- Timestamp:
- Sep 24, 2009, 9:15:13 AM (16 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.2.x/docs/htmldocs/Samba3-HOWTO/winbind.html
r272 r335 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 24. Winbind: Use of Domain Accounts</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="VFS.html" title="Chapter 23. Stackable VFS modules"><link rel="next" href="AdvancedNetworkManagement.html" title="Chapter 25. Advanced Network Management"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 24. Winbind: Use of Domain Accounts</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="VFS.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="AdvancedNetworkManagement.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="winbind"></a>Chapter 24. Winbind: Use of Domain Accounts</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Tim</span> <span class="orgname">Samba Team</span> <span class="surname">Potter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:tpot@linuxcare.com.au">tpot@linuxcare.com.au</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Andrew</span> <span class="orgname">Samba Team</span> <span class="surname">Tridgell</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:tridge@samba.org">tridge@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Naag</span> <span class="surname">Mummaneni</span></h3><span class="contrib">Notes for Solaris</span> <div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:getnag@rediffmail.com">getnag@rediffmail.com</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="orgname">SNAP</span> <span class="surname">Trostel</span></h3><div class="affiliation"><span class="orgname">SNAP<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jtrostel@snapserver.com">jtrostel@snapserver.com</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="orgname">The Samba Team</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jelmer@samba.org">jelmer@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="orgname">Samba Team</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><p class="pubdate">June 15, 2005</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="winbind.html#id265311 7">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="winbind.html#id2653461">Introduction</a></span></dt><dt><span class="sect1"><a href="winbind.html#id2653550">What Winbind Provides</a></span></dt><dd><dl><dt><span class="sect2"><a href="winbind.html#id2653704">Target Uses</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2653749">Handling of Foreign SIDs</a></span></dt></dl></dd><dt><span class="sect1"><a href="winbind.html#id2653875">How Winbind Works</a></span></dt><dd><dl><dt><span class="sect2"><a href="winbind.html#id2653925">Microsoft Remote Procedure Calls</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2654018">Microsoft Active Directory Services</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2654066">Name Service Switch</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2654298">Pluggable Authentication Modules</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2654453">User and Group ID Allocation</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2654529">Result Caching</a></span></dt></dl></dd><dt><span class="sect1"><a href="winbind.html#id2654586">Installation and Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="winbind.html#id2654592">Introduction</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2654706">Requirements</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2654858">Testing Things Out</a></span></dt></dl></dd><dt><span class="sect1"><a href="winbind.html#id2657317">Conclusion</a></span></dt><dt><span class="sect1"><a href="winbind.html#id2657366">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="winbind.html#id2657408">NSCD Problem Warning</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2657444">Winbind Is Not Resolving Users and Groups</a></span></dt></dl></dd></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2653117"></a>Features and Benefits</h2></div></div></div><p>2 <a class="indexterm" name="id265312 5"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 24. Winbind: Use of Domain Accounts</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="VFS.html" title="Chapter 23. Stackable VFS modules"><link rel="next" href="AdvancedNetworkManagement.html" title="Chapter 25. Advanced Network Management"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 24. Winbind: Use of Domain Accounts</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="VFS.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="AdvancedNetworkManagement.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="winbind"></a>Chapter 24. Winbind: Use of Domain Accounts</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Tim</span> <span class="orgname">Samba Team</span> <span class="surname">Potter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:tpot@linuxcare.com.au">tpot@linuxcare.com.au</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Andrew</span> <span class="orgname">Samba Team</span> <span class="surname">Tridgell</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:tridge@samba.org">tridge@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Naag</span> <span class="surname">Mummaneni</span></h3><span class="contrib">Notes for Solaris</span> <div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:getnag@rediffmail.com">getnag@rediffmail.com</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="orgname">SNAP</span> <span class="surname">Trostel</span></h3><div class="affiliation"><span class="orgname">SNAP<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jtrostel@snapserver.com">jtrostel@snapserver.com</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="orgname">The Samba Team</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jelmer@samba.org">jelmer@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="orgname">Samba Team</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><p class="pubdate">June 15, 2005</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="winbind.html#id2653118">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="winbind.html#id2653461">Introduction</a></span></dt><dt><span class="sect1"><a href="winbind.html#id2653551">What Winbind Provides</a></span></dt><dd><dl><dt><span class="sect2"><a href="winbind.html#id2653704">Target Uses</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2653749">Handling of Foreign SIDs</a></span></dt></dl></dd><dt><span class="sect1"><a href="winbind.html#id2653875">How Winbind Works</a></span></dt><dd><dl><dt><span class="sect2"><a href="winbind.html#id2653925">Microsoft Remote Procedure Calls</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2654018">Microsoft Active Directory Services</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2654066">Name Service Switch</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2654298">Pluggable Authentication Modules</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2654453">User and Group ID Allocation</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2654529">Result Caching</a></span></dt></dl></dd><dt><span class="sect1"><a href="winbind.html#id2654586">Installation and Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="winbind.html#id2654592">Introduction</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2654706">Requirements</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2654858">Testing Things Out</a></span></dt></dl></dd><dt><span class="sect1"><a href="winbind.html#id2657317">Conclusion</a></span></dt><dt><span class="sect1"><a href="winbind.html#id2657366">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="winbind.html#id2657408">NSCD Problem Warning</a></span></dt><dt><span class="sect2"><a href="winbind.html#id2657444">Winbind Is Not Resolving Users and Groups</a></span></dt></dl></dd></dl></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2653118"></a>Features and Benefits</h2></div></div></div><p> 2 <a class="indexterm" name="id2653126"></a> 3 3 <a class="indexterm" name="id2653132"></a> 4 4 Integration of UNIX and Microsoft Windows NT through a unified logon has … … 15 15 domain user and group ownerships with integrity. 16 16 </p><p> 17 <a class="indexterm" name="id265318 4"></a>17 <a class="indexterm" name="id2653185"></a> 18 18 <a class="indexterm" name="id2653194"></a> 19 19 <a class="indexterm" name="id2653201"></a> … … 34 34 NT4 (including a Samba domain) or an Active Directory domain. 35 35 </p></li><li><p> 36 <a class="indexterm" name="id265325 6"></a>37 <a class="indexterm" name="id265326 3"></a>36 <a class="indexterm" name="id2653257"></a> 37 <a class="indexterm" name="id2653264"></a> 38 38 Identity resolution (via NSS). This is the default when winbind is not used. 39 39 </p></li><li><p> … … 53 53 from the LDAP database. 54 54 </p></li></ul></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 55 <a class="indexterm" name="id265334 5"></a>55 <a class="indexterm" name="id2653346"></a> 56 56 <a class="indexterm" name="id2653352"></a> 57 57 <a class="indexterm" name="id2653362"></a> … … 90 90 groups on either system. The Winbind system provides a simple 91 91 and elegant solution to all three components of the unified logon 92 problem.</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id265355 0"></a>What Winbind Provides</h2></div></div></div><p>93 <a class="indexterm" name="id265355 8"></a>92 problem.</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2653551"></a>What Winbind Provides</h2></div></div></div><p> 93 <a class="indexterm" name="id2653559"></a> 94 94 <a class="indexterm" name="id2653566"></a> 95 95 <a class="indexterm" name="id2653572"></a> … … 101 101 to be used in much the same manner that NIS+ is used within 102 102 UNIX-only environments.</p><p> 103 <a class="indexterm" name="id265359 8"></a>104 <a class="indexterm" name="id265360 5"></a>103 <a class="indexterm" name="id2653599"></a> 104 <a class="indexterm" name="id2653606"></a> 105 105 <a class="indexterm" name="id2653612"></a> 106 106 <a class="indexterm" name="id2653619"></a> … … 132 132 passwords between systems, since all passwords are stored in a single 133 133 location (on the domain controller).</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2653704"></a>Target Uses</h3></div></div></div><p> 134 <a class="indexterm" name="id265371 1"></a>134 <a class="indexterm" name="id2653712"></a> 135 135 Winbind is targeted at organizations that have an 136 136 existing NT-based domain infrastructure into which they wish … … 140 140 simplifies the administrative overhead of deploying UNIX 141 141 workstations into an NT-based organization.</p><p> 142 <a class="indexterm" name="id265372 8"></a>142 <a class="indexterm" name="id2653729"></a> 143 143 <a class="indexterm" name="id2653735"></a> 144 144 Another interesting way in which we expect Winbind to … … 164 164 <a class="indexterm" name="id2653804"></a> 165 165 <a class="indexterm" name="id2653811"></a> 166 <a class="indexterm" name="id265381 7"></a>166 <a class="indexterm" name="id2653818"></a> 167 167 If the Samba server will be accessed from a domain other than the local Samba domain, or 168 168 if there will be access from machines that are not local domain members, winbind will … … 185 185 <a class="indexterm" name="id2653883"></a> 186 186 <a class="indexterm" name="id2653890"></a> 187 <a class="indexterm" name="id265389 6"></a>187 <a class="indexterm" name="id2653897"></a> 188 188 <a class="indexterm" name="id2653903"></a> 189 189 The Winbind system is designed around a client/server … … 193 193 clients and are processed sequentially.</p><p>The technologies used to implement Winbind are described 194 194 in detail below.</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2653925"></a>Microsoft Remote Procedure Calls</h3></div></div></div><p> 195 <a class="indexterm" name="id265393 3"></a>195 <a class="indexterm" name="id2653934"></a> 196 196 <a class="indexterm" name="id2653943"></a> 197 197 <a class="indexterm" name="id2653950"></a> 198 <a class="indexterm" name="id265395 6"></a>199 <a class="indexterm" name="id265396 3"></a>198 <a class="indexterm" name="id2653957"></a> 199 <a class="indexterm" name="id2653964"></a> 200 200 Over the last few years, efforts have been underway by various Samba Team members to implement various aspects of 201 201 the Microsoft Remote Procedure Call (MSRPC) system. This system is used for most network-related operations … … 204 204 Samba, it has also yielded a body of code that can be used for other purposes. 205 205 </p><p> 206 <a class="indexterm" name="id265398 2"></a>206 <a class="indexterm" name="id2653983"></a> 207 207 <a class="indexterm" name="id2653989"></a> 208 208 <a class="indexterm" name="id2653996"></a> … … 212 212 information onto UNIX user and group names. 213 213 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2654018"></a>Microsoft Active Directory Services</h3></div></div></div><p> 214 <a class="indexterm" name="id265402 6"></a>214 <a class="indexterm" name="id2654027"></a> 215 215 <a class="indexterm" name="id2654033"></a> 216 216 <a class="indexterm" name="id2654040"></a> … … 223 223 <a class="indexterm" name="id2654074"></a> 224 224 <a class="indexterm" name="id2654080"></a> 225 <a class="indexterm" name="id265408 7"></a>225 <a class="indexterm" name="id2654088"></a> 226 226 <a class="indexterm" name="id2654094"></a> 227 227 The NSS is a feature that is present in many UNIX operating systems. It allows system … … 335 335 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2654586"></a>Installation and Configuration</h2></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2654592"></a>Introduction</h3></div></div></div><p> 336 336 <a class="indexterm" name="id2654600"></a> 337 <a class="indexterm" name="id265460 6"></a>337 <a class="indexterm" name="id2654607"></a> 338 338 <a class="indexterm" name="id2654613"></a> 339 339 This section describes the procedures used to get Winbind up and running. Winbind is capable of providing … … 353 353 <span class="emphasis"><em>Who should be reading this document?</em></span> 354 354 </p><p> 355 <a class="indexterm" name="id265468 4"></a>355 <a class="indexterm" name="id2654685"></a> 356 356 <a class="indexterm" name="id2654691"></a> 357 357 This document is designed for system administrators. If you are implementing Samba on a file server and wish … … 361 361 <a class="indexterm" name="id2654714"></a> 362 362 <a class="indexterm" name="id2654721"></a> 363 <a class="indexterm" name="id265472 7"></a>363 <a class="indexterm" name="id2654728"></a> 364 364 If you have a Samba configuration file that you are currently using, <span class="emphasis"><em>BACK IT UP!</em></span> 365 365 If your system already uses PAM, <span class="emphasis"><em>back up the <code class="filename">/etc/pam.d</code> directory … … 391 391 <a class="indexterm" name="id2654873"></a> 392 392 <a class="indexterm" name="id2654880"></a> 393 <a class="indexterm" name="id265488 6"></a>393 <a class="indexterm" name="id2654887"></a> 394 394 <a class="indexterm" name="id2654893"></a> 395 395 Before starting, it is probably best to kill off all the Samba-related daemons running on your server. … … 438 438 group: files winbind 439 439 </pre><p> 440 <a class="indexterm" name="id265515 2"></a>440 <a class="indexterm" name="id2655153"></a> 441 441 <a class="indexterm" name="id2655159"></a> 442 442 <a class="indexterm" name="id2655166"></a> … … 455 455 </p><p> 456 456 <a class="indexterm" name="id2655244"></a> 457 <a class="indexterm" name="id265525 0"></a>457 <a class="indexterm" name="id2655251"></a> 458 458 <a class="indexterm" name="id2655257"></a> 459 459 <a class="indexterm" name="id2655264"></a> … … 484 484 <a class="indexterm" name="id2655355"></a> 485 485 <a class="indexterm" name="id2655362"></a> 486 <a class="indexterm" name="id265536 8"></a>487 <a class="indexterm" name="id265537 5"></a>488 <a class="indexterm" name="id265538 2"></a>486 <a class="indexterm" name="id2655369"></a> 487 <a class="indexterm" name="id2655376"></a> 488 <a class="indexterm" name="id2655383"></a> 489 489 <a class="indexterm" name="id2655390"></a> 490 490 The Winbind AIX identification module gets built as <code class="filename">libnss_winbind.so</code> in the … … 506 506 Management Guide: Operating System and Devices.</a> 507 507 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2655457"></a>Configure smb.conf</h4></div></div></div><p> 508 <a class="indexterm" name="id265546 4"></a>508 <a class="indexterm" name="id2655465"></a> 509 509 <a class="indexterm" name="id2655471"></a> 510 510 <a class="indexterm" name="id2655478"></a> 511 511 Several parameters are needed in the <code class="filename">smb.conf</code> file to control the behavior of <span class="application">winbindd</span>. These 512 512 are described in more detail in the <a class="citerefentry" href="winbindd.8.html"><span class="citerefentry"><span class="refentrytitle">winbindd</span>(8)</span></a> man page. My <code class="filename">smb.conf</code> file, as shown in <a class="link" href="winbind.html#winbindcfg" title="Example 24.1. smb.conf for Winbind Setup">the smb.conf for Winbind Setup</a>, was modified to include the necessary entries in the [global] section. 513 </p><div class="example"><a name="winbindcfg"></a><p class="title"><b>Example 24.1. smb.conf for Winbind Setup</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td># separate domain and username with '\', like DOMAIN\username</td></tr><tr><td><a class="indexterm" name="id2655552"></a><em class="parameter"><code>winbind separator = \</code></em></td></tr><tr><td># use uids from 10000 to 20000 for domain users</td></tr><tr><td><a class="indexterm" name="id2655568"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td># use gids from 10000 to 20000 for domain groups</td></tr><tr><td><a class="indexterm" name="id265558 3"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td># allow enumeration of winbind users and groups</td></tr><tr><td><a class="indexterm" name="id2655599"></a><em class="parameter"><code>winbind enum users = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2655611"></a><em class="parameter"><code>winbind enum groups = yes</code></em></td></tr><tr><td># give winbind users a real shell (only needed if they have telnet access)</td></tr><tr><td><a class="indexterm" name="id2655628"></a><em class="parameter"><code>template homedir = /home/winnt/%D/%U</code></em></td></tr><tr><td><a class="indexterm" name="id2655640"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2655654"></a>Join the Samba Server to the PDC Domain</h4></div></div></div><p>513 </p><div class="example"><a name="winbindcfg"></a><p class="title"><b>Example 24.1. smb.conf for Winbind Setup</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td># separate domain and username with '\', like DOMAIN\username</td></tr><tr><td><a class="indexterm" name="id2655552"></a><em class="parameter"><code>winbind separator = \</code></em></td></tr><tr><td># use uids from 10000 to 20000 for domain users</td></tr><tr><td><a class="indexterm" name="id2655568"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td># use gids from 10000 to 20000 for domain groups</td></tr><tr><td><a class="indexterm" name="id2655584"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td># allow enumeration of winbind users and groups</td></tr><tr><td><a class="indexterm" name="id2655599"></a><em class="parameter"><code>winbind enum users = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2655611"></a><em class="parameter"><code>winbind enum groups = yes</code></em></td></tr><tr><td># give winbind users a real shell (only needed if they have telnet access)</td></tr><tr><td><a class="indexterm" name="id2655628"></a><em class="parameter"><code>template homedir = /home/winnt/%D/%U</code></em></td></tr><tr><td><a class="indexterm" name="id2655640"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2655654"></a>Join the Samba Server to the PDC Domain</h4></div></div></div><p> 514 514 <a class="indexterm" name="id2655662"></a> 515 515 <a class="indexterm" name="id2655669"></a> 516 <a class="indexterm" name="id265567 5"></a>516 <a class="indexterm" name="id2655676"></a> 517 517 All machines that will participate in domain security should be members of 518 518 the domain. This applies also to the PDC and all BDCs. 519 519 </p><p> 520 <a class="indexterm" name="id265568 7"></a>520 <a class="indexterm" name="id2655688"></a> 521 521 <a class="indexterm" name="id2655694"></a> 522 522 <a class="indexterm" name="id2655701"></a> … … 524 524 <a class="indexterm" name="id2655719"></a> 525 525 <a class="indexterm" name="id2655726"></a> 526 <a class="indexterm" name="id265573 2"></a>526 <a class="indexterm" name="id2655733"></a> 527 527 <a class="indexterm" name="id2655739"></a> 528 528 <a class="indexterm" name="id2655746"></a> … … 534 534 </p><p> 535 535 <a class="indexterm" name="id2655774"></a> 536 <a class="indexterm" name="id265578 0"></a>536 <a class="indexterm" name="id2655781"></a> 537 537 <a class="indexterm" name="id2655788"></a> 538 538 Enter the following command to make the Samba server join the domain, where <em class="replaceable"><code>PDC</code></em> is … … 548 548 137/udp, 135/tcp, 139/tcp, and 445/tcp (if Samba or Windows Server 2Kx). 549 549 </p></div><p> 550 <a class="indexterm" name="id265584 3"></a>550 <a class="indexterm" name="id2655844"></a> 551 551 The use of the <code class="literal">net rpc join</code> facility is shown here: 552 552 </p><pre class="screen"> … … 556 556 <em class="replaceable"><code>DOMAIN</code></em></span>” where <em class="replaceable"><code>DOMAIN</code></em> 557 557 is your domain name. 558 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id265589 1"></a>Starting and Testing the <code class="literal">winbindd</code> Daemon</h4></div></div></div><p>559 <a class="indexterm" name="id265590 5"></a>558 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2655892"></a>Starting and Testing the <code class="literal">winbindd</code> Daemon</h4></div></div></div><p> 559 <a class="indexterm" name="id2655906"></a> 560 560 <a class="indexterm" name="id2655912"></a> 561 561 <a class="indexterm" name="id2655919"></a> … … 568 568 Use the appropriate path to the location of the <code class="literal">winbindd</code> executable file. 569 569 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 570 <a class="indexterm" name="id265595 8"></a>570 <a class="indexterm" name="id2655959"></a> 571 571 <a class="indexterm" name="id2655965"></a> 572 572 The command to start up Winbind services assumes that Samba has been installed in the … … 581 581 </pre><p> 582 582 </p><p> 583 <a class="indexterm" name="id265602 5"></a>583 <a class="indexterm" name="id2656026"></a> 584 584 This command should produce output like the following if the daemon is running. 585 585 </p><pre class="screen"> … … 624 624 <a class="indexterm" name="id2656151"></a> 625 625 <a class="indexterm" name="id2656158"></a> 626 <a class="indexterm" name="id265616 4"></a>626 <a class="indexterm" name="id2656165"></a> 627 627 <a class="indexterm" name="id2656171"></a> 628 628 <a class="indexterm" name="id2656178"></a> 629 <a class="indexterm" name="id265618 4"></a>629 <a class="indexterm" name="id2656185"></a> 630 630 The function <code class="literal">getent</code> can now be used to get unified lists of both local and PDC users and 631 631 groups. Try the following command: … … 720 720 <a class="indexterm" name="id2656500"></a> 721 721 <a class="indexterm" name="id2656507"></a> 722 <a class="indexterm" name="id265651 3"></a>722 <a class="indexterm" name="id2656514"></a> 723 723 On Solaris, you need to modify the <code class="filename">/etc/init.d/samba.server</code> startup script. It 724 724 usually only starts smbd and nmbd but should now start winbindd, too. If you have Samba installed in … … 802 802 <a class="indexterm" name="id2656723"></a> 803 803 <a class="indexterm" name="id2656730"></a> 804 <a class="indexterm" name="id265673 6"></a>804 <a class="indexterm" name="id2656737"></a> 805 805 You will need a PAM module to use winbindd with these other services. This module will be compiled in the 806 806 <code class="filename">../source/nsswitch</code> directory by invoking the command: … … 826 826 <a class="indexterm" name="id2656860"></a> 827 827 <a class="indexterm" name="id2656867"></a> 828 <a class="indexterm" name="id265687 3"></a>828 <a class="indexterm" name="id2656874"></a> 829 829 <a class="indexterm" name="id2656880"></a> 830 830 <a class="indexterm" name="id2656887"></a> … … 845 845 </pre><p> 846 846 <a class="indexterm" name="id2656954"></a> 847 <a class="indexterm" name="id265696 0"></a>847 <a class="indexterm" name="id2656961"></a> 848 848 <a class="indexterm" name="id2656968"></a> 849 849 For ftp services to work properly, you will also need to either have individual directories for the domain … … 851 851 domain users. These can be easily set using the <code class="filename">smb.conf</code> global entry <a class="link" href="smb.conf.5.html#TEMPLATEHOMEDIR" target="_top">template homedir</a>. 852 852 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 853 <a class="indexterm" name="id265700 3"></a>853 <a class="indexterm" name="id2657004"></a> 854 854 The directory in <a class="link" href="smb.conf.5.html#TEMPLATEHOMEDIR" target="_top">template homedir</a> is not created automatically! Use pam_mkhomedir or 855 855 pre-create the directories of users to make sure users can log in on UNIX with their own home directory.
Note:
See TracChangeset
for help on using the changeset viewer.
