XigmaNAS

Code: Select all

nas4free-labo: openldap # ssh 192.168.0.61 -l ppda
ppda@192.168.0.61's password: 
Permission denied, please try again.
ppda@192.168.0.61's password: 

nas4free-labo: openldap # 

Code: Select all

slapd_owner="DEFAULT"
slapd_enable="YES"
slapd_flags='-h "ldapi:///var/run/openldap/ldapi/ ldap://nas4free-labo.famille/"'
slapd_sockets="/var/run/openldap/ldapi"

Code: Select all

cat /usr/local/etc/openldap/rc.conf >> /etc/rc.conf

Code: Select all

openssl genrsa -out cert.key 1024
openssl req -new -key cert.key -out cert.csr
openssl x509 -req -in cert.csr -days 365 -signkey cert.key -out cert.crt

Code: Select all

smbpasswd -w mot_de_passe

Code: Select all

# $Id: smbldap.conf 139 2012-08-07 11:11:37Z fumiyas $
#
# smbldap-tools.conf : Q & D configuration file for smbldap-tools

#  This code was developped by IDEALX (http://IDEALX.org/) and
#  contributors (their names can be found in the CONTRIBUTORS file).
#
#                 Copyright (C) 2001-2002 IDEALX
#
#  This program is free software; you can redistribute it and/or
#  modify it under the terms of the GNU General Public License
#  as published by the Free Software Foundation; either version 2
#  of the License, or (at your option) any later version.
#
#  This program is distributed in the hope that it will be useful,
#  but WITHOUT ANY WARRANTY; without even the implied warranty of
#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#  GNU General Public License for more details.
#
#  You should have received a copy of the GNU General Public License
#  along with this program; if not, write to the Free Software
#  Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
#  USA.

#  Purpose :
#       . be the configuration file for all smbldap-tools scripts

##############################################################################
#
# General Configuration
#
##############################################################################

# Put your own SID. To obtain this number do: "net getlocalsid".
# If not defined, parameter is taking from "net getlocalsid" return
SID="S-1-5-21-1386905757-1073149043-2289761240"

# Domain name the Samba server is in charged.
# If not defined, parameter is taking from smb.conf configuration file
# Ex: sambaDomain="IDEALX-NT"
sambaDomain="YOHANN"

##############################################################################
#
# LDAP Configuration
#
##############################################################################

# Notes: to use to dual ldap servers backend for Samba, you must patch
# Samba with the dual-head patch from IDEALX. If not using this patch
# just use the same server for slaveLDAP and masterLDAP.
# Those two servers declarations can also be used when you have
# . one master LDAP server where all writing operations must be done
# . one slave LDAP server where all reading operations must be done
#   (typically a replication directory)

# Slave LDAP server URI
# Ex: slaveLDAP=ldap://slave.ldap.example.com/
# If not defined, parameter is set to "ldap://127.0.0.1/"
slaveLDAP="ldap://192.168.0.50/"

# Master LDAP server URI: needed for write operations
# Ex: masterLDAP=ldap://master.ldap.example.com/
# If not defined, parameter is set to "ldap://127.0.0.1/"
masterLDAP="ldap://192.168.0.50/"

# Use TLS for LDAP
# If set to 1, this option will use start_tls for connection
# (you must also used the LDAP URI "ldap://...", not "ldaps://...")
# If not defined, parameter is set to "0"
ldapTLS="0"

# How to verify the server's certificate (none, optional or require)
# see "man Net::LDAP" in start_tls section for more details
verify="require"

# CA certificate
# see "man Net::LDAP" in start_tls section for more details
cafile="/etc/smbldap-tools/ca.pem"

# certificate to use to connect to the ldap server
# see "man Net::LDAP" in start_tls section for more details
clientcert="/etc/smbldap-tools/smbldap-tools.example.com.pem"

# key certificate to use to connect to the ldap server
# see "man Net::LDAP" in start_tls section for more details
clientkey="/etc/smbldap-tools/smbldap-tools.example.com.key"

# LDAP Suffix
# Ex: suffix=dc=IDEALX,dc=ORG
suffix="dc=julp,dc=com"

# Where are stored Users
# Ex: usersdn="ou=Users,dc=IDEALX,dc=ORG"
# Warning: if 'suffix' is not set here, you must set the full dn for usersdn
usersdn="ou=Utilisateurs,${suffix}"

# Where are stored Computers
# Ex: computersdn="ou=Computers,dc=IDEALX,dc=ORG"
# Warning: if 'suffix' is not set here, you must set the full dn for computersdn
computersdn="ou=Computers,${suffix}"

# Where are stored Groups
# Ex: groupsdn="ou=Groups,dc=IDEALX,dc=ORG"
# Warning: if 'suffix' is not set here, you must set the full dn for groupsdn
groupsdn="ou=Groupes,${suffix}"

# Where are stored Idmap entries (used if samba is a domain member server)
# Ex: idmapdn="ou=Idmap,dc=IDEALX,dc=ORG"
# Warning: if 'suffix' is not set here, you must set the full dn for idmapdn
idmapdn="ou=Idmap,${suffix}"

# Where to store next uidNumber and gidNumber available for new users and groups
# If not defined, entries are stored in sambaDomainName object.
# Ex: sambaUnixIdPooldn="sambaDomainName=${sambaDomain},${suffix}"
# Ex: sambaUnixIdPooldn="cn=NextFreeUnixId,${suffix}"
sambaUnixIdPooldn="sambaDomainName=${sambaDomain},${suffix}"

# Default scope Used
scope="sub"

# Unix password hash scheme (CRYPT, MD5, SMD5, SSHA, SHA, CLEARTEXT)
# If set to "exop", use LDAPv3 Password Modify (RFC 3062) extended operation.
password_hash="SSHA"

# if password_hash is set to CRYPT, you may set a salt format.
# default is "%s", but many systems will generate MD5 hashed
# passwords if you use "$1$%.8s". This parameter is optional!
password_crypt_salt_format="%s"

##############################################################################
# 
# Unix Accounts Configuration
# 
##############################################################################

# Login defs
# Default Login Shell
# Ex: userLoginShell="/bin/bash"
userLoginShell="/bin/bash"

# Home directory
# Ex: userHome="/home/%U"
userHome="/home/%U"

# Default mode used for user homeDirectory
userHomeDirectoryMode="700"

# Gecos
userGecos="System User"

# Default User (POSIX and Samba) GID
defaultUserGid="513"

# Default Computer (Samba) GID
defaultComputerGid="515"

# Skel dir
skeletonDir="/etc/skel"

# Treat shadowAccount object or not
shadowAccount="1"

# Default password validation time (time in days) Comment the next line if
# you don't want password to be enable for defaultMaxPasswordAge days (be
# careful to the sambaPwdMustChange attribute's value)
defaultMaxPasswordAge="45"

##############################################################################
#
# SAMBA Configuration
#
##############################################################################

# The UNC path to home drives location (%U username substitution)
# Just set it to a null string if you want to use the smb.conf 'logon home'
# directive and/or disable roaming profiles
# Ex: userSmbHome="\\PDC-SMB3\%U"
userSmbHome="\\192.168.0.50\%U"

# The UNC path to profiles locations (%U username substitution)
# Just set it to a null string if you want to use the smb.conf 'logon path'
# directive and/or disable roaming profiles
# Ex: userProfile="\\PDC-SMB3\profiles\%U"
userProfile="\\192.168.0.50\profiles\%U"

# The default Home Drive Letter mapping
# (will be automatically mapped at logon time if home directory exist)
# Ex: userHomeDrive="H:"
userHomeDrive="H:"

# The default user netlogon script name (%U username substitution)
# if not used, will be automatically username.cmd
# make sure script file is edited under dos
# Ex: userScript="startup.cmd" # make sure script file is edited under dos
userScript="logon.bat"

# Domain appended to the users "mail"-attribute
# when smbldap-useradd -M is used
# Ex: mailDomain="idealx.com"
mailDomain="example.com"

##############################################################################
#
# SMBLDAP-TOOLS Configuration (default are ok for a RedHat)
#
##############################################################################

# Allows not to use smbpasswd (if with_smbpasswd="0" in smbldap.conf) but
# prefer Crypt::SmbHash library
with_smbpasswd="0"
smbpasswd="/usr/local/bin/smbpasswd"

# Allows not to use slappasswd (if with_slappasswd="0" in smbldap.conf)
# but prefer Crypt:: libraries
with_slappasswd="0"
slappasswd="/usr/local/sbin/slappasswd"

# comment out the following line to get rid of the default banner
# no_banner="1"

Code: Select all

# $Id: smbldap_bind.conf 35 2011-02-23 09:07:36Z fumiyas $
#
############################
# Credential Configuration #
############################
# Notes: you can specify two differents configuration if you use a
# master ldap for writing access and a slave ldap server for reading access
# By default, we will use the same DN (so it will work for standard Samba
# release)
slaveDN="cn=manager,dc=julp,dc=com"
slavePw="mot_de_passe_en_clair"
masterDN="cn=manager,dc=julp,dc=com"
masterPw="mot_de_passe_en_clair"

Code: Select all

/usr/local/sbin/smbldap-populate

Code: Select all

wins support = yes
domain logons = yes
os level = 64
logon path = \192.168.0.21\profile\%U
logon drive = P:
logon home = \192.168.0.21\%U
logon script = %U.bat

[netlogon]
path = /usr/local/lib/samba/netlogon
locking = No

[homes]
comment = Home Directory
read only = No
browseable = No
valid users = %S

[profile]
path = /usr/local/lib/samba/profile
browseable = No
writeable = Yes
create mask = 0777
directory mask = 0777

Code: Select all

mkdir /usr/local/lib/samba/netlogon
mkdir /usr/local/lib/samba/profile
mkdir /usr/local/lib/samba/home

Code: Select all

nas4free: ~ # testparm
Load smb config files from /var/etc/smb.conf
WARNING: The "idmap uid" option is deprecated
WARNING: The "idmap gid" option is deprecated
Processing section "[netlogon]"
Processing section "[homes]"
Processing section "[profile]"
Processing section "[films]"
Loaded services file OK.
Server role: ROLE_DOMAIN_PDC
Press enter to see a dump of your service definitions

[global]
        dos charset = CP437
        workgroup = YOHANN
        server string = NAS4Free Server
        passdb backend = ldapsam:"ldap://192.168.0.50"
        guest account = ftp
        syslog only = Yes
        max log size = 100
        max protocol = SMB2
        max xmit = 65535
        time server = Yes
        deadtime = 15
        socket options = TCP_NODELAY SO_SNDBUF=64240 SO_RCVBUF=64240
        load printers = No
        printcap name = /dev/null
        disable spoolss = Yes
        logon script = %U.bat
        logon path = \192.168.0.21\profile\%U
        logon drive = P:
        logon home = \192.168.0.21\%U
        domain logons = Yes
        os level = 64
        preferred master = Yes
        domain master = Yes
        dns proxy = No
        wins support = Yes
        ldap admin dn = cn=manager,dc=julp,dc=com
        ldap group suffix = ou=Groupes
        ldap machine suffix = ou=Computers
        ldap passwd sync = yes
        ldap suffix = dc=julp,dc=com
        ldap ssl = no
        ldap user suffix = ou=Utilisateurs
        idmap config * : range = 10000-39999
        ldapsam:trusted = yes
        idmap config * : backend = tdb
        store dos attributes = Yes
        strict locking = No

[netlogon]
        path = /usr/local/lib/samba/netlogon
        locking = No

[homes]
        comment = Home Directory
        valid users = %S
        read only = No
        browseable = No

[profile]
        path = /usr/local/lib/samba/profile
        read only = No
        create mask = 0777
        directory mask = 0777
        browseable = No

[films]
        comment = debian
        path = /mnt/pool1/coco/
        read only = No
        inherit permissions = Yes
        guest ok = Yes
        veto files = /.snap/.sujournal/
        vfs objects = shadow_copy2
        shadow:localtime = yes
        shadow:sort = desc
        shadow:snapdir = .zfs/snapshot
        shadow:format = auto-%Y%m%d-%H%M%S

Code: Select all

mkdir /mnt/opendlap
mount /dev/zvol/pool1/opendlap /mnt/opendlap
mount_unionfs -o w /mnt/openldap/usr/ /usr/
mount_unionfs -o w /mnt/openldap/var/ /var/

Code: Select all

/usr/local/libexec/slapd -d -1
/etc/rc.d/samba restart

Code: Select all

pw useradd patrick\$ -s /sbin/nologin -c "patrick"
smbldap-useradd -w patrick
smbpasswd -a -m patrick

Code: Select all

nas4free: ~ # smbldap-useradd -a -P pierre
Changing UNIX and samba passwords for pierre
New password:
Retype new password:

Code: Select all

nas4free: ~ # smbpasswd -a pierre
New SMB password:
Retype new SMB password:
nas4free: ~ # smbpasswd -e pierre
Enabled user pierre.
nas4free: ~ #

Code: Select all

net sam rights grant pierre SeMachineAccountPrivilege

Code: Select all

logon path = \\%L\profile\%U

Code: Select all

cd /usr/local/lib/samba
chown -R root:"Domain Users" profile

Code: Select all

logon path =

Code: Select all

smbldap-useradd -a -P -m toto

Code: Select all

sudo su
apt-get install winbind
nano /etc/samba/smb.conf

Code: Select all

mkdir /home/BERNARD

Code: Select all

nano /etc/nsswitch.conf 

Code: Select all

reboot

Code: Select all

sudo su

Code: Select all

net rpc join -S 192.168.0.21 -U pierre