- Timestamp:
- Nov 12, 2012, 7:37:04 PM (13 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.5.x/docs/htmldocs/Samba3-ByExample/DomApps.html
r599 r739 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 12. Integrating Additional Services</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"><link rel="next" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 12. Integrating Additional Services</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="kerberos.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="HA.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 12. Integrating Additional Services"><div class="titlepage"><div><div><h2 class="title"><a name="DomApps"></a>Chapter 12. Integrating Additional Services</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="DomApps.html#id38 2225">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id382248">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id382338">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id382367">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id382513">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id382530">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id384281">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id384336">Questions and Answers</a></span></dt></dl></div><p>2 <a class="indexterm" name="id38 2181"></a>3 <a class="indexterm" name="id38 2187"></a>4 <a class="indexterm" name="id38 2194"></a>5 <a class="indexterm" name="id38 2201"></a>6 <a class="indexterm" name="id38 2208"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 12. Integrating Additional Services</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"><link rel="next" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 12. Integrating Additional Services</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="kerberos.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="HA.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 12. Integrating Additional Services"><div class="titlepage"><div><div><h2 class="title"><a name="DomApps"></a>Chapter 12. Integrating Additional Services</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="DomApps.html#id380752">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id380775">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id380865">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id380894">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id381040">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id381058">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id382809">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id382864">Questions and Answers</a></span></dt></dl></div><p> 2 <a class="indexterm" name="id380708"></a> 3 <a class="indexterm" name="id380714"></a> 4 <a class="indexterm" name="id380721"></a> 5 <a class="indexterm" name="id380728"></a> 6 <a class="indexterm" name="id380735"></a> 7 7 You've come a long way now. You have pretty much mastered Samba-3 for 8 8 most uses it can be put to. Up until now, you have cast Samba-3 in the leading … … 15 15 the latest Windows authentication technologies. Let's get started this is 16 16 leading edge. 17 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id38 2225"></a>Introduction</h2></div></div></div><p>17 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id380752"></a>Introduction</h2></div></div></div><p> 18 18 Abmas has continued its miraculous growth; indeed, nothing seems to be able 19 19 to stop its diversification into multiple (and seemingly unrelated) fields. … … 31 31 gradually, taking over key services and easing the way to a full migration and, 32 32 therefore, integration into Abmas's existing business later. 33 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id38 2248"></a>Assignment Tasks</h3></div></div></div><p>34 <a class="indexterm" name="id38 2256"></a>35 <a class="indexterm" name="id38 2264"></a>33 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id380775"></a>Assignment Tasks</h3></div></div></div><p> 34 <a class="indexterm" name="id380783"></a> 35 <a class="indexterm" name="id380791"></a> 36 36 You've promised the skeptical Abmas Snack Foods management team 37 37 that you can show them how Samba can ease itself and other Open Source … … 40 40 acquisition). You have chosen Web proxying and caching as your proving ground. 41 41 </p><p> 42 <a class="indexterm" name="id38 2279"></a>43 <a class="indexterm" name="id38 2286"></a>42 <a class="indexterm" name="id380806"></a> 43 <a class="indexterm" name="id380813"></a> 44 44 Abmas Snack Foods has several thousand users housed at its head office 45 45 and multiple regional offices, plants, and warehouses. A high proportion of … … 51 51 the earliest commercial users of Microsoft ISA. 52 52 </p><p> 53 <a class="indexterm" name="id38 2301"></a>54 <a class="indexterm" name="id38 2308"></a>55 <a class="indexterm" name="id38 2315"></a>53 <a class="indexterm" name="id380828"></a> 54 <a class="indexterm" name="id380835"></a> 55 <a class="indexterm" name="id380842"></a> 56 56 The team is not happy with ISA. Because it never lived up to its marketing promises, 57 57 it underperformed and had reliability problems. You have pounced on the opportunity … … 64 64 This is a hands-on exercise. You build software applications so 65 65 that you obtain the functionality Abmas needs. 66 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id38 2338"></a>Dissection and Discussion</h2></div></div></div><p>66 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id380865"></a>Dissection and Discussion</h2></div></div></div><p> 67 67 The key requirements in this business example are straightforward. You are not required 68 68 to do anything new, just to replicate an existing system, not lose any existing features, … … 74 74 </p></li><li class="listitem"><p> 75 75 Seamless and transparent interoperability with the existing Active Directory domain 76 </p></li></ul></div><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id38 2367"></a>Technical Issues</h3></div></div></div><p>77 <a class="indexterm" name="id38 2375"></a>78 <a class="indexterm" name="id38 2381"></a>79 <a class="indexterm" name="id38 2388"></a>80 <a class="indexterm" name="id38 2395"></a>81 <a class="indexterm" name="id38 2402"></a>82 <a class="indexterm" name="id38 2409"></a>83 <a class="indexterm" name="id38 2415"></a>84 <a class="indexterm" name="id38 2422"></a>85 <a class="indexterm" name="id38 2429"></a>86 <a class="indexterm" name="id38 2436"></a>87 <a class="indexterm" name="id38 2443"></a>88 <a class="indexterm" name="id38 2450"></a>89 <a class="indexterm" name="id38 2459"></a><a class="indexterm" name="id382464"></a>76 </p></li></ul></div><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id380894"></a>Technical Issues</h3></div></div></div><p> 77 <a class="indexterm" name="id380902"></a> 78 <a class="indexterm" name="id380909"></a> 79 <a class="indexterm" name="id380916"></a> 80 <a class="indexterm" name="id380922"></a> 81 <a class="indexterm" name="id380929"></a> 82 <a class="indexterm" name="id380936"></a> 83 <a class="indexterm" name="id380943"></a> 84 <a class="indexterm" name="id380950"></a> 85 <a class="indexterm" name="id380956"></a> 86 <a class="indexterm" name="id380963"></a> 87 <a class="indexterm" name="id380970"></a> 88 <a class="indexterm" name="id380977"></a> 89 <a class="indexterm" name="id380986"></a><a class="indexterm" name="id380992"></a> 90 90 Functionally, the user's Internet Explorer requests a browsing session with the 91 91 Squid proxy, for which it offers its AD authentication token. Squid hands off … … 108 108 </p></li><li class="listitem"><p> 109 109 Tying it all together 110 </p></li></ul></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id38 2513"></a>Political Issues</h3></div></div></div><p>110 </p></li></ul></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id381040"></a>Political Issues</h3></div></div></div><p> 111 111 You are a stranger in a strange land, and all eyes are upon you. Some would even like to see 112 112 you fail. For you to gain the trust of your newly acquired IT people, it is essential that your … … 114 114 will the entrenched positions consider taking up your new way of doing things on a 115 115 wider scale. 116 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id38 2530"></a>Implementation</h2></div></div></div><p>117 <a class="indexterm" name="id38 2538"></a>116 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id381058"></a>Implementation</h2></div></div></div><p> 117 <a class="indexterm" name="id381065"></a> 118 118 First, your system needs to be prepared and in a known good state to proceed. This consists 119 119 of making sure that everything the system depends on is present and that everything that could … … 122 122 they must be removed. 123 123 </p><p> 124 <a class="indexterm" name="id38 2552"></a>124 <a class="indexterm" name="id381079"></a> 125 125 The following packages should be available on your Red Hat Linux system: 126 126 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 127 <a class="indexterm" name="id38 2566"></a>128 <a class="indexterm" name="id38 2572"></a>127 <a class="indexterm" name="id381093"></a> 128 <a class="indexterm" name="id381100"></a> 129 129 krb5-libs 130 130 </p></li><li class="listitem"><p> … … 137 137 pam_krb5 138 138 </p></li></ul></div><p> 139 <a class="indexterm" name="id38 2602"></a>139 <a class="indexterm" name="id381129"></a> 140 140 In the case of SUSE Linux, these packages are called: 141 141 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> … … 144 144 heimdal-devel 145 145 </p></li><li class="listitem"><p> 146 <a class="indexterm" name="id38 2625"></a>146 <a class="indexterm" name="id381153"></a> 147 147 heimdal 148 148 </p></li><li class="listitem"><p> … … 153 153 for your Linux system to ensure that the packages are correctly updated. 154 154 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 155 <a class="indexterm" name="id38 2648"></a>156 <a class="indexterm" name="id38 2655"></a>157 <a class="indexterm" name="id38 2662"></a>155 <a class="indexterm" name="id381175"></a> 156 <a class="indexterm" name="id381182"></a> 157 <a class="indexterm" name="id381189"></a> 158 158 If the requirement is for interoperation with MS Windows Server 2003, it 159 159 will be necessary to ensure that you are using MIT Kerberos version 1.3.1 … … 161 161 updating. 162 162 </p><p> 163 <a class="indexterm" name="id38 2673"></a>164 <a class="indexterm" name="id38 2680"></a>163 <a class="indexterm" name="id381201"></a> 164 <a class="indexterm" name="id381208"></a> 165 165 Heimdal 0.6 or later is required in the case of SUSE Linux. SUSE Enterprise 166 166 Linux Server 8 ships with Heimdal 0.4. SUSE 9 ships with the necessary version. 167 167 </p></div><div class="sect2" title="Removal of Pre-Existing Conflicting RPMs"><div class="titlepage"><div><div><h3 class="title"><a name="ch10-one"></a>Removal of Pre-Existing Conflicting RPMs</h3></div></div></div><p> 168 <a class="indexterm" name="id38 2701"></a>168 <a class="indexterm" name="id381229"></a> 169 169 If Samba and/or Squid RPMs are installed, they should be updated. You can 170 170 build both from source. 171 171 </p><p> 172 <a class="indexterm" name="id38 2712"></a>173 <a class="indexterm" name="id38 2719"></a>174 <a class="indexterm" name="id38 2725"></a>172 <a class="indexterm" name="id381240"></a> 173 <a class="indexterm" name="id381246"></a> 174 <a class="indexterm" name="id381253"></a> 175 175 Locating the packages to be un-installed can be achieved by running: 176 176 </p><pre class="screen"> … … 182 182 <code class="prompt">root# </code> rpm -e samba-common 183 183 </pre><p> 184 </p><div class="sect2" title="Kerberos Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id38 2764"></a>Kerberos Configuration</h3></div></div></div><p>185 <a class="indexterm" name="id38 2771"></a>186 <a class="indexterm" name="id38 2778"></a>187 <a class="indexterm" name="id38 2787"></a>188 <a class="indexterm" name="id38 2794"></a>184 </p><div class="sect2" title="Kerberos Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id381292"></a>Kerberos Configuration</h3></div></div></div><p> 185 <a class="indexterm" name="id381299"></a> 186 <a class="indexterm" name="id381306"></a> 187 <a class="indexterm" name="id381315"></a> 188 <a class="indexterm" name="id381322"></a> 189 189 The systems Kerberos installation must be configured to communicate with 190 190 your primary Active Directory server (ADS KDC). … … 194 194 unless you are using Windows 2003 servers. 195 195 </p><p> 196 <a class="indexterm" name="id38 2810"></a>197 <a class="indexterm" name="id38 2817"></a>198 <a class="indexterm" name="id38 2824"></a>199 <a class="indexterm" name="id38 2830"></a>200 <a class="indexterm" name="id38 2837"></a>201 <a class="indexterm" name="id38 2846"></a>202 <a class="indexterm" name="id38 2853"></a>196 <a class="indexterm" name="id381338"></a> 197 <a class="indexterm" name="id381345"></a> 198 <a class="indexterm" name="id381352"></a> 199 <a class="indexterm" name="id381358"></a> 200 <a class="indexterm" name="id381365"></a> 201 <a class="indexterm" name="id381374"></a> 202 <a class="indexterm" name="id381381"></a> 203 203 Officially, neither MIT (1.3.4) nor Heimdal (0.63) Kerberos needs an <code class="filename">/etc/krb5.conf</code> 204 204 file in order to work correctly. All ADS domains automatically create SRV records in the … … 208 208 specifying only a single KDC, even if there is more than one. Using the DNS lookup 209 209 allows the KRB5 libraries to use whichever KDCs are available. 210 </p><div class="procedure" title="Procedure 12.1. Kerberos Configuration Steps"><a name="id38 2882"></a><p class="title"><b>Procedure 12.1. Kerberos Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>211 <a class="indexterm" name="id38 2893"></a>210 </p><div class="procedure" title="Procedure 12.1. Kerberos Configuration Steps"><a name="id381410"></a><p class="title"><b>Procedure 12.1. Kerberos Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 211 <a class="indexterm" name="id381421"></a> 212 212 If you find the need to manually configure the <code class="filename">krb5.conf</code>, you should edit it 213 213 to have the contents shown in <a class="link" href="DomApps.html#ch10-krb5conf" title="Example 12.1. Kerberos Configuration File: /etc/krb5.conf">“Kerberos Configuration File: /etc/krb5.conf”</a>. The final fully qualified path for this file 214 214 should be <code class="filename">/etc/krb5.conf</code>. 215 215 </p></li><li class="step" title="Step 2"><p> 216 <a class="indexterm" name="id38 2926"></a>217 <a class="indexterm" name="id38 2933"></a>218 <a class="indexterm" name="id38 2940"></a>219 <a class="indexterm" name="id38 2947"></a>220 <a class="indexterm" name="id38 2953"></a>221 <a class="indexterm" name="id38 2960"></a>222 <a class="indexterm" name="id38 2967"></a>223 <a class="indexterm" name="id38 2974"></a>224 <a class="indexterm" name="id38 2981"></a>225 <a class="indexterm" name="id38 2990"></a>226 <a class="indexterm" name="id38 2996"></a>227 <a class="indexterm" name="id38 3003"></a>228 <a class="indexterm" name="id38 3010"></a>216 <a class="indexterm" name="id381455"></a> 217 <a class="indexterm" name="id381462"></a> 218 <a class="indexterm" name="id381468"></a> 219 <a class="indexterm" name="id381475"></a> 220 <a class="indexterm" name="id381482"></a> 221 <a class="indexterm" name="id381489"></a> 222 <a class="indexterm" name="id381495"></a> 223 <a class="indexterm" name="id381502"></a> 224 <a class="indexterm" name="id381509"></a> 225 <a class="indexterm" name="id381518"></a> 226 <a class="indexterm" name="id381525"></a> 227 <a class="indexterm" name="id381532"></a> 228 <a class="indexterm" name="id381538"></a> 229 229 The following gotchas often catch people out. Kerberos is case sensitive. Your realm must 230 230 be in UPPERCASE, or you will get an error: <span class="quote">“<span class="quote">Cannot find KDC for requested realm while getting … … 242 242 when you try to join the realm. 243 243 </p></li><li class="step" title="Step 3"><p> 244 <a class="indexterm" name="id38 3045"></a>244 <a class="indexterm" name="id381574"></a> 245 245 You are now ready to test your installation by issuing the command: 246 246 </p><pre class="screen"> … … 262 262 kdc = w2k3s.london.abmas.biz 263 263 } 264 </pre></div></div><br class="example-break"><p><a class="indexterm" name="id38 3105"></a>264 </pre></div></div><br class="example-break"><p><a class="indexterm" name="id381633"></a> 265 265 The command 266 266 </p><pre class="screen"> … … 268 268 </pre><p> 269 269 shows the Kerberos tickets cached by the system. 270 </p><div class="sect3" title="Samba Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id38 3127"></a>Samba Configuration</h4></div></div></div><p>271 <a class="indexterm" name="id38 3135"></a>270 </p><div class="sect3" title="Samba Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id381656"></a>Samba Configuration</h4></div></div></div><p> 271 <a class="indexterm" name="id381663"></a> 272 272 Samba must be configured to correctly use Active Directory. Samba-3 must be used, since it 273 273 has the necessary components to interface with Active Directory. 274 </p><div class="procedure" title="Procedure 12.2. Securing Samba-3 With ADS Support Steps"><a name="id38 3144"></a><p class="title"><b>Procedure 12.2. Securing Samba-3 With ADS Support Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>275 <a class="indexterm" name="id38 3156"></a>276 <a class="indexterm" name="id38 3162"></a>277 <a class="indexterm" name="id38 3169"></a>278 <a class="indexterm" name="id38 3176"></a>279 <a class="indexterm" name="id38 3183"></a>274 </p><div class="procedure" title="Procedure 12.2. Securing Samba-3 With ADS Support Steps"><a name="id381673"></a><p class="title"><b>Procedure 12.2. Securing Samba-3 With ADS Support Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 275 <a class="indexterm" name="id381684"></a> 276 <a class="indexterm" name="id381691"></a> 277 <a class="indexterm" name="id381698"></a> 278 <a class="indexterm" name="id381704"></a> 279 <a class="indexterm" name="id381711"></a> 280 280 Download the latest stable Samba-3 for Red Hat Linux from the official Samba Team 281 281 <a class="ulink" href="http://ftp.samba.org" target="_top">FTP site.</a> The official Samba Team … … 283 283 needed, and are linked against MIT KRB5 version 1.3.1 and therefore are ready for use. 284 284 </p><p> 285 <a class="indexterm" name="id38 3207"></a>286 <a class="indexterm" name="id38 3213"></a>285 <a class="indexterm" name="id381735"></a> 286 <a class="indexterm" name="id381742"></a> 287 287 The necessary, validated RPM packages for SUSE Linux may be obtained from 288 288 the <a class="ulink" href="ftp://ftp.sernet.de/pub/samba" target="_top">SerNet</a> FTP site that … … 294 294 file so it has contents similar to the example shown in <a class="link" href="DomApps.html#ch10-smbconf" title="Example 12.2. Samba Configuration File: /etc/samba/smb.conf">“Samba Configuration File: /etc/samba/smb.conf”</a>. 295 295 </p></li><li class="step" title="Step 3"><p> 296 <a class="indexterm" name="id38 3261"></a>297 <a class="indexterm" name="id38 3268"></a>298 <a class="indexterm" name="id38 3274"></a>i299 <a class="indexterm" name="id38 3286"></a>300 <a class="indexterm" name="id38 3293"></a>296 <a class="indexterm" name="id381790"></a> 297 <a class="indexterm" name="id381797"></a> 298 <a class="indexterm" name="id381803"></a>i 299 <a class="indexterm" name="id381815"></a> 300 <a class="indexterm" name="id381822"></a> 301 301 Next you need to create a computer account in the Active Directory. 302 302 This sets up the trust relationship needed for other clients to … … 308 308 </pre><p> 309 309 </p></li><li class="step" title="Step 4"><p> 310 <a class="indexterm" name="id38 3324"></a>311 <a class="indexterm" name="id38 3331"></a>312 <a class="indexterm" name="id38 3337"></a>313 <a class="indexterm" name="id38 3344"></a>314 <a class="indexterm" name="id38 3351"></a>310 <a class="indexterm" name="id381853"></a> 311 <a class="indexterm" name="id381860"></a> 312 <a class="indexterm" name="id381866"></a> 313 <a class="indexterm" name="id381873"></a> 314 <a class="indexterm" name="id381880"></a> 315 315 Your new Samba binaries must be started in the standard manner as is applicable 316 316 to the platform you are running on. Alternatively, start your Active Directory-enabled Samba with the following commands: … … 321 321 </pre><p> 322 322 </p></li><li class="step" title="Step 5"><p> 323 <a class="indexterm" name="id38 3390"></a>324 <a class="indexterm" name="id38 3396"></a>325 <a class="indexterm" name="id38 3406"></a>326 <a class="indexterm" name="id38 3412"></a>327 <a class="indexterm" name="id38 3419"></a>323 <a class="indexterm" name="id381919"></a> 324 <a class="indexterm" name="id381925"></a> 325 <a class="indexterm" name="id381935"></a> 326 <a class="indexterm" name="id381941"></a> 327 <a class="indexterm" name="id381948"></a> 328 328 We now need to test that Samba is communicating with the Active 329 329 Directory domain; most specifically, we want to see whether winbind … … 358 358 This enumerates all the groups in your Active Directory tree. 359 359 </p></li><li class="step" title="Step 6"><p> 360 <a class="indexterm" name="id38 3476"></a>361 <a class="indexterm" name="id38 3483"></a>360 <a class="indexterm" name="id382005"></a> 361 <a class="indexterm" name="id382012"></a> 362 362 Squid uses the <code class="literal">ntlm_auth</code> helper build with Samba-3. 363 363 You may test <code class="literal">ntlm_auth</code> with the command: … … 371 371 </pre><p> 372 372 </p></li><li class="step" title="Step 7"><p> 373 <a class="indexterm" name="id38 3533"></a>374 <a class="indexterm" name="id38 3540"></a>375 <a class="indexterm" name="id38 3547"></a>376 <a class="indexterm" name="id38 3553"></a>377 <a class="indexterm" name="id38 3560"></a>378 <a class="indexterm" name="id38 3567"></a>379 <a class="indexterm" name="id38 3574"></a>380 <a class="indexterm" name="id38 3581"></a>373 <a class="indexterm" name="id382062"></a> 374 <a class="indexterm" name="id382069"></a> 375 <a class="indexterm" name="id382076"></a> 376 <a class="indexterm" name="id382082"></a> 377 <a class="indexterm" name="id382089"></a> 378 <a class="indexterm" name="id382096"></a> 379 <a class="indexterm" name="id382103"></a> 380 <a class="indexterm" name="id382110"></a> 381 381 The <code class="literal">ntlm_auth</code> helper, when run from a command line as the user 382 382 <span class="quote">“<span class="quote">root</span>”</span>, authenticates against your Active Directory domain (with … … 396 396 <code class="prompt">root# </code> chmod 750 /var/lib/samba/winbindd_privileged 397 397 </pre><p> 398 </p></li></ol></div></div><div class="sect3" title="NSS Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id38 3649"></a>NSS Configuration</h4></div></div></div><p>399 <a class="indexterm" name="id38 3656"></a>400 <a class="indexterm" name="id38 3663"></a>401 <a class="indexterm" name="id38 3670"></a>398 </p></li></ol></div></div><div class="sect3" title="NSS Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id382178"></a>NSS Configuration</h4></div></div></div><p> 399 <a class="indexterm" name="id382185"></a> 400 <a class="indexterm" name="id382192"></a> 401 <a class="indexterm" name="id382199"></a> 402 402 For Squid to benefit from Samba-3, NSS must be updated to allow winbind as a valid route to user authentication. 403 403 </p><p> 404 404 Edit your <code class="filename">/etc/nsswitch.conf</code> file so it has the parameters shown 405 405 in <a class="link" href="DomApps.html#ch10-etcnsscfg" title="Example 12.3. NSS Configuration File Extract File: /etc/nsswitch.conf">“NSS Configuration File Extract File: /etc/nsswitch.conf”</a>. 406 </p><div class="example"><a name="ch10-smbconf"></a><p class="title"><b>Example 12.2. Samba Configuration File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id38 3726"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id383737"></a><em class="parameter"><code>netbios name = W2K3S</code></em></td></tr><tr><td><a class="indexterm" name="id383749"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id383760"></a><em class="parameter"><code>security = ads</code></em></td></tr><tr><td><a class="indexterm" name="id383772"></a><em class="parameter"><code>encrypt passwords = yes</code></em></td></tr><tr><td><a class="indexterm" name="id383783"></a><em class="parameter"><code>password server = w2k3s.london.abmas.biz</code></em></td></tr><tr><td># separate domain and username with '/', like DOMAIN/username</td></tr><tr><td><a class="indexterm" name="id383799"></a><em class="parameter"><code>winbind separator = /</code></em></td></tr><tr><td># use UIDs from 10000 to 20000 for domain users</td></tr><tr><td><a class="indexterm" name="id383814"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td># use GIDs from 10000 to 20000 for domain groups</td></tr><tr><td><a class="indexterm" name="id383829"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td># allow enumeration of winbind users and groups</td></tr><tr><td><a class="indexterm" name="id383844"></a><em class="parameter"><code>winbind enum users = yes</code></em></td></tr><tr><td><a class="indexterm" name="id383856"></a><em class="parameter"><code>winbind enum groups = yes</code></em></td></tr><tr><td><a class="indexterm" name="id383868"></a><em class="parameter"><code>winbind user default domain = yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch10-etcnsscfg"></a><p class="title"><b>Example 12.3. NSS Configuration File Extract File: <code class="filename">/etc/nsswitch.conf</code></b></p><div class="example-contents"><pre class="screen">406 </p><div class="example"><a name="ch10-smbconf"></a><p class="title"><b>Example 12.2. Samba Configuration File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id382255"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id382266"></a><em class="parameter"><code>netbios name = W2K3S</code></em></td></tr><tr><td><a class="indexterm" name="id382278"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id382289"></a><em class="parameter"><code>security = ads</code></em></td></tr><tr><td><a class="indexterm" name="id382301"></a><em class="parameter"><code>encrypt passwords = yes</code></em></td></tr><tr><td><a class="indexterm" name="id382312"></a><em class="parameter"><code>password server = w2k3s.london.abmas.biz</code></em></td></tr><tr><td># separate domain and username with '/', like DOMAIN/username</td></tr><tr><td><a class="indexterm" name="id382328"></a><em class="parameter"><code>winbind separator = /</code></em></td></tr><tr><td># use UIDs from 10000 to 20000 for domain users</td></tr><tr><td><a class="indexterm" name="id382343"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td># use GIDs from 10000 to 20000 for domain groups</td></tr><tr><td><a class="indexterm" name="id382358"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td># allow enumeration of winbind users and groups</td></tr><tr><td><a class="indexterm" name="id382373"></a><em class="parameter"><code>winbind enum users = yes</code></em></td></tr><tr><td><a class="indexterm" name="id382385"></a><em class="parameter"><code>winbind enum groups = yes</code></em></td></tr><tr><td><a class="indexterm" name="id382396"></a><em class="parameter"><code>winbind user default domain = yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch10-etcnsscfg"></a><p class="title"><b>Example 12.3. NSS Configuration File Extract File: <code class="filename">/etc/nsswitch.conf</code></b></p><div class="example-contents"><pre class="screen"> 407 407 passwd: files winbind 408 408 shadow: files 409 409 group: files winbind 410 </pre></div></div><br class="example-break"></div><div class="sect3" title="Squid Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id38 3905"></a>Squid Configuration</h4></div></div></div><p>411 <a class="indexterm" name="id38 3913"></a>412 <a class="indexterm" name="id38 3920"></a>410 </pre></div></div><br class="example-break"></div><div class="sect3" title="Squid Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id382434"></a>Squid Configuration</h4></div></div></div><p> 411 <a class="indexterm" name="id382441"></a> 412 <a class="indexterm" name="id382448"></a> 413 413 Squid must be configured correctly to interact with the Samba-3 414 414 components that handle Active Directory authentication. 415 </p></div></div><div class="sect2" title="Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id38 3934"></a>Configuration</h3></div></div></div></div><div class="procedure" title="Procedure 12.3. Squid Configuration Steps"><a name="id383939"></a><p class="title"><b>Procedure 12.3. Squid Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>416 <a class="indexterm" name="id38 3950"></a>417 <a class="indexterm" name="id38 3957"></a>418 <a class="indexterm" name="id38 3965"></a>415 </p></div></div><div class="sect2" title="Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id382462"></a>Configuration</h3></div></div></div></div><div class="procedure" title="Procedure 12.3. Squid Configuration Steps"><a name="id382467"></a><p class="title"><b>Procedure 12.3. Squid Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 416 <a class="indexterm" name="id382479"></a> 417 <a class="indexterm" name="id382485"></a> 418 <a class="indexterm" name="id382493"></a> 419 419 If your Linux distribution is SUSE Linux 9, the version of Squid 420 420 supplied is already enabled to use the winbind helper agent. You … … 422 422 programs. 423 423 </p></li><li class="step" title="Step 2"><p> 424 <a class="indexterm" name="id38 3980"></a>425 <a class="indexterm" name="id38 3987"></a>426 <a class="indexterm" name="id38 3994"></a>427 <a class="indexterm" name="id38 4001"></a>428 <a class="indexterm" name="id38 4007"></a>424 <a class="indexterm" name="id382508"></a> 425 <a class="indexterm" name="id382515"></a> 426 <a class="indexterm" name="id382522"></a> 427 <a class="indexterm" name="id382529"></a> 428 <a class="indexterm" name="id382536"></a> 429 429 Squid, by default, runs as the user <code class="constant">nobody</code>. You need to 430 430 add a system user <code class="constant">squid</code> and a system group … … 434 434 and a <code class="constant">squid</code> group in <code class="filename">/etc/group</code> if these aren't there already. 435 435 </p></li><li class="step" title="Step 3"><p> 436 <a class="indexterm" name="id38 4053"></a>437 <a class="indexterm" name="id38 4060"></a>436 <a class="indexterm" name="id382581"></a> 437 <a class="indexterm" name="id382588"></a> 438 438 You now need to change the permissions on Squid's <code class="constant">var</code> 439 439 directory. Enter the following command: … … 442 442 </pre><p> 443 443 </p></li><li class="step" title="Step 4"><p> 444 <a class="indexterm" name="id38 4089"></a>445 <a class="indexterm" name="id38 4096"></a>444 <a class="indexterm" name="id382617"></a> 445 <a class="indexterm" name="id382624"></a> 446 446 Squid must also have control over its logging. Enter the following commands: 447 447 </p><pre class="screen"> … … 457 457 </pre><p> 458 458 </p></li><li class="step" title="Step 6"><p> 459 <a class="indexterm" name="id38 4153"></a>459 <a class="indexterm" name="id382681"></a> 460 460 The <code class="filename">/etc/squid/squid.conf</code> file must be edited to include the lines from 461 461 <a class="link" href="DomApps.html#etcsquidcfg" title="Example 12.4. Squid Configuration File Extract /etc/squid.conf [ADMINISTRATIVE PARAMETERS Section]">“Squid Configuration File Extract /etc/squid.conf [ADMINISTRATIVE PARAMETERS Section]”</a> and <a class="link" href="DomApps.html#etcsquid2" title="Example 12.5. Squid Configuration File extract File: /etc/squid.conf [AUTHENTICATION PARAMETERS Section]">“Squid Configuration File extract File: /etc/squid.conf [AUTHENTICATION PARAMETERS Section]”</a>. 462 462 </p></li><li class="step" title="Step 7"><p> 463 <a class="indexterm" name="id38 4186"></a>463 <a class="indexterm" name="id382714"></a> 464 464 You must create Squid's cache directories before it may be run. Enter the following command: 465 465 </p><pre class="screen"> … … 488 488 acl AuthorizedUsers proxy_auth REQUIRED 489 489 http_access allow all AuthorizedUsers 490 </pre></div></div><br class="example-break"></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id38 4281"></a>Key Points Learned</h3></div></div></div><p>491 <a class="indexterm" name="id38 4289"></a>492 <a class="indexterm" name="id38 4296"></a>493 <a class="indexterm" name="id38 4303"></a>494 <a class="indexterm" name="id38 4310"></a>495 <a class="indexterm" name="id38 4321"></a>490 </pre></div></div><br class="example-break"></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id382809"></a>Key Points Learned</h3></div></div></div><p> 491 <a class="indexterm" name="id382816"></a> 492 <a class="indexterm" name="id382823"></a> 493 <a class="indexterm" name="id382830"></a> 494 <a class="indexterm" name="id382837"></a> 495 <a class="indexterm" name="id382848"></a> 496 496 Microsoft Windows networking protocols permeate the spectrum of technologies that Microsoft 497 497 Windows clients use, even when accessing traditional services such as Web browsers. Depending … … 500 500 the cookie-based authentication regime used by all competing browsers. It is Samba's implementation 501 501 of NTLMSSP that makes it attractive to implement the solution that has been demonstrated in this chapter. 502 </p></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id38 4336"></a>Questions and Answers</h2></div></div></div><p>503 <a class="indexterm" name="id38 4344"></a>504 <a class="indexterm" name="id38 4351"></a>505 <a class="indexterm" name="id38 4358"></a>506 <a class="indexterm" name="id38 4365"></a>502 </p></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id382864"></a>Questions and Answers</h2></div></div></div><p> 503 <a class="indexterm" name="id382871"></a> 504 <a class="indexterm" name="id382878"></a> 505 <a class="indexterm" name="id382885"></a> 506 <a class="indexterm" name="id382892"></a> 507 507 The development of the <code class="literal">ntlm_auth</code> module was first discussed in many Open Source circles 508 508 in 2002. At the SambaXP conference in Goettingen, Germany, Mr. Francesco Chemolli demonstrated the use of … … 523 523 Make certain that your Squid proxy server is equipped with sufficient memory to permit all proxy operations to run 524 524 out of memory without invoking the overheads involved in the use of memory that has to be swapped to disk. 525 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id38 4423"></a><dl><dt> <a href="DomApps.html#id384430">525 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id382950"></a><dl><dt> <a href="DomApps.html#id382957"> 526 526 What does Samba have to do with Web proxy serving? 527 </a></dt><dt> <a href="DomApps.html#id38 4585">527 </a></dt><dt> <a href="DomApps.html#id383112"> 528 528 What other services does Samba provide? 529 </a></dt><dt> <a href="DomApps.html#id38 4721">529 </a></dt><dt> <a href="DomApps.html#id383248"> 530 530 Does use of Samba (ntlm_auth) improve the performance of Squid? 531 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id38 4430"></a><a name="id384432"></a></td><td align="left" valign="top"><p>531 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id382957"></a><a name="id382959"></a></td><td align="left" valign="top"><p> 532 532 What does Samba have to do with Web proxy serving? 533 533 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 534 <a class="indexterm" name="id38 4443"></a>535 <a class="indexterm" name="id38 4450"></a>536 <a class="indexterm" name="id38 4457"></a>537 <a class="indexterm" name="id38 4466"></a>538 <a class="indexterm" name="id38 4473"></a>534 <a class="indexterm" name="id382970"></a> 535 <a class="indexterm" name="id382977"></a> 536 <a class="indexterm" name="id382984"></a> 537 <a class="indexterm" name="id382993"></a> 538 <a class="indexterm" name="id383000"></a> 539 539 To provide transparent interoperability between Windows clients and the network services 540 540 that are used from them, Samba had to develop tools and facilities that deliver that feature. The benefit … … 542 542 module is basically a wrapper around authentication code from the core of the Samba project. 543 543 </p><p> 544 <a class="indexterm" name="id38 4492"></a>545 <a class="indexterm" name="id38 4499"></a>546 <a class="indexterm" name="id38 4508"></a>547 <a class="indexterm" name="id38 4517"></a>548 <a class="indexterm" name="id38 4526"></a>549 <a class="indexterm" name="id38 4533"></a>550 <a class="indexterm" name="id38 4540"></a>551 <a class="indexterm" name="id38 4546"></a>552 <a class="indexterm" name="id38 4553"></a>544 <a class="indexterm" name="id383019"></a> 545 <a class="indexterm" name="id383026"></a> 546 <a class="indexterm" name="id383035"></a> 547 <a class="indexterm" name="id383044"></a> 548 <a class="indexterm" name="id383053"></a> 549 <a class="indexterm" name="id383060"></a> 550 <a class="indexterm" name="id383067"></a> 551 <a class="indexterm" name="id383074"></a> 552 <a class="indexterm" name="id383080"></a> 553 553 The <code class="literal">ntlm_auth</code> module supports basic plain-text authentication and NTLMSSP 554 554 protocols. This module makes it possible for Web and FTP proxy requests to be authenticated without … … 558 558 also. 559 559 </p><p> 560 <a class="indexterm" name="id38 4574"></a>560 <a class="indexterm" name="id383101"></a> 561 561 The short answer is that by adding a wrapper around key authentication components of Samba, other 562 562 projects (like Squid) can benefit from the labors expended in meeting user interoperability needs. 563 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id38 4585"></a><a name="id384588"></a></td><td align="left" valign="top"><p>563 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id383112"></a><a name="id383115"></a></td><td align="left" valign="top"><p> 564 564 What other services does Samba provide? 565 565 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 566 <a class="indexterm" name="id38 4599"></a>567 <a class="indexterm" name="id38 4606"></a>568 <a class="indexterm" name="id38 4612"></a>569 <a class="indexterm" name="id38 4619"></a>570 <a class="indexterm" name="id38 4626"></a>566 <a class="indexterm" name="id383126"></a> 567 <a class="indexterm" name="id383133"></a> 568 <a class="indexterm" name="id383139"></a> 569 <a class="indexterm" name="id383146"></a> 570 <a class="indexterm" name="id383153"></a> 571 571 Samba-3 is a file and print server. The core components that provide this functionality are <code class="literal">smbd</code>, 572 572 <code class="literal">nmbd</code>, and the identity resolver daemon, <code class="literal">winbindd</code>. 573 573 </p><p> 574 <a class="indexterm" name="id38 4655"></a>575 <a class="indexterm" name="id38 4662"></a>574 <a class="indexterm" name="id383182"></a> 575 <a class="indexterm" name="id383189"></a> 576 576 Samba-3 is an SMB/CIFS client. The core component that provides this is called <code class="literal">smbclient</code>. 577 577 </p><p> 578 <a class="indexterm" name="id38 4679"></a>579 <a class="indexterm" name="id38 4685"></a>580 <a class="indexterm" name="id38 4692"></a>581 <a class="indexterm" name="id38 4699"></a>582 <a class="indexterm" name="id38 4706"></a>578 <a class="indexterm" name="id383206"></a> 579 <a class="indexterm" name="id383212"></a> 580 <a class="indexterm" name="id383219"></a> 581 <a class="indexterm" name="id383226"></a> 582 <a class="indexterm" name="id383233"></a> 583 583 Samba-3 includes a number of helper tools, plug-in modules, utilities, and test and validation facilities. 584 584 Samba-3 includes glue modules that help provide interoperability between MS Windows clients and UNIX/Linux … … 587 587 to permit identity resolution via SMB/CIFS servers (Windows NT4/200x, Samba, and a host of other commercial 588 588 server products). 589 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id38 4721"></a><a name="id384723"></a></td><td align="left" valign="top"><p>589 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id383248"></a><a name="id383250"></a></td><td align="left" valign="top"><p> 590 590 Does use of Samba (<code class="literal">ntlm_auth</code>) improve the performance of Squid? 591 591 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
Note:
See TracChangeset
for help on using the changeset viewer.
