| |
Note
Samba cannot use the Heimdal libraries if there is no /etc/krb5.conf file.
So long as there is an empty file, the Heimdal kerberos libraries will be usable. There is no
need to specify any settings because Samba, using the Heimdal libraries, can figure this out automatically.
Edit the NSS control file /etc/nsswitch.conf so it has the following entries:
...
passwd: files ldap
shadow: files ldap
group: files ldap
...
hosts: files wins
...
You will need the
PADL
nss_ldap
tool set for this solution. Configure the /etc/ldap.conf file so it has
the information needed. The following is an example of a working file:
host 192.168.2.1
base dc=snowshow,dc=com
binddn cn=Manager,dc=snowshow,dc=com
bindpw not24get
pam_password exop
nss_base_passwd ou=People,dc=snowshow,dc=com?one
nss_base_shadow ou=People,dc=snowshow,dc=com?one
nss_base_group ou=Groups,dc=snowshow,dc=com?one
ssl no
The following procedure may be followed to effect a working configuration:
-
Configure the smb.conf file as shown above.
-
Create the /etc/krb5.conf file as shown above.
-
Configure the /etc/nsswitch.conf file as shown above.
-
Download, build, and install the PADL nss_ldap tool set. Configure the
/etc/ldap.conf file as shown above.
-
Configure an LDAP server and initialize the directory with the top-level entries needed by IDMAP,
shown in the following LDIF file:
dn: dc=snowshow,dc=com
objectClass: dcObject
objectClass: organization
dc: snowshow
o: The Greatest Snow Show in Singapore.
description: Posix and Samba LDAP Identity Database
dn: cn=Manager,dc=snowshow,dc=com
objectClass: organizationalRole
cn: Manager
description: Directory Manager
dn: ou=Idmap,dc=snowshow,dc=com
objectClass: organizationalUnit
ou: idmap
-
Execute the command to join the Samba DMS to the ADS domain as shown here:
root# net ads testjoin
Using short domain name -- SNOWSHOW
Joined 'GOODELF' to realm 'SNOWSHOW.COM'
-
Store the LDAP server access password in the Samba secrets.tdb file as follows:
root# smbpasswd -w not24get
-
Start the
nmbd
,
winbind
, and
smbd
daemons in the order shown.
Follow the diagnositic procedures shown earlier in this chapter to identify success or failure of the join.
In many cases a failure is indicated by a silent return to the command prompt with no indication of the
reason for failure.
|
|
