Table of Contents
Installing Samba.........................................................................................................................................2
Configure OpenLdap..................................................................................................................................2
Configure Samba........................................................................................................................................3
Configure smbldap Tools...........................................................................................................................7
Adding User Groups and Shared Folders..................................................................................................9
Installing Samba
Setting Rpmforge repository ..
rpm --import [Link]
rpm -ivh [Link]
yum repolist
yum install openldap-servers nss_ldap samba httpd openssl mod_ssl mysql mysql-server php php-xml
php-ldap php-mysql php-pdo php-cli php-common smbldap-tools
perl-LDAP perl-Crypt-SmbHash smbldap-tools perl-Digest-SHA1 perl-Unicode-MapUTF8 openldap-
clients
Configure OpenLdap
mv -f /etc/openldap/[Link] /etc/openldap/[Link]
Generate a master password to set up ldap
slappasswd
New password:
Re-enter new password:
{SSHA}et/Lp4/V1wigdaP0pfeQtQIpT1PPJY8+
Copy this ssha encrypted password we will use it in the configuretion
vi /etc/openldap/[Link]
include /etc/openldap/schema/[Link]
include /etc/openldap/schema/[Link]
include /etc/openldap/schema/[Link]
include /etc/openldap/schema/[Link]
include /etc/openldap/schema/[Link]
allow bind_v2
pidfile /var/run/openldap/[Link]
argsfile /var/run/openldap/[Link]
access to
attrs=userPassword,sambaLMPassword,sambaNTPassword,sambaPwdLastSet,sambaPwdMustChange
by self write
by anonymous auth
by * none
access to *
by self write
by * read
database bdb
suffix "dc=sceh,dc=net"
rootdn "cn=Manager,dc=sceh,dc=net"
rootpw {SSHA}et/Lp4/V1wigdaP0pfeQtQIpT1PPJY8+
password-hash {SSHA}
directory /var/lib/ldap
index cn,sn,uid,displayName pres,sub,eq
index uidNumber,gidNumber eq
index sambaSID eq
index sambaPrimaryGroupSID eq
index sambaDomainName eq
index objectClass pres,eq
index default sub
cp /usr/share/doc/samba-3.*/LDAP/[Link] /etc/openldap/schema/
cp /etc/openldap/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown ldap:ldap /var/lib/ldap/DB_CONFIG
chmod 600 /var/lib/ldap/DB_CONFIG
vi [Link]
dn: dc=sceh,dc=net
objectclass: dcObject
objectclass: organization
o: sceh
dc: sceh
vi [Link]
dn: cn=root,dc=sceh,dc=net
objectclass: organizationalRole
cn: root
slapadd -l /etc/openldap/[Link]
chown -R ldap:ldap /var/lib/ldap
chmod 600 /var/lib/ldap/*
slapcat
service ldap start
chkconfig ldap on
Configure Samba
mv /etc/samba/[Link] /etc/samba/[Link]
vi /etc/samba/[Link]
[global]
dos charset = 850
unix charset = ISO8859- 1
workgroup = SCEH
netbios name = SAMBA1
obey pam restrictions = Yes
password server = [Link]
passdb backend = ldapsam:ldap://[Link]/
username map = /etc/samba/smbusers
log level = 2
log file = /var/log/samba/%[Link]
unix extensions = No
add user script = /usr/sbin/smbldap-useradd -m %u
delete user script = /usr/sbin/smbldap-userdel %u
add group script = /usr/sbin/smbldap-groupadd -p %g
delete group script = /usr/sbin/smbldap-groupdel %g
add user to group script = /usr/sbin/smbldap-groupmod -m %g %u
delete user from group script = /usr/sbin/smbldap-groupmod -x %g %u
set primary group script = /usr/sbin/smbldap-usermod -g %g %u
add machine script = /usr/sbin/smbldap-useradd -w %u
# logon script = [Link]
logon path = \\%N\%U\profile
logon home = \\%N\%U
logon drive = Z:
domain logons = Yes
os level = 65
smb ports = 139
socket options = IPTOS_LOWDELAY TCP_NODELAY SO_KEEPALIVE
SO_RCVBUF=8192 SO_SNDBUF=8192
preferred master = Yes
domain master = Yes
ldap admin dn = cn=Manager,dc=sceh,dc=net
ldap group suffix = ou=Groups
ldap idmap suffix = ou=Users
ldap machine suffix = ou=Computers
ldap passwd sync = Yes
# wins support = Yes
ldap suffix = dc=sceh,dc=net
ldap ssl = no
idmap backend = ldap://[Link]/
idmap uid = 15000-20000
idmap gid = 15000-20000
recycle:touch = Yes
recycle:versions = Yes
recycle:maxsize = 0
recycle:exclude = *.tmp|*.temp|*.o|*.obj|~$*|*.~??
recycle:excludedir = /tmp|/temp|/cache
recycle:noversions = *.doc|*.xls|*.ppt
recycle:repository = .Recycle/%U
recycle:keeptree = Yes
inherit acls = Yes
hosts allow = 192.168.1.
ea support = Yes
map acl inherit = Yes
store dos attributes = Yes
dont descend = /proc,/dev,/etc,/lib,/lost+found,/initrd
dos filemode = Yes
vfs objects = recycle
posix locking = no
nt acl support = yes
[homes]
comment = Home Directories
path = /home/%u
valid users = %S
writeable = yes
read only = No
browseable = No
[netlogon]
comment = Network Logon service
path = /home/netlogon
guest ok = Yes
browseable = no
read only = Yes
Configure smbldap Tools
cp /usr/share/doc/smbldap-tools-0.9.5/[Link] /etc/smbldap-tools/[Link]
net getlocalsid
vi /etc/smbldap-tools/[Link]
# General Configuration
SID="S-1-5-21-2670368159-1018889019-89649393"
sambaDomain="SCEH"
# LDAP Configuration
slaveLDAP="[Link]"
slavePort="389"
masterLDAP="[Link]"
masterPort="389"
ldapTLS="0"
ldapSSL="0"
verify="require"
cafile="/etc/smbldap-tools/[Link]"
clientcert="/etc/smbldap-tools/[Link]"
clientkey="/etc/smbldap-tools/[Link]"
suffix="dc=sceh,dc=net"
usersdn="ou=Users,${suffix}"
computersdn="ou=Computers,${suffix}"
groupsdn="ou=Groups,${suffix}"
idmapdn="ou=Idmap,${suffix}"
sambaUnixIdPooldn="sambaDomainName=${sambaDomain},${suffix}"
scope="sub"
hash_encrypt="SSHA"
crypt_salt_format="%s"
# Unix Accounts Configuration
userLoginShell="/bin/bash"
userHome="/home/%U"
userHomeDirectoryMode="700"
userGecos="System User"
defaultUserGid="513"
defaultComputerGid="515"
skeletonDir="/etc/skel"
defaultMaxPasswordAge="10950"
# SAMBA Configuration
userSmbHome=""
userProfile=""
userHomeDrive=""
userScript=""
mailDomain="[Link]"
vi /etc/smbldap-tools/smbldap_bind.conf
slaveDN="cn=Manager,dc=sceh,dc=net"
slavePw="p4mail1server"
masterDN="cn=Manager,dc=sceh,dc=net"
masterPw="p4mail1server"
chmod 644 /etc/smbldap-tools/[Link]
chmod 600 /etc/smbldap-tools/smbldap_bind.conf
authconfig-tui
[*] Use MD5 Passwords
[*] Use Shadow Passwords
[*] Use LDAP
[*] Use LDAP Authentication
[ ] Local authorization is sufficient
vi /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_ldap.so use_first_pass
auth required pam_deny.so
account required pam_unix.so broken_shadow
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_ldap.so
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password sufficient pam_ldap.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_ldap.so
vi /etc/[Link]
passwd: files ldap
shadow: files ldap
group: files ldap
hosts: files dns
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files ldap
rpc: files
services: files ldap
netgroup: files ldap
publickey: nisplus
automount: files ldap
aliases: files nisplus
testparm -v
smbpasswd -w p4mail1server
smbldap-populate
/etc/init.d/smb start
chkconfig smb on
Adding User Groups and Shared Folders
smbldap-useradd -a -G 'Domain Users' -m -s /bin/bash -d /home/user -F "" -P user
net groupmap list
If you want to add a group to LDAP/Samba, say for controlling which users can write/read files on a
share, and have it determine that by groups:
smbldap-groupadd -a account
add users to the group..
smbldap-groupmod -m nitin,test accounts
Now create shared directory for accounts group
mkdir /data/accounts
chown [Link] /data/accounts
chmod 771 /data/accounts
Now add this in the samba configuration..
vi /etc/samba/[Link]
[accounts]
comment = Account Department
path = /data/accounts
valid users = +accounts
admin users = nitin
write list = +accounts
read only = No
force create mode = 760
directory mask = 0750
force directory mode = 0750
