Integrating samba 3 into a windows2003 Domain

wxb517xz

Integrating samba 3 into a windows2003 Domain

                                                Date: 2005-6-17

Summary
This How-To will walk you through integrating your Samba file servers in to a Windows 2003 Domain.
Backgroud
We are ready to upgrade previous Windows 2000 farms to Microsoft’s most talked about OS.This is a very good achievement for them and also one that will benefit existing Windows infrastructures.
With that said, on the other side of the tracks, we see that penguin in the sky, making headlines as well. Some organizations have already took the leap, and have started bringing in Linux very slowly, as well as some of the more bold organizations willing to totally replace their existing Windows infrastructure with Linux.
Can we integrate Linux, from a file sharing perspective, in to Windows 2003 domains? Well, up until now, Samba, file sharing services for Linux and Unix variants, has been revolutionary in doing just such a thing within Windows NT and Windows 2000 domains. But, we all know Microsoft doesn't want its open-source rival to be that tightly integrated with its Windows products, we then began wondering whether they had changed the behavior of the SMB (server message block) protocol in Windows 2003 at all. From a security standpoint, they have, within relation to Active Directory.
The guide that follows will show you how to integrate our Samba servers running Linux in to your newly stocked Windows 2003 domains with Active Directory, using Samba 3.0.14a (current stage of development), Kerberos for authentication with Active Directory, and Winbind for making windows users available to the Samba server.
Invironment:
Windows 2003 Primary Domain Controller - IP Address: 192.168.80.10- HOSTNAME: ZQDC2
Red Hat Linux 9 - IP Address: 192.168.80.8- HOSTNAME: SAM01
Tools needed:
[root@sam01 root]# rpm -qa | grep openldap
openldap-devel-2.0.27-8
openldap-2.0.27-8
openldap-clients-2.0.27-8

[root@sam01 root]# rpm -qa | grep pam
pam-devel-0.75-48
pam_krb5-2.1.2-1
pam_smb-1.1.6-7
pam-0.75-48
would also install the smb package as well so samba must upgrad to 3.0.0 or later
would also install the krb5 package as well so krb5 must upgrad to1.3.1 or later
Downloading the Samba Distribution ,frist installing samba:
$ tar xvfz samba-latest.tar.gz
cd samba-3.0.14a /source
./configure
--with-smbwrapper   #allows programs running on the Unix host to access SMB shared folders
--with-smbmount               #allows SMB shared folders to be mounted
--with-msdfs                         #support for Microsoft Distributed file
--with-syslog
--with-winbind                       #suppport join the windows pdc
--with-pam                        #support pam authentication
--with-krb5                             #support kerberos authentication
--with-ads                             #support samba join win200x DC
--with-ldap
2>&1 | tee config.my.log

make 2>&1 | tee make.log
make install 2>&1 | tee make-install.log          #default located /usr/local/samba

Upgrading installation:
1) rpm package:        
                     rpm -e samba
                     rpm -e samba-client
                     rpm -e samba-common
rpm –Uvh samba-latest.i386.rpm
        Or  rpmbuild –rebuild samba-latest.src.rpm
                     cd /usr/src/redhat/rpms/i386
                     rpm –Uvh samba-latest.rpm
2) tar package:   
                     autoconf
                     make clean
                     rm config.cache
                     rm –rf /usr/local/samba
                     reinstalling samba
Configure samba for GUI:
1)Enabling SWAT:
              Cat /etc/service
              Swat 901/tcp           #add it to the end of the file
2)use your web browser to connect to http://localhost:901

Starting the Samba Daemons:
1)Starting the manually:
              # /usr/local/samba/bin/smbd -D
              # /usr/local/samba/bin/nmbd -D
              # /usr/local/samba/bin/wibindd -D
2)Starting script:
               # Script para Samba
               # Source function library.
                      ./etc/init.d/functions
                            RETVAL=0
                   prog="Samba"
                            start() {
             echo -n $"Starting $prog: "
    daemon /usr/local/samba/sbin/smbd -D
    daemon /usr/local/samba/sbin/nmbd -D
    daemon /usr/local/samba/sbin/winbindd
    RETVAL=$?
  echo
  [ $RETVAL -eq 0 ] && touch /usr/local/samba/var/locks
  return $RETVAL
}
                            stop() {
    echo -n $"Shutting down $prog: "
              killproc smbd
              killproc nmbd
              killproc winbindd
              RETVAL=$?
              echo
              [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/samba
              return $RETVAL
}
# See how we were called.
case "$1" in
  start)
        start
        ;;
  stop)
        stop
        ;;
  restart|reload)
        stop
               start
        RETVAL=$?
        ;;
  status)
        status smbd
        status nmbd
        status winbindd
        RETVAL=$?
        ;;
  who)
        /usr/local/samba/bin/smbstatus
        ;;
  config)
        vi /usr/local/samba/lib/smb.conf
        ;;
  *)
        echo $"Usage: $0 {start|stop|restart|status|who|config}"
        exit 1
esac
exit $RETVAL

with the script can start and stop samba:
       /etc/rc.d/init.d/smb start
       /etc/rc.d/init.d/smb stop

Testing the Samba Daemons:
/usr/local/samba/bin/smbclient -U% -L localhost
/usr/local/samba/bin/testparm ../lib/smb.conf   #test samba conf file
Connect from a Remote SMB Client:
C:\> net use d:
\\servername\service
A Basic Samba Configuration File:
# Global parameters
[global]
        workgroup = I-ZQ-LOCAL                # domain
        realm = I-ZQ.COM                                                               
        server string = Wiki_FStore Server
        security = ADS                          # domain authentication
        client schannel = No
        obey pam restrictions = Yes
        pam password change = Yes
        passwd chat = *New*password* %n\n *Retype*new*password* %n\n *passwd:*all*authentication*tokens*updated*successfully*
        unix password sync = Yes
        log file = /usr/local/samba/var/sam.log
        max log size = 30000000
        socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
        domain master = No
        dns proxy = No
        idmap uid = 10000-20000
        idmap gid = 10000-20000
        template homedir = /home/winnt/%D/%U
        template shell = /bin/bash
        winbind separator = +
        hosts allow = 192.168.
[homes]
        comment = Home Directories
        valid users = %S
        read only = No
        create mask = 0664
        valid users = @"I-ZQ-LOCAL+domain users"          #domain users
        directory mask = 0775
        browseable = No
Configure samba authentication:
1)cp ../samba/source/nsswitch/libnss_winbind.so /lib           # winbind library
ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2
/sbin/ldconfig -v | grep winbind                                  # make sure system can find the file

2)make nsswitch/pam_winbind.so
       cp ../samba/source/nsswitch/pam_winbind.so /lib/security    # pam library

3)configure the /etc/nsswith.conf
       vi  /etc/nsswitch.conf  
              passwd:     files winbind     
              shadow:     files winbind      
              group:      files winbind
      
4)configure the /etc/pam.d
       cat /etc/pam.d/sshd
#%PAM-1.0
auth       sufficient     /lib/security/pam_winbind.so  
auth       required      /lib/security/pam_stack.so service=system-auth
auth       required      /lib/security/pam_nologin.so
account    sufficient     /lib/security/pam_winbind.so
account    required      /lib/security/pam_stack.so service=system-auth
password   required      /lib/security/pam_stack.so service=system-auth
session    required       /lib/security/pam_stack.so service=system-auth
session    required       /lib/security/pam_limits.so
session    required       /lib/security/pam_mkhomedir.so   
session    optional       /lib/security/pam_console.so         
       cat /etc/pam.d/samba
#%PAM-1.0
auth       required     pam_stack.so service=system-auth
account    required     pam_stack.so service=system-auth   
cat /etc/pam.d/system-auth
#%PAM-1.0
auth        required     /lib/security/$ISA/pam_env.so
auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok
auth        sufficient    /lib/security/$ISA/pam_winbind.so use_first_pass
auth        required     /lib/security/$ISA/pam_deny.so
account     required     /lib/security/$ISA/pam_unix.so
account     sufficient    /lib/security/$ISA/pam_winbind.so use_first_pass
password    required     /lib/security/$ISA/pam_cracklib.so retry=3 type=
# Note: The above line is complete. There is nothing following the '='
password    sufficient    /lib/security/$ISA/pam_unix.so \
                                             nullok use_authtok md5 shadow
password    sufficient    /lib/security/$ISA/pam_winbind.so use_first_pass
password    required     /lib/security/$ISA/pam_deny.so

Notes: We shalll want to insert the lines above that are in italics. I pam samba config file should look similarly if not almost identically to the lines above (minus the lines in italics) if you are on Red Hat. If it does, I have included the appropriate vi commands for editing the file below, to insert the new lines

5) configure the /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
ticket_lifetime = 24000
default_realm = I-ZQ.COM
dns_lookup_realm = true
dns_lookup_kdc = true

[realms]
I-ZQ.COM = {
  kdc = zqdc2.i-zq.com
  admin_server = zqdc2.i-zq.com
  default_domain = I-ZQ.COM
}

[domain_realm]
.zqdc2.i-zq.com = I-ZQ.COM

[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf

   krb4_convert = false
}   
Notes: To obtain this information from our Domain Controller, right click on my computer->computer name tab->and the full name of your domain will be listed below the Full computer name line on the computer name tab. You will also want to replace IP_ADDRESS in the instructions below (192.168.80.10 in the config file) to the domain controller's IP address.   

6)  configure the npt
install the ntp4171 on windows2003 PDC
start the ntpd
ntpdate 192.168.80.8

7) configure the kdc
kinit administrator@I-ZQ-LOCAL                #Test the kerberos
usr/local/samba/bin/smbclient //ZQDC2/c$ -k

Note: Make sure the times are in sync with your domain controller and your samba server, otherwise you will recieve a message like this, "kinit(v5): Clock skew too great while getting initial credentials", and things will not work
Enter your password for the share if we get prompted to enter one (we shouldn't because we are already logged in to the domain as administrator).
.
8) join the windows:
net rpc join -S I-ZQ-LOCAL -U Administrator
net ads administrator

Note: We shall  then see a success message saying that we SAMBA Host has joined your windows 2003 DOMAIN (for example in the test scenario for this guide: Joined sam01' to Domain  I-ZQ-LOCAL)

9) test the domain users and groups:
wbinfo -u
wbinfo -g  
wbinfo -t                        #checking the trust secret via RPC calls succeeded
wbinfo -D I-ZQ-LOCAL               # view the PDC info
Name              : I-ZQ-LOCAL
Alt_Name          : I-ZQ.COM
SID               : S-1-5-21-2007172020-1639523183-3157189061
Active Directory     : Yes
Native             : No
Primary            : Yes
Sequence           : 17603

Sys Note: A bug was noticed in the version of winbindd that is compiled from this 3.0.14a release. That is to be expected, as there are probably other bugs in this samba release because it is samba software at this point. It seems as though the winbindd deamon needs to be "woken up". so to speak.. Windows will then kick back again with the login screen. Now you may enter a windows user for login and that particular user's password,(ex: I-ZQ-LOCAL+USER) then click ok. You will now be able to browse the samba share.
There you have it, you have just integrated your Samba server in to your Windows 2003 Domain. You can access any machine in the Domain and their shares from the samba server. The same can be done from any windows box in the domain accessing samba shares. The beauty here is that windows users can log in with their own credentials on to samba shares. This is the work of winbindd. Winbind creates maps of domain users and binds them with UID and GID 10000-20000 on to the samba server when those credentials accesses it.
The only security feature we disabled on the Domain Controller is the default signing procedure that takes place on the communication route within Active Directory schema's. On Windows 2000 and Windows NT domains, this signing of packets was not enabled by default. Once Samba nears beta of 3











本文来自ChinaUnix博客，如果查看原文请点：http://blog.chinaunix.net/u/17184/showart_97307.html