在Redhat linux下使用ADS进行用户验证

在Redhat linux下使用ADS进行用户验证张会光msn:tony.guang@1.环境说明：ADS的主机名为ADSsrv，Linux的主机名为samplehost1，域名为。

Linux的版本为Redhat Entprise Linux V5.4，ADS的IP地址为192.168.1.103，Linux的IP地址为192.168.1.104。

IPTABLES和SELINUX均Disabled。

请根据实际情况进行设置。

ADS的配置方法与Troubleshooting不在本文档的范围内。

2.验证Windows的ADS域的正确性。

a)方法：在CMD里面ping ADS的主机名。

比如ADS的主机名为，则在CMD里面ping ，能够ping通。

3.安装一台全新的Linux系统，所有安装过程全部采用默认配置。

4.确保Linux系统时间和ADS的时间一致。

a)使用指令date查看。

如果不一致修改为时间一致。

5.安装必要的软件确保安装了以下软件：samba-common-3.0.33-3.14.el5system-config-samba-1.2.41-5.el5samba-client-3.0.33-3.14.el5samba-3.0.33-3.14.el5pam_krb5-2.2.14-10krb5-libs-1.6.1-36.el5krb5-workstation-1.6.1-36.el5krb5-auth-dialog-0.7-1krb5-devel-1.6.1-36.el56.配置基本的网络参数a)配置主机名修改/etc/sysconfig/networkNETWORKING=yesNETWORKING_IPV6=noHOSTNAME=samplehost1b)配置IP地址修改/etc/sysconfig/network-script/ifcfg-eth0内容如下：# Advanced Micro Devices [AMD] 79c970 [PCnet32 LANCE]DEVICE=eth0BOOTPROTO=staticHWADDR=00:0C:29:15:B9:48IPADDR=192.168.1.104NETMASK=255.255.255.0ONBOOT=yesc)配置本地IP解析修改/etc/hosts 内容如下：# Do not remove the following line, or various programs# that require network functionality will fail.127.0.0.1 localhost.localdomain localhost::1 localhost6.localdomain6 localhost6192.168.1.104 samplehost1d)配置DNS修改/etc/resolv.conf内容如下：search samplehost1nameserver 192.168.1.103e)验证配置#service network reload#ping 7.修改配置文件/etc/nsswitch.conf，主要修改内容如下：passwd: files winbindshadow: files winbindgroup: files winbind8.修改配置文件/etc/krb5.confa)配置/etc/krb5.conf内容如下：[logging]default = FILE:/var/log/krb5libs.logkdc = FILE:/var/log/krb5kdc.logadmin_server = FILE:/var/log/kadmind.log[libdefaults]default_realm = dns_lookup_realm = falsedns_lookup_kdc = falseticket_lifetime = 24hforwardable = yes[realms] = {kdc = 192.168.1.103:88default_domain = kdc = 192.168.1.103}[domain_realm] = = [appdefaults]pam = {debug = falseticket_lifetime = 36000renew_lifetime = 36000forwardable = truekrb4_convert = false}b)测试[root@samplehost1 ~]# kinit administrator@ Password for administrator@:[root@samplehost1 ~]#9.修改配置文件/etc/samba/smb.confa)创建文件夹/filedata/CIM和/filedata/DA TAb)配置，添加以下内容到/etc/samba/smb.conf里面：i.在global域里面添加以下行：workgroup = CFpassword server = 192.168.1.103realm = security = adsidmap uid = 16777216-33554431idmap gid = 16777216-33554431winbind separator = /template homedir = /home/%Utemplate shell = /bin/nologinwinbind use default domain = truewinbind offline logon = trueii.注释掉以下行：; security = user; passdb backend = tdbsamiii.注释掉home域和printers域里面的所有行：;[homes]; comment = Home Directories; browseable = no; writable = yes; valid users = %S; valid users = MYDOMAIN\%S;[printers]; comment = All Printers; path = /var/spool/samba; browseable = no; guest ok = no; writable = no; printable = yesiv.在文件的最后添加以下行：[CIM]comment = CIMpath = /filedata/CIMwriteable = yes[DA TA]comment = DA TApath = /filedata/DA TAwriteable = yesc)测试[root@samplehost1 ~]# testparmLoad smb config files from /etc/samba/smb.confProcessing section "[CIM]"Processing section "[DA TA]"Loaded services file OK.Server role: ROLE_STANDALONEPress enter to see a dump of your service definitions[global]workgroup = CFrealm = server string = Samba Server V ersion %vpassword server = 192.168.1.103idmap uid = 16777216-33554431idmap gid = 16777216-33554431template homedir = /home/%Utemplate shell = /bin/bashwinbind separator = /winbind use default domain = Y eswinbind offline logon = Y escups options = raw[CIM]comment = CIMpath = /filedata/CIMread only = No[DA TA]comment = DA TApath = /filedata/DA TAread only = No10.启动服务a)启动smb服务#service smb startb)启动winbind服务#service winbind start11.开启必要的服务、关闭不必要的服务[root@samplehost1 ~]# chkconfig smb on[root@samplehost1 ~]# chkconfig winbind on[root@samplehost1 ~]# chkconfig bluetooth off[root@samplehost1 ~]# chkconfig cups off[root@samplehost1 ~]# chkconfig firstboot off[root@samplehost1 ~]# chkconfig iptables off[root@samplehost1 ~]# chkconfig ip6tables off[root@samplehost1 ~]# chkconfig restorecond off[root@samplehost1 ~]# chkconfig rhnsd off[root@samplehost1 ~]# chkconfig sendmail off[root@samplehost1 ~]# chkconfig setroubleshoot off[root@samplehost1 ~]# chkconfig yum-updatesd off12.加入Windows域a)加入域[root@samplehost1 ~]# net rpc join -S -U administrator Password:Joined domain CF.b)重新启动smb、winbind服务[root@samplehost1 ~]# /etc/init.d/smb restartShutting down SMB services: [ OK ] Shutting down NMB services: [ OK ] Starting SMB services: [ OK ] Starting NMB services: [ OK ] [root@samplehost1 ~]# /etc/init.d/winbind restartShutting down Winbind services: [ OK ] Starting Winbind services: [ OK ]c)测试[root@samplehost1 ~]# wbinfo -tchecking the trust secret via RPC calls succeeded[root@samplehost1 ~]# wbinfo -gBUILTIN/administratorsBUILTIN/usersdomain computersdomain controllersschema adminsenterprise adminsdomain adminsdomain usersdomain guestsgroup policy creator ownersdnsupdateproxyaaaabbbbccccddddeeee[root@samplehost1 ~]# wbinfo -uadministratorguestsupport_388945a0__vmware_user__krbtgta1b1c1d1e113.自动创建用户目录a)配置修改/etc/pam.d/system-auth，添加以下行：session required pam_mkhomedir.so silent skel=/etc/skel umask=0077b)测试[root@samplehost1 ~]# su - a1[a1@samplehost1 ~]$ ls[a1@samplehost1 ~]$ pwd/home/a114.文件访问权限设置a)启动双机，通过clustat查看双机服务在那个机器上面。