Samba结合AD实现域帐号认证的文件服务器

准备一台Windows域控制器, 在Samba服务器上安装Webmin图形化管理工具, samba, krb5-user, winbind.

修改/etc/krb5.conf.

[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = HZVOBILE.LOCAL
dns_lookup_kdc = false

[realms]
HZVOBILE.LOCAL = {
   default_domain = hzvobile.local
   kdc = vobile-dc1.hzvobile.local:88
   admin_server = vobile-dc1.hzvobile.local:749
}

[domain_realm]
.hzvobile.local = HZVOBILE.LOCAL
hzvobile.local = HZVOBILE.LOCAL

 

修改/etc/samba/smb.conf, 用testparm -s来检查smb.conf文件的合规性.

[global]
    winbind use default domain = yes
    pam password change = yes
;   winbind trusted domains only = yes       ##这行决定getent passwd是否能获得域帐号
    map to guest = bad user
    workgroup = HZVOBILE
    passdb backend = tdbsam
    log file = /var/log/samba/log.%m
    idmap config * : range = 16777216-33554431       ##如果不指定用户的UID, 上传文件后通过ll命令会发现所上传的用户和组都是root; 指定之后, 就显示用户user和domain user组
    obey pam restrictions = yes
    os level = 20
    panic action = /usr/share/samba/panic-action %d
    realm = HZVOBILE.LOCAL
;   password server = vobile-dc1.hzvobile.local
    passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
    server string = %h server (Samba, Ubuntu)
    dns proxy = no
    passwd program = /usr/bin/passwd %u
    usershare allow guests = yes
    unix password sync = yes
    security = ads
    syslog = 0
    max log size = 1000
    server role = standalone server
    winbind offline logon = false
    winbind enum groups = yes
    winbind enum users = yes

 

修改/etc/nsswitch.conf, 添加winbind验证方式.

passwd:         compat winbind
group:          compat winbind
shadow:         compat winbind

 

使用net ads join -U administrator命令将Samba服务器加入域.

重启后用wbinfo -t和-u或-g检查连通性, 正常情况下你可以看到活动目录中的所有账号和组.

checking the trust secret for domain HZVOBILE via RPC calls succeeded

 

此时你应该可以通过getent passwd查看到所有域帐号.

创建文件夹, 并将文件夹权限777(此处类似Windows权限控制, NTFS与Share权限共同作用于一个用户对文件的最终权限)

[chen_chen]
    valid users = hzvobile\chen_chen
    path = /mnt/hd2/chen_chen
    writeable = yes
[it]
    path = /mnt/hd2/it
    writeable = yes
    valid users = @hzvobile\it

 

客户端访问: smbclient //ip/folder -W workgroup -U chen.

 

2015-10-8更新:

我在Debian 8.2上安装了Samba 4.1.17, 发现wbinfo可以获取域帐号和组, 但是getent却不行, 经Google后找到解决方案

apt-get install libnss-winbind

 

2015-10-15更新:

域控设置的变更到winbind有一个刷新时间, 如果想缩短这个时间, 可以在smb.conf中加入以下设置:

[global]
...
idmap cache time = 1
idmap negative cache time = 1
winbind cache time = 1

 

2015-10-15更新磁盘配额:

首先, Linux的磁盘配额是对于整个分区生效的, 然后可以针对User或者Group进行限制, 下面对几种"矛盾"的情况作出分析:

1. 同时设置了User1和PGroup1的配额 (User1属于PGroup1), 则User1的配额生效.

2. 同时设置了PGroup2和SGroup2的配额 (User2同时属于PGroup2和SGroup2), 以User2的身份上传数据时, 哪个组是User2的Primary Group, 则哪个组的配额生效.

    2.1 在Windows活动目录中, 所有域帐号的Primary Group都是Domain Users, 一开始我希望通过usermod命令修改用户的Primary Group, 然后系统提示我: XXX用户不存在于/etc/passwd. 想想也是这样! Google后发现对于Winbind+ Active Directory的方式, 需要在Windows中修改用户的Primary Group, 具体方式是开启ADUC的高级功能, 然后在"隶属于"中"设置主要组". 注意: 如果组类型是本地域组, 则"设置主要组"按钮为灰色.

 

 

参考资料:

http://winda.blog.51cto.com/55153/261293/

http://rainbird.blog.51cto.com/211214/197509

http://blog.yam.com/gavint/article/4530697

http://ubuntuforums.org/showthread.php?t=2206822