Hi Sure no problems, I have made a new one as I can not share the default one ( will be looking for a new job if I did so :)) This is made from a default smb.conf file but it will work, do I am not sure if it will resolve all your problems, if you need some more help then drop me a line. Regards Per On Mon, 2010-03-15 at 08:43 -0400, Shouben Zhou wrote: > Hi Per, > > Thanks for your help. My rehat-ds serves Unix and MAC clients very well. > My goal is to let ds serve WindowsXP as well. I only need to let > WindowXP client to be able to use login name and LDAP password. > > This is what I did: > > 1. add samba.schema LDIF to my redhat-ds and restart the ds server > 2. on one of my linux LDAP client, configure and start SAMBA as DC > > Then I am assuming it should work, but not. Could you email your working > smb.conf file? > > -- > Shouben Zhou > Science Systems and Applications Inc.(SSAI) > 1 Enterprise Pkwy, Hampton, VA 23666 > Tel: (757)951-1905 Fax: (757)951-1900 > Email: Shouben.Zhou@xxxxxxxx > > > > Per Qvindesland wrote: > > Hi > > > > I have setup more samba ldap dc's then I dare to think of and it's > > pretty easy, I used to script the whole thing and I had it online for > > others to download but I have not maintained it for a long while so it's > > way to old to be used today. > > > > If you are looking at the nt4 style then there is a great howto here: > > http://www.howtoforge.com/centos-5.x-samba-domain-controller-with-ldap-backend > > > > But mind you it could be a good idea to actually look at the samba4, > > it's getting pretty stable, I have installed it on a dev environment > > where is serves authentication to the dev servers and dev clients and > > has not given a day of shit really smooth installation also: > > http://wiki.samba.org/index.php/Main_Page#Samba4 > > > > Per > > On Thu, 2010-03-11 at 09:29 +0100, jean-Noël Chardron wrote: > > > >> Please do not cut the discussion list but post a new thread > >> > >> Shouben Zhou wrote: > >> > >>> What is the best way to configure Window clients to authenticate from > >>> 389 DS? > >>> > >>> > >> I'm not sure but I have a small idea of it : if you don't have an > >> Active Directory server, a way is to setup a domain controler NT4 like > >> Samba (free software), It seems little bit complexe as you need to > >> setup a backend ldap server with a particular schema to store the > >> information of workstations, then setup the samba server, then join each > >> XP workstation to the domain of the Samba Server (exactly like AD) . > >> An another way is to replace the Gina.dll in windows XP by a new Gina to > >> auth from various source as ldap (there are some free project like > >> pGina.org that is hosted on sourceforge). In google look after "Gina" or > >> "pGina.org". I suppose you will need to replace the DLL and configure > >> each workstation that is waste time on a big park of stations. > >> > >> > >>> -- > >>> Shouben Zhou > >>> Science Systems and Applications Inc.(SSAI) > >>> 1 Enterprise Pkwy, Hampton, VA 23666 > >>> Tel: (757)951-1905 Fax: (757)951-1900 > >>> Email: Shouben.Zhou@xxxxxxxx > >>> > >>> > >>> > >>> -- > >>> 389 users mailing list > >>> 389-users@xxxxxxxxxxxxxxxxxxxxxxx > >>> https://admin.fedoraproject.org/mailman/listinfo/389-users > >>> > >>> > >> > > > > > > -- > > 389 users mailing list > > 389-users@xxxxxxxxxxxxxxxxxxxxxxx > > https://admin.fedoraproject.org/mailman/listinfo/389-users
# This is the main Samba configuration file. You should read the # smb.conf(5) manual page in order to understand the options listed # here. Samba has a huge number of configurable options (perhaps too # many!) most of which are not shown in this example # # Any line which starts with a ; (semi-colon) or a # (hash) # is a comment and is ignored. In this example we will use a # # for commentry and a ; for parts of the config file that you # may wish to enable # # NOTE: Whenever you modify this file you should run the command "testparm" # to check that you have not made any basic syntactic errors. # #======================= Global Settings ===================================== [global] # workgroup = NT-Domain-Name or Workgroup-Name workgroup = NORHEXCOM netbios name = NORHEXCOM-PDC # server string is the equivalent of the NT Description field #server string = Samba Server server string = Samba Server %v # This option is important for security. It allows you to restrict # connections to machines which are on your local network. The # following example restricts access to two C class networks and # the "loopback" interface. For more examples of the syntax see # the smb.conf man page ; hosts allow = 192.168.1. 192.168.2. 127. # if you want to automatically load your printer list rather # than setting them up individually then you'll need this printcap name = /etc/printcap load printers = yes utmp = yes # It should not be necessary to spell out the print system type unless # yours is non-standard. Currently supported print systems include: # bsd, sysv, plp, lprng, aix, hpux, qnx ; printing = cups # This option tells cups that the data has already been rasterized cups options = raw # Uncomment this if you want a guest account, you must add this to /etc/passwd # otherwise the user "nobody" is used ; guest account = pcguest # this tells Samba to use a separate log file for each machine # that connects log file = /var/log/samba/log.%m # all log information in one file # log file = /var/log/samba/smbd.log # Put a capping on the size of the log files (in Kb). max log size = 100000 # Security mode. Most people will want user level security. See # security_level.txt for details. security = user # Use password server option only with security = server ; password server = <NT-Server-Name> # Password Level allows matching of _n_ characters of the password for # all combinations of upper and lower case. ; password level = 8 ; username level = 8 # You may wish to use password encryption. Please read # ENCRYPTION.txt, Win95.txt and WinNT.txt in the Samba documentation. # Do not enable this option unless you have read those documents encrypt passwords = yes ; smb passwd file = /etc/samba/smbpasswd obey pam restrictions = No ldap passwd sync = Yes time server = Yes enable privileges = yes # The following are needed to allow password changing from Windows to # update the Linux system password also. # NOTE: Use these with 'encrypt passwords' and 'smb passwd file' above. # NOTE2: You do NOT need these to allow workstations to change only # the encrypted SMB passwords. They allow the Unix password # to be kept in sync with the SMB password. unix password sync = no ; passwd program = /usr/bin/passwd %u ; passwd chat = *New*UNIX*password* %n\n *ReType*new*UNIX*password* %n\n *passwd:*all*authentication*tokens*updated*successfully* passwd program = /usr/sbin//smbldap-passwd %u log level = 0 syslog = 0 mangling method = hash2 dos charset = 850 unix charset = ISO8859-1 # Unix users can map to different SMB User names username map = /etc/samba/smbusers # Using the following line enables you to customise your configuration # on a per machine basis. The %m gets replaced with the netbios name # of the machine that is connecting ; include = /etc/samba/smb.conf.%m # Most people will find that this option gives better performance. # See speed.txt and the manual pages for details socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 # Configure Samba to use multiple interfaces # If you have multiple network interfaces then you must list them # here. See the man page for details. ; interfaces = 192.168.12.2/24 192.168.13.2/24 interfaces = eth0,lo # Configure remote browse list synchronisation here # request announcement to, or browse list sync from: # a specific host or from / to a whole subnet (see below) ; remote browse sync = 192.168.3.25 192.168.5.255 # Cause this host to announce itself to local subnets here ; remote announce = 192.168.1.255 192.168.2.44 # Browser Control Options: # set local master to no if you don't want Samba to become a master # browser on your network. Otherwise the normal election rules apply ; local master = no # OS Level determines the precedence of this server in master browser # elections. The default value should be reasonable ; os level = 33 os level = 65 # Domain Master specifies Samba to be the Domain Master Browser. This # allows Samba to collate browse lists between subnets. Don't use this # if you already have a Windows NT domain controller doing this job ; domain master = yes domain master = yes # Preferred Master causes Samba to force a local browser election on startup # and gives it a slightly higher chance of winning the election ; preferred master = yes preferred master = yes # Enable this if you want Samba to be a domain logon server for # Windows95 workstations. ; domain logons = yes domain logons = yes # if you enable domain logons then you may want a per-machine or # per user logon script # run a specific logon batch file per workstation (machine) ; logon script = %m.bat # run a specific logon batch file per username ; logon script = %U.bat logon script = startup.bat # Added by me logon drive = X: logon home = passdb backend = ldapsam:ldap://127.0.0.1/ ldap admin dn = cn=Manager,dc=norhex,dc=com ldap suffix = dc=norhex,dc=com ldap group suffix = ou=Groups ldap user suffix = ou=Users ldap machine suffix = ou=Computers ldap idmap suffix = ou=Users idmap backend = ldap://127.0.0.1 #ldap ssl = start tls ldap delete dn = Yes # use the smbldap-tools scripts add user script = /usr/sbin//smbldap-useradd -m "%u" delete user script = /usr/sbin//smbldap-userdel "%u" add machine script = /usr/sbin//smbldap-useradd -w "%u" add group script = /usr/sbin//smbldap-groupadd -p "%g" delete group script = /usr/sbin//smbldap-groupdel "%g" add user to group script = /usr/sbin//smbldap-groupmod -m "%u" "%g" delete user from group script = /usr/sbin//smbldap-groupmod -x "%u" "%g" set primary group script = /usr/sbin//smbldap-usermod -g "%g" "%u" # Where to store roving profiles (only for Win95 and WinNT) # %L substitutes for this servers netbios name, %U is username # You must uncomment the [Profiles] share below ; logon path = \\%L\Profiles\%U logon path = # All NetBIOS names must be resolved to IP Addresses # 'Name Resolve Order' allows the named resolution mechanism to be specified # the default order is "host lmhosts wins bcast". "host" means use the unix # system gethostbyname() function call that will use either /etc/hosts OR # DNS or NIS depending on the settings of /etc/host.config, /etc/nsswitch.conf # and the /etc/resolv.conf file. "host" therefore is system configuration # dependant. This parameter is most often of use to prevent DNS lookups # in order to resolve NetBIOS names to IP Addresses. Use with care! # The example below excludes use of name resolution for machines that are NOT # on the local network segment # - OR - are not deliberately to be known via lmhosts or via WINS. ; name resolve order = wins lmhosts bcast # Windows Internet Name Serving Support Section: # WINS Support - Tells the NMBD component of Samba to enable it's WINS Server ; wins support = yes wins support = yes # WINS Server - Tells the NMBD components of Samba to be a WINS Client # Note: Samba can be either a WINS Server, or a WINS Client, but NOT both ; wins server = w.x.y.z # WINS Proxy - Tells Samba to answer name resolution queries on # behalf of a non WINS capable client, for this to work there must be # at least one WINS Server on the network. The default is NO. ; wins proxy = yes # DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names # via DNS nslookups. The built-in default for versions 1.9.17 is yes, # this has been changed in version 1.9.18 to no. # dns proxy = no # Case Preservation can be handy - system default is _no_ # NOTE: These can be set on a per share basis ; preserve case = no ; short preserve case = no # Default case is normally upper case for all DOS files ; default case = lower # Be very careful with case sensitivity - it can break things! ; case sensitive = no #============================ Share Definitions ============================== idmap uid = 16777216-33554431 idmap gid = 16777216-33554431 template shell = /bin/false winbind use default domain = no [homes] comment = Home Directories valid users = %S browseable = yes writable = yes #create mask = 0664 #directory mask = 0775 # this prevents users from browsing other peoples' files create mask = 0600 directory mask = 0700 # Un-comment the following and create the netlogon directory for Domain Logons [netlogon] comment = Network Logon Service path = /opt/samba/netlogon [profiles] path = /opt/samba/profiles writeable = yes browseable = no #create mode = 0644 #directory mode = 0755 # this prevents users from browsing other peoples' profiles create mode = 0600 directory mode = 0700 # Un-comment the following to provide a specific roving profile share # the default is to use the user's home directory ;[Profiles] ; path = /home/profiles ; browseable = no ; guest ok = yes # NOTE: If you have a BSD-style print system there is no need to # specifically define each individual printer [printers] comment = All Printers path = /var/spool/samba browseable = no printable = yes # Set public = yes to allow user 'guest account' to print # This one is useful for people to share files ;[tmp] ; comment = Temporary file space ; path = /tmp ; read only = no ; public = yes # A publicly accessible directory, but read only, except for people in # the "staff" group ;[public] ; comment = Public Stuff ; path = /home/samba ; public = yes ; read only = yes ; write list = @staff # Other examples. # # A private printer, usable only by fred. Spool data will be placed in fred's # home directory. Note that fred must have write access to the spool directory, # wherever it is. ;[fredsprn] ; comment = Fred's Printer ; valid users = fred ; path = /homes/fred ; printer = freds_printer ; public = no ; writable = no ; printable = yes # A private directory, usable only by fred. Note that fred requires write # access to the directory. ;[fredsdir] ; comment = Fred's Service ; path = /usr/somewhere/private ; valid users = fred ; public = no ; writable = yes ; printable = no # a service which has a different directory for each machine that connects # this allows you to tailor configurations to incoming machines. You could # also use the %u option to tailor it by user name. # The %m gets replaced with the machine name that is connecting. ;[pchome] ; comment = PC Directories ; path = /usr/pc/%m ; public = no ; writable = yes # A publicly accessible directory, read/write to all users. Note that all files # created in the directory by users will be owned by the default user, so # any user with access can delete any other user's files. Obviously this # directory must be writable by the default user. Another user could of course # be specified, in which case all files would be owned by that user instead. ;[public] ; path = /usr/somewhere/else/public ; public = yes ; only guest = yes ; writable = yes ; printable = no # The following two entries demonstrate how to share a directory so that two # users can place files there that will be owned by the specific users. In this # setup, the directory should be writable by both users and should have the # sticky bit set on it to prevent abuse. Obviously this could be extended to # as many users as required. ;[myshare] ; comment = Mary's and Fred's stuff ; path = /usr/somewhere/shared ; valid users = mary fred ; public = no ; writable = yes ; printable = no ; create mask = 0765
-- 389 users mailing list 389-users@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/389-users
