Есть домен с контролером домена на Windows 2000 Server, есть samba на ALT Linux 5.0 Ark Server. Нужно сделать, что бы пользователи домена могли входить под своими учётными записями в открытые для доступа папки на Linux.
Домен будет иметь название compania.ru контроллер домена будет иметь адрес
192.168.0.1 и доменное имя pdc.compania.ru, создаваемый файловый сервер -
filesrv.compania.ru и адрес 192.168.0.3 соответственно.
/etc/krb5.conf
[libdefaults]
default_realm = COMPANIA.RU
dns_lookup_realm = true
dns_lookup_kdc = true
[domain_realm]
.compania.ru = COMPANIA.RU
compania.ru = COMPANIA.RU
[dbdefaults]
ldap_kerberos_container_dn = "cn=kerberos,ou=kdcroot,dc=compania,dc=ru"
[dbmodules]
compania.ru = {
db_library = kldap
ldap_kdc_dn = cn=kdc,ou=kdcroot,dc=compania,dc=ru
ldap_kadmind_dn = cn=kadmin,ou=kdcroot,dc=compania,dc=ru
ldap_service_password_file = /var/lib/kerberos/krb5kdc/ compania.ru.ldapkey
ldap_servers = ldap://localhost/
ldap_conns_per_server = 5
}
[realms]
COMPANIA.RU = {
# kdc = pdc.compania.ru
# default_domain = compania.ru
database_module = compania.ru
}
/etc/samba/smb.conf
[global]
winbind separator = +
template shell = /bin/bash
template homedir = /home/%U
winbind uid = 10000-20000
winbind gid = 10000-20000
realm = COMPANIA.RU
server string = Samba server on %h (v. %v)
security = DOMAIN
use kerberos keytab = Yes
password server = pdc.compania.ru
encrypt passwords = yes
log file = /var/log/samba/log.%m
max log size = 50
printcap name = cups
dns proxy = No
use sendfile = Yes
passdb backend = ldapsam:ldap://127.0.0.1/
ldap admin dn = cn=ldaproot,dc=compania,dc=ru
ldap suffix = dc=compania,dc=ru
ldap group suffix = ou=Group
ldap user suffix = ou=People
[share]
comment = Commonplace
path = /srv/share
read only = No
[homes]
comment = Home Directory for '%u'
browseable = no
writable = yes
[mirror]
comment = mirror
guest ok = yes
path = /mnt/win/mirror
read only = No
[Почта]
comment = Почта
guest ok = yes
path = /mnt/win
read only = No
/etc/hosts
127.0.0.1 localhost.localdomain localhost
192.168.0.1 pdc.compania.ru pdc
192.168.0.3 filesrv.compania.ru filesrv
/etc/nsswitch.conf
#
# Please refer to nsswitch.conf(5) for more information on this file.
#
# This is the Name Service Switch configuration file. This file should
# be sorted with the most-used databases at the beginning.
#
# Specifying '[NOTFOUND=return]' means that the search for an entry
# should stop if the search with the previous service turned up nothing.
# Note that if the search failed due to some other reason (like no NIS
# server responding) then the search continues with the next service.
#
# Legal name services are:
#
# files Use local files
# tcb Use local tcb shadow files, see tcb(5)
# db Use local database files under /var/db
# nis or yp Use NIS (NIS version 2), also called YP
# nisplus or nis+ Use NIS+ (NIS version 3)
# dns Use DNS (Domain Name Service)
# compat Use NIS in compatibility mode
# hesiod Use Hesiod for user lookups
# [NOTFOUND=return] Stop searching if not found so far
#
#passwd: files ldap
passwd: files ldap
shadow: tcb files ldap
#group: files ldap
group: files ldap
gshadow: files
hosts: files nisplus nis dns
# To use db, put the "db" in front of "files" for things you want to be
# looked up first in the db files.
#
#passwd: db files nisplus nis
#shadow: db tcb files nisplus nis
#group: db files nisplus nis
#
#hosts: db files nisplus nis dns
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files
# Example - obey only what nisplus tells us...
#services: nisplus [NOTFOUND=return] files
#networks: nisplus [NOTFOUND=return] files
#protocols: nisplus [NOTFOUND=return] files
#rpc: nisplus [NOTFOUND=return] files
#ethers: nisplus [NOTFOUND=return] files
#netmasks: nisplus [NOTFOUND=return] files
bootparams: nisplus [NOTFOUND=return] files
netgroup: nisplus
publickey: nisplus
automount: files nisplus
aliases: files nisplus
При попытке зарегистрировать в домене выдаёт
[root@filesrv etc]# net ads join -U administrator -S pdc.compania.ru
administrator's password:
[2010/05/06 16:05:04, 0] libads/kerberos.c:ads_kinit_password(228)
kerberos_kinit_password FILESRV$@COMPANIA.RU failed: Preauthentication failed
Failed to join domain: Logon failure
Если пробую зайти доменным админом выдаёт
[root@filesrv ~]# kinit administratorсобачкаcompania.ru
kinit(v5): Client not found in Kerberos database while getting initial credentials
Что я упустил?
