パソコンやサーバの設定などのメモ

aptitude install slapd ldap-utils samba-doc

sudo su -m openldap
cp /etc/ldap/slapd.conf /etc/ldap/slapd.conf_ubuntu_default
vi /etc/ldap/slapd.conf

include         /etc/ldap/schema/samba.schema
include         /etc/ldap/schema/misc.schema

suffix          "dc=example,dc=com"
rootdn          "cn=admin,dc=example,dc=com"
rootpw {SSHA}なにやらランダムな文字列

slappasswd

access to attrs=userPassword,shadowLastChange,sambaNTPassword,sambaLMPassword
        by dn="cn=admin,dc=example,dc=com" write
        by anonymous auth
        by self write
        by * none

access to *
        by dn="cn=admin,dc=example,dc=com" write
        by self write
        by * read

cp /usr/share/doc/samba-doc/examples/LDAP/samba.schema.gz /etc/ldap/schema/
gzip -d /etc/ldap/schema/samba.schema.gz
ls -l /etc/ldap/schema/

sudo su -m openldap
vi /etc/ldap/ldap.conf

host 127.0.0.1
base dc=example,dc=com
ldap_version 3
uri ldap://127.0.0.1/
rootbinddn cn=admin,dc=example,dc=com

/etc/init.d/slapd restart

ldapsearch -x

# extended LDIF
#
# LDAPv3
# base <dc=example,dc=com> (default) with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# example.com
dn: dc=example,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: example.com
dc: example

# admin, example.com
dn: cn=admin,dc=example,dc=com
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin
description: LDAP administrator

# search result
search: 2
result: 0 Success

# numResponses: 3
# numEntries: 2

aptitude install libpam-ldap libnss-ldap nss-updatedb libnss-db

vi /etc/ldap.conf

host 127.0.0.1
base dc=example,dc=com
ldap_version 3
uri ldap://127.0.0.1/
rootbinddn cn=admin,dc=example,dc=com

cp /etc/nsswitch.conf /etc/nsswitch.conf_ubuntu_default
vi /etc/nsswitch.conf

passwd: files ldap
group: files ldap
shadow: files ldap

auth-client-config -a -p プロファイル名 設定ファイル名

cd /etc/pam.d
mkdir backup_default
cp common* backup_default/

vi common-account

account sufficient      pam_ldap.so
account required        pam_unix.so

vi common-auth

auth    sufficient      pam_ldap.so
auth    required        pam_unix.so nullok_secure use_first_pass

vi common-password

password   sufficient   pam_unix.so nullok obscure min=4 max=8 md5
password   required     pam_ldap.so try_first_pass

vi common-session

session required        pam_unix.so
session optional        pam_ldap.so

sync
reboot

aptitude install samba smbclient libpam-smbpass smbldap-tools

cp /etc/samba/smb.conf /etc/samba/smb.conf_ubuntu_default
vi /etc/samba/smb.conf

[global]
  dos charset = CP932
  unix charset = UTF8
  netbios name = SAMBA9
  workgroup = TEST9
  passdb backend = ldapsam
  domain logons = yes
  domain master = Yes
  preferred master = Yes
  domain master = Yes
  local master = Yes
  wins support = yes
  os level = 64
  log level = 1
  enable privileges = Yes
  store dos attributes = yes
  map archive = no

  add share command = /etc/samba/mgrshare
  change share command = /etc/samba/mgrshare
  delete share command = /etc/samba/mgrshare

  admin users = Administrator
  ldap ssl = no
  ldap admin dn = cn=admin,dc=example,dc=com
  ldap suffix = dc=example,dc=com
  ldap group suffix = ou=Groups
  ldap user suffix = ou=Users
  ldap machine suffix = ou=Computers
  ldap idmap suffix = ou=Idmap

  add user script = /usr/sbin/smbldap-useradd -m "%u"
  ldap delete dn = Yes
  delete user script = /usr/sbin/smbldap-userdel "%u"
  rename user script = /usr/sbin/smbldap-usermod -r "%unew" "%uold"
  add machine script = /usr/sbin/smbldap-useradd -w "%u"
  add group script = /usr/sbin/smbldap-groupadd -p "%g"
  delete group script = /usr/sbin/smbldap-groupdel "%g"
  add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
  delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
  set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u"

  ldap passwd sync = Yes
  passwd program = /usr/sbin/smbldap-passwd %u
  passwd chat = *New*password* %n\n *Retype*new*password* %n\n *all*authentication*tokens*updated*

  logon path = \\%N\profiles\%U

  socket options = TCP_NODELAY SO_SNDBUF=8760 SO_RCVBUF=8760

#  username map = /etc/samba/smbusers

[homes]
  comment = %U's Home Directory
  browseable = no
  writeable = yes
  hide unreadable = Yes
  delete veto files = Yes
  hide files = /.*/DesktopFolderDB/TrashFor%m/resource.frk/
  vfs objects = recycle
  recycle:repository = recycle
  recycle:keeptree = yes
  recycle:versions = yes
  recycle:touch = no
  recycle:maxsize = 0
  recycle:exclude = *.tmp ~$*

[profiles]
  comment = Profile Directory
  path = /var/lib/samba/shares/profiles
  profile acls = yes
  writeable = yes
  directory mask = 0700
  create mask = 0600
  browseable = no

[netlogon]
  comment = Network Logon Service
  path = /var/lib/samba/shares/netlogon
  guest ok = yes
  writeable = no

mkdir -p /var/lib/samba/shares/{netlogon,profiles,printers}
chmod 1777 /var/lib/samba/shares/profiles
chmod g+ws /var/lib/samba/shares/printers
chgrp "Print Operators" /var/lib/samba/shares/printers

/etc/init.d/samba restart

smbpasswd -w Samba管理者パスワード

cd /usr/share/doc/smbldap-tools/examples/
cp smbldap_bind.conf /etc/smbldap-tools/
cp smbldap.conf.gz /etc/smbldap-tools/
gzip -d /etc/smbldap-tools/smbldap.conf.gz
cd /etc/smbldap-tools/

cd /etc/smbldap-tools
cp smbldap_bind.conf  smbldap_bind.conf_ubuntu_default
vi smbldap_bind.conf

slaveDN="cn=admin,dc=example,dc=com"
slavePw="LDAPの管理者生パスワード"
masterDN="cn=admin,dc=example,dc=com"
masterPw="LDAPの管理者生パスワード"

cp smbldap.conf smbldap.conf_ubuntu_default
vi smbldap.conf

SID="なにやら長い数字"

net getlocalsid

sambaDomain="TEST9"
suffix="dc=example,dc=com"
mailDomain="example.com"
userSmbHome="\\SAMBA9\%U"
userProfile="\\SAMBA9\profiles\%U"

smbldap-populate -u 30000 -g 30000

ldapsearch -x

smbldap-useradd -a test01
smbldap-passwd test01

pdbedit -v test01

su - test01
exit

smbldap-userdel test01

smbldap-useradd -a -m -G "Domain Admins,Domain Users" ユーザ名