient pam_winbind.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session optional pam_krb5.so
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
Reinicie a máquina.