- Timestamp:
- Jun 17, 2009, 2:19:52 PM (16 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.3.x/docs/htmldocs/Samba3-ByExample/DomApps.html
r218 r274 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 12. Integrating Additional Services</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"><link rel="next" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 12. Integrating Additional Services</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="kerberos.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="HA.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="DomApps"></a>Chapter 12. Integrating Additional Services</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="DomApps.html#id26161 62">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2616193">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2616294">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2616327">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2616483">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2616500">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2618352">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2618413">Questions and Answers</a></span></dt></dl></div><p>2 <a class="indexterm" name="id26161 13"></a>3 <a class="indexterm" name="id26161 19"></a>4 <a class="indexterm" name="id26161 26"></a>5 <a class="indexterm" name="id26161 33"></a>6 <a class="indexterm" name="id261614 0"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 12. Integrating Additional Services</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"><link rel="next" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 12. Integrating Additional Services</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="kerberos.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="HA.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="DomApps"></a>Chapter 12. Integrating Additional Services</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="DomApps.html#id2616172">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2616202">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2616313">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2616346">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2616502">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2616520">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2618372">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2618432">Questions and Answers</a></span></dt></dl></div><p> 2 <a class="indexterm" name="id2616122"></a> 3 <a class="indexterm" name="id2616129"></a> 4 <a class="indexterm" name="id2616136"></a> 5 <a class="indexterm" name="id2616142"></a> 6 <a class="indexterm" name="id2616149"></a> 7 7 You've come a long way now. You have pretty much mastered Samba-3 for 8 8 most uses it can be put to. Up until now, you have cast Samba-3 in the leading … … 15 15 the latest Windows authentication technologies. Let's get started this is 16 16 leading edge. 17 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id26161 62"></a>Introduction</h2></div></div></div><p>17 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2616172"></a>Introduction</h2></div></div></div><p> 18 18 Abmas has continued its miraculous growth; indeed, nothing seems to be able 19 19 to stop its diversification into multiple (and seemingly unrelated) fields. … … 31 31 gradually, taking over key services and easing the way to a full migration and, 32 32 therefore, integration into Abmas's existing business later. 33 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2616193"></a>Assignment Tasks</h3></div></div></div><p> 34 <a class="indexterm" name="id2616201"></a> 33 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2616202"></a>Assignment Tasks</h3></div></div></div><p> 35 34 <a class="indexterm" name="id2616210"></a> 35 <a class="indexterm" name="id2616219"></a> 36 36 You've promised the skeptical Abmas Snack Foods management team 37 37 that you can show them how Samba can ease itself and other Open Source … … 40 40 acquisition). You have chosen Web proxying and caching as your proving ground. 41 41 </p><p> 42 <a class="indexterm" name="id26162 28"></a>43 <a class="indexterm" name="id26162 35"></a>42 <a class="indexterm" name="id2616238"></a> 43 <a class="indexterm" name="id2616245"></a> 44 44 Abmas Snack Foods has several thousand users housed at its head office 45 45 and multiple regional offices, plants, and warehouses. A high proportion of … … 51 51 the earliest commercial users of Microsoft ISA. 52 52 </p><p> 53 <a class="indexterm" name="id26162 56"></a>54 <a class="indexterm" name="id26162 63"></a>55 <a class="indexterm" name="id26162 70"></a>53 <a class="indexterm" name="id2616275"></a> 54 <a class="indexterm" name="id2616282"></a> 55 <a class="indexterm" name="id2616289"></a> 56 56 The team is not happy with ISA. Because it never lived up to its marketing promises, 57 57 it underperformed and had reliability problems. You have pounced on the opportunity … … 64 64 This is a hands-on exercise. You build software applications so 65 65 that you obtain the functionality Abmas needs. 66 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2616 294"></a>Dissection and Discussion</h2></div></div></div><p>66 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2616313"></a>Dissection and Discussion</h2></div></div></div><p> 67 67 The key requirements in this business example are straightforward. You are not required 68 68 to do anything new, just to replicate an existing system, not lose any existing features, … … 74 74 </p></li><li><p> 75 75 Seamless and transparent interoperability with the existing Active Directory domain 76 </p></li></ul></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id26163 27"></a>Technical Issues</h3></div></div></div><p>77 <a class="indexterm" name="id26163 34"></a>78 <a class="indexterm" name="id26163 41"></a>79 <a class="indexterm" name="id26163 48"></a>80 <a class="indexterm" name="id26163 55"></a>81 <a class="indexterm" name="id26163 62"></a>82 <a class="indexterm" name="id26163 69"></a>83 <a class="indexterm" name="id26163 76"></a>84 <a class="indexterm" name="id2616 382"></a>85 <a class="indexterm" name="id2616 389"></a>86 <a class="indexterm" name="id2616 396"></a>87 <a class="indexterm" name="id26164 03"></a>88 <a class="indexterm" name="id26164 10"></a>89 <a class="indexterm" name="id26164 19"></a><a class="indexterm" name="id2616425"></a>76 </p></li></ul></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2616346"></a>Technical Issues</h3></div></div></div><p> 77 <a class="indexterm" name="id2616354"></a> 78 <a class="indexterm" name="id2616361"></a> 79 <a class="indexterm" name="id2616368"></a> 80 <a class="indexterm" name="id2616374"></a> 81 <a class="indexterm" name="id2616381"></a> 82 <a class="indexterm" name="id2616388"></a> 83 <a class="indexterm" name="id2616395"></a> 84 <a class="indexterm" name="id2616402"></a> 85 <a class="indexterm" name="id2616409"></a> 86 <a class="indexterm" name="id2616416"></a> 87 <a class="indexterm" name="id2616423"></a> 88 <a class="indexterm" name="id2616430"></a> 89 <a class="indexterm" name="id2616439"></a><a class="indexterm" name="id2616445"></a> 90 90 Functionally, the user's Internet Explorer requests a browsing session with the 91 91 Squid proxy, for which it offers its AD authentication token. Squid hands off … … 108 108 </p></li><li><p> 109 109 Tying it all together 110 </p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2616 483"></a>Political Issues</h3></div></div></div><p>110 </p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2616502"></a>Political Issues</h3></div></div></div><p> 111 111 You are a stranger in a strange land, and all eyes are upon you. Some would even like to see 112 112 you fail. For you to gain the trust of your newly acquired IT people, it is essential that your … … 114 114 will the entrenched positions consider taking up your new way of doing things on a 115 115 wider scale. 116 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id26165 00"></a>Implementation</h2></div></div></div><p>117 <a class="indexterm" name="id26165 08"></a>116 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2616520"></a>Implementation</h2></div></div></div><p> 117 <a class="indexterm" name="id2616528"></a> 118 118 First, your system needs to be prepared and in a known good state to proceed. This consists 119 119 of making sure that everything the system depends on is present and that everything that could … … 122 122 they must be removed. 123 123 </p><p> 124 <a class="indexterm" name="id26165 25"></a>124 <a class="indexterm" name="id2616545"></a> 125 125 The following packages should be available on your Red Hat Linux system: 126 126 </p><div class="itemizedlist"><ul type="disc"><li><p> 127 <a class="indexterm" name="id26165 40"></a>128 <a class="indexterm" name="id26165 47"></a>127 <a class="indexterm" name="id2616560"></a> 128 <a class="indexterm" name="id2616566"></a> 129 129 krb5-libs 130 130 </p></li><li><p> … … 137 137 pam_krb5 138 138 </p></li></ul></div><p> 139 <a class="indexterm" name="id26165 77"></a>139 <a class="indexterm" name="id2616597"></a> 140 140 In the case of SUSE Linux, these packages are called: 141 141 </p><div class="itemizedlist"><ul type="disc"><li><p> … … 144 144 heimdal-devel 145 145 </p></li><li><p> 146 <a class="indexterm" name="id26166 02"></a>146 <a class="indexterm" name="id2616621"></a> 147 147 heimdal 148 148 </p></li><li><p> … … 153 153 for your Linux system to ensure that the packages are correctly updated. 154 154 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 155 <a class="indexterm" name="id26166 27"></a>156 <a class="indexterm" name="id26166 34"></a>157 <a class="indexterm" name="id26166 41"></a>155 <a class="indexterm" name="id2616646"></a> 156 <a class="indexterm" name="id2616653"></a> 157 <a class="indexterm" name="id2616660"></a> 158 158 If the requirement is for interoperation with MS Windows Server 2003, it 159 159 will be necessary to ensure that you are using MIT Kerberos version 1.3.1 … … 161 161 updating. 162 162 </p><p> 163 <a class="indexterm" name="id26166 54"></a>164 <a class="indexterm" name="id26166 61"></a>163 <a class="indexterm" name="id2616674"></a> 164 <a class="indexterm" name="id2616681"></a> 165 165 Heimdal 0.6 or later is required in the case of SUSE Linux. SUSE Enterprise 166 166 Linux Server 8 ships with Heimdal 0.4. SUSE 9 ships with the necessary version. 167 167 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch10-one"></a>Removal of Pre-Existing Conflicting RPMs</h3></div></div></div><p> 168 <a class="indexterm" name="id2616 684"></a>168 <a class="indexterm" name="id2616704"></a> 169 169 If Samba and/or Squid RPMs are installed, they should be updated. You can 170 170 build both from source. 171 171 </p><p> 172 <a class="indexterm" name="id2616 696"></a>173 <a class="indexterm" name="id26167 02"></a>174 <a class="indexterm" name="id26167 09"></a>172 <a class="indexterm" name="id2616716"></a> 173 <a class="indexterm" name="id2616722"></a> 174 <a class="indexterm" name="id2616729"></a> 175 175 Locating the packages to be un-installed can be achieved by running: 176 176 </p><pre class="screen"> … … 182 182 <code class="prompt">root# </code> rpm -e samba-common 183 183 </pre><p> 184 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id26167 49"></a>Kerberos Configuration</h3></div></div></div><p>185 <a class="indexterm" name="id26167 57"></a>186 <a class="indexterm" name="id26167 64"></a>187 <a class="indexterm" name="id26167 74"></a>188 <a class="indexterm" name="id2616 780"></a>184 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2616769"></a>Kerberos Configuration</h3></div></div></div><p> 185 <a class="indexterm" name="id2616777"></a> 186 <a class="indexterm" name="id2616784"></a> 187 <a class="indexterm" name="id2616793"></a> 188 <a class="indexterm" name="id2616800"></a> 189 189 The systems Kerberos installation must be configured to communicate with 190 190 your primary Active Directory server (ADS KDC). … … 194 194 unless you are using Windows 2003 servers. 195 195 </p><p> 196 <a class="indexterm" name="id2616799"></a>197 <a class="indexterm" name="id2616806"></a>198 <a class="indexterm" name="id2616813"></a>199 196 <a class="indexterm" name="id2616819"></a> 200 <a class="indexterm" name="id2616826"></a> 201 <a class="indexterm" name="id2616835"></a> 202 <a class="indexterm" name="id2616842"></a> 197 <a class="indexterm" name="id2616825"></a> 198 <a class="indexterm" name="id2616832"></a> 199 <a class="indexterm" name="id2616839"></a> 200 <a class="indexterm" name="id2616846"></a> 201 <a class="indexterm" name="id2616855"></a> 202 <a class="indexterm" name="id2616861"></a> 203 203 Officially, neither MIT (1.3.4) nor Heimdal (0.63) Kerberos needs an <code class="filename">/etc/krb5.conf</code> 204 204 file in order to work correctly. All ADS domains automatically create SRV records in the … … 208 208 specifying only a single KDC, even if there is more than one. Using the DNS lookup 209 209 allows the KRB5 libraries to use whichever KDCs are available. 210 </p><div class="procedure"><a name="id26168 76"></a><p class="title"><b>Procedure 12.1. Kerberos Configuration Steps</b></p><ol type="1"><li><p>211 <a class="indexterm" name="id2616 887"></a>210 </p><div class="procedure"><a name="id2616896"></a><p class="title"><b>Procedure 12.1. Kerberos Configuration Steps</b></p><ol type="1"><li><p> 211 <a class="indexterm" name="id2616907"></a> 212 212 If you find the need to manually configure the <code class="filename">krb5.conf</code>, you should edit it 213 213 to have the contents shown in <a class="link" href="DomApps.html#ch10-krb5conf" title="Example 12.1. Kerberos Configuration File: /etc/krb5.conf">“Kerberos Configuration File: /etc/krb5.conf”</a>. The final fully qualified path for this file 214 214 should be <code class="filename">/etc/krb5.conf</code>. 215 215 </p></li><li><p> 216 <a class="indexterm" name="id2616922"></a> 217 <a class="indexterm" name="id2616929"></a> 218 <a class="indexterm" name="id2616936"></a> 219 <a class="indexterm" name="id2616943"></a> 216 <a class="indexterm" name="id2616942"></a> 220 217 <a class="indexterm" name="id2616949"></a> 221 218 <a class="indexterm" name="id2616956"></a> 222 <a class="indexterm" name="id261696 3"></a>223 <a class="indexterm" name="id26169 70"></a>224 <a class="indexterm" name="id261697 7"></a>225 <a class="indexterm" name="id261698 6"></a>226 <a class="indexterm" name="id261699 3"></a>227 <a class="indexterm" name="id261 7000"></a>219 <a class="indexterm" name="id2616962"></a> 220 <a class="indexterm" name="id2616969"></a> 221 <a class="indexterm" name="id2616976"></a> 222 <a class="indexterm" name="id2616983"></a> 223 <a class="indexterm" name="id2616990"></a> 224 <a class="indexterm" name="id2616997"></a> 228 225 <a class="indexterm" name="id2617006"></a> 226 <a class="indexterm" name="id2617012"></a> 227 <a class="indexterm" name="id2617019"></a> 228 <a class="indexterm" name="id2617026"></a> 229 229 The following gotchas often catch people out. Kerberos is case sensitive. Your realm must 230 230 be in UPPERCASE, or you will get an error: “<span class="quote">Cannot find KDC for requested realm while getting … … 242 242 when you try to join the realm. 243 243 </p></li><li><p> 244 <a class="indexterm" name="id26170 51"></a>244 <a class="indexterm" name="id2617070"></a> 245 245 You are now ready to test your installation by issuing the command: 246 246 </p><pre class="screen"> … … 262 262 kdc = w2k3s.london.abmas.biz 263 263 } 264 </pre></div></div><br class="example-break"><p><a class="indexterm" name="id26171 16"></a>264 </pre></div></div><br class="example-break"><p><a class="indexterm" name="id2617135"></a> 265 265 The command 266 266 </p><pre class="screen"> … … 268 268 </pre><p> 269 269 shows the Kerberos tickets cached by the system. 270 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id26171 39"></a>Samba Configuration</h4></div></div></div><p>271 <a class="indexterm" name="id26171 46"></a>270 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2617158"></a>Samba Configuration</h4></div></div></div><p> 271 <a class="indexterm" name="id2617166"></a> 272 272 Samba must be configured to correctly use Active Directory. Samba-3 must be used, since it 273 273 has the necessary components to interface with Active Directory. 274 </p><div class="procedure"><a name="id26171 57"></a><p class="title"><b>Procedure 12.2. Securing Samba-3 With ADS Support Steps</b></p><ol type="1"><li><p>275 <a class="indexterm" name="id26171 69"></a>276 <a class="indexterm" name="id26171 76"></a>277 <a class="indexterm" name="id2617 183"></a>278 <a class="indexterm" name="id2617 190"></a>279 <a class="indexterm" name="id2617 196"></a>274 </p><div class="procedure"><a name="id2617177"></a><p class="title"><b>Procedure 12.2. Securing Samba-3 With ADS Support Steps</b></p><ol type="1"><li><p> 275 <a class="indexterm" name="id2617188"></a> 276 <a class="indexterm" name="id2617195"></a> 277 <a class="indexterm" name="id2617202"></a> 278 <a class="indexterm" name="id2617209"></a> 279 <a class="indexterm" name="id2617216"></a> 280 280 Download the latest stable Samba-3 for Red Hat Linux from the official Samba Team 281 281 <a class="ulink" href="http://ftp.samba.org" target="_top">FTP site.</a> The official Samba Team … … 283 283 needed, and are linked against MIT KRB5 version 1.3.1 and therefore are ready for use. 284 284 </p><p> 285 <a class="indexterm" name="id26172 23"></a>286 <a class="indexterm" name="id26172 30"></a>285 <a class="indexterm" name="id2617242"></a> 286 <a class="indexterm" name="id2617249"></a> 287 287 The necessary, validated RPM packages for SUSE Linux may be obtained from 288 288 the <a class="ulink" href="ftp://ftp.sernet.de/pub/samba" target="_top">SerNet</a> FTP site that … … 294 294 file so it has contents similar to the example shown in <a class="link" href="DomApps.html#ch10-smbconf" title="Example 12.2. Samba Configuration File: /etc/samba/smb.conf">“Samba Configuration File: /etc/samba/smb.conf”</a>. 295 295 </p></li><li><p> 296 <a class="indexterm" name="id2617 281"></a>297 <a class="indexterm" name="id2617 288"></a>298 <a class="indexterm" name="id2617 295"></a>i299 <a class="indexterm" name="id26173 06"></a>300 <a class="indexterm" name="id26173 13"></a>296 <a class="indexterm" name="id2617301"></a> 297 <a class="indexterm" name="id2617307"></a> 298 <a class="indexterm" name="id2617314"></a>i 299 <a class="indexterm" name="id2617326"></a> 300 <a class="indexterm" name="id2617332"></a> 301 301 Next you need to create a computer account in the Active Directory. 302 302 This sets up the trust relationship needed for other clients to … … 308 308 </pre><p> 309 309 </p></li><li><p> 310 <a class="indexterm" name="id2617347"></a>311 <a class="indexterm" name="id2617354"></a>312 <a class="indexterm" name="id2617361"></a>313 310 <a class="indexterm" name="id2617367"></a> 314 <a class="indexterm" name="id2617374"></a> 311 <a class="indexterm" name="id2617373"></a> 312 <a class="indexterm" name="id2617380"></a> 313 <a class="indexterm" name="id2617387"></a> 314 <a class="indexterm" name="id2617394"></a> 315 315 Your new Samba binaries must be started in the standard manner as is applicable 316 316 to the platform you are running on. Alternatively, start your Active Directory-enabled Samba with the following commands: … … 321 321 </pre><p> 322 322 </p></li><li><p> 323 <a class="indexterm" name="id26174 15"></a>324 <a class="indexterm" name="id26174 22"></a>325 <a class="indexterm" name="id26174 31"></a>326 <a class="indexterm" name="id26174 38"></a>327 <a class="indexterm" name="id26174 45"></a>323 <a class="indexterm" name="id2617435"></a> 324 <a class="indexterm" name="id2617441"></a> 325 <a class="indexterm" name="id2617451"></a> 326 <a class="indexterm" name="id2617458"></a> 327 <a class="indexterm" name="id2617464"></a> 328 328 We now need to test that Samba is communicating with the Active 329 329 Directory domain; most specifically, we want to see whether winbind … … 358 358 This enumerates all the groups in your Active Directory tree. 359 359 </p></li><li><p> 360 <a class="indexterm" name="id26175 09"></a>361 <a class="indexterm" name="id26175 16"></a>360 <a class="indexterm" name="id2617528"></a> 361 <a class="indexterm" name="id2617535"></a> 362 362 Squid uses the <code class="literal">ntlm_auth</code> helper build with Samba-3. 363 363 You may test <code class="literal">ntlm_auth</code> with the command: … … 371 371 </pre><p> 372 372 </p></li><li><p> 373 <a class="indexterm" name="id2617568"></a>374 <a class="indexterm" name="id2617575"></a>375 <a class="indexterm" name="id2617582"></a>376 373 <a class="indexterm" name="id2617588"></a> 377 <a class="indexterm" name="id2617595"></a> 378 <a class="indexterm" name="id2617602"></a> 379 <a class="indexterm" name="id2617609"></a> 380 <a class="indexterm" name="id2617616"></a> 374 <a class="indexterm" name="id2617594"></a> 375 <a class="indexterm" name="id2617601"></a> 376 <a class="indexterm" name="id2617608"></a> 377 <a class="indexterm" name="id2617615"></a> 378 <a class="indexterm" name="id2617622"></a> 379 <a class="indexterm" name="id2617629"></a> 380 <a class="indexterm" name="id2617635"></a> 381 381 The <code class="literal">ntlm_auth</code> helper, when run from a command line as the user 382 382 “<span class="quote">root</span>”, authenticates against your Active Directory domain (with … … 396 396 <code class="prompt">root# </code> chmod 750 /var/lib/samba/winbindd_privileged 397 397 </pre><p> 398 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2617 691"></a>NSS Configuration</h4></div></div></div><p>399 <a class="indexterm" name="id2617 699"></a>400 <a class="indexterm" name="id26177 05"></a>401 <a class="indexterm" name="id26177 12"></a>398 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2617710"></a>NSS Configuration</h4></div></div></div><p> 399 <a class="indexterm" name="id2617718"></a> 400 <a class="indexterm" name="id2617725"></a> 401 <a class="indexterm" name="id2617732"></a> 402 402 For Squid to benefit from Samba-3, NSS must be updated to allow winbind as a valid route to user authentication. 403 403 </p><p> 404 404 Edit your <code class="filename">/etc/nsswitch.conf</code> file so it has the parameters shown 405 405 in <a class="link" href="DomApps.html#ch10-etcnsscfg" title="Example 12.3. NSS Configuration File Extract File: /etc/nsswitch.conf">“NSS Configuration File Extract File: /etc/nsswitch.conf”</a>. 406 </p><div class="example"><a name="ch10-smbconf"></a><p class="title"><b>Example 12.2. Samba Configuration File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id26177 70"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id2617782"></a><em class="parameter"><code>netbios name = W2K3S</code></em></td></tr><tr><td><a class="indexterm" name="id2617794"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id2617806"></a><em class="parameter"><code>security = ads</code></em></td></tr><tr><td><a class="indexterm" name="id2617817"></a><em class="parameter"><code>encrypt passwords = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2617829"></a><em class="parameter"><code>password server = w2k3s.london.abmas.biz</code></em></td></tr><tr><td># separate domain and username with '/', like DOMAIN/username</td></tr><tr><td><a class="indexterm" name="id2617846"></a><em class="parameter"><code>winbind separator = /</code></em></td></tr><tr><td># use UIDs from 10000 to 20000 for domain users</td></tr><tr><td><a class="indexterm" name="id2617862"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td># use GIDs from 10000 to 20000 for domain groups</td></tr><tr><td><a class="indexterm" name="id2617877"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td># allow enumeration of winbind users and groups</td></tr><tr><td><a class="indexterm" name="id2617893"></a><em class="parameter"><code>winbind enum users = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2617905"></a><em class="parameter"><code>winbind enum groups = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2617917"></a><em class="parameter"><code>winbind user default domain = yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch10-etcnsscfg"></a><p class="title"><b>Example 12.3. NSS Configuration File Extract File: <code class="filename">/etc/nsswitch.conf</code></b></p><div class="example-contents"><pre class="screen">406 </p><div class="example"><a name="ch10-smbconf"></a><p class="title"><b>Example 12.2. Samba Configuration File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2617790"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id2617802"></a><em class="parameter"><code>netbios name = W2K3S</code></em></td></tr><tr><td><a class="indexterm" name="id2617813"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id2617825"></a><em class="parameter"><code>security = ads</code></em></td></tr><tr><td><a class="indexterm" name="id2617837"></a><em class="parameter"><code>encrypt passwords = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2617849"></a><em class="parameter"><code>password server = w2k3s.london.abmas.biz</code></em></td></tr><tr><td># separate domain and username with '/', like DOMAIN/username</td></tr><tr><td><a class="indexterm" name="id2617865"></a><em class="parameter"><code>winbind separator = /</code></em></td></tr><tr><td># use UIDs from 10000 to 20000 for domain users</td></tr><tr><td><a class="indexterm" name="id2617881"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td># use GIDs from 10000 to 20000 for domain groups</td></tr><tr><td><a class="indexterm" name="id2617897"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td># allow enumeration of winbind users and groups</td></tr><tr><td><a class="indexterm" name="id2617913"></a><em class="parameter"><code>winbind enum users = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2617925"></a><em class="parameter"><code>winbind enum groups = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2617937"></a><em class="parameter"><code>winbind user default domain = yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch10-etcnsscfg"></a><p class="title"><b>Example 12.3. NSS Configuration File Extract File: <code class="filename">/etc/nsswitch.conf</code></b></p><div class="example-contents"><pre class="screen"> 407 407 passwd: files winbind 408 408 shadow: files 409 409 group: files winbind 410 </pre></div></div><br class="example-break"></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id26179 56"></a>Squid Configuration</h4></div></div></div><p>411 <a class="indexterm" name="id26179 64"></a>412 <a class="indexterm" name="id26179 71"></a>410 </pre></div></div><br class="example-break"></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2617976"></a>Squid Configuration</h4></div></div></div><p> 411 <a class="indexterm" name="id2617983"></a> 412 <a class="indexterm" name="id2617990"></a> 413 413 Squid must be configured correctly to interact with the Samba-3 414 414 components that handle Active Directory authentication. 415 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id261 7986"></a>Configuration</h3></div></div></div></div><div class="procedure"><a name="id2617991"></a><p class="title"><b>Procedure 12.3. Squid Configuration Steps</b></p><ol type="1"><li><p>416 <a class="indexterm" name="id26180 03"></a>417 <a class="indexterm" name="id26180 09"></a>418 <a class="indexterm" name="id26180 17"></a>415 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2618005"></a>Configuration</h3></div></div></div></div><div class="procedure"><a name="id2618011"></a><p class="title"><b>Procedure 12.3. Squid Configuration Steps</b></p><ol type="1"><li><p> 416 <a class="indexterm" name="id2618022"></a> 417 <a class="indexterm" name="id2618029"></a> 418 <a class="indexterm" name="id2618037"></a> 419 419 If your Linux distribution is SUSE Linux 9, the version of Squid 420 420 supplied is already enabled to use the winbind helper agent. You … … 422 422 programs. 423 423 </p></li><li><p> 424 <a class="indexterm" name="id26180 34"></a>425 <a class="indexterm" name="id26180 41"></a>426 <a class="indexterm" name="id26180 48"></a>427 <a class="indexterm" name="id26180 55"></a>428 <a class="indexterm" name="id26180 62"></a>424 <a class="indexterm" name="id2618054"></a> 425 <a class="indexterm" name="id2618061"></a> 426 <a class="indexterm" name="id2618068"></a> 427 <a class="indexterm" name="id2618074"></a> 428 <a class="indexterm" name="id2618081"></a> 429 429 Squid, by default, runs as the user <code class="constant">nobody</code>. You need to 430 430 add a system user <code class="constant">squid</code> and a system group … … 434 434 and a <code class="constant">squid</code> group in <code class="filename">/etc/group</code> if these aren't there already. 435 435 </p></li><li><p> 436 <a class="indexterm" name="id26181 09"></a>437 <a class="indexterm" name="id26181 16"></a>436 <a class="indexterm" name="id2618129"></a> 437 <a class="indexterm" name="id2618136"></a> 438 438 You now need to change the permissions on Squid's <code class="constant">var</code> 439 439 directory. Enter the following command: … … 442 442 </pre><p> 443 443 </p></li><li><p> 444 <a class="indexterm" name="id26181 47"></a>445 <a class="indexterm" name="id26181 54"></a>444 <a class="indexterm" name="id2618167"></a> 445 <a class="indexterm" name="id2618173"></a> 446 446 Squid must also have control over its logging. Enter the following commands: 447 447 </p><pre class="screen"> … … 457 457 </pre><p> 458 458 </p></li><li><p> 459 <a class="indexterm" name="id26182 14"></a>459 <a class="indexterm" name="id2618233"></a> 460 460 The <code class="filename">/etc/squid/squid.conf</code> file must be edited to include the lines from 461 461 <a class="link" href="DomApps.html#etcsquidcfg" title="Example 12.4. Squid Configuration File Extract /etc/squid.conf [ADMINISTRATIVE PARAMETERS Section]">“Squid Configuration File Extract /etc/squid.conf [ADMINISTRATIVE PARAMETERS Section]”</a> and <a class="link" href="DomApps.html#etcsquid2" title="Example 12.5. Squid Configuration File extract File: /etc/squid.conf [AUTHENTICATION PARAMETERS Section]">“Squid Configuration File extract File: /etc/squid.conf [AUTHENTICATION PARAMETERS Section]”</a>. 462 462 </p></li><li><p> 463 <a class="indexterm" name="id26182 48"></a>463 <a class="indexterm" name="id2618267"></a> 464 464 You must create Squid's cache directories before it may be run. Enter the following command: 465 465 </p><pre class="screen"> … … 488 488 acl AuthorizedUsers proxy_auth REQUIRED 489 489 http_access allow all AuthorizedUsers 490 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id26183 52"></a>Key Points Learned</h3></div></div></div><p>491 <a class="indexterm" name="id26183 60"></a>492 <a class="indexterm" name="id26183 67"></a>493 <a class="indexterm" name="id26183 74"></a>494 <a class="indexterm" name="id2618 381"></a>495 <a class="indexterm" name="id2618 393"></a>490 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2618372"></a>Key Points Learned</h3></div></div></div><p> 491 <a class="indexterm" name="id2618380"></a> 492 <a class="indexterm" name="id2618387"></a> 493 <a class="indexterm" name="id2618394"></a> 494 <a class="indexterm" name="id2618401"></a> 495 <a class="indexterm" name="id2618412"></a> 496 496 Microsoft Windows networking protocols permeate the spectrum of technologies that Microsoft 497 497 Windows clients use, even when accessing traditional services such as Web browsers. Depending … … 500 500 the cookie-based authentication regime used by all competing browsers. It is Samba's implementation 501 501 of NTLMSSP that makes it attractive to implement the solution that has been demonstrated in this chapter. 502 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id26184 13"></a>Questions and Answers</h2></div></div></div><p>503 <a class="indexterm" name="id26184 21"></a>504 <a class="indexterm" name="id26184 28"></a>505 <a class="indexterm" name="id26184 35"></a>506 <a class="indexterm" name="id26184 41"></a>502 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2618432"></a>Questions and Answers</h2></div></div></div><p> 503 <a class="indexterm" name="id2618440"></a> 504 <a class="indexterm" name="id2618447"></a> 505 <a class="indexterm" name="id2618454"></a> 506 <a class="indexterm" name="id2618461"></a> 507 507 The development of the <code class="literal">ntlm_auth</code> module was first discussed in many Open Source circles 508 508 in 2002. At the SambaXP conference in Goettingen, Germany, Mr. Francesco Chemolli demonstrated the use of … … 523 523 Make certain that your Squid proxy server is equipped with sufficient memory to permit all proxy operations to run 524 524 out of memory without invoking the overheads involved in the use of memory that has to be swapped to disk. 525 </p><div class="qandaset"><dl><dt> <a href="DomApps.html#id26185 19">525 </p><div class="qandaset"><dl><dt> <a href="DomApps.html#id2618546"> 526 526 What does Samba have to do with Web proxy serving? 527 </a></dt><dt> <a href="DomApps.html#id2618 685">527 </a></dt><dt> <a href="DomApps.html#id2618712"> 528 528 What other services does Samba provide? 529 </a></dt><dt> <a href="DomApps.html#id26188 28">529 </a></dt><dt> <a href="DomApps.html#id2618855"> 530 530 Does use of Samba (ntlm_auth) improve the performance of Squid? 531 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id26185 19"></a><a name="id2618521"></a></td><td align="left" valign="top"><p>531 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2618546"></a><a name="id2618548"></a></td><td align="left" valign="top"><p> 532 532 What does Samba have to do with Web proxy serving? 533 533 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 534 <a class="indexterm" name="id26185 33"></a>535 <a class="indexterm" name="id26185 40"></a>536 <a class="indexterm" name="id26185 47"></a>537 <a class="indexterm" name="id26185 56"></a>538 <a class="indexterm" name="id26185 63"></a>534 <a class="indexterm" name="id2618560"></a> 535 <a class="indexterm" name="id2618567"></a> 536 <a class="indexterm" name="id2618574"></a> 537 <a class="indexterm" name="id2618583"></a> 538 <a class="indexterm" name="id2618590"></a> 539 539 To provide transparent interoperability between Windows clients and the network services 540 540 that are used from them, Samba had to develop tools and facilities that deliver that feature. The benefit … … 542 542 module is basically a wrapper around authentication code from the core of the Samba project. 543 543 </p><p> 544 <a class="indexterm" name="id2618585"></a> 545 <a class="indexterm" name="id2618592"></a> 546 <a class="indexterm" name="id2618601"></a> 547 <a class="indexterm" name="id2618610"></a> 544 <a class="indexterm" name="id2618612"></a> 548 545 <a class="indexterm" name="id2618619"></a> 549 <a class="indexterm" name="id2618626"></a> 550 <a class="indexterm" name="id2618633"></a> 551 <a class="indexterm" name="id2618640"></a> 552 <a class="indexterm" name="id2618647"></a> 546 <a class="indexterm" name="id2618629"></a> 547 <a class="indexterm" name="id2618638"></a> 548 <a class="indexterm" name="id2618646"></a> 549 <a class="indexterm" name="id2618653"></a> 550 <a class="indexterm" name="id2618660"></a> 551 <a class="indexterm" name="id2618667"></a> 552 <a class="indexterm" name="id2618674"></a> 553 553 The <code class="literal">ntlm_auth</code> module supports basic plain-text authentication and NTLMSSP 554 554 protocols. This module makes it possible for Web and FTP proxy requests to be authenticated without … … 558 558 also. 559 559 </p><p> 560 <a class="indexterm" name="id26186 71"></a>560 <a class="indexterm" name="id2618699"></a> 561 561 The short answer is that by adding a wrapper around key authentication components of Samba, other 562 562 projects (like Squid) can benefit from the labors expended in meeting user interoperability needs. 563 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2618 685"></a><a name="id2618687"></a></td><td align="left" valign="top"><p>563 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2618712"></a><a name="id2618714"></a></td><td align="left" valign="top"><p> 564 564 What other services does Samba provide? 565 565 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 566 <a class="indexterm" name="id2618699"></a>567 <a class="indexterm" name="id2618706"></a>568 <a class="indexterm" name="id2618712"></a>569 <a class="indexterm" name="id2618719"></a>570 566 <a class="indexterm" name="id2618726"></a> 567 <a class="indexterm" name="id2618733"></a> 568 <a class="indexterm" name="id2618740"></a> 569 <a class="indexterm" name="id2618746"></a> 570 <a class="indexterm" name="id2618753"></a> 571 571 Samba-3 is a file and print server. The core components that provide this functionality are <code class="literal">smbd</code>, 572 572 <code class="literal">nmbd</code>, and the identity resolver daemon, <code class="literal">winbindd</code>. 573 573 </p><p> 574 <a class="indexterm" name="id26187 57"></a>575 <a class="indexterm" name="id26187 63"></a>574 <a class="indexterm" name="id2618784"></a> 575 <a class="indexterm" name="id2618791"></a> 576 576 Samba-3 is an SMB/CIFS client. The core component that provides this is called <code class="literal">smbclient</code>. 577 577 </p><p> 578 <a class="indexterm" name="id2618781"></a>579 <a class="indexterm" name="id2618788"></a>580 <a class="indexterm" name="id2618794"></a>581 <a class="indexterm" name="id2618801"></a>582 578 <a class="indexterm" name="id2618808"></a> 579 <a class="indexterm" name="id2618815"></a> 580 <a class="indexterm" name="id2618822"></a> 581 <a class="indexterm" name="id2618828"></a> 582 <a class="indexterm" name="id2618835"></a> 583 583 Samba-3 includes a number of helper tools, plug-in modules, utilities, and test and validation facilities. 584 584 Samba-3 includes glue modules that help provide interoperability between MS Windows clients and UNIX/Linux … … 587 587 to permit identity resolution via SMB/CIFS servers (Windows NT4/200x, Samba, and a host of other commercial 588 588 server products). 589 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id26188 28"></a><a name="id2618830"></a></td><td align="left" valign="top"><p>589 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2618855"></a><a name="id2618858"></a></td><td align="left" valign="top"><p> 590 590 Does use of Samba (<code class="literal">ntlm_auth</code>) improve the performance of Squid? 591 591 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
Note:
See TracChangeset
for help on using the changeset viewer.
