Настройка Samba — различия между версиями

Текущая версия на 01:42, 17 февраля 2012

Первым делом необходимо остановить самбу:

/etc/init.d/smb stop

Правим /etc/samba/smb.conf, настраивая обыкновенный PDC. В итоге smb.conf должен принять примерно такой вид:

[global]
workgroup = Mandriva
netbiosname = MDS
preferred master = yes
os level = 65
wins support = yes
enable privileges = yes
timeserver = yes
log level = 3
null passwords = yes
security = user
name resolve order = bcast host
domain logons = yes
domain master = yes
printing = cups
printcap name = cups
logon path = \\%N\profiles\%U
logon script = logon.bat
logon drive = H:
map acl inherit = yes
nt acl support = yes
passdb backend = ldapsam:ldap://127.0.0.1/
obey pam restrictions = no
ldap admin dn = cn=manager,dc=mandriva,dc=com
ldap suffix = dc=mandriva,dc=com
ldap group suffix = ou=Group
ldap user suffix = ou=People
ldap machine suffix = ou=Hosts
ldap idmap suffix = ou=Idmap
ldap passwd sync = yes
# ldap delete dn = yes
passwd program = /usr/sbin/smbldap-passwd -u %u
passwd chat = "Changing password for*\nNew password*" %n\n "*Retype new password*" %n\n
add user script = /usr/sbin/smbldap-useradd -m "%u"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u"
add group script = /usr/sbin/ambldap-groupadd -p "%g"
add machine script = /usr/lib/mmc/add_machine_script '%u'
delete user script = /usr/sbin/smbldap-userdel "%u"
delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
delete group script = /usr/sbin/smbldap-groupdel "%g" 

[homes]
comment = Home directories
browseable = no
writeable = yes
create mask = 0700
directory mask = 0700
hide files = /Maildir/

[public]
comment = Public share
path = /home/samba/shares/public
browseable = yes
public = yes
writeable = yes

[archives]
comment = Backup share
path = /home/samba/archives
browseable = yes
public = no
writeable = no

[printers]
comment = Printers
path = /tmp
browseable = no
public = yes
guest ok = yes
writeable = no
printable = yes

[print$]
comment = Drivers
path = /var/lib/samba/printers
browseable = yes
guest ok = yes
read only = yes
write list = Administrator,root,@lpadmin

[netlogon]
path = /home/samba/netlogon
public = yes
writeable = yes
browseable = no

[profiles]
path = /home/samba/profiles
writeable = yes
create mask = 0700
directory mask = 0700
browseable = no
hide files = /desktop.ini/ntuser.ini/NTUSER.*/

[partage]
comment = aucun
path = /home/samba/partage
browseable = yes
public = no
writeable = yes

Затем — проверяем конфиг командой testparm:

testparm
Load smb config files from /etc/samba/smb.conf
...
Processing section "[partage]"
Loaded services file OK.
Server role: ROLE_DOMAIN_PDC
Press enter to see a dump of your service definitions

Теперь создаем необходимые директории:
mkdir -p /home/samba/shares/public/
mkdir /home/samba/netlogon/
mkdir /home/samba/profiles/
mkdir /home/samba/partage/
mkdir /home/samba/archives/

И зададим им соответствующие права:
chown -R :"Domain Users" /home/samba/
chmod 777 /var/spool/samba/ /home/samba/shares/public/
chmod 755 /home/samba/netlogon/
chmod 770 /home/samba/profiles/ /home/samba/partage/
chmod 700 /home/samba/archives/

Всё хорошо. Идём дальше. Теперь дадим самбе права на чтение ldap базы.

smbpasswd -w example
Setting stored password for "cn=manager,dc=mandriva,dc=com" in secrets.tdb

Получаем SID для нашего домена:

net getlocalsid mandriva.com

Теперь нам необходимо заселить LDAP записями Samba-домена. Устанавливаем smbldap-tools:

urpmi smbldap-tools

Идем в /etc/smbldap-tools/ и правим smbldap_bind.conf:

slaveDN="cn=admin,dc=mandriva,dc=com"
slavePw="example"
masterDN="cn=Manager,dc=mandriva,dc=com"
masterPw="example"

Теперь правим smbldap.conf:

SID="S-1-5-21-128599351-419866736-2079179792"
sambaDomain="MANDRIVA"
ldapTLS="0"
suffix="dc=mandriva,dc=com
sambaUnixIdPooldn="sambaDomainName=MANDRIVA,${suffix}"
#defaultMaxPasswordAge="45"
userSmbHome=""
userProfile=""
userHomeDrive=""

Заселяем LDAP:

smbldap-populate -m 512 -a administrator

Настраиваем NSS: В /etc/nsswitch.conf правим такие записи:

passwd: files ldap
shadow: files ldap
group: files ldap
hosts: files dns
bootparams: files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files
netgroup: files
publickey: files
automount: files
aliases: files

В /etc/ldap.conf:

host 127.0.0.1
base dc=mandriva,dc=com

Теперь перезапускаем samba и ldap и получаем работающий контроллер домена.