НИКАК НЕ МОГУ WINDOWS XP ПРИСОЕДИНИТЬ В ДОМЕН, ПОДНЯТЫЙ НА ALT LINUX !!!
И так начал пробывать уже на пятой версии.
К switch'y подключил три компа:
1) Alt Linux Server 5.0 прототип;
2) Alt Linux Desktop 5.0 прототип;
3) Windows XP.
Между собой два Альта прекрасно общаются, Desktop вогнал в домен с первого раза (почти), авторизуюсь пользователем через LDAP поднятый на Server'e, через smb вижу всю сеть (лазию по папкам, сохраняю). КРАСОТА!!!
Но Windows мне весь мозг вынес :'(
Подскажите пожалуйста, что ещё нужно на Alt Linux Server 5.0 подправить чтоб заработало?
[root@server etc]# cat hosts
127.0.0.1 localhost.localdomain localhost
22.22.22.2 server.alt.loc server
22.22.22.22 ivanov.alt.loc ivanov
22.22.22.10 petrov.alt.loc petrov
[root@server etc]# cat /etc/openldap/slapd.conf | grep -v ^# | grep -v ^$
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/openldap.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/misc.schema
include /etc/openldap/schema/samba3.schema
include /etc/openldap/schema/kerberos.schema
allow bind_v2
concurrency 20
gentlehup on
sizelimit -1
loglevel -1
pidfile /var/run/slapd.pid
argsfile /var/run/slapd.args
replica-pidfile /var/run/slurpd.pid
replica-argsfile /var/run/slurpd.args
rootDSE /etc/openldap/rootdse.ldif
access to dn.exact=""
by * read
access to dn.subtree="cn=Subschema"
by * read
access to attrs=userPassword,sambaNTPassword,sambaLMPassword
by self write
by anonymous auth
by * none
modulepath /usr/lib/openldap
moduleload back_hdb.la
moduleload back_monitor.la
moduleload back_null.la
include /etc/openldap/slapd-hdb-db01.conf
include /etc/openldap/slapd-hdb-db02.conf
include /etc/openldap/slapd-alt.loc.conf
[root@server etc]#
[root@server etc]# cat /etc/openldap/ldap.conf | grep -v ^# | grep -v ^$
host 127.0.0.1
tls_reqcert never
base dc=alt,dc=loc
uri ldap://127.0.0.1
rootbinddn cn=ldaproot,dc=alt,dc=loc
bind_policy soft
[root@server etc]#
Даже smbldap-tools поставил...
[root@server etc]# cat /etc/samba/smb.conf | grep -v ^# | grep -v ^$
[global]
realm = ALT.LOC
netbios name = server
server string = Samba server on %h (v. %v)
use kerberos keytab = Yes
log file = /var/log/samba/log.%m
max log size = 50
printcap name = cups
dns proxy = No
use sendfile = Yes
passdb backend = ldapsam:ldap://localhost/
ldap admin dn = cn=ldaproot,dc=alt,dc=loc
ldap suffix = dc=alt,dc=loc
ldap group suffix = ou=Group
ldap user suffix = ou=People
workgroup = ALT
security = user
obey pam restrictions = no
ldap machine suffix = ou=Computers
ldap idmap suffix = ou=Users
; Do ldap passwd sync
ldap passwd sync = Yes
passwd program = /usr/sbin/smbldap-passwd %u
passwd chat = *New*password* %n\n *Retype*new*password* %n\n *all*authentication*tokens*updated*
add user script = /usr/sbin/smbldap-useradd -m "%u"
ldap delete dn = Yes
delete user script = /usr/sbin/smbldap-userdel "%u"
add machine script = /usr/sbin/smbldap-useradd -w "%u"
add group script = /usr/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/sbin/smbldap-groupdel "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u"
domain logons = yes
logon path =
[netlogon]
comment = Network Logon Service
path = /var/lib/samba/netlogon
guest ok = yes
writable = no
write list = admin, administrator, unixadm
[Profiles]
path = /var/lib/samba/profiles
browseable = no
read only = no
create mask = 0600
directory mask = 0700
[share]
comment = Commonplace
path = /srv/share
read only = No
[root@server etc]#
[root@server openldap]# net getlocalsid
SID for domain SERVER is: S-1-5-21-4091439222-3168486375-1279198542
[root@server openldap]#
[root@server openldap]# cat /etc/openldap/slapd-alt.loc.conf | grep -v ^# | grep -v ^$
database hdb
suffix "dc=alt,dc=loc"
rootdn "cn=ldaproot,dc=alt,dc=loc"
rootpw Futyncndj
directory /var/lib/ldap/bases/alt.loc
index objectClass eq
index uid eq
index cn eq
index uidNumber eq
index gidNumber eq
access to attrs=userPassword,sambaLMPassword,sambaNTPassword
by self write
by anonymous auth
by * none
access to dn.subtree="ou=kdcroot,dc=alt,dc=loc"
by dn.exact="cn=kdc,ou=kdcroot,dc=alt,dc=loc" read
by dn.exact="cn=kadmin,ou=kdcroot,dc=alt,dc=loc" write
by * none
access to dn.subtree="cn=ALT.LOC,cn=kerberos,ou=kdcroot,dc=alt,dc=loc"
by dn.exact="cn=kdc,ou=kdcroot,dc=alt,dc=loc" read
by dn.exact="cn=kadmin,ou=kdcroot,dc=alt,dc=loc" write
by * none
access to *
by * read
[root@server openldap]#
[root@server smbldap-tools]# cat /etc/smbldap-tools/smbldap.conf | grep -v ^# | grep -v ^$
SID="S-1-5-21-4091439222-3168486375-1279198542"
sambaDomain="ALT"
slaveLDAP="server.alt.loc"
slavePort="389"
masterLDAP="server.alt.loc"
masterPort="389"
ldapTLS="0"
ldapSSL="0"
verify="require"
cafile="/etc/smbldap-tools/ca.pem"
clientcert="/etc/smbldap-tools/smbldap-tools.iallanis.info.pem"
clientkey="/etc/smbldap-tools/smbldap-tools.iallanis.info.key"
suffix="dc=alt,dc=loc"
usersdn="ou=People,${suffix}"
computersdn="ou=Computers,${suffix}"
groupsdn="ou=Groups,${suffix}"
idmapdn="ou=Idmap,${suffix}"
sambaUnixIdPooldn="sambaDomainName=ALT,${suffix}"
scope="sub"
hash_encrypt="SSHA"
crypt_salt_format="%s"
userLoginShell="/bin/bash"
userHome="/home/%U"
userHomeDirectoryMode="700"
userGecos="System User"
defaultUserGid="513"
defaultComputerGid="515"
skeletonDir="/etc/skel"
defaultMaxPasswordAge="45"
userSmbHome="\\server\%U"
userProfile="\\server\profiles\%U"
userHomeDrive="H:"
userScript="logon.bat"
mailDomain="alt.loc"
with_smbpasswd="0"
smbpasswd="/usr/bin/smbpasswd"
with_slappasswd="0"
slappasswd="/usr/sbin/slappasswd"
[root@server smbldap-tools]#
[root@server smbldap-tools]# cat /etc/smbldap-tools/smbldap_bind.conf | grep -v ^# | grep -v ^$
slaveDN="cn=ldaproot,dc=alt,dc=loc"
slavePw="Futyncndj"
masterDN="cn=ldaproot,dc=alt,dc=loc"
masterPw="Futyncndj"
[root@server smbldap-tools]#
[root@server /]# /usr/sbin/smbldap-populate -u 30000 -g 30000
Populating LDAP directory for domain ALT (S-1-5-21-4091439222-3168486375-1279198542)
(using builtin directory structure)
entry dc=alt,dc=loc already exist.
entry ou=People,dc=alt,dc=loc already exist.
entry ou=Groups,dc=alt,dc=loc already exist.
entry ou=Computers,dc=alt,dc=loc already exist.
entry ou=Idmap,dc=alt,dc=loc already exist.
adding new entry: uid=root,ou=People,dc=alt,dc=loc
adding new entry: uid=nobody,ou=People,dc=alt,dc=loc
entry cn=Domain Admins,ou=Groups,dc=alt,dc=loc already exist.
entry cn=Domain Users,ou=Groups,dc=alt,dc=loc already exist.
entry cn=Domain Guests,ou=Groups,dc=alt,dc=loc already exist.
entry cn=Domain Computers,ou=Groups,dc=alt,dc=loc already exist.
entry cn=Administrators,ou=Groups,dc=alt,dc=loc already exist.
entry cn=Account Operators,ou=Groups,dc=alt,dc=loc already exist.
entry cn=Print Operators,ou=Groups,dc=alt,dc=loc already exist.
entry cn=Backup Operators,ou=Groups,dc=alt,dc=loc already exist.
entry cn=Replicators,ou=Groups,dc=alt,dc=loc already exist.
entry sambaDomainName=ALT,dc=alt,dc=loc already exist. Updating it...
Please provide a password for the domain root:
Changing UNIX and samba passwords for root
New password:
Retype new password:
[root@server /]#
[root@server /]# ldapsearch -LLL -H ldap://localhost -D "cn=ldaproot,dc=alt,dc=loc" -x unixadm -w Futyncndj | more
dn: dc=alt,dc=loc
dn: cn=ldaproot,dc=alt,dc=loc
dn: ou=People,dc=alt,dc=loc
dn: ou=Group,dc=alt,dc=loc
dn: ou=kdcroot,dc=alt,dc=loc
dn: cn=kdc,ou=kdcroot,dc=alt,dc=loc
dn: cn=kadmin,ou=kdcroot,dc=alt,dc=loc
dn: cn=kerberos,ou=kdcroot,dc=alt,dc=loc
dn: cn=ALT.LOC,cn=kerberos,ou=kdcroot,dc=alt,dc=loc
dn: krbPrincipalName=K/M@ALT.LOC,cn=ALT.LOC,cn=kerberos,ou=kdcroot,dc=alt,dc=l
oc
dn: krbPrincipalName=krbtgt/ALT.LOC@ALT.LOC,cn=ALT.LOC,cn=kerberos,ou=kdcroot,
dc=alt,dc=loc
dn: krbPrincipalName=kadmin/admin@ALT.LOC,cn=ALT.LOC,cn=kerberos,ou=kdcroot,dc
=alt,dc=loc
dn: krbPrincipalName=kadmin/changepw@ALT.LOC,cn=ALT.LOC,cn=kerberos,ou=kdcroot
,dc=alt,dc=loc
dn: krbPrincipalName=kadmin/history@ALT.LOC,cn=ALT.LOC,cn=kerberos,ou=kdcroot,
dc=alt,dc=loc
dn: krbPrincipalName=kadmin/server.alt.loc@ALT.LOC,cn=ALT.LOC,cn=kerberos,ou=k
dcroot,dc=alt,dc=loc
dn: krbPrincipalName=nfs/server.alt.loc@ALT.LOC,cn=ALT.LOC,cn=kerberos,ou=kdcr
oot,dc=alt,dc=loc
dn: krbPrincipalName=cifs/server.alt.loc@ALT.LOC,cn=ALT.LOC,cn=kerberos,ou=kdc
root,dc=alt,dc=loc
dn: krbPrincipalName=host/server.alt.loc@ALT.LOC,cn=ALT.LOC,cn=kerberos,ou=kdc
root,dc=alt,dc=loc
dn: krbPrincipalName=imap/server.alt.loc@ALT.LOC,cn=ALT.LOC,cn=kerberos,ou=kdc
root,dc=alt,dc=loc
dn: krbPrincipalName=pop3/server.alt.loc@ALT.LOC,cn=ALT.LOC,cn=kerberos,ou=kdc
root,dc=alt,dc=loc
dn: krbPrincipalName=smtp/server.alt.loc@ALT.LOC,cn=ALT.LOC,cn=kerberos,ou=kdc
......
.....
и т.д.
[root@server /]# /usr/sbin/ldapserch -x -b dc=alt,dc=loc | less
[root@server /]# ldapsearch -x -b dc=alt,dc=loc | less
# extended LDIF
#
# LDAPv3
# base <dc=alt,dc=loc> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# alt.loc
dn: dc=alt,dc=loc
objectClass: organization
objectClass: dcObject
dc: alt
o: loc
# ldaproot, alt.loc
dn: cn=ldaproot,dc=alt,dc=loc
objectClass: organizationalRole
cn: ldaproot
# People, alt.loc
dn: ou=People,dc=alt,dc=loc
objectClass: organizationalUnit
ou: People
# Group, alt.loc
dn: ou=Group,dc=alt,dc=loc
objectClass: organizationalUnit
ou: Group
# root, Group, alt.loc
dn: cn=root,ou=Group,dc=alt,dc=loc
objectClass: posixGroup
objectClass: top
objectClass: extensibleObject
cn: root
gidNumber: 0
memberUid: unixadm
.....
.....
и т.д.
[root@server pam.d]# cat system-auth-ldap
#%PAM-1.0
auth sufficient pam_tcb.so shadow fork prefix=$2a$ count=8 nullok
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_ldap.so use_first_pass
account sufficient pam_tcb.so shadow fork
account required pam_ldap.so
password required pam_passwdqc.so config=/etc/passwdqc.conf
password sufficient pam_tcb.so use_authtok shadow fork prefix=$2a$ count=8 nullok write_to=tcb
password requisite pam_succeed_if.so uid >= 500 quiet
password required pam_ldap.so use_authtok
session optional pam_tcb.so
session optional pam_ldap.so
session required pam_mktemp.so
session required pam_mkhomedir.so silent
session required pam_limits.so
[root@server pam.d]#
[root@server etc]# cat /etc/nsswitch.conf | grep -v ^# | grep -v ^$
passwd: files ldap
shadow: tcb files ldap
group: files ldap
gshadow: files
hosts: files dns nisplus nis
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files
bootparams: nisplus [NOTFOUND=return] files
netgroup: nisplus
publickey: nisplus
automount: files nisplus
aliases: files nisplus
[root@server etc]#
ну и соответственно всё что связанно с DNS (BIND)
[root@server etc]# cat resolv.conf.dnsmasq
# Generated by resolvconf
search alt.loc
nameserver 127.0.0.1
nameserver 22.22.22.2
nameserver 83.242.139.10
nameserver 83.242.140.10
[root@server etc]#
[root@server etc]# cat alt.loc
$ORIGIN alt.loc.
$TTL 86400 ; 1 day
@ IN SOA alt.loc. root.alt.loc. (
2009080659 ; serial
14400 ; refresh (4 h)
3600 ; retry (1 h)
2592000 ; expire (4w2d)
600 ; minimum (10 minute)
)
NS server.alt.loc.
NS server.alt.loc.
alt.loc. A 22.22.22.2
*.alt.loc. CNAME @
alt.loc. MX 10 mail.alt.loc.
mail.alt.loc. A 22.22.22.2
server A 22.22.22.2
ivanov A 22.22.22.22
petrov A 22.22.22.10
[root@server etc]#
ИЗВИНИТЕ ЗА СПАМ !!! (если понадобиться ещё какие файлики показать только скажите, или команды какие дать и логи)
НО ДЕЙСТВИТЕЛЬНО ХОЧУ ВНЕДРИТЬ ПРОДУКТЫ ALT LINUX В СВОЮ ОРГАНИЗАЦИЮ.
