Samba com autenticação no AD 2008
Autor: Diego Maciel | Publicado: 2012-07-23T09:37:00-03:00



Ambiente utilizado:

Servidor AD: Windows 2008 Server R2
Domínio AD: empresa.com.br
Nome da Máquina: master.empresa.com.br
IP: 192.168.1.2
Configurar os serviços AD e DNS (o que é bastante simples)

Servidor Samba: CentOS 5
Nome da Máquina: alpha.empresa.com.br
IP: 192.168.1.10

Vamos as que interessa!!!




Configuração da Rede:




Edite o arquivo /etc/sysconfig/network



NETWORKING: yes

NETWORKING_IPV6: no

HOSTNAME: alpha.empresa.com.br

GATEWAY: 192.168.1.1




Resolução de Nomes


Edite o arquivo /etc/hosts



127.0.0.1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;localhost.localdomain &nbsp; &nbsp; &nbsp; &nbsp;localhost


::1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;localhost6.localdomain &nbsp; &nbsp; &nbsp;localhost6

192.168.1.10 &nbsp; &nbsp;alpha.empresa.com.br &nbsp; &nbsp; &nbsp; &nbsp;alpha

192.168.1.2 &nbsp; &nbsp; &nbsp;master.empresa.com.br &nbsp; &nbsp; &nbsp;master

192.168.1.2 &nbsp; &nbsp; &nbsp;empresa.com.br &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; empresa



Faça os teste de ping nos nomes configurados.




Configuração do DNS


Edite o arquivo /etc/resolv.conf




domain empresa.com.br

search empresa.com.br

nameserver 192.168.1.1




Configuração do Kerberos


Edite o arquivo /etc/krb5.conf





[logging]

default = FILE:/var/log/krb5libs.log

kdc = FILE:/var/log/krb5kdc.log

admin_server = FILE:/var/log/kadmind.log



[libdefaults]

default_realm = EMPRESA.COM.BR

dns_lookup_realm = false

dns_lookup_kdc = true



[realms]

EMPRESA.COM.BR = {

admin_server = master.empresa.com.br

default_domain = empresa.com.br

kdc = 192.168.1.2

}



[domain_realm]

.empresa.com.br = EMPRESA.COM.BR

empresa.com.br = EMPRESA.COM.BR



[kdc]

profile = /var/kerberos/krb5kdc/kdc.conf



[appdefaults]

pam = {

debug = false

ticket_lifetime = 36000

renew_lifetime = 36000

forwardable = true

krb4_convert = false

}





Configuração do Samba


Edite o arquivo /etc/samba/smb.conf





[global]

&nbsp; &nbsp; &nbsp; &nbsp; workgroup = EMPRESA

&nbsp; &nbsp; &nbsp; &nbsp; server string = Samba Server

&nbsp; &nbsp; &nbsp; &nbsp; netbios name = alpha

&nbsp; &nbsp; &nbsp; &nbsp; realm = EMPRESA.COM.BR

&nbsp; &nbsp; &nbsp; &nbsp; passdb backend = tdbsam



&nbsp; &nbsp; &nbsp; &nbsp; password server = 192.168.1.2

&nbsp; &nbsp; &nbsp; &nbsp; idmap uid = 600-20000

&nbsp; &nbsp; &nbsp; &nbsp; idmap gid = 600-20000



&nbsp; &nbsp; &nbsp; &nbsp; winbind enum users = yes

&nbsp; &nbsp; &nbsp; &nbsp; winbind enum groups = yes

&nbsp; &nbsp; &nbsp; &nbsp; winbind use default domain = yes

&nbsp; &nbsp; &nbsp; &nbsp; winbind nested groups = yes

&nbsp; &nbsp; &nbsp; &nbsp; winbind cache time = 86400



&nbsp; &nbsp; &nbsp; &nbsp; max connections = 0

&nbsp; &nbsp; &nbsp; &nbsp; socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192

&nbsp; &nbsp; &nbsp; &nbsp; unix charset = iso-8859-1

&nbsp; &nbsp; &nbsp; &nbsp; template shell = /bin/false

&nbsp; &nbsp; &nbsp; &nbsp; template homedir = /dev/null

&nbsp; &nbsp; &nbsp; &nbsp; enhanced browsing = no



&nbsp; &nbsp; &nbsp; &nbsp; log file = /var/log/samba/%m.log

&nbsp; &nbsp; &nbsp; &nbsp; max log size = 1000

&nbsp; &nbsp; &nbsp; &nbsp; syslog = 0

&nbsp; &nbsp; &nbsp; &nbsp; encrypt passwords = true

&nbsp; &nbsp; &nbsp; &nbsp; security = ads

&nbsp; &nbsp; &nbsp; &nbsp; password server = 192.168.1.2

&nbsp; &nbsp; &nbsp; &nbsp; preferred master = no

&nbsp; &nbsp; &nbsp; &nbsp; wins server = master.empresa.com.br

&nbsp; &nbsp; &nbsp; &nbsp; dns proxy = no

&nbsp; &nbsp; &nbsp; &nbsp; load printers = no

&nbsp; &nbsp; &nbsp; &nbsp; map to guest = bad user





[geral]

&nbsp; &nbsp; &nbsp; &nbsp; comment = Compartilhamento Geral para todos os usuarios

&nbsp; &nbsp; &nbsp; &nbsp; path = /home/geral

&nbsp; &nbsp; &nbsp; &nbsp; read only = no

&nbsp; &nbsp; &nbsp; &nbsp; browseable = yes



[informatica]

&nbsp; &nbsp; &nbsp; &nbsp; path = /home/ti

&nbsp; &nbsp; &nbsp; &nbsp; read only = no

&nbsp; &nbsp; &nbsp; &nbsp; valid users = @EMPRESA\Informatica

&nbsp; &nbsp; &nbsp; &nbsp; guest ok = no

&nbsp; &nbsp; &nbsp; &nbsp; browseable = yes

&nbsp; &nbsp; &nbsp; &nbsp; force group = Informatica





Configurando a Autenticação


Edite o arquivo /etc/nsswitch.conf (modifique somente as linha abaixo, as demais não devem ser apagadas)





passwd: &nbsp; &nbsp; files winbind

shadow: &nbsp; &nbsp; files winbind

group: &nbsp; &nbsp; &nbsp;files winbind

protocols: &nbsp;files winbind

services: &nbsp; files winbind

netgroup: &nbsp; files winbind

automount: &nbsp;files winbind





Adicionando a Máquina ao Domínio



Restart o Samba e o Winbind:



/etc/init.d/smb restart

/etc/init.d/winbind restart



Acerte a hora o servidor:



ntpdate master.empresa.com.br



Adicione ao domínio:



net ads join -U Administrador



Informe a senha do Administrador do AD, o comando deve informar a seguinte saída:



Using Short domain name - EMPRESA

Joined 'ALPHA' to realm 'EMPRESA.COM.BR'



Em alguns tutorias que pesquisei na internet, na saída acima existia mais uma linha com o conteúdo 'DNS update failed'. Vi que a resolução desse problema é bastante simples, mas não sei exatamente se vai funcionar, pois no meu caso não obtive esse problema. Segue abaixo a resolução do problema.



Edite o arquivo /etc/hosts




#127.0.0.1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;localhost.localdomain &nbsp; &nbsp; &nbsp; &nbsp;localhost

#::1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;localhost6.localdomain &nbsp; &nbsp; &nbsp;localhost6

192.168.1.10 &nbsp; &nbsp;alpha.empresa.com.br &nbsp; &nbsp; &nbsp; &nbsp;alpha

192.168.1.2 &nbsp; &nbsp; &nbsp;master.empresa.com.br &nbsp; &nbsp; &nbsp;master

192.168.1.2 &nbsp; &nbsp; &nbsp;empresa.com.br &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; empresa




Execute mais uma vez o comando para adicionar a máquina ao domínio.



Deixe os serviços do Samba e Winbind subindo automaticamente:



chkconfig --level 12345 smb on

chkconfig --level 12345 winbind on



Use o comando wbinfo para fazer os teste necessários.

Edite o arquivo /etc/pam.d/system-auth e deixe-o da seguinte forma:



auth &nbsp; &nbsp; &nbsp; &nbsp;required &nbsp; &nbsp; &nbsp;pam_env.so
auth &nbsp; &nbsp; &nbsp; &nbsp;sufficient &nbsp; &nbsp;pam_unix.so nullok try_first_pass
auth &nbsp; &nbsp; &nbsp; &nbsp;sufficient &nbsp; &nbsp;pam_krb5.so use_first_pass
auth &nbsp; &nbsp; &nbsp; &nbsp;requisite &nbsp; &nbsp; pam_succeed_if.so uid &gt;= 500 quiet
auth &nbsp; &nbsp; &nbsp; &nbsp;required &nbsp; &nbsp; &nbsp;pam_deny.so

account &nbsp; &nbsp; required &nbsp; &nbsp; &nbsp;pam_unix.so
account &nbsp; &nbsp; sufficient &nbsp; &nbsp;pam_succeed_if.so uid &lt; 500 quiet
account &nbsp; &nbsp; sufficient &nbsp; &nbsp;pam_krb5.so
account &nbsp; &nbsp; required &nbsp; &nbsp; &nbsp;pam_permit.so

password &nbsp; &nbsp;requisite &nbsp; &nbsp; pam_cracklib.so try_first_pass retry=3
password &nbsp; &nbsp;sufficient &nbsp; &nbsp;pam_unix.so md5 shadow nullok try_first_pass use_authtok
password &nbsp; &nbsp;sufficient &nbsp; &nbsp;pam_krb5.so use_authtok
password &nbsp; &nbsp;sufficient &nbsp; &nbsp;pam_winbind.so use_authtok
password &nbsp; &nbsp;required &nbsp; &nbsp; &nbsp;pam_deny.so

session &nbsp; &nbsp; optional &nbsp; &nbsp; &nbsp;pam_keyinit.so revoke
session &nbsp; &nbsp; optional &nbsp; &nbsp; &nbsp;pam_krb5.so
session &nbsp; &nbsp; required &nbsp; &nbsp; &nbsp;pam_limits.so
session &nbsp; &nbsp; [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session &nbsp; &nbsp; required &nbsp; &nbsp; &nbsp;pam_unix.so



Reinicie a máquina.