Samba BDC2011/03/21 |
|
Samba BDC (バックアップドメインコントローラ) を構築します。
当然のことながら同一サブネット内にSamba PDC 構築済みが前提です。
また、この Samba BDC はLDAPクライアントである必要があります。
Samba PDC は同一サブネット内に一つのみ存在できますが、この Samba BDC はいくらでも構築することができます。
|
|
| [1] | smb.conf の設定はほぼプライマリ側と同じです。異なるのはプライマリ側が「domain master = Yes」に対して、 バックアップ側は「domain master = No」になる箇所のみです。 |
|
[root@slave ~]# mv /etc/samba/smb.conf /etc/samba/smb.conf.bak [root@slave ~]# cp /usr/share/doc/smbldap-tools-*/smb.conf /etc/samba/smb.conf
[root@slave ~]#
vi /etc/samba/smb.conf # 3行目：workgroup名を任意のものに変更 workgroup = ServerWorld
# 12行目：コメント化 # min passwd length = 3
# 22行目：変更 ldap passwd sync = yes
# 33,34行目：変更 Dos charset = CP932 Unix charset = UTF-8
# 42行目：変更(プライマリ側と異なる箇所) domain master = No
# 47行目：LDAPサーバー指定 passdb backend = ldapsam: ldap://10.0.0.100/
# 48行目：LDAP管理者DN変更 (LDAPサーバーで指定したもの) ldap admin dn = cn=admin,dc=server,dc=world
# 50行目：LDAP suffix 変更 (LDAPサーバーで指定したもの) ldap suffix = dc=server,dc=world ldap group suffix = ou= groups ldap user suffix = ou= people
# 60行目：コメント解除 delete group script = /usr/sbin/smbldap-groupdel "%g" # 64行目あたりに2行追記：管理者ユーザー指定、SSLなし set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u' admin users = domainadm
ldap ssl = no mkdir /home/netlogon [root@slave ~]# /etc/rc.d/init.d/smb restart Shutting down SMB services: [ OK ] Starting SMB services: [ OK ] [root@slave ~]# /etc/rc.d/init.d/nmb restart
Shutting down NMB services:
[root@slave ~]# [ OK ] Starting NMB services: [ OK ] smbpasswd -W # LDAP管理者パスワードをSambaに登録
Setting stored password for "cn=admin,dc=server,dc=world" in secrets.tdb
[root@slave ~]# New SMB password: # LDAP管理者パスワード Retype new SMB password: net rpc getsid # プライマリ側のSID取得(後で入力するので控えておく) Storing SID S-1-5-21-993657731-4025595428-2303453378 for Domain SERVERWORLD in secrets.tdb
[root@slave ~]#
vi /usr/share/doc/smbldap-tools-*/configure.pl # 527行目：以下のように\を追記
# Allows not to use smbpasswd (if with_smbpasswd=
\ "0\ " in smbldap.conf) but
# 532行目：以下のように\を追記
# Allows not to use slappasswd (if with_slappasswd=
[root@slave ~]# \ "0\ " in smbldap.conf)
perl /usr/share/doc/smbldap-tools-*/configure.pl $# is no longer supported at /usr/share/doc/smbldap-tools/configure.pl line 314. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- smbldap-tools script configuration -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Before starting, check . if your samba controller is up and running.
. if the domain SID is defined (you can get it with the 'net getlocalsid')
. you can leave the configuration using the Crtl-c key combination. empty value can be set with the "." character -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Looking for configuration files...
Samba Configuration File Path [/etc/samba/smb.conf] >
The default directory in which the smbldap configuration files are stored is shown.# 空Enter If you need to change this, enter the full directory path, then press enter to continue. Smbldap-tools Configuration Directory Path [/etc/smbldap-tools/] > # 空Enter -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Let's start configuring the smbldap-tools scripts ...
. workgroup name: name of the domain Samba act as a PDCworkgroup name [ServerWorld] > # 空Enter . netbios name: netbios name of the samba controler netbios name [PDC-SRV] > # 空Enter . logon drive: local path to which the home directory will be connected (for NT Workstations). Ex: 'H:' logon drive [H:] > # 空Enter . logon home: home directory location (for Win95/98 or NT Workstation). (use %U as username) Ex:'\\PDC-SRV\%U' logon home (press the "." character if you don't want homeDirectory) [\\PDC-SRV\%U] > . # ピリオド入力 . logon path: directory where roaming profiles are stored. Ex:'\\PDC-SRV\profiles\%U' logon path (press the "." character if you don't want roaming profile) [\\PDC-SRV\profiles\%U] > . # ピリオド入力 . home directory prefix (use %U as username) [/home/%U] > # 空Enter . default users' homeDirectory mode [700] > # 空Enter . default user netlogon script (use %U as username) [logon.bat] > # 空Enter default password validation time (time in days) [45] > # 空Enter . ldap suffix [dc=server,dc=world] > # 空Enter . ldap group suffix [ou=groups] > # 空Enter . ldap user suffix [ou=people] > # 空Enter . ldap machine suffix [ou=Computers] > # 空Enter . Idmap suffix [ou=Idmap] > # 空Enter . sambaUnixIdPooldn: object where you want to store the next uidNumber and gidNumber available for new users and groups sambaUnixIdPooldn object (relative to ) [sambaDomainName=ServerWorld] > # 空Enter . ldap master server: IP adress or DNS name of the master (writable) ldap server ldap master server [10.0.0.100] > # LDAPサーバーのIPを確認して空Enter . ldap master port [389] > # 空Enter . ldap master bind dn [cn=admin,dc=server,dc=world] > # 空Enter . ldap master bind password [] > # LDAP管理者パスワード . ldap slave server: IP adress or DNS name of the slave ldap server: can also be the master one ldap slave server [10.0.0.100] > # LDAPスレーブがあれば指定(なければ空Enter) . ldap slave port [389] > # 空Enter . ldap slave bind dn [cn=admin,dc=server,dc=world] > # 空Enter . ldap slave bind password [] > # スレーブがあれば入力(なければテキトーに) . ldap tls support (1/0) [0] > # 空Enter . SID for domain ServerWorld: SID of the domain (can be obtained with 'net getlocalsid PDC-SRV') SID for domain ServerWorld [S-1-5-21-1920916380-1846773335-299452290] > S-1-5-21-993657731-4025595428-2303453378 # PDCと同じもの . unix password encryption: encryption used for unix passwords unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA) [SSHA] > MD5 # MD5指定 . default user gidNumber [513] > # 空Enter . default computer gidNumber [515] > # 空Enter . default login shell [/bin/bash] > # 空Enter . default skeleton directory [/etc/skel] > # 空Enter . default domain name to append to mail adress [] > # 空Enter -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Use of uninitialized value $# in concatenation (.) or string at /usr/share/doc/smbldap-tools/configure.pl line 314, <STDIN> line 33. backup old configuration files: /etc/smbldap-tools/smbldap.conf->/etc/smbldap-tools/smbldap.conf.old /etc/smbldap-tools/smbldap_bind.conf->/etc/smbldap-tools/smbldap_bind.conf.old writing new configuration file: /etc/smbldap-tools/smbldap.conf done.
/etc/smbldap-tools/smbldap_bind.conf done.
[root@slave ~]# /etc/rc.d/init.d/smb restart Shutting down SMB services: [ OK ] Starting SMB services: [ OK ] [root@slave ~]# /etc/rc.d/init.d/nmb restart Shutting down NMB services: [ OK ] Starting NMB services: [ OK ] [root@slave ~]# pdbedit -L # ユーザー情報確認 root:0:root # プライマリ側と同じ結果が得られているか確認 nobody:99:nobody domainadm:1000:domainadm rx-78$:1001:RX-78$ rx-3$:1002:RX-3$ |
| Sponsored Link |