Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen der Seite angezeigt.
Nächste Überarbeitung | Vorherige Überarbeitung | ||
server_und_serverdienste:openldap_mit_samba_als_pdc_neues_backend [2017/04/01 18:22] – angelegt admin | server_und_serverdienste:openldap_mit_samba_als_pdc_neues_backend [2021/03/04 15:53] (aktuell) – lois | ||
---|---|---|---|
Zeile 1: | Zeile 1: | ||
====== OpenLDAP mit Samba als PDC (neues backend) ====== | ====== OpenLDAP mit Samba als PDC (neues backend) ====== | ||
{{: | {{: | ||
+ | |||
+ | Hauseigenes Apt-Repo: [[https:// | ||
+ | \\ | ||
+ | \\ | ||
===== Grundinformation ===== | ===== Grundinformation ===== | ||
- | __Verwendetes System: Debian 6.0__ | + | __Verwendetes System: Debian 6.0, Debian 9.3 und Ubuntu 16.04.3__ |
+ | |||
+ | **Wichtige INFO:** 12.2017 \\ | ||
+ | Ich hab Freigabeeinstellungen auf Debian 9.3 (Samba Version 4.5.12) und Ubuntu 16.04.3 (Samba Version 4.3.11) getestet. Anscheindend ist die Sambaversion von Ubuntu Schrott. Kopiert schreibend gerade mal mit 35 bis 65MB/s. Bei Debian, gleich Config kopierte ich schreibend mit 115MB/s. Das ganze gilt auf der virtualsierten Ebene von Proxmox. Ubuntu ist als LXC (lokales ZFS) oder Ubuntu mit KVM gleich langsam. Ubuntu auf eine PHY Maschine funktioniert mit den gleichen spezifikationen super schnell. Debian hingeben ist überall supernschell, | ||
+ | |||
+ | Daran sollte man denken. Ich habe Samba und LDAP auf einem Ubuntuserver laufen. Die Freigaben sind aber auf einem Debian. Ist mit LXC ja kein Problem. | ||
Seit Version 2.4 arbeitet [[http:// | Seit Version 2.4 arbeitet [[http:// | ||
Zeile 379: | Zeile 388: | ||
ldapsearch -d -1 -x uid=ml -b dc=darkwolf, | ldapsearch -d -1 -x uid=ml -b dc=darkwolf, | ||
+ | |||
+ | ldapsearch -h ldapserver.local -ZZ -x -D " | ||
+ | |||
+ | ldapsearch -h ldapserver.local -ZZ -x -D " | ||
+ | |||
</ | </ | ||
Zeile 509: | Zeile 523: | ||
===== LDAP mit SAMBA als PDC ===== | ===== LDAP mit SAMBA als PDC ===== | ||
+ | |||
+ | Um die Config von Samba neu einzulesen wird davon abegraten Samba neu zu starten, da das Protokoll sehr lange braucht um wieder vollwertig verfügbar zu sein, immerhin wird das ganze Netzwerk gescannt und der Cache befüllt. Die Config kann man mit folgendem Befehl neu einlesen: '' | ||
+ | |||
Als ersters übergeben wir Samba das LDAPpasswort. Dies wird verschlüsselt in einer Datenbankfile gespeichert. | Als ersters übergeben wir Samba das LDAPpasswort. Dies wird verschlüsselt in einer Datenbankfile gespeichert. | ||
< | < | ||
Zeile 530: | Zeile 547: | ||
/ | / | ||
</ | </ | ||
+ | Damit das nachfolgende Script läuft muss die '' | ||
+ | |||
+ | Beispiel: | ||
+ | <file bash smbldap_bind.conf> | ||
+ | ############################ | ||
+ | # Credential Configuration # | ||
+ | ############################ | ||
+ | # Notes: you can specify two differents configuration if you use a | ||
+ | # master ldap for writing access and a slave ldap server for reading access | ||
+ | # By default, we will use the same DN (so it will work for standard Samba | ||
+ | # release) | ||
+ | # | ||
+ | # | ||
+ | masterDN=" | ||
+ | masterPw=" | ||
+ | </ | ||
+ | <file perl smbldap.conf> | ||
+ | # $Source: $ | ||
+ | # $Id: smbldap.conf, | ||
+ | # | ||
+ | # smbldap-tools.conf : Q & D configuration file for smbldap-tools | ||
+ | |||
+ | # This code was developped by IDEALX (http:// | ||
+ | # contributors (their names can be found in the CONTRIBUTORS file). | ||
+ | # | ||
+ | # | ||
+ | # | ||
+ | # This program is free software; you can redistribute it and/or | ||
+ | # modify it under the terms of the GNU General Public License | ||
+ | # as published by the Free Software Foundation; either version 2 | ||
+ | # of the License, or (at your option) any later version. | ||
+ | # | ||
+ | # This program is distributed in the hope that it will be useful, | ||
+ | # but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
+ | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. | ||
+ | # GNU General Public License for more details. | ||
+ | # | ||
+ | # You should have received a copy of the GNU General Public License | ||
+ | # along with this program; if not, write to the Free Software | ||
+ | # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, | ||
+ | # USA. | ||
+ | |||
+ | # Purpose : | ||
+ | # . be the configuration file for all smbldap-tools scripts | ||
+ | |||
+ | ############################################################################## | ||
+ | # | ||
+ | # General Configuration | ||
+ | # | ||
+ | ############################################################################## | ||
+ | |||
+ | # Put your own SID. To obtain this number do: "net getlocalsid" | ||
+ | # If not defined, parameter is taking from "net getlocalsid" | ||
+ | SID=" | ||
+ | |||
+ | # Domain name the Samba server is in charged. | ||
+ | # If not defined, parameter is taking from smb.conf configuration file | ||
+ | # Ex: sambaDomain=" | ||
+ | sambaDomain=" | ||
+ | |||
+ | ############################################################################## | ||
+ | # | ||
+ | # LDAP Configuration | ||
+ | # | ||
+ | ############################################################################## | ||
+ | |||
+ | # Notes: to use to dual ldap servers backend for Samba, you must patch | ||
+ | # Samba with the dual-head patch from IDEALX. If not using this patch | ||
+ | # just use the same server for slaveLDAP and masterLDAP. | ||
+ | # Those two servers declarations can also be used when you have | ||
+ | # . one master LDAP server where all writing operations must be done | ||
+ | # . one slave LDAP server where all reading operations must be done | ||
+ | # | ||
+ | |||
+ | # Slave LDAP server | ||
+ | # Ex: slaveLDAP=127.0.0.1 | ||
+ | # If not defined, parameter is set to " | ||
+ | # | ||
+ | |||
+ | # Slave LDAP port | ||
+ | # If not defined, parameter is set to " | ||
+ | # | ||
+ | |||
+ | # Master LDAP server: needed for write operations | ||
+ | # Ex: masterLDAP=127.0.0.1 | ||
+ | # If not defined, parameter is set to " | ||
+ | masterLDAP=" | ||
+ | |||
+ | # Master LDAP port | ||
+ | # If not defined, parameter is set to " | ||
+ | masterPort=" | ||
+ | |||
+ | # Use TLS for LDAP | ||
+ | # If set to 1, this option will use start_tls for connection | ||
+ | # (you should also used the port 389) | ||
+ | # If not defined, parameter is set to " | ||
+ | ldapTLS=" | ||
+ | |||
+ | # How to verify the server' | ||
+ | # see "man Net:: | ||
+ | # | ||
+ | |||
+ | # CA certificate | ||
+ | # see "man Net:: | ||
+ | # | ||
+ | |||
+ | # certificate to use to connect to the ldap server | ||
+ | # see "man Net:: | ||
+ | # | ||
+ | |||
+ | # key certificate to use to connect to the ldap server | ||
+ | # see "man Net:: | ||
+ | # | ||
+ | |||
+ | # LDAP Suffix | ||
+ | # Ex: suffix=dc=IDEALX, | ||
+ | suffix=" | ||
+ | |||
+ | # Where are stored Users | ||
+ | # Ex: usersdn=" | ||
+ | # Warning: if ' | ||
+ | usersdn=" | ||
+ | |||
+ | # Where are stored Computers | ||
+ | # Ex: computersdn=" | ||
+ | # Warning: if ' | ||
+ | computersdn=" | ||
+ | |||
+ | # Where are stored Groups | ||
+ | # Ex: groupsdn=" | ||
+ | # Warning: if ' | ||
+ | groupsdn=" | ||
+ | |||
+ | # Where are stored Idmap entries (used if samba is a domain member server) | ||
+ | # Ex: groupsdn=" | ||
+ | # Warning: if ' | ||
+ | idmapdn=" | ||
+ | |||
+ | # Where to store next uidNumber and gidNumber available for new users and groups | ||
+ | # If not defined, entries are stored in sambaDomainName object. | ||
+ | # Ex: sambaUnixIdPooldn=" | ||
+ | # Ex: sambaUnixIdPooldn=" | ||
+ | sambaUnixIdPooldn=" | ||
+ | |||
+ | # Default scope Used | ||
+ | scope=" | ||
+ | |||
+ | # Unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA, CLEARTEXT) | ||
+ | hash_encrypt=" | ||
+ | |||
+ | # if hash_encrypt is set to CRYPT, you may set a salt format. | ||
+ | # default is " | ||
+ | # passwords if you use " | ||
+ | crypt_salt_format=" | ||
+ | |||
+ | ############################################################################## | ||
+ | # | ||
+ | # Unix Accounts Configuration | ||
+ | # | ||
+ | ############################################################################## | ||
+ | |||
+ | # Login defs | ||
+ | # Default Login Shell | ||
+ | # Ex: userLoginShell="/ | ||
+ | userLoginShell="/ | ||
+ | |||
+ | # Home directory | ||
+ | # Ex: userHome="/ | ||
+ | userHome="/ | ||
+ | |||
+ | # Default mode used for user homeDirectory | ||
+ | userHomeDirectoryMode=" | ||
+ | |||
+ | # Gecos | ||
+ | userGecos=" | ||
+ | |||
+ | # Default User (POSIX and Samba) GID | ||
+ | defaultUserGid=" | ||
+ | |||
+ | # Default Computer (Samba) GID | ||
+ | defaultComputerGid=" | ||
+ | |||
+ | # Skel dir | ||
+ | skeletonDir="/ | ||
+ | |||
+ | # Default password validation time (time in days) Comment the next line if | ||
+ | # you don't want password to be enable for defaultMaxPasswordAge days (be | ||
+ | # careful to the sambaPwdMustChange attribute' | ||
+ | defaultMaxPasswordAge=" | ||
+ | |||
+ | ############################################################################## | ||
+ | # | ||
+ | # SAMBA Configuration | ||
+ | # | ||
+ | ############################################################################## | ||
+ | |||
+ | # The UNC path to home drives location (%U username substitution) | ||
+ | # Just set it to a null string if you want to use the smb.conf 'logon home' | ||
+ | # directive and/or disable roaming profiles | ||
+ | # Ex: userSmbHome=" | ||
+ | userSmbHome=" | ||
+ | |||
+ | # The UNC path to profiles locations (%U username substitution) | ||
+ | # Just set it to a null string if you want to use the smb.conf 'logon path' | ||
+ | # directive and/or disable roaming profiles | ||
+ | # Ex: userProfile=" | ||
+ | userProfile=" | ||
+ | |||
+ | # The default Home Drive Letter mapping | ||
+ | # (will be automatically mapped at logon time if home directory exist) | ||
+ | # Ex: userHomeDrive=" | ||
+ | userHomeDrive=" | ||
+ | |||
+ | # The default user netlogon script name (%U username substitution) | ||
+ | # if not used, will be automatically username.cmd | ||
+ | # make sure script file is edited under dos | ||
+ | # Ex: userScript=" | ||
+ | userScript=" | ||
+ | |||
+ | # Domain appended to the users " | ||
+ | # when smbldap-useradd -M is used | ||
+ | # Ex: mailDomain=" | ||
+ | # | ||
+ | |||
+ | ############################################################################## | ||
+ | # | ||
+ | # SMBLDAP-TOOLS Configuration (default are ok for a RedHat) | ||
+ | # | ||
+ | ############################################################################## | ||
+ | |||
+ | # Allows not to use smbpasswd (if with_smbpasswd == 0 in smbldap_conf.pm) but | ||
+ | # prefer Crypt:: | ||
+ | with_smbpasswd=" | ||
+ | smbpasswd="/ | ||
+ | |||
+ | # Allows not to use slappasswd (if with_slappasswd == 0 in smbldap_conf.pm) | ||
+ | # but prefer Crypt:: libraries | ||
+ | with_slappasswd=" | ||
+ | slappasswd="/ | ||
+ | |||
+ | # comment out the following line to get rid of the default banner | ||
+ | # no_banner=" | ||
+ | |||
+ | </ | ||
+ | <file bash smb.conf> | ||
+ | [global] | ||
+ | |||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | load printers = no | ||
+ | |||
+ | log level = 1 | ||
+ | log file = / | ||
+ | max log size = 50 | ||
+ | |||
+ | | ||
+ | |||
+ | ldap admin dn = cn=admin, | ||
+ | ldap passwd sync = yes | ||
+ | ldap machine suffix = ou=machines, | ||
+ | ldap User suffix = ou=users, | ||
+ | ldap Group Suffix = ou=windowsusergroups, | ||
+ | ldap suffix = dc=darkwolf, | ||
+ | ldap ssl = off | ||
+ | |||
+ | tls enabled | ||
+ | idmap config * : range = 10000-40000 | ||
+ | |||
+ | add user script = / | ||
+ | add machine script = / | ||
+ | |||
+ | add group script = / | ||
+ | add user to group script = / | ||
+ | | ||
+ | set primary group script = / | ||
+ | | ||
+ | | ||
+ | |||
+ | |||
+ | local master = yes | ||
+ | os level = 200 | ||
+ | | ||
+ | | ||
+ | | ||
+ | wins support = yes | ||
+ | dns proxy = no | ||
+ | |||
+ | logon path = \\%N\profiles\%U | ||
+ | |||
+ | # | ||
+ | [netlogon] | ||
+ | | ||
+ | path = / | ||
+ | guest ok = yes | ||
+ | | ||
+ | write list = root | ||
+ | |||
+ | |||
+ | [profiles] | ||
+ | path = / | ||
+ | | ||
+ | | ||
+ | read only = No | ||
+ | force create mode = 0600 | ||
+ | force directory mode = 0700 | ||
+ | csc policy = disable | ||
+ | store dos attributes = yes | ||
+ | vfs objects = acl_xattr | ||
+ | |||
+ | |||
+ | [homes] | ||
+ | path = /home/%U | ||
+ | | ||
+ | valid users = %S | ||
+ | read only = no | ||
+ | | ||
+ | | ||
+ | |||
+ | [public] | ||
+ | | ||
+ | path = / | ||
+ | | ||
+ | | ||
+ | | ||
+ | write list = @ldapbenutzer | ||
+ | |||
+ | |||
+ | [printers] | ||
+ | | ||
+ | | ||
+ | path = / | ||
+ | | ||
+ | guest ok = no | ||
+ | read only = yes | ||
+ | | ||
+ | |||
+ | [print$] | ||
+ | | ||
+ | path = / | ||
+ | | ||
+ | read only = yes | ||
+ | guest ok = no | ||
+ | </ | ||
< | < | ||
smbldap-populate | smbldap-populate | ||
Zeile 541: | Zeile 906: | ||
</ | </ | ||
+ | ==== Sambadomäne mit Linuxclient beitreten ==== | ||
+ | Vorausetztung ist natürlich das der Client bereits am LDAP-Server hängt. Für die Anbindung an die Sambadomäne muss man Samba installieren und konfigurieren. Hier eine Minimalconfig mit 2 Freigaben. | ||
+ | <file bash smb.conf> | ||
+ | [global] | ||
+ | | ||
+ | | ||
+ | dns proxy = no | ||
+ | | ||
+ | log file = / | ||
+ | max log size = 1000 | ||
+ | panic action = / | ||
+ | | ||
+ | | ||
+ | obey pam restrictions = yes | ||
+ | unix password sync = yes | ||
+ | | ||
+ | | ||
+ | pam password change = yes | ||
+ | map to guest = bad user | ||
+ | | ||
+ | # | ||
+ | |||
+ | [homes] | ||
+ | path = /home/%U | ||
+ | | ||
+ | valid users = %S | ||
+ | read only = no | ||
+ | | ||
+ | | ||
+ | |||
+ | [public] | ||
+ | | ||
+ | path = / | ||
+ | | ||
+ | | ||
+ | | ||
+ | write list = @ldapbenutzer | ||
+ | </ | ||
+ | Lokalen Rootgenutzer zu Samba hinzufügen. Kann man, muss man aber unter normalen Umständen nicht. | ||
+ | < | ||
+ | smbpasswd -a root | ||
+ | </ | ||
+ | Beitreten einer Domäne: | ||
+ | < | ||
+ | net rpc join | ||
+ | </ | ||
+ | Danach kann das ganze noch überprüfen: | ||
+ | < | ||
+ | net rpc info | ||
+ | net getdomainsid | ||
+ | smbclient -L /localhost | ||
+ | </ |