First of all, I want to thank the Ubuntu community. This is a brief guide with parts taken from this links:
https://help.ubuntu.com/community/Op...-OrgInfo-Posix
and
http://www.howtoforge.com/openldap-s...ler-ubuntu7.10
Thanks all of you guys.
Intro:
Following the previous guides you will find many differences for getting your PDC up and running. For further information, please refer to the links above, I'm just attempting to make a step-through step guide that will make your PDC work in less than 15 minutes. Worked for me the last three times I used this guide, with roaming profiles disabled.
For this example, we will be using the domain 'ubuntudom'. Replace the 'ubuntudom' entry with your own domain name! Files attached here are 100% working if you follow this tutorial step by step.
Hold your breath, here we go:
1) Install OpenLDAP ..
sudo apt-get --yes install slapd ldap-utils db4.2-util
1.1) Completely delete the slapd.d directory inside /etc/ldap/
1.2) Edit /etc/default/slapd and look for the line
SLAPD_CONF=
And add the following:
SLAPD_CONF=/etc/ldap/slapd.conf
2) Install Samba documentation containing the Samba schema. Extract samba.schema and copy to the required system area for OpenLDAP.
sudo apt-get --yes install samba-doc
sudo gunzip /usr/share/doc/samba-doc/examples/LDAP/samba.schema.gz
sudo cp -v /usr/share/doc/samba-doc/examples/LDAP/samba.schema /etc/ldap/schema
3) Decide on an LDAP admin password and generate a SSHA hash key for it.
slappasswd
4) Create an init.ldif file. Name the 4 OUs Users, Groups, Computers and Idmap for use with smbldap-tools. - Remember to replace 'ubuntudom' with your domain name
4) Modify /etc/ldap/slapd.conf for this site, and paste this .. - Remember to replace 'ubuntudom' with your domain nameCode:dn: dc=ubuntudom objectClass: dcObject objectClass: organizationalUnit dc: ubuntudom ou: Ubuntudom dn: cn=admin,dc=ubuntudom objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword: {SSHA}paste-here-the-results-of-slappaswd # example: userPassword: {SSHA}iPFTqrtFrEET3DSQot2wxCuuljKA9vMU -- DELETE THIS LINE, FOR EXAMPLE PURPOSE dn: ou=Users,dc=ubuntudom objectClass: organizationalUnit ou: Users dn: ou=Groups,dc=ubuntudom objectClass: organizationalUnit ou: Groups dn: ou=Computers,dc=ubuntudom objectClass: organizationalUnit ou: Computers dn: ou=Idmap,dc=ubuntudom objectClass: organizationalUnit ou: Idmap
Code:# Remember to replace suffix "dc=ubuntudom" with your domain name # Change the rootpw entry with the results from slappaswd (Must match the same you pasted on init.ldif) # /etc/ldap/slapd.conf # This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options. ####################################################################### # Global Directives: # Features to permit #allow bind_v2 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/misc.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel 0 # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_bdb # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 ####################################################################### # Specific Backend Directives for bdb: # Backend specific directives apply to this backend until another # 'backend' directive occurs backend bdb #checkpoint 512 30 ####################################################################### # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs #backend <other> ####################################################################### # Specific Directives for database #1, of type bdb: # Database specific directives apply to this databasse until another # 'database' directive occurs database bdb # The base of your directory in database #1 suffix "dc=ubuntudom" # rootdn directive for specifying a superuser on the database. This is needed # for syncrepl. rootdn "cn=admin,dc=ubuntudom" rootpw {SSHA}iPFTqrtwr3yT3XGQot2wxCuuljKA9vMU # Where the database file are physically stored for database #1 directory "/var/lib/ldap" # For the Debian package we use 2MB as default but be sure to update this # value if you have plenty of RAM dbconfig set_cachesize 0 2097152 0 # Sven Hartge reported that he had to set this value incredibly high # to get slapd running at all. See http://bugs.debian.org/303057 # for more information. # Number of objects that can be locked at the same time. dbconfig set_lk_max_objects 1500 # Number of locks (both requested and granted) dbconfig set_lk_max_locks 1500 # Number of lockers dbconfig set_lk_max_lockers 1500 # Indexing options for database #1 #index objectClass eq, pres index ou,cn,sn,mail,givenname eq,pres,sub index uidNumber,gidNumber,memberUid eq,pres index loginShell eq,pres index uniqueMember eq,pres index uid pres,sub,eq index displayName pres,sub,eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub #index uid pres,eq,sub # Save the time that the entry gets modified, for database #1 lastmod on # Where to store the replica logs for database #1 # replogfile /var/lib/ldap/replog # The userPassword by default can be changed # by the entry owning it if they are authenticated. # Others should not be able to see it, except the # admin entry below # These access lines apply to database #1 only access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=ubuntudom" write by anonymous auth by self write by * none # Ensure read access to the base for things like # supportedSASLMechanisms. Without this you may # have problems with SASL not knowing what # mechanisms are available and the like. # Note that this is covered by the 'access to *' # ACL below too but if you change that as people # are wont to do you'll still need this if you # want SASL (and possible other things) to work # happily. access to dn.base="" by * read # The admin dn has full write access, everyone else # can read everything. access to * by dn="cn=admin,dc=ubuntudom" write by * read # For Netscape Roaming support, each user gets a roaming # profile for which they have write access to #access to dn=".*,ou=Roaming,o=morsnet" # by dn="cn=admin,dc=example,dc=ch" write # by dnattr=owner write ####################################################################### # Specific Directives for database #2, of type 'other' (can be bdb too): # Database specific directives apply to this databasse until another # 'database' directive occurs #database <other> # The base of your directory for database #2 #suffix "dc=debian,dc=org"
5) Initialise OpenLDAP database ..
sudo /etc/init.d/slapd stop
sudo rm -rf /var/lib/ldap/*
sudo slapadd -v -l init.ldif
/etc/ldap/slapd.conf: line 109: rootdn is always granted unlimited privileges.
/etc/ldap/slapd.conf: line 126: rootdn is always granted unlimited privileges.
added: "dc=ubuntudom" (00000001)
added: "cn=admin,dc=ubuntudom" (00000002)
added: "ou=Users,dc=ubuntudom" (00000003)
: : :
sudo chown -R openldap:openldap /var/lib/ldap
sudo /etc/init.d/slapd start
Confirm all is OK with a Search ..
ldapsearch -xLLL -b "dc=ubuntudom"
dn: dc=ubuntudom
objectClass: dcObject
objectClass: organizationalUnit
: : :
6) Install and Configure Samba
sudo apt-get --y install libtalloc1 smbclient samba libpam-smbpass
7) Create Samba folders that have not been automatically created ..
sudo mkdir -v /var/lib/samba/profiles
sudo chmod 777 /var/lib/samba/profiles
sudo mkdir -v -p /var/lib/samba/netlogon
8) Edit /etc/samba/smb.conf - so it looks EXACTLY like this but replacing your domain name
9) Write password for the LDAP admin account (eg. cn=admin,dc=ubuntudom) into /etc/samba/secrets.tdbCode:[global] # Domain name .. workgroup = UBUNTUDOM # Server name - as seen by Windows PCs .. netbios name = SERVERNAME # Be a PDC .. domain logons = Yes domain master = Yes # Be a WINS server .. wins support = true obey pam restrictions = Yes dns proxy = No os level = 35 log file = /var/log/samba/log.%m max log size = 1000 syslog = 0 panic action = /usr/share/samba/panic-action %d pam password change = Yes # Allows users on WinXP PCs to change their password when they press Ctrl-Alt-Del unix password sync = no ldap passwd sync = yes # Printing from PCs will go via CUPS .. load printers = yes printing = cups printcap name = cups # Use LDAP for Samba user accounts and groups .. passdb backend = ldapsam:ldap://localhost # This must match init.ldif .. ldap suffix = dc=ubuntudom # The password for cn=admin MUST be stored in /etc/samba/secrets.tdb # This is done by running 'sudo smbpasswd -w'. ldap admin dn = cn=admin,dc=ubuntudom # 4 OUs that Samba uses when creating user accounts, computer accounts, etc. # (Because we are using smbldap-tools, call them 'Users', 'Computers', etc.) ldap machine suffix = ou=Computers ldap user suffix = ou=Users ldap group suffix = ou=Groups ldap idmap suffix = ou=Idmap # Samba and LDAP server are on the same server in this example. ldap ssl = no # Scripts for Samba to use if it creates users, groups, etc. add user script = /usr/sbin/smbldap-useradd -m '%u' delete user script = /usr/sbin/smbldap-userdel %u add group script = /usr/sbin/smbldap-groupadd -p '%g' delete group script = /usr/sbin/smbldap-groupdel '%g' add user to group script = /usr/sbin/smbldap-groupmod -m '%u' '%g' delete user from group script = /usr/sbin/smbldap-groupmod -x '%u' '%g' set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u' # Script that Samba users when a PC joins the domain .. # (when changing 'Computer Properties' on the PC) add machine script = /usr/sbin/smbldap-useradd -w '%u' # Values used when a new user is created .. # (Note: '%L' does not work properly with smbldap-tools 0.9.4-1) logon drive = logon home = logon path = logon script = # This is required for Windows XP client .. server signing = auto server schannel = Auto [homes] comment = Home Directories valid users = %S read only = No browseable = No [netlogon] comment = Network Logon Service path = /var/lib/samba/netlogon admin users = root guest ok = Yes browseable = No [Profiles] comment = Roaming Profile Share # would probably change this to elsewhere in a production system .. path = /var/lib/samba/profiles read only = No profile acls = Yes browsable = No [printers] comment = All Printers path = /var/spool/samba use client driver = Yes create mask = 0600 guest ok = Yes printable = Yes browseable = No public = yes writable = yes admin users = root write list = root [print$] comment = Printer Drivers Share path = /var/lib/samba/printers write list = root create mask = 0664 directory mask = 0775 admin users = root
sudo smbpasswd -W
Setting stored password for "cn=admin,dc=ubuntudom" in secrets.tdb
New SMB password:
Retype new SMB password:
10) Restart Samba ..
sudo /etc/init.d/samba restart
11) Use the SMB client to check that the Samba server is responding correctly.
smbclient -L localhost -U anonymous%
Anonymous login successful
Domain=[UBUNTUDOM] OS=[Unix] Server=[Samba 3.3.2]
Sharename Type Comment
--------- ---- -------
IPC$ IPC IPC Service (Samba 3.3.2)
print$ Disk Printer Drivers Share
Anonymous login successful
Domain=[UBUNTUDOM] OS=[Unix] Server=[Samba 3.3.2]
Server Comment
--------- -------
SERVERNAME Samba 3.3.
Workgroup Master
--------- -------
UBUNTUDOM SERVERNAME
12) Install smbldap-tools and extract the configure.pl script.
sudo apt-get install smbldap-tools
sudo gunzip /usr/share/doc/smbldap-tools/configure.pl.gz
sudo chmod +x /usr/share/doc/smbldap-tools/configure.pl
13) Before configuring smbldap-tools, check that Samba is running and the Windows domain SID can be retrieved.
ps -e | grep -i "smb"
4956 ? 00:00:00 smbd
5096 ? 00:00:00 smbd
sudo net getlocalsid
SID for domain SERVERNAME is: S-1-5-21-2899629268-4176875250-2352135513
14) Populate the LDAP database with essential Samba entries. This includes the creation of standard groups, such as Administrators and Domain Users.
sudo smbldap-populate
Populating LDAP directory for domain UBUNTUDOM (S-1-5-21-2899629268-4176875250-2352135513)
(using builtin directory structure)
entry dc=ubuntudom already exist.
entry ou=Users,dc=ubuntudom already exist.
entry ou=Groups,dc=ubuntudom already exist.
entry ou=Computers,dc=ubuntudom already exist.
entry ou=Idmap,dc=ubuntudom already exist.
adding new entry: uid=root,ou=Users,dc=ubuntudom
adding new entry: uid=nobody,ou=Users,dc=ubuntudom
adding new entry: cn=Domain Admins,ou=Groups,dc=ubuntudom
adding new entry: cn=Domain Users,ou=Groups,dc=ubuntudom
adding new entry: cn=Domain Guests,ou=Groups,dc=ubuntudom
adding new entry: cn=Domain Computers,ou=Groups,dc=ubuntudom
adding new entry: cn=Administrators,ou=Groups,dc=ubuntudom
adding new entry: cn=Account Operators,ou=Groups,dc=ubuntudom
adding new entry: cn=Print Operators,ou=Groups,dc=ubuntudom
adding new entry: cn=Backup Operators,ou=Groups,dc=ubuntudom
adding new entry: cn=Replicators,ou=Groups,dc=ubuntudom
entry sambaDomainName=UBUNTUDOM,dc=ubuntudom already exist. Updating it...
Please provide a password for the domain root:
Changing UNIX and samba passwords for root
New password:
Retype new password:
15) Following this, stop the LDAP server, run slapindex, and restart the LDAP server.
sudo /etc/init.d/slapd stop
Stopping OpenLDAP: slapd.
sudo slapindex
WARNING!
Runnig as root!
There's a fair chance slapd will fail to start.
Check file permissions!
/etc/ldap/slapd.conf: line 128: rootdn is always granted unlimited privileges.
/etc/ldap/slapd.conf: line 145: rootdn is always granted unlimited privileges.
# Correct the ownership of the index files ..
sudo chown openldap:openldap /var/lib/ldap/*
sudo /etc/init.d/slapd start
Starting OpenLDAP: slapd
16) Add Test Account
sudo smbldap-useradd -a -m -P david
17) Add root and david to the Windows Administrators group and confirm ..
sudo /usr/sbin/smbldap-groupmod -m 'david' 'Administrators'
sudo /usr/sbin/smbldap-groupmod -m 'root' 'Administrators'
18) Add root and david to the Windows Administrators group and confirm ..
sudo /usr/sbin/smbldap-groupmod -m 'david' 'Administrators'
smbldap-groupshow Administrators
19) Add LDAP Authentication on Clients
sudo apt-get --yes install ldap-auth-client
LDAP server Uniform Resource Identifier: ldap://xxxx - enter the name of the LDAPServer here
# EXAMPLE: ldap://servername
Distinguished name of the search base: dc=ubuntudom
LDAP version to use: 3
Make local root Database admin: Yes
Does the LDAP database require login? No
LDAP account for root: cn=admin,dc=ubuntudom
LDAP root account password: <enter the LDAP admin password>
sudo auth-client-config -t nss -p lac_ldap
sudo pam-auth-update ldap
19) Test - see if the list of groups and users includes those users and groups in LDAP.
getent group
: :
- output will include Windows groups held in LDAP ..
Domain Admins:*:512:root
Domain Users:*:513:
Domain Guests:*:514:
Domain Computers:*:515:
Administrators:*:544:root,david
Account Operators:*:548:
Print Operators:*:550:
Backup Operators:*:551:
Replicators:*:552:
: :
getent passwd
- output will include user accounts that only exist in LDAP (eg. david)
20) RESTART YOUR SERVER
21) Join Windows XP PC to the Domain as ubuntudom\root and your root password
22) DONE!
Hope this guide works for everybody
Regards from Argentina,
Ariel
Adv Reply
Originally Posted by ghen
I definitely found it useful and will probably use it as the main guide when my setup goes production. Thanks.
Bookmarks