Ooh nee nog een samba3 PDC HOWTO...
Nou een aantal van de pdc howto's op GoT waren op dusdanig niveau dat ik het niet kon laten.
Hier is mijn samba3 PDC HOWTO voor office gebruik (SuSE GNU/linux)
Download/install packeges
Download and install the samba3 packages for SuSE at:
ftp.suse.com /pub/projects/samba/3.0
start the samba (smb) and nmb server
Configure your smb.conf
example
edit for your situation (check file/program/vars locations)
Check your smb.conf
restart both smb and nmb demons
Create groups/users with your favorite tool (eg. YAST)
create group for the Domain Admin user(s) eg. ntadmins
create custom group(s) eg. organisationname
map unix groups to nt groups (users -> (Domain Users) and ntadmins -> (Domain Admins), etc)
check config
create linux and smb root/admin user
create admin users with ntadmin group gid (default group)
eg. user: admin with default group: ntadmin (wich is mapped to Domain admin)
create root entry in your smbpasswd database (smbpasswd/tdbsam) needed to add machines to join domain. (use differend pwd for securtry reasons)
to convert your smbpasswd file to and tdbsam backend execute
edit yout smbusers (map to unix users)
Make directory for the location of the login script and create directory for the roaming profiles (eg. /home/profiles/.winprofile)
Create logon script
users.bat (/var/lib/samba/netlogon/scripts/users.bat)
Add windows box to the domain
First excecute a registry hack (winxp) click
Its windows so reboot..
Network settings
Check your tcp/ip settings!
if you are using wins support add the serverip to the wins server list
Join domain
When the loginbox pops up login with the user root and its pwd
If sucseeded reboot again
login with your admin user (Domain Admin) for creating users and group (srvtools)
login with a normal user for normal operation
Windows/samba network management
download nt4 domain management tool (srvtools)
login as your domain admin users install the tool (srvtools.exe), now you can create/assign users and groups
Toelichting...
Met het bovenstaande voorbeeld heb je bij een succesvolle afronding een domein. een domein admin user, en een aanmelding procedure met roaming profiles en beheer functionalitied doormiddlen van de srvtools (server en user management).
todo
policies
note
for SuSE 9.1 find an older version of the gpasswd program. Since 9.1 gpasswd can only be used tot changen a group password. So 9.1 users edit your delete user from group scripts, download and point it to an older version op gpasswd (eg /var/lib/samba/bin/gpasswd
References
The Official Samba-3 HOWTO and Reference Guide
man smb.conf
Nou een aantal van de pdc howto's op GoT waren op dusdanig niveau dat ik het niet kon laten.
Hier is mijn samba3 PDC HOWTO voor office gebruik (SuSE GNU/linux)
Download/install packeges
Download and install the samba3 packages for SuSE at:
ftp.suse.com /pub/projects/samba/3.0
code:
1
| rpm -Uvh package.rpm |
start the samba (smb) and nmb server
code:
1
2
| rcsmb start|restart rcnmb start|restart |
Configure your smb.conf
example
edit for your situation (check file/program/vars locations)
code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
| [global]
; Global settings...
workgroup = DOMAIN
netbios name = SERVERNAME
server string = on %L
log file = /var/log/samba.log
log level = 2
; Domain settings...
domain logons = yes
os level = 65
preferred master = yes
domain master = yes
wins support = yes
; Authoristation settings...
; passdb backend = smbpasswd
passdb backend = tdbsam
encrypt passwords = yes
unix password sync = Yes
passwd program = /usr/bin/passwd %u
passwd chat = *New*password* %n\n *Retype*new*password* %n\n \
*password:*all*authentication*tokens*updated*successfully
Pam password change = yes
username map = /etc/samba/smbusers
add user script = /usr/sbin/useradd -m %u -c "domain users" -g users
delete user script = /usr/sbin/userdel -r %u
add group script = /usr/sbin/groupadd %g
set primary group script = /usr/sbin/usermod -g %g %u
delete group script = /usr/sbin/groupdel %g
add user to group script = /usr/sbin/usermod -G %g %u
delete user from group script = /var/lib/samba/bin/gpasswd -d %u %g
add machine script = /usr/sbin/useradd -r -c "machineaccount" -g machines -s /bin/false \
-d /var/tmp/ %u
; template homedir = /home/%D/%U
logon script = scripts\%g.bat
logon path = \\%L\profiles\%U
logon drive = H:
logon home = \\%L\%U
; Security settings...
bind interfaces only = yes
interfaces = 10.1.0.15/24
hosts allow = 10.1.0.0/24 127.0.0.1
; hosts deny =
max connections = 10
security = user
; security = domain
null passwords = no
guest account = nobody
map to guest = Bad User
admin users = admin
; invalid users =
; File settings
hide dot files = yes
hide unreadable = yes
hide files = /desktop.ini/
; max disk size = 1000
; Other...
time server = yes
idmap uid = 15000-20000
idmap gid = 15000-20000
; Printing settings...
printing = cups
printcap name = cups
printcap cache time = 750
cups options = raw
printer admin = username
; Default Shares...
[homes]
comment = Home Directories
valid users = %S
read only = No
browseable = No
inherit permissions = yes
hide dot files = yes
; veto files =
[profiles]
comment = Roaming Profile Share
path = /home/profiles/.winprofiles
read only = No
profile acls = yes
browseable = No
[netlogon]
comment = Network Logon Service
path = /var/lib/samba/netlogon
max connections = 15
; admin users = admin
invalid users = root
guest ok = no
browseable = no
[users]
comment = All users
path = /home
read only = no
inherit permissions = yes
veto files = /aquota.user/groups/shares/
valid users = username
[pdf]
comment = PDF creator
path = /var/tmp
printable = Yes
print command = /usr/bin/smbprngenpdf -J '%J' -c %c -s %s -u '%u' -z %z
create mask = 0600
[printers]
comment = All Printers
path = /var/tmp
printable = Yes
create mask = 0600
browseable = Yes
[print$]
comment = Printer Drivers
path = /var/lib/samba/drivers
write list = @ntadmin root
force group = ntadmin
create mask = 0664
directory mask = 0775
; Organisation shares...
[documents]
comment = Users Data
browseable = yes
read only = no
create mode = 0775
directory mask = 0775
force create mode = 0775
force directory mode = 0775
path = /files/data
users = @groupname
[software]
comment = Software
browseable = yes
read only = yes
path = /files/software
valid users = @groupname
[root]
comment = Servers root
browseable = no
read only = no
create mode = 0664
directory mask = 0775
path = /
valid users = username |
Check your smb.conf
code:
1
| testparm |
restart both smb and nmb demons
code:
1
2
| rcsmb restart rcnmb restart |
Create groups/users with your favorite tool (eg. YAST)
create group for the Domain Admin user(s) eg. ntadmins
create custom group(s) eg. organisationname
map unix groups to nt groups (users -> (Domain Users) and ntadmins -> (Domain Admins), etc)
code:
1
2
3
4
| net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmins net groupmap modify ntgroup="Domain Users" unixgroup=users net groupmap modify ntgroup="Domain Guests" unixgroup=nobody net groupmap add ntgroup="organisationname" unixgroup=organistationname |
check config
code:
1
| net groupmap list |
create linux and smb root/admin user
create admin users with ntadmin group gid (default group)
eg. user: admin with default group: ntadmin (wich is mapped to Domain admin)
create root entry in your smbpasswd database (smbpasswd/tdbsam) needed to add machines to join domain. (use differend pwd for securtry reasons)
code:
1
| smbpasswd -a root or pdbedit -a -u root |
to convert your smbpasswd file to and tdbsam backend execute
code:
1
| pdbedit -i smbpasswd -e tdbsam |
edit yout smbusers (map to unix users)
code:
1
2
| root = administrator nobody = guest pcguest smbguest |
Make directory for the location of the login script and create directory for the roaming profiles (eg. /home/profiles/.winprofile)
code:
1
2
| mkdir -p /var/lib/samba/netlogon/scripts mkdir -p /home/profiles/.winprofile (be sure it's writeable for the Domain User group (users(linuxgroup)) |
Create logon script
users.bat (/var/lib/samba/netlogon/scripts/users.bat)
code:
1
2
3
| echo Mapping Network Drives to Server... net use f: \\netbiosname\documents net time \\netbiosname /SET /YES |
Add windows box to the domain
First excecute a registry hack (winxp) click
Its windows so reboot..
Network settings
Check your tcp/ip settings!
if you are using wins support add the serverip to the wins server list
Join domain
When the loginbox pops up login with the user root and its pwd
If sucseeded reboot again
login with your admin user (Domain Admin) for creating users and group (srvtools)
login with a normal user for normal operation
Windows/samba network management
download nt4 domain management tool (srvtools)
login as your domain admin users install the tool (srvtools.exe), now you can create/assign users and groups
Toelichting...
Met het bovenstaande voorbeeld heb je bij een succesvolle afronding een domein. een domein admin user, en een aanmelding procedure met roaming profiles en beheer functionalitied doormiddlen van de srvtools (server en user management).
todo
policies
note
for SuSE 9.1 find an older version of the gpasswd program. Since 9.1 gpasswd can only be used tot changen a group password. So 9.1 users edit your delete user from group scripts, download and point it to an older version op gpasswd (eg /var/lib/samba/bin/gpasswd
References
The Official Samba-3 HOWTO and Reference Guide
man smb.conf
[ Voor 10% gewijzigd door Verwijderd op 17-06-2004 12:29 . Reden: machine worden nu toegevoegd als system users ]
:strip_icc():strip_exif()/u/21865/shoe_60x60.jpg?f=community)
:strip_exif()/u/53522/crop583d477015a24.gif?f=community)
/u/5808/Linux.png?f=community)
doe bij maar ietst met unix