Код: Выделить всё
1255933448.887 3 192.168.74.66 TCP_DENIED/403 1292 GET http://mail.ru/ DOMAIN\user NONE/- text/html
Код: Выделить всё
[2009/10/19 15:25:19, 3] nsswitch/winbindd_pam.c:winbindd_dual_pam_auth_crap (1755)
[ 699]: pam auth crap domain: DOMAIN user: user
Код: Выделить всё
winbindd[18179]: [2009/10/21 17:07:30, 0] libsmb/credentials.c:creds_client_check(324)
winbindd[18179]: creds_client_check: credentials check failed.
winbindd[18179]: [2009/10/21 17:07:30, 0] rpc_client/cli_netlogon.c:rpccli_netlogon_sam_network_logon(1030)
winbindd[18179]: rpccli_netlogon_sam_network_logon: credentials chain check failed
Код: Выделить всё
bsd8# uname -a
FreeBSD bsd8.local 8.0-RC1 FreeBSD 8.0-RC1 #1: Fri Oct 23 12:38:52 MSD 2009 root@bsd8.local:/usr/obj/usr/src/sys/yota_pf i386
bsd8# cat /usr/local/etc/sams.conf | grep -v #
[client]
SQUID_DB=squidlog
SAMS_DB=squidctrl
MYSQLHOSTNAME=localhost
MYSQLUSER=sams
MYSQLPASSWORD=******
MYSQLVERSION=5.1
SQUIDCACHEFILE=access.log
SQUIDROOTDIR=/usr/local/etc/squid
SQUIDLOGDIR=/usr/local/squid/logs
SQUIDCACHEDIR=/usr/local/squid/cache
SAMSPATH=/usr/local
SQUIDPATH=/usr/local/sbin
RECODECOMMAND=iconv -f KOI8-R -t 866 %finp > %fout
REJIKPATH=/usr/local/rejik
SHUTDOWNCOMMAND=/sbin/shutdown -h now
CACHENUM=0
bsd8# cat /usr/local/etc/smb.conf | grep -v # | grep -v \;
[global]
workgroup = OFFICE
server string = SAMS Server
security = ADS
hosts allow = 192.168. 127.
load printers = yes
log file = /var/log/samba/log.%m
max log size = 50
password server = dc1.office.local
realm = office.local
interfaces = 192.168.1.29/24
dns proxy = no
display charset = koi8-r
unix charset = koi8-r
dos charset = cp866
winbind separator = +
winbind use default domain = yes
winbind uid = 10000-15000
winbind gid = 10000-15000
winbind enum users = yes
winbind enum groups = yes
[homes]
comment = Home Directories
browseable = no
writable = yes
[printers]
comment = All Printers
path = /var/spool/samba
browseable = no
guest ok = no
writable = no
printable = yes
bsd8# bsd8# cat /usr/local/etc/squid/squid.conf | grep auth_param
# TAG: auth_param
# format: auth_param scheme parameter [setting]
# auth_param basic program /usr/local/libexec/ncsa_auth /usr/local/etc/passwd
# auth_param basic children 5
# auth_param basic realm Squid proxy-caching web server
# auth_param basic credentialsttl 2 hours
# auth_param basic casesensitive off
# auth_param digest program /usr/local/libexec/digest_auth_pw /usr/local/etc/digpass
# auth_param digest children 5
# auth_param digest realm Squid proxy-caching web server
# auth_param digest nonce_garbage_interval 5 minutes
# auth_param digest nonce_max_duration 30 minutes
# auth_param digest nonce_max_count 50
# auth_param digest nonce_strictness off
# auth_param digest check_nonce_count on
# auth_param digest post_workaround off
# auth_param ntlm program /path/to/samba/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
# auth_param ntlm children 5
# auth_param ntlm keep_alive on
# auth_param negotiate program /path/to/samba/bin/ntlm_auth --helper-protocol=gss-spnego
# auth_param negotiate children 5
# auth_param negotiate keep_alive on
#auth_param negotiate program <uncomment and complete this line to activate>
#auth_param negotiate children 5
#auth_param negotiate keep_alive on
auth_param ntlm program /usr/local/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 5
auth_param ntlm keep_alive on
#auth_param digest program <uncomment and complete this line>
#auth_param digest children 5
#auth_param digest realm Squid proxy-caching web server
#auth_param digest nonce_garbage_interval 5 minutes
#auth_param digest nonce_max_duration 30 minutes
#auth_param digest nonce_max_count 50
auth_param basic program /usr/local/bin/ntlm_auth --helper-protocol=squid-2.5-basic
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off
# # auth_param directive).
bsd8# cat /etc/krb5.conf
[libdefaults]
default_realm = OFFICE.LOCAL
clockskew = 300
v4_instance_resolve = false
v4_name_convert = {
host = {
rcmd = host
ftp = ftp
}
plain = {
something = something-else
}
}
[realms]
OFFICE.LOCAL = {
kdc = 192.168.1.124
admin_server = 192.168.1.124
kpasswd_server = 192.168.1.124
}
[domain_realm]
.office.local = OFFICE.LOCAL
bsd8# cat /etc/nsswitch.conf
#
# nsswitch.conf(5) - name service switch configuration file
# $FreeBSD: src/etc/nsswitch.conf,v 1.1.10.1 2009/08/03 08:13:06 kensmith Exp $
#
group: files winbind
group_compat: nis
hosts: files dns
networks: files
passwd: files winbind
passwd_compat: nis
shells: files
services: compat
services_compat: nis
protocols: files
rpc: files
bsd8# cat /etc/hosts
::1 localhost localhost.office.local
127.0.0.1 localhost localhost.office.local
192.168.1.29 bsd8.office.local bsd8
192.168.1.29 bsd8.office.local.
192.168.1.124 dc1.office.local dc1
Код: Выделить всё
[2009/10/28 11:27:52, 1] nsswitch/winbindd.c:main(1019)
winbindd version 3.0.37 started.
Copyright Andrew Tridgell and the Samba Team 1992-2009
[2009/10/28 11:27:52, 0] nsswitch/winbindd_cache.c:initialize_winbindd_cache(2230)
initialize_winbindd_cache: clearing cache and re-creating with version number 1
[2009/10/28 11:27:52, 0] lib/util_sid.c:string_to_sid(242)
string_to_sid: Sid S-0-0 is not in a valid format.
[2009/10/28 11:30:00, 1] nsswitch/idmap.c:idmap_init(377)
Initializing idmap domains
[2009/10/28 11:33:02, 0] lib/util_sid.c:string_to_sid(242)
string_to_sid: Sid S-0-0 is not in a valid format.
[2009/10/28 11:38:23, 0] lib/util_sid.c:string_to_sid(242)
string_to_sid: Sid S-0-0 is not in a valid format.
[2009/10/28 11:43:40, 0] lib/util_sid.c:string_to_sid(242)
string_to_sid: Sid S-0-0 is not in a valid format.
[2009/10/28 11:48:43, 0] lib/util_sid.c:string_to_sid(242)
string_to_sid: Sid S-0-0 is not in a valid format.
[2009/10/28 11:54:06, 0] lib/util_sid.c:string_to_sid(242)
string_to_sid: Sid S-0-0 is not in a valid format.
[2009/10/28 11:59:18, 0] lib/util_sid.c:string_to_sid(242)
string_to_sid: Sid S-0-0 is not in a valid format.
[2009/10/28 12:04:21, 0] lib/util_sid.c:string_to_sid(242)
string_to_sid: Sid S-0-0 is not in a valid format.
[2009/10/28 12:09:24, 0] lib/util_sid.c:string_to_sid(242)
string_to_sid: Sid S-0-0 is not in a valid format.
[2009/10/28 12:14:30, 0] lib/util_sid.c:string_to_sid(242)
string_to_sid: Sid S-0-0 is not in a valid format.
[2009/10/28 12:19:30, 0] lib/util_sid.c:string_to_sid(242)
string_to_sid: Sid S-0-0 is not in a valid format.
Код: Выделить всё
LDAPSERVER=servername_or_ipadress
LDAPBASEDN=your.domain
LDAPUSER=DomainAdministrator
LDAPUSERPASSWD=passwd
LDAPUSERSGROUP=UsersКод: Выделить всё
[2009/10/28 17:34:04, 0] libsmb/credentials.c:creds_client_check(324)
creds_client_check: credentials check failed.
[2009/10/28 17:34:04, 0] rpc_client/cli_netlogon.c:rpccli_netlogon_sam_network_logon(1030)
rpccli_netlogon_sam_network_logon: credentials chain check failed
[2009/10/28 17:35:11, 0] libsmb/credentials.c:creds_client_check(324)
creds_client_check: credentials check failed.
[2009/10/28 17:35:11, 0] rpc_client/cli_netlogon.c:rpccli_netlogon_sam_network_logon(1030)
rpccli_netlogon_sam_network_logon: credentials chain check failed
Код: Выделить всё
[2009/10/28 17:29:35, 1] libsmb/clientgen.c:cli_rpc_pipe_close(386)
cli_rpc_pipe_close: cli_close failed on pipe \NETLOGON, fnum 0x6 to machine server.domain.local. Error was SUCCESS - 0
[2009/10/28 17:34:42, 1] libsmb/clientgen.c:cli_rpc_pipe_close(386)
cli_rpc_pipe_close: cli_close failed on pipe \lsarpc, fnum 0x8003 to machine server.domain.local. Error was SUCCESS - 0
[2009/10/28 17:34:42, 1] libsmb/clientgen.c:cli_rpc_pipe_close(386)
cli_rpc_pipe_close: cli_close failed on pipe \NETLOGON, fnum 0x6 to machine server.domain.local. Error was SUCCESS - 0
[2009/10/28 17:39:45, 1] libsmb/clientgen.c:cli_rpc_pipe_close(386)
cli_rpc_pipe_close: cli_close failed on pipe \lsarpc, fnum 0x8003 to
Код: Выделить всё
Oct 28 17:34:04 proxs winbindd[894]: [2009/10/28 17:34:04, 0] libsmb/credentials.c:creds_client_check(324)
Oct 28 17:34:04 proxs winbindd[894]: creds_client_check: credentials check failed.
Oct 28 17:34:04 proxs winbindd[894]: [2009/10/28 17:34:04, 0] rpc_client/cli_netlogon.c:rpccli_netlogon_sam_network_logon(1030)
Oct 28 17:34:04 proxs winbindd[894]: rpccli_netlogon_sam_network_logon: credentials chain check failed
Oct 28 17:35:04 proxs kernel: pid 1148 (sams), uid 0: exited on signal 11 (core dumped)
Oct 28 17:35:11 proxs winbindd[894]: [2009/10/28 17:35:11, 0] libsmb/credentials.c:creds_client_check(324)
Oct 28 17:35:11 proxs winbindd[894]: creds_client_check: credentials check failed.
Oct 28 17:35:11 proxs winbindd[894]: [2009/10/28 17:35:11, 0] rpc_client/cli_netlogon.c:rpccli_netlogon_sam_network_logon(1030)
Oct 28 17:35:11 proxs winbindd[894]: rpccli_netlogon_sam_network_logon: credentials chain check failed
Oct 28 17:36:05 proxs kernel: pid 1204 (sams), uid 0: exited on signal 11 (core dumped)
Oct 28 17:37:05 proxs kernel: pid 1207 (sams), uid 0: exited on signal 11 (core dumped)
Код: Выделить всё
[2009/11/02 09:47:14, 1] nsswitch/winbindd_group.c:winbindd_getgrnam(519)
group ilia in domain DOMAIN does not exist
[2009/11/02 09:47:15, 1] nsswitch/winbindd_group.c:winbindd_getgrnam(519)
group 0 in domain DOMAIN does not exist
[2009/11/02 09:48:14, 1] nsswitch/winbindd_group.c:winbindd_getgrnam(519)
group 0 in domain DOMAIN does not exist
[2009/11/02 09:50:52, 1] nsswitch/winbindd_group.c:winbindd_getgrnam(519)
group mod_ssl in domain DOMAIN does not exist
[2009/11/02 09:50:52, 1] nsswitch/winbindd_group.c:winbindd_getgrnam(519)
group kaie in domain DOMAIN does not exist
[2009/11/02 09:50:58, 1] nsswitch/winbindd_group.c:winbindd_getgrnam(519)
group ilia in domain DOMAIN does not exist
Код: Выделить всё
FreeBSD proxs.dbschenker.ru 7.2-RELEASE FreeBSD 7.2-RELEASE #0: Fri May 1 08:49:13 UTC 2009 root@walker.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386
Код: Выделить всё
::1 localhost localhost.domain.ru
127.0.0.1 localhost localhost.domain.ru
192.168.0.247 proxs.domain.ru proxs
192.168.0.247 proxs.domain.ru.
192.168.0.252 dc1.domain.ru
192.168.0.248 dc2.domain.ru
Код: Выделить всё
domain domain.ru
nameserver 192.168.0.252
nameserver 192.168.0.248
Код: Выделить всё
[global]
workgroup = DOMAIN
server string = Самс Сервер
security = ADS
hosts allow = 192.168.0. 127.
log file = /var/log/samba/log.%m
max log size = 50
password server = DOMAIN.LOCAL
realm = DOMAIN.LOCAL
dns proxy = no
display charset = koi8-r
unix charset = koi8-r
dos charset = cp866
winbind separator = +
winbind use default domain = yes
winbind uid = 10000-15000
winbind gid = 10000-15000
winbind enum users = yes
winbind enum groups = yes
Код: Выделить всё
[libdefaults]
default_realm = DOMAIN.LOCAL
clockskew = 300
v4_instance_resolve = false
v4_name_convert = {
host = {
rcmd = host
ftp = ftp
}
plain = {
something = something-else
}
}
[realms]
DOMAIN.LOCAL = {
kdc = 192.168.0.248
admin_server = 192.168.0.248
kpasswd_server = 192.168.0.248
}
[domain_realm]
.domain.local = DOMAIN.LOCAL
Код: Выделить всё
group: files winbind
group_compat: nis
hosts: files dns
networks: files
passwd: files winbind
passwd_compat: nis
shells: files
Код: Выделить всё
[client]
SQUID_DB=squidlog
SAMS_DB=squidctrl
MYSQLHOSTNAME=localhost
MYSQLUSER=root
MYSQLPASSWORD=1234567
MYSQLVERSION=5.1
SQUIDCACHEFILE=access.log
SQUIDROOTDIR=/usr/local/etc/squid
SQUIDLOGDIR=/usr/local/squid/logs
SQUIDCACHEDIR=/usr/local/squid/cache
SAMSPATH=/usr/local
SQUIDPATH=/usr/local/sbin
#SQUIDGUARDLOGPATH=/var/log
#SQUIDGUARDDBPATH=/var/db/squidGuard
RECODECOMMAND=iconv -f KOI8-R -t 866 %finp > %fout
#LDAPSERVER=servername_or_ipadress
#LDAPBASEDN=your.domain
#LDAPUSER=DomainAdministrator
#LDAPUSERPASSWD=passwd
#LDAPUSERSGROUP=Users
REJIKPATH=/usr/local/rejik
SHUTDOWNCOMMAND=/sbin/shutdown -h now
CACHENUM=0
Код: Выделить всё
#Recommended minimum configuration per scheme:
auth_param ntlm program /usr/local/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 5
auth_param ntlm keep_alive on
auth_param basic program /usr/local/bin/ntlm_auth --helper-protocol=squid-2.5-basic
auth_param basic children 5
auth_param basic realm Squid Proxy-Server
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off
# TAG: http_access
http_access deny all
Блин ну каким хреном самс их увидет ??? если у вас строки в конфиге закомментированы!alex1812 писал(а): sams.confКод: Выделить всё
[client] SQUID_DB=squidlog SAMS_DB=squidctrl MYSQLHOSTNAME=localhost MYSQLUSER=root MYSQLPASSWORD=1234567 MYSQLVERSION=5.1 SQUIDCACHEFILE=access.log SQUIDROOTDIR=/usr/local/etc/squid SQUIDLOGDIR=/usr/local/squid/logs SQUIDCACHEDIR=/usr/local/squid/cache SAMSPATH=/usr/local SQUIDPATH=/usr/local/sbin #SQUIDGUARDLOGPATH=/var/log #SQUIDGUARDDBPATH=/var/db/squidGuard RECODECOMMAND=iconv -f KOI8-R -t 866 %finp > %fout #LDAPSERVER=servername_or_ipadress #LDAPBASEDN=your.domain #LDAPUSER=DomainAdministrator #LDAPUSERPASSWD=passwd #LDAPUSERSGROUP=Users REJIKPATH=/usr/local/rejik SHUTDOWNCOMMAND=/sbin/shutdown -h now CACHENUM=0
Код: Выделить всё
LDAPSERVER=АЙ ПИ Адрес PDC
LDAPBASEDN=ВАШ.ДОМЕН
LDAPUSER=Administrator
LDAPUSERPASSWD=ПАРОЛЬ_Админа
LDAPUSERSGROUP=Users #(Контейнер АД где находятся пользователи)Самс увидел пользователей после отключения safe_modе в php.ini, но ошибки все равно остались.Cancer писал(а): Блин ну каким хреном самс их увидет ??? если у вас строки в конфиге закомментированы!Код: Выделить всё
LDAPSERVER=АЙ ПИ Адрес PDC LDAPBASEDN=ВАШ.ДОМЕН LDAPUSER=Administrator LDAPUSERPASSWD=ПАРОЛЬ_Админа LDAPUSERSGROUP=Users #(Контейнер АД где находятся пользователи)
В самом первоначальном они были в нормальном виде!alex1812 писал(а):Самс увидел пользователей после отключения safe_modе в php.ini, но ошибки все равно остались.Cancer писал(а): Блин ну каким хреном самс их увидет ??? если у вас строки в конфиге закомментированы!Код: Выделить всё
LDAPSERVER=АЙ ПИ Адрес PDC LDAPBASEDN=ВАШ.ДОМЕН LDAPUSER=Administrator LDAPUSERPASSWD=ПАРОЛЬ_Админа LDAPUSERSGROUP=Users #(Контейнер АД где находятся пользователи)
В первоначальном варианте статьи эти строки тоже были закомментированы, завтра попробую раскоментировать строки, о результатах отпишусь.
, вы сами должны уже начинать думать, а не все копи паст-ом делать, так же ??? 
Про думать согласен, просто не так давно столкнулся с BSD, перелопатил уже кучу материалов, гугл очень хорошо помогаетCancer писал(а): В самом первоначальном они были в нормальном виде!
Это я когда дополнял статью лолонулся и закоментил их, вчера только увидел (пофиксил и дописал описание конфига sams.conf)
Но вас это не умоляет
, но пока не все получается гладко .... Код: Выделить всё
/var/db/samba/>getfacl /var/db/samba/winbindd_privileged
# file: /var/db/samba/winbindd_privileged
# owner: root
# group: wheel
user::rwx
group::r-x
group:squid:r-x
mask::r-x
other::---
Код: Выделить всё
samba-3.0.37,1
sams-1.0.4,1
squid-2.7.7
php5-5.2.11_1
mysql-server-5.1.40
apache-1.3.41_1
.......
fox писал(а):Добрый день, Господа!
Всё сделал по этой статье:
http://www.lissyara.su/?id=1808
Но вот не задача, пробиваю в браузерах прокси, всё работает всё считает, но вот с браузером Opera есть трабла, он всё равно просит аунтитификацию, как это в неё отключить или кто то с этим сталкивался? На офисе до чёрта Опир и все под ними сидят, а тут каждый раз им логин с паролем вводить Юзверы меня прикончат!
За ранние спасибо!
Код: Выделить всё
AddType application/x-httpd-php .php
AddType application/x-httpd-php-source .phps
kesha писал(а):Люди подскажите где начать копать, я настраиваю по этой статье. У меня возникла проблема на этапе настройки sams через веб интерфэйс, не открывается страница ipta4ki/sams, хотя при этом норм работает ipta4ki/index.php, все вроде норм встало, единственное при загрузке выдает
сообщение:
hostname winbindd[743] [data] nsswitch/winbind_cache.c:initialize_winbindd_cache(2230)
hostname winbindd initialize_winbindd_cache:clearing cache and re-craating with version number 1
Kit1 писал(а):Ребят, помогите плиз. Вопрос в 1 посте на этой странице
Код: Выделить всё
mysql_real_connect() error 0. no open database squidctrl, DELAY 3 secСобственно помогите изменить пароль рута, пользователя самс я так понял создаст сам.slatim писал(а):Товарищи форумчане! кто сталкивался с ошибкойВсе настроено по статье. Я так понимаю надо сделать что то с базой squidctrl и пользователем sams.Код: Выделить всё
mysql_real_connect() error 0. no open database squidctrl, DELAY 3 sec
mysql -u mysql ----работает
а mysql -u root --- никак не хочет
Код: Выделить всё
1. Log on to your system as the Unix mysql user that the mysqld server runs as.
2. Locate the .pid file that contains the server's process ID. The exact location and name of this file depend on your distribution, host name, and configuration. Common locations are /var/lib/mysql/, /var/run/mysqld/, and /usr/local/mysql/data/. Generally, the file name has an extension of .pid and begins with either mysqld or your system's host name.
You can stop the MySQL server by sending a normal kill (not kill -9) to the mysqld process, using the path name of the .pid file in the following command:
shell> kill `cat /mysql-data-directory/host_name.pid`
Note the use of backticks rather than forward quotes with the cat command; these cause the output of cat to be substituted into the kill command.
3. Create a text file and place the following statements in it. Replace the password with the password that you want to use.
UPDATE mysql.user SET Password=PASSWORD('MyNewPass') WHERE User='root';
FLUSH PRIVILEGES;
The UPDATE and FLUSH statements each must be written on a single line. The UPDATE statement resets the password for all existing root accounts, and the FLUSH statement tells the server to reload the grant tables into memory.
4. Save the file. For this example, the file will be named /home/me/mysql-init. The file contains the password, so it should not be saved where it can be read by other users.
5. Start the MySQL server with the special --init-file option:
shell> mysqld_safe --init-file=/home/me/mysql-init &
The server executes the contents of the file named by the --init-file option at startup, changing each root account password.
6. After the server has started successfully, delete /home/me/mysql-init.
You should now be able to connect to MySQL as root using the new password.
Alternatively, on any platform, you can set the new password using the mysql client (but this approach is less secure):
1. Stop mysqld and restart it with the --skip-grant-tables option.
2. Connect to the mysqld server with this command:
shell> mysql
3. Issue the following statements in the mysql client. Replace the password with the password that you want to use.
mysql> UPDATE mysql.user SET Password=PASSWORD('MyNewPass')
-> WHERE User='root';
mysql> FLUSH PRIVILEGES;
You should now be able to connect to MySQL as root using the new password.