Делал все по статье http://www.lissyara.su/articles/freebsd ... inbind+ad/
Но увы ни чего не выходит ... в логах пишет
Код: Выделить всё
Feb 24 13:18:05 zhel sshd[68577]: Invalid user pupkin.vv from 10.239.2.188
Feb 24 13:18:05 zhel sshd[68577]: input_userauth_request: invalid user pupkin.vv [preauth]
Feb 24 13:18:05 zhel sshd[68577]: Postponed keyboard-interactive for invalid user pupkin.vv from 10.239.2.188 port 51417 ssh2 [preauth]
Feb 24 13:18:07 zhel sshd[68577]: Postponed keyboard-interactive/pam for invalid user pupkin.vv from 10.239.2.188 port 51417 ssh2 [preauth]
Код: Выделить всё
#
# $FreeBSD: releng/10.1/etc/pam.d/sshd 197769 2009-10-05 09:28:54Z des $
#
# PAM configuration for the "sshd" service
#
# auth
auth sufficient pam_opie.so no_warn no_fake_prompts
auth requisite pam_opieaccess.so no_warn allow_local
#auth sufficient pam_krb5.so no_warn try_first_pass
#auth sufficient pam_ssh.so no_warn try_first_pass
auth required pam_unix.so no_warn try_first_pass
auth sufficient pam_winbind.so
# account
account required pam_nologin.so
#account required pam_krb5.so
account required pam_login_access.so
account required pam_unix.so
account sufficient pam_winbind.so
# session
#session optional pam_ssh.so want_agent
session required /usr/local/lib/pam_mkhomedir.so skel=/usr/share/skel
#session required /usr/local/lib/pam_mkhomedir.so
session required pam_permit.so
# password
#password sufficient pam_krb5.so no_warn try_first_pass
password required pam_unix.so no_warn try_first_pass
Код: Выделить всё
root@zhel:/home/OCTI # wbinfo -u | grep pupkin.vv
pupkin.vv
Код: Выделить всё
root@zhel:/home/OCTI # cat /etc/krb5.conf
[libdefaults]
default_realm = OCTI.ORG
dns_lookup_realm = false
dns_lookup_kdc = true
Код: Выделить всё
root@zhel:/home/OCTI # klist
Credentials cache: FILE:/tmp/krb5cc_0
Principal: pupkin.vv@OCTI.ORG
Issued Expires Principal
Feb 24 11:58:56 2015 Feb 24 21:58:53 2015 krbtgt/OCTI.ORG@OCTI.ORG
Код: Выделить всё
root@zhel:/home/OCTI # cat /usr/local/etc/smb4.conf
[global]
workgroup = OCTI
realm = OCTI.ORG
server role = member server
security = ADS
allow trusted domains = No
unix extensions = No
dns proxy = No
winbind enum users = Yes
winbind enum groups = Yes
winbind use default domain = Yes
winbind nss info = rfc2307
nsupdate command = /usr/local/bin/samba-nsupdate -g
server services = nbt, winbind, smb
nfs4:chown = yes
nfs4:acedup = merge
nfs4:mode = special
idmap config OCTI:range = 500-40000
idmap config OCTI:schema_mode = rfc2307
idmap config OCTI:backend = ad
idmap config *:range = 70001-80000
idmap config * : backend = tdb
map acl inherit = Yes
store dos attributes = Yes
vfs objects = zfsacl
template homedir = /usr/home/OCTI/%U
template shell = /bin/csh
Отправлено спустя 1 час 35 минут 48 секунд:
Задача решилась ... трабла была в том что ВАЖЕН порядок в /etc/pam.d/sshd
Теперь другой вопрос, как разрешить доменной группе root доступ?
