forum.lissyara.su

Код: Выделить всё

[root@onyx /distr/freebsd/samba_ad]# ldapdeleteuser umbrellavc
Warning : using command-line passwords, ldapscripts may not be safe
Successfully deleted user uid=umbrellavc,ou=users,dc=onyx,dc=com from LDAP
[root@onyx /distr/freebsd/samba_ad]# smbpasswd -D 10 -a umbrellavc
Netbios name list:-
my_netbios_names[0]="ONYX"
Attempting to register passdb backend ldapsam
Successfully added passdb backend 'ldapsam'
Attempting to register passdb backend ldapsam_compat
Successfully added passdb backend 'ldapsam_compat'
Attempting to register passdb backend NDS_ldapsam
Successfully added passdb backend 'NDS_ldapsam'
Attempting to register passdb backend NDS_ldapsam_compat
Successfully added passdb backend 'NDS_ldapsam_compat'
Attempting to register passdb backend smbpasswd
Successfully added passdb backend 'smbpasswd'
Attempting to register passdb backend tdbsam
Successfully added passdb backend 'tdbsam'
Attempting to register passdb backend wbc_sam
Successfully added passdb backend 'wbc_sam'
Attempting to find a passdb backend to match ldapsam:ldap://127.0.0.1 (ldapsam)
Found pdb backend ldapsam
smbldap_search_domain_info: Searching for:[(&(objectClass=sambaDomain)(sambaDomainName=ONYX))]
smbldap_search_ext: base => [dc=onyx,dc=com], filter => [(&(objectClass=sambaDomain)(sambaDomainName=ONYX))], scope => [2]
The connection to the LDAP server was closed
smb_ldap_setup_connection: ldap://127.0.0.1
smbldap_open_connection: connection opened
ldap_connect_system: Binding to ldap server ldap://127.0.0.1 as "cn=root,dc=onyx,dc=com"
ldap_connect_system: successful connection to the LDAP server
ldap_connect_system: LDAP server does support paged results
The LDAP server is successfully connected
pdb backend ldapsam:ldap://127.0.0.1 has a valid init
New SMB password:
Retype new SMB password:
smbldap_search_ext: base => [dc=onyx,dc=com], filter => [(&(uid=umbrellavc)(objectclass=sambaSamAccount))], scope => [2]
ldapsam_getsampwnam: Unable to locate user [umbrellavc] count=0
Finding user umbrellavc
Trying _Get_Pwnam(), username as lowercase is umbrellavc
Trying _Get_Pwnam(), username as uppercase is UMBRELLAVC
Checking combinations of 0 uppercase letters in umbrellavc
Get_Pwnam_internals didn't find user [umbrellavc]!
Warning : using command-line passwords, ldapscripts may not be safe
Successfully added user umbrellavc to LDAP
Successfully set password for user umbrellavc
Skipped home directory creation for user umbrellavc (already exists)
_samr_create_user: Running the command `/usr/local/sbin/ldapadduser 'umbrellavc' users' gave 0
Finding user umbrellavc
Trying _Get_Pwnam(), username as lowercase is umbrellavc
Trying _Get_Pwnam(), username as uppercase is UMBRELLAVC
Checking combinations of 0 uppercase letters in umbrellavc
Get_Pwnam_internals didn't find user [umbrellavc]!
pdb_default_create_user: failed to create a new user structure: NT_STATUS_NO_SUCH_USER
Failed to add entry for user umbrellavc.
The connection to the LDAP server was closed

Код: Выделить всё

Failed to find entry for user umbrellavc
но если искать в ldapsearch то там он есть!
[root@onyx /distr/freebsd/samba_ad]# ldapsearch -LLL -x -b 'dc=onyx,dc=com' 'uid=umbrellavc'
dn: uid=umbrellavc,ou=users,dc=onyx,dc=com
objectClass: account
objectClass: posixAccount
cn: umbrellavc
uid: umbrellavc
uidNumber: 10007
gidNumber: 1003
homeDirectory: /home/samba/homes/umbrellavc
loginShell: /bin/sbin/nologin
gecos: umbrellavc
description: User account
Но вот в smbpasswd его както не находит
[root@onyx /distr/freebsd/samba_ad]# smbpasswd -x umbrellavc
Failed to find entry for user umbrellavc.

Код: Выделить всё

FreeBSD onyx.com 9.0-RELEASE FreeBSD 9.0-RELEASE #0: Mon May 21 01:35:23 ALMT 2012 root@onyx.com:/usr/src/sys/amd64/compile/GENERIC amd64
Samba version 3.5.15
PID Username Group Machine
-------------------------------------------------------------------

Service pid machine Connected at
-------------------------------------------------------

No locked files


[root@onyx ~]# wbinfo -m
BUILTIN
ONYX


[root@onyx ~]# /usr/local/etc/rc.d/samba restart
Performing sanity check on Samba configuration: OK
Stopping winbindd.
Waiting for PIDS: 30408.
Stopping smbd.
Waiting for PIDS: 30405.
Stopping nmbd.
Waiting for PIDS: 30402.
Removing stale Samba tdb files: ........ done
Starting nmbd.
Starting smbd.
Starting winbindd.

Код: Выделить всё

smb.conf:





#======================= Global Settings =====================================
[global]
        display charset = koi8-r
        ldap ssl = off
        admin users = umbrellavc
        delete user from group script = /usr/local/sbin/ldapdeleteuserfromgroup '%u' '%g'
        time server = yes
        hosts allow = 192.168.90. 10.10.0. 127. 192.168.88.
        winbind uid = 10000-20000
        dns proxy = no
        netbios name = onyx
        dos charset = cp866
        rename user script = /usr/local/sbin/ldaprenameuser '%uold' '%unew
        local master = yes
        workgroup = onyx
        os level = 255
        ldap admin dn = "cn=root,dc=onyx,dc=com"
        security = user
        add machine script = /usr/local/sbin/ldapaddmachine '%u' computers
        delete user script = /usr/local/sbin/ldapdeleteuser '%u'
        winbind separator = @
        max log size = 50000
        log file = /var/log/samba/samba.log
        load printers = no
        ldap user suffix = ou=users
        add group script = /usr/local/sbin/ldapaddgroup '%g'
        delete group script = /usr/local/sbin/ldapdeletegroup '%g'
        socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
        add user to group script = /usr/local/sbin/ldapaddusertogroup '%u' '%g'
        logon drive = R:
        interfaces = re3
        domain master = yes
        encrypt passwords = yes
        winbind use default domain = yes
        wins proxy = yes
        passdb backend = ldapsam:ldap://127.0.0.1
        logon home = \\%L\homes
        wins support = true
        ldap delete dn = no
        ldap group suffix = ou=groups
        server string = Onyx Server
        ldap machine suffix = ou=computers
        ldap suffix = dc=onyx,dc=com
        winbind gid = 10000-20000
        logon path =
        add user script = /usr/local/sbin/ldapadduser '%u' users
        set primary group script = /usr/local/sbin/ldapsetprimarygroup '%u' '%g'
        unix charset = koi8-r
        preferred master = yes
        domain logons = yes
# wins server = 192.168.90.250
# Пустое значение - неперемещаемые профили.
# username map = /usr/local/etc/samba/smbusers


#============================ Share Definitions ==============================
[homes]
 comment = Home Directories
 path = /home/samba/homes/%U
 browseable = no
 writable = yes
 public = no
 read only = no
 create mask = 0600
 directory mask = 0700
 valid users = %S

[netlogon]
 comment = Network Logon Service
 path = /usr/local/etc/samba/netlogon
 browseable = no
 guest ok = yes
 writable = no
 share modes = no
 volume = NETLOGON

[profiles]
 create mode = 0600
 directory mode = 700
 path = /home/samba/profiles/%u
 browseable = no
 guest ok = yes
 writeable = yes

[pub]
 comment = Папка общего пользования
 path = /home/samba/pub
 valid users = @users
 create mode = 666
 directory mode = 777
 public = yes
 writable = yes
 printable = no
 browseable = yes

[IPC$]
 path = /tmp
 hosts allow = 192.168.90.0/24 10.10.100.0/24 127.0.0.1
 hosts deny = 0.0.0.0/0

                 slapd.conf:
include /usr/local/etc/openldap/schema/core.schema
include /usr/local/etc/openldap/schema/cosine.schema
include /usr/local/etc/openldap/schema/inetorgperson.schema
#include /usr/local/etc/openldap/schema/samba.schema
include /usr/local/etc/openldap/schema/misc.schema
include /usr/local/etc/openldap/schema/nis.schema
include /usr/local/etc/openldap/schema/openldap.schema

# схемы самбы берутся из самбы (потом скопируем), схемы dns и dhcp
# тоже позже скопируем. пока строчки закоментарим
include /usr/local/etc/openldap/schema/samba.schema
#include /usr/local/etc/openldap/schema/dnszone.schema
#include /usr/local/etc/openldap/schema/dhcp.schema

pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args

# Load dynamic backend modules:

modulepath /usr/local/libexec/openldap
moduleload back_ldap
moduleload back_ldbm

access to attr=userPassword
        by self write
        by anonymous auth
        by dn="uid=root,dc=onyx,dc=com" write
        by * none
access to attrs=sambaLMPassword,sambaNTPassword
        by dn="cn=umbrellavc,ou=users,dc=onyx,dc=com" write
        by * none
access to *
        by dn="uid=root,dc=onyx,dc=com" write
        by * read

access to attrs=userPassword
        by dn="cn=root,dc=onyx,dc=com" write
        by self write
        by anonymous auth
        by * none

access to *
        by self write
        by anonymous read
        by * none

#######################################################################
# BDB database definitions
#######################################################################
backend ldbm
database ldbm
suffix "dc=onyx,dc=com"
rootdn "cn=root,dc=onyx,dc=com"
#
# пароль на рута можно сгенерировать с помощью slappasswd
#
rootpw {SSHA}LBN6v8jc092z+qTdckOm2NhtEMZrnvhS

directory /var/db/openldap-data

index objectClass eq
index cn eq
loglevel 256
     
nss_ldap.conf:
# Корневой каталог LDAP сервера
uri ldapi://%2fvar%2frun%2fopenldap%2fldapi/
base dc=onyx,dc=com

# Если не удалось подключиться к LDAP,
# То не пытаться переподключиться
bind_policy soft

# Timeout подключения к LDAP серверу
bind_timelimit 10

# ip-адрес или hostname LDAP сервера
host localhost

# nss_ldap закроет подключение, если сервер
# не ответит в указонное в idle_timelimit время
idle_timelimit 3600

# Версия протокола
ldap_version 3

# Описание каталогов, где хранятся группы, пользователи, пароли соответственно
nss_base_group ou=groups,dc=onyx,dc=com?one
nss_base_passwd ou=users,dc=onyx,dc=com?one
# Следущая строку нужна для samb'ы, так как аккаунты
# компьютеров должны быть видны системе
nss_base_passwd ou=computers,dc=onyx,dc=com?one
nss_base_shadow ou=users,dc=onyx,dc=com?one

# persist -- не отключаться от LDAP сервера
# oneshot -- отключаться после каждого запроса
nss_connect_policy persist

# Использовать страничный вывод
nss_paged_results yes

# Размер страницы
pagesize 1000

# Порт, на котором работает LDAP
port 389

# Область поиска
scope one

# Время ожидпния при поиске
timelimit 30
                  nsswitch:.conf:

#
# nsswitch.conf(5) - name service switch configuration file
# $FreeBSD: release/9.0.0/etc/nsswitch.conf 224765 2011-08-10 20:52:02Z d
group: files ldap
group_compat: nis
hosts: files dns
networks: files
passwd: files ldap
passwd_compat: nis
shells: files
services: compat
services_compat: nis
protocols: files
rpc: files
  ldapscripts.conf:
SERVER="localhost"
BINDDN="cn=root,dc=onyx,dc=com"
BINDPWD="real2012"

SUFFIX="dc=onyx,dc=com"
GSUFFIX="ou=groups"
USUFFIX="ou=users"
MSUFFIX="ou=computers"

GIDSTART="10000"
UIDSTART="10000"
MIDSTART="20000"

USHELL="/usr/sbin/nologin"
UHOMES="/home/samba/homes/%u"
ASKGECOS="no"
CREATEHOMES="yes"
HOMESKEL="/etc/skel"
HOMEPERMS="700"

# Одна строка
PASSWORDGEN="head -c8 /dev/random | uuencode -m - | sed -n -e '2s|=*$||;2p' | sed -e 's|+||g' -e 's|/||g'"

RECORDPASSWORDS="yes"
PASSWORDFILE="/var/log/ldapscripts_passwd.log"
LOGFILE="/var/log/ldapscripts.log"
LDAPSEARCHBIN="/usr/local/bin/ldapsearch"
LDAPADDBIN="/usr/local/bin/ldapadd"
LDAPDELETEBIN="/usr/local/bin/ldapdelete"
LDAPMODIFYBIN="/usr/local/bin/ldapmodify"
LDAPMODRDNBIN="/usr/local/bin/ldapmodrdn"
LDAPPASSWDBIN="/usr/local/bin/ldappasswd"

GETENTPWCMD=""
GETENTGRCMD=""
GCLASS="posixGroup"

Код: Выделить всё

access to attrs=sambaLMPassword,sambaNTPassword
by dn="cn=umbrellavc,ou=users,dc=onyx,dc=com" write