Hi again,
Thanks again, Denis, Steve and Rowland for your previous answers about
RFC2307 and winbind.
Maybe I'm an dreamer but here is that I wanted to achieve :
Ubuntu server 12.04.3, samba4 as PDC, several NICS : 1 LAN and 2/3 WANS
Use a windows VM (on this server) to control AD through WRAT
AD offers me the 'wishdom' of software deployment and GPO, users are
can't install anything
All standard Linux services (apache, postfix, dovecot, pptp, mysql,
webmail, ...) can query AD
What is done :
I have setup 'folder redirection' in WRAT, so users 'documents' and
'desktop' are avalaible offline and mapped to home/%U on server
AD Administrator has a roaming profile
Searched a lot and succeed to deploy Office, Acrobat reader, Skype,
7-zip, Firefox to users (windows is another world...)
Shares are mounted (depending on AD 'ou' rights) on user's pc
Administrator can login via UltraVNC to all workstation
What needs to be done:
Linux services to auth to AD
From what I've read, sssd is the more secure solution to achieve this,
but ...
Using sssd 1.11.1 : files configuration:
1)
sudo cat /etc/sssd/sssd.conf
[sssd]
services = nss, pam
config_file_version = 2
domains = radiodjiido.nc
[nss]
[pam]
[domain/radiodjiido.nc]
dyndns_update = false
ad_hostname = serveur.radiodjiido.nc
ad_server = serveur.radiodjiido.nc
ad_domain = radiodjiido.nc
ldap_schema = ad
id_provider = ad
access_provider = simple
enumerate = true
cache_credentials = true
auth_provider = krb5
chpass_provider = krb5
krb5_realm = RADIODJIIDO.NC
krb5_server = serveur.radiodjiido.nc
krb5_kpasswd = serveur.radiodjiido.nc
#next line only lists users with uidNumber/gidNumber entered via ldbedit
ldap_id_mapping = false
ldap_referrals = false
ldap_uri = ldap://serveur.radiodjiido.nc
ldap_search_base = dc=radiodjiido,dc=nc
ldap_user_object_class = user
ldap_user_name = samAccountName
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_home_directory = unixHomeDirectory
ldap_user_shell = loginShell
ldap_group_object_class = group
ldap_group_search_base = dc=radiodjiido,dc=nc
ldap_group_name = cn
ldap_group_member = member
ldap_sasl_mech = gssapi
#ldap_sasl_authid = serveur$
ldap_sasl_authid = serveur$@RADIODJIIDO.NC
krb5_keytab = /etc/krb5.sssd.keytab
ldap_krb5_init_creds = true
cat /usr/local/samba/etc/smb.conf
# Global parameters
[global]
workgroup = RADIODJIIDO
realm = RADIODJIIDO.NC
netbios name = SERVEUR
server role = active directory domain controller
dns forwarder = 192.168.1.1
# for sssd
idmap_ldb:use rfc2307 = yes
[netlogon]
path = /usr/local/samba/var/locks/sysvol/radiodjiido.nc/scripts
read only = No
[sysvol]
path = /usr/local/samba/var/locks/sysvol
read only = No
[Profiles]
path = /media/data/Profiles/
read only = No
[partage]
comment = partage general
path = /media/data/global
read only = No
[home]
comment = dossiers utilisateurs
path = /media/data/homes
read only = No
[journal]
comment = journal
path = /media/data/journal
read only = No
[musique]
comment = musique
path = /media/data/musique
read only = No
cat /etc/nsswitch.conf
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed,
try:
# `info libc "Name Service Switch"' for information about this file.
passwd: compat sss
group: compat sss
shadow: compat
hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis sss
Result with:
getent passwd
mysql:x:113:124:MySQL Server,,,:/nonexistent:/bin/false
nut:x:114:125::/var/lib/nut:/bin/false
nico:*:3000025:100:nico:/:
-> the user I entered uidNumber/gidNumber is listed, home dir seems /
and no shell
Result with:
getent group
rtkit:x:123:
mysql:x:124:
nut:x:125:
-> no AD group listed at all
2) If sssd.conf is modified:
#ldap_id_mapping = false
ldap_schema = rfc2307bis
getent passwd and getent group are listing (nearly all) users and groups
in AD with the infamous random IDs like :
nico-virtual-7$:*:166801125:166800515:NICO-VIRTUAL-7:/:
administrator:*:166800500:166800513:Administrator:/:
So I'm a bit desesperate with the sssd use...
Is an OpenLDAP proxy the best way to make all this working together ?
Thanks in advance for your time.
Nicolas
In case that could help some, here are the steps I've done to install
sssd 1.11.1:
cd ~
wget https://fedorahosted.org/released/sssd/sssd-1.11.1.tar.gz
sudo apt-get install debhelper quilt dh-autoreconf autopoint
lsb-release dpkg-dev dnsutils libpopt-dev libdbus-1-dev
libkeyutils-dev libkeyutils-dev libldap2-dev libpam-dev libnl-dev
libnss3-dev libnspr4-dev libpcre3-dev libselinux1-dev libsasl2-dev
libtevent-dev libldb-dev libtalloc-dev libtdb-dev xml-core
docbook-xsl docbook-xml libxml2-utils xsltproc krb5-config
libkrb5-dev libc-ares-dev python-dev libdhash-dev libcollection-dev
libini-config-dev check dh-apparmor libglib2.0-dev libndr-dev
libndr-standard-dev libsamba-util-dev samba4-dev libdcerpc-dev
build-essential libsemanage1-dev samba4-dev libpam-sss
cyrus-sasl2-heimdal-dbg
-> this installed sssd 1.8.6 with this /etc/sssd/sssd.conf
[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains = radiodjiido.nc
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
[pam]
reconnection_retries = 3
[domain/radiodjiido.nc]
; Using enumerate = true leads to high load and slow response
enumerate = false
cache_credentials = true
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
ldap_uri = ldap://serveur.radiodjiido.nc
ldap_search_base = DC=radiodjiido,DC=nc
ldap_tls_reqcert = demand
ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
krb5_kdcip = serveur.radiodjiido.nc
krb5_realm = RADIODJIIDO.NC
krb5_changepw_principle = kadmin/changepw
krb5_auth_timeout = 15
sudo service sssd stop
tar -xzvf sssd-1.11.1.tar.gz
cd sssd-1.11.1
./configure && make
sudo make install
sudo cp /usr/local/lib/* /lib/x86_64-linux-gnu
sudo rm /lib/x86_64-linux-gnu/*.la
sudo cp /usr/local/lib/security/pam_sss.so /lib/x86_64-linux-gnu/security
sudo rm /usr/lib/x86_64-linux-gnu/ldb/modules/ldb/samba
sudo rm /usr/lib/x86_64-linux-gnu/ldb/modules/ldb/memberof.la
sudo pam-auth-update
sudo /usr/local/samba/bin/samba-tool domain exportkeytab
/etc/krb5.sssd.keytab --principal=serveur$
sudo chown root:root /etc/krb5.sssd.keytab
sudo chmod 600 /etc/krb5.sssd.keytab
sudo nano /usr/local/etc/sssd/sssd.conf
-> see beginning of message for configuration
sudo chmod 600 /usr/local/etc/sssd/sssd.conf
sudo rm /usr/local/var/lib/sss/db/*
sudo cp /usr/local/lib/security/pam_sss.so /lib/x86_64-linux-gnu/security
sudo nano /root/.bashrc
add at end:
PATH="/usr/local/sbin:/usr/local/lib:/usr/local/etc:$PATH"
sudo mv /etc/sssd/sssd.conf /etc/sssd/sssd.conf_dist
sudo ln -s /usr/local/etc/sssd/sssd.conf /etc/sssd/
sudo sssd -i -d3
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
