Настройка Samba - [17] :: В помощь системному администратору

Вообще запарился. Конфигов этих несколько: один в /etc/samba, три других (smb.conf etch; smb.conf fiesty? и smb.conf gutsy) в /usr/share/samba.
Выкладываю /etc/samba/smb.conf:

#======================= Global Settings =======================

[global]

## Browsing/Identification ###

# Change this to the workgroup/NT-domain name your Samba server will part of
workgroup = mshome

# server string is the equivalent of the NT Description field
server string = %h server (Samba, Ubuntu)

# Windows Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable its WINS Server
;    wins support = no

# WINS Server - Tells the NMBD components of Samba to be a WINS Client
# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
; wins server = w.x.y.z

# This will prevent nmbd to search for NetBIOS names through DNS.
;    dns proxy = yes

# What naming service and in what order should we use to resolve host names
# to IP addresses
; name resolve order = lmhosts host wins bcast

#### Networking ####

# The specific set of interfaces / networks to bind to
# This can be either the interface name or an IP address/netmask;
# interface names are normally preferred
; interfaces = 169.254.165.227/255.255.0.0 eth0

# Only bind to the named interfaces and/or networks; you must use the
# 'interfaces' option above to use this.
# It is recommended that you enable this feature if your Samba machine is
# not protected by a firewall or is a firewall itself. However, this
# option cannot handle dynamic or non-broadcast interfaces correctly.
; bind interfaces only = true

#### Debugging/Accounting ####

# This tells Samba to use a separate log file for each machine
# that connects
log file = /var/log/samba/log.%m

# Cap the size of the individual log files (in KiB).
max log size = 1000

# If you want Samba to only log through syslog then set the following
# parameter to 'yes'.
;    syslog only = no

# We want Samba to log a minimum amount of information to syslog. Everything
# should go to /var/log/samba/log.{smbd,nmbd} instead. If you want to log
# through syslog you should set the following parameter to something higher.
syslog = 0

# Do something sensible when Samba crashes: mail the admin a backtrace
panic action = /usr/share/samba/panic-action %d

####### Authentication #######

# "security = user" is always a good idea. This will require a Unix account
# in this server for every user accessing the server. See
# /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/ServerType.html
# in the samba-doc package for details.
security = share

# You may wish to use password encryption. See the section on
# 'encrypt passwords' in the smb.conf(5) manpage before enabling.
;    encrypt passwords = yes

# If you are using encrypted passwords, Samba will need to know what
# password database type you are using.
passdb backend = tdbsam

obey pam restrictions = yes

;    guest account = nobody
invalid users = root

# This boolean parameter controls whether Samba attempts to sync the Unix
# password with the SMB password when the encrypted SMB password in the
# passdb is changed.
unix password sync = yes

# For Unix password sync to work on a Debian GNU/Linux system, the following
# parameters must be set (thanks to Ian Kahan <<kahan@informatik.tu-muenchen.de> for
# sending the correct chat script for the passwd program in Debian Sarge).
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .

# This boolean controls whether PAM will be used for password changes
# when requested by an SMB client instead of the program listed in
# 'passwd program'. The default is 'no'.
pam password change = yes

# This option controls how nsuccessful authentication attempts are mapped
# to anonymous connections
;    map to guest = never

########## Domains ###########

# Is this machine able to authenticate users. Both PDC and BDC
# must have this setting enabled. If you are the BDC you must
# change the 'domain master' setting to no
#
; domain logons = yes
#
# The following setting only takes effect if 'domain logons' is set
# It specifies the location of the user's profile directory
# from the client point of view)
# The following required a [profiles] share to be setup on the
# samba server (see below)
; logon path = \\%N\profiles\%U
# Another common choice is storing the profile in the user's home directory
;    logon path = \\%n\%u\profile

# The following setting only takes effect if 'domain logons' is set
# It specifies the location of a user's home directory (from the client
# point of view)
; logon drive = H:
;    logon home = \\%n\%u

# The following setting only takes effect if 'domain logons' is set
# It specifies the script to run during logon. The script must be stored
# in the [netlogon] share
# NOTE: Must be store in 'DOS' file format convention
; logon script = logon.cmd

# This allows Unix users to be created on the domain controller via the SAMR
# RPC pipe. The example command creates a user account with a disabled Unix
# password; please adapt to your needs
; add user script = /usr/sbin/adduser --quiet --disabled-password --gecos "" %u

########## Printing ##########

# If you want to automatically load your printer list rather
# than setting them up individually then you'll need this
;    load printers = yes

# lpr(ng) printing. You may wish to override the location of the
# printcap file
; printing = bsd
; printcap name = /etc/printcap

# CUPS printing. See also the cupsaddsmb(8) manpage in the
# cupsys-client package.
;    printing = cups
; printcap name = cups

############ Misc ############

# Using the following line enables you to customise your configuration
# on a per machine basis. The %m gets replaced with the netbios name
# of the machine that is connecting
; include = /home/samba/etc/smb.conf.%m

# Most people will find that this option gives better performance.
# See smb.conf(5) and /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/speed.html
# for details
# You may want to add the following on a Linux system:
# SO_RCVBUF=8192 SO_SNDBUF=8192
;    socket options = tcp_nodelay

# The following parameter is useful only if you have the linpopup package
# installed. The samba maintainer and the linpopup maintainer are
# working to ease installation and configuration of linpopup and samba.
; message command = /bin/sh -c '/usr/bin/linpopup "%f" "%m" %s; rm %s' &

# Domain Master specifies Samba to be the Domain Master Browser. If this
# machine will be configured as a BDC (a secondary logon server), you
# must set this to 'no'; otherwise, the default behavior is recommended.
;    domain master = auto

# Some defaults for winbind (make sure you're not using the ranges
# for something else.)
; idmap uid = 10000-20000
; idmap gid = 10000-20000
; template shell = /bin/bash

# The following was the default behaviour in sarge,
# but samba upstream reverted the default because it might induce
# performance issues in large organizations.
# See Debian bug #368251 for some of the consequences of *not*
# having this setting and smb.conf(5) for details.
; winbind enum groups = yes
; winbind enum users = yes

# Setup usershare options to enable non-root users to share folders
# with the net usershare command.

# Maximum number of usershare. 0 (default) means that usershare is disabled.
;    usershare max shares = 100

# Allow users who've been granted usershare privileges to create
# public shares, not just authenticated ones
usershare allow guests = yes
restrict anonymous = no
preferred master = no
max protocol = NT
acl compatibility = winnt
ldap ssl = No
server signing = Auto
username map = /etc/samba/smbusers
printer name = PDF
domain master = no
;    guest ok = no

#======================= Share Definitions =======================

# Un-comment the following (and tweak the other settings below to suit)
# to enable the default home directory shares. This will share each
# user's home directory as \\server\username
;[homes]
; comment = Home Directories
; browseable = yes

# By default, the home directories are exported read-only. Change the
# next parameter to 'no' if you want to be able to write to them.
; read only = no

# File creation mask is set to 0700 for security reasons. If you want to
# create files with group=rw permissions, set next parameter to 0775.
; create mask = 0700

# Directory creation mask is set to 0700 for security reasons. If you want to
# create dirs. with group=rw permissions, set next parameter to 0775.
; directory mask = 0700

# By default, \\server\username shares can be connected to by anyone
# with access to the samba server. Un-comment the following parameter
# to make sure that only "username" can connect to \\server\username
# This might need tweaking when using external authentication schemes
; valid users = %S

# Un-comment the following and create the netlogon directory for Domain Logons
# (you need to configure Samba to act as a domain controller too.)
;[netlogon]
; comment = Network Logon Service
; path = /home/samba/netlogon
; guest ok = yes
; read only = yes
; share modes = yes

# Un-comment the following and create the profiles directory to store
# users profiles (see the "logon path" option above)
# (you need to configure Samba to act as a domain controller too.)
# The path below should be writable by all users so that their
# profile directory may be created the first time they log on
;[profiles]
; comment = Users profiles
; path = /home/samba/profiles
; guest ok = no
; browseable = yes
; create mask = 0600
; directory mask = 0700

[printers]
comment = All Printers
browseable = no
path = /var/spool/samba
printable = yes
create mask = 0700

# Windows clients look for this share name as a source of downloadable
# printer drivers
[print$]
comment = Printer Drivers
path = /var/lib/samba/printers
read only = no
;    browseable = yes
valid users = vit, vitalian

[vit]
path = /home
read only = no
;    browseable = yes
guest ok = yes

[Vitalian]
path = /home/vitalian
browseable = yes
read only = no
writable = yes
valid users = vitalian

Я уже тут справки навожу - запутался еще больше. Вот посоветовали проверить командой testparm. Проверил. Выдает следующее:

Load smb config files from /etc/samba/smb.conf
Processing section "[printers]"
Processing section "[print$]"
Processing section "[vit]"
Processing section "[Vitalian]"
Loaded services file OK.
ERROR: lock directory /var/run/samba does not exist
ERROR: pid directory /var/run/samba does not exist
Server role: ROLE_STANDALONE
Press enter to see a dump of your service definitions

[global]
workgroup = MSHOME
server string = %h server (Samba, Ubuntu)
security = SHARE
obey pam restrictions = Yes
passdb backend = tdbsam
pam password change = Yes
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
username map = /etc/samba/smbusers
unix password sync = Yes
syslog = 0
log file = /var/log/samba/log.%m
max log size = 1000
acl compatibility = winnt
server signing = auto
preferred master = No
domain master = No
ldap ssl = no
usershare allow guests = Yes
panic action = /usr/share/samba/panic-action %d
invalid users = root
printer name = PDF

[printers]
comment = All Printers
path = /var/spool/samba
create mask = 0700
printable = Yes
browseable = No

[print$]
comment = Printer Drivers
path = /var/lib/samba/printers
valid users = vit, vitalian
read only = No

[vit]
path = /home
read only = No
guest ok = Yes

[Vitalian]
path = /home/vitalian
valid users = vitalian
read only = No

Т.е. не все настройки вышеприведенного конфига работают???

Доброго времени суток.
Ура, я это победил.

Конфигурация рабочая!!!

(ВНИАМАНИЕ ЕСТЬ ПРОБЛЕМА: все работает до перезагрузки компа с самбой. Потом приходится снова ручками вводить в домен)

* Сеть: полностью виндозовская
* Samba: версии 3.0.28a (samba-winbind 3.0.28.a ставил отдельно, позже Самбы)
* ОС: Mandriva 10 Spring
* Домен: Windows 2003 SP 4(???) Server(русский), Active Directory, DNS находится
на этом сервере
* Имя машины под Linux: new_gateway (IP 192.168.0.111)
* Имя домена: dcts # в конфиге обязательно соблюдайте регистр
* Имя сервера: server2003 (IP 192.168.0.1), servernew (IP 192.168.0.242)
* Имя админа сервера: alena #здесь может быть любой пользователь, который имеет права администратора и пишется латиницей
Заведен комп в домен и расшарены ресурсы на полный доступ

Обязательно должен стоять
1. kerberos (проверяем вводом

Код:

[root@]# rpm -q krb5

Если все ок, выдаст версию)
2. samba (для проверки введите

Код:

[root@]# service samba start

(после для остановки

Код:

[root@]# service samba stop

)) будет надпись, что стартовал и остановился или такого сервиса нет
3. winbind

Код:

[root@]# service winbind start

(после для остановки

Код:

[root@]# service winbind stop

)) будет надпись, что стартовал и остановился или такого сервиса нет

Привожу ниже конфиг самбы: /etc/smb.conf

Код:

[global]
display charset = UTF-8
name resolve order = hosts wins bcast lmhosts
idmap gid = 10000-20000
hosts allow = 192.168.0. 127.0.0.1
winbind uid = 10000-20000
dns proxy = no
netbios name = new_gateway
idmap uid = 10000-20000
dos charset = 866
local master = no
workgroup = DCTS (Регистр!!!)
#debug level = 2
security = ADS (Регистр!!!)
winbind separator = \
max log size = 50
log file = /var/log/samba/log.%m
guest account = nobody
socket options = TCP_NODELAY SO_SNDBUF=8192 SO_RCVBUF=8192
wins server = 192.168.0.1 192.168.0.242
auth methods = winbind
map to guest = bad user
bind interfaces only = yes
interfaces = eth0 192.168.0.
null passwords = yes
domain master = no
local master = no
encrypt passwords = yes
winbind use default domain = yes
realm = DCTS
case sensitive = no
server string = gateway
password server = DCTS
winbind gid = 10000-20000
create mode = 777
unix charset = KOI8-R
winbind separator = \
#interfaces = 192.168.0.111/24

#Расшаренные ресурсы
[TMP]
comment = Temp_files
path = /etc/samba/tmp #Проверьте наличие каталога. К данному каталогу обязательно выдайте те права, которые нужны с помощью любой оболочки
browseable = yes
writeable = yes
directory mask = 0777
create mask = 0777
public = yes

Для проверки введите
Код:

testparm

. Не реагируйте, если пишет что-то за winbind separator

Файл: /etc/samba/lmhosts

Код:

127.0.0.1 localhost
192.168.0.111 new_gateway
192.168.0.1 pdc
192.168.0.242 bdc

Файл etc/krb5.conf (соблюдайте регистр букв!!!)

Код:

[logging]
default = FILE:/var/log/kerberos/krb5libs.log
kdc = FILE:/var/log/kerberos/krb5kdc.log
admin_server = FILE:/var/log/kerberos/kadmind.log

[libdefaults]
ticket_lifetime = 24000
default_realm = DCTS
dns_lookup_realm = false
dns_lookup_kdc = false

[realms]
DCTS = {
kdc = DCTS:88
admin_server = DCTS
default_domain = DCTS
}

[domain_realm]
.dcts = DCTS

[kdc]
profile = /etc/kerberos/krb5kdc/kdc.conf

[pam]
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false

[login]
krb4_convert = false
krb4_get_tickets = false

Правим файл /etc/nsswitch.conf
Я привожу его полностью, обратите внимание на строки с надписью winbind (первые три)

Код:

passwd: files winbind
shadow: files winbind
group: files winbind

#hosts: files nis dns
hosts: files nisplus nis dns
networks: files

services: files
protocols: files
rpc: files
ethers: files
netmasks: files
#netgroup: files
netgroup: nisplus files

#publickey: files
publickey: nisplus files

bootparams: nisplus [NOTFOUND=return] files
#bootparams: files
automount: files nisplus
aliases: files nisplus

Потом редактируем /etc/pam.d/samba
Добавляем недостающие строки:

Код:

#%PAM-1.0
auth include system-auth
auth required pam_winbind.so
auth required pam_nologin.so
auth required pam_stack.so service=system-auth
account required pam_nologin.so
account required pam_stack.so service=system-auth
account include system-auth
account sufficient pam_winbind.so
session include system-auth
session required pam_stack.so service=system-auth
password required pam_winbind.so

Аналогично: /etc/pam.d/system-auth-winbind (Не перепутайте с system-auth, иначе есть риск, что уже больше не авторизуетесь при перезагрузке)

Код:

#%PAM-1.0
auth required pam_env.so
auth sufficient pam_winbind.so
auth sufficient pam_unix.so likeauth nullok use_first_pass
auth required pam_deny.so

account sufficient pam_winbind.so
account required pam_unix.so

password required pam_cracklib.so retry=3
password sufficient pam_unix.so nullok use_authtok md5 shadow
password required pam_deny.so

session required pam_mkhomedir.so skel=/etc/skel/ umask=0022
session required pam_limits.so
session required pam_unix.so

Пробуем пинговать. В моем случае

Код:

[root@]# ping dcts.local
[root@]# ping 192.168.0.1
[root@]# ping 192.168.0.242 #IP наших серверов

Выполняем:

Код:

[root@]# net join -U alena

Иногда надо

Код:

[root@]# net join -U alena@dcts

После этого мы должны ввести пароль админа контроллера домена.
Результатом должно быть
Joined to domain DCTS.

Далее выполняем:

Код:

[root@]# service winbind restart
[root@]# service smb restart

После этого, смотрим, как все работает:
Если что-то неправильно - смотрим конфиги.
Сначала:

Код:

[root@]# wbinfo -p

Ping to winbindd succeeded

Затем:

Код:

[root@]# wbinfo -t

Сhecking the trust secret via RPC calls succeeded

Смотрим, отображаются ли пользователи:

Код:

[root@]# wbinfo -u

Тут будут перечислены пользователи домена.

Смотрим, отображаются ли группы:

Код:

[root@]# wbinfo -g

Тут будут перечислены группы домена.

Смотрим видит ли линукс вышеперечисленное:

Код:

[root@]# getent group

Тут будут перечислены сначала группы и пользователи линукса - следом будут пользователи и группы домена.

Если что-то не так: смотрим
/var/log/samba/log.smbd
/var/log/samba/log.nmbd
/var/log/samba/log.winbindd

PS Если что, пишите в личку, помогу чем смогу, правда я сам в этом лузер. Спасибо за внимание

Модерирует : lynx, Crash_Master, dg, emx, ShriEkeR
Версия для печати • Подписаться • Добавить в закладки
Страницы: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38