Samba BDC2014/08/21 |
Samba PDC 構築済みのサブネット内に Samba BDC (バックアップドメインコントローラ) を構築します。
Samba PDC は同一サブネット内に一つのみ存在できますが、この Samba BDC はいくらでも構築することができます。 |
|
[1] |
Samba BDC とするサーバーを LDAP クライアントとして設定しておきます。
|
[2] | Samba BDC の設定です。 smb.conf の設定はほぼプライマリ側と同じで、異なるのはプライマリ側が「domain master = Yes」に対して、バックアップ側は「domain master = No」になる箇所のみです。 |
[root@bdc ~]# mv /etc/samba/smb.conf /etc/samba/smb.conf.bak [root@bdc ~]# cp /usr/share/doc/smbldap-tools-*/smb.conf /etc/samba/smb.conf
[root@bdc ~]#
vi /etc/samba/smb.conf # 3行目:workgroup名を任意のものに変更 workgroup = SERVER-WORLD
# 12行目:コメント化 # min passwd length = 3
# 22行目:変更 ldap passwd sync = yes
# 33,34行目:変更 Dos charset = CP932 Unix charset = UTF-8
# 42行目:変更(プライマリ側と異なる箇所) domain master = No
# 47行目:LDAPサーバー指定 passdb backend = ldapsam: ldap://10.0.0.30/
# 48行目:LDAP管理者DN変更 (LDAPサーバーで指定したもの) ldap admin dn = cn=admin,dc=server,dc=world
# 50行目:LDAP suffix 変更 (LDAPサーバーで指定したもの) ldap suffix = dc=server,dc=world ldap group suffix = ou= groups ldap user suffix = ou= people
# 60行目:コメント解除 delete group script = /usr/sbin/smbldap-groupdel "%g" # 64行目あたりに2行追記:管理者ユーザー指定、SSLなし set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u' admin users = domainadmin
ldap ssl = no mkdir /home/netlogon
[root@lan ~]#
[root@bdc ~]# /etc/rc.d/init.d/smb start Starting SMB services: [ OK ][root@lan ~]# /etc/rc.d/init.d/nmb start Starting NMB services: [ OK ][root@lan ~]# chkconfig smb on [root@lan ~]# chkconfig nmb on smbpasswd -W # LDAP管理者パスワードをSambaに登録
Setting stored password for "cn=admin,dc=server,dc=world" in secrets.tdb
New SMB password: # LDAP管理者パスワード Retype new SMB password:
[root@bdc ~]#
[root@bdc ~]# net rpc getsid # プライマリ側のSID取得(後で入力するので控えておく) Storing SID S-1-5-21-647443440-3639858122-3827560290 for Domain SERVER-WORLD in secrets.tdb perl /usr/share/doc/smbldap-tools-*/configure.pl -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- smbldap-tools script configuration -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Before starting, check . if your samba controller is up and running. . if the domain SID is defined (you can get it with the 'net getlocalsid') . you can leave the configuration using the Ctrl-c key combination . empty value can be set with the "." character -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Looking for configuration files...
Samba Configuration File Path [/etc/samba/smb.conf] >
The default directory in which the smbldap configuration files are stored is shown.# 空Enter
If you need to change this, enter the full directory path, then press enter to continue. Smbldap-tools Configuration Directory Path [/etc/smbldap-tools/] > # 空Enter -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Let's start configuring the smbldap-tools scripts ...
. workgroup name: name of the domain Samba act as a PDCworkgroup name [SERVER-WORLD] > # 空Enter . netbios name: netbios name of the samba controler netbios name [PDC-SRV] > # 空Enter . logon drive: local path to which the home directory will be connected (for NT Workstations). Ex: 'H:' logon drive [H:] > # 空Enter . logon home: home directory location (for Win95/98 or NT Workstation). (use %U as username) Ex:'\\PDC-SRV\%U' logon home (press the "." character if you don't want homeDirectory) [\\PDC-SRV\%U] > . # ピリオド入力 . logon path: directory where roaming profiles are stored. Ex:'\\PDC-SRV\profiles\%U' logon path (press the "." character if you don't want roaming profile) [\\PDC-SRV\profiles\%U] > . # ピリオド入力 . home directory prefix (use %U as username) [/home/%U] > # 空Enter . default users' homeDirectory mode [700] > # 空Enter . default user netlogon script (use %U as username) [logon.bat] > # 空Enter default password validation time (time in days) [45] > # 空Enter . ldap suffix [dc=server,dc=world] > # 空Enter . ldap group suffix [ou=groups] > # 空Enter . ldap user suffix [ou=people] > # 空Enter . ldap machine suffix [ou=Computers] > # 空Enter . Idmap suffix [ou=Idmap] > # 空Enter . sambaUnixIdPooldn: object where you want to store the next uidNumber and gidNumber available for new users and groups sambaUnixIdPooldn object (relative to ) [sambaDomainName=SERVER-WORLD] > # 空Enter . ldap master server: IP adress or DNS name of the master (writable) ldap server ldap master server [10.0.0.30] > # LDAPサーバーのIPを確認して空Enter . ldap master port [389] > # 空Enter . ldap master bind dn [cn=admin,dc=server,dc=world] > # 空Enter . ldap master bind password [] > # LDAP管理者パスワード . ldap slave server: IP adress or DNS name of the slave ldap server: can also be the master one ldap slave server [10.0.0.30] > # LDAPスレーブがあれば指定(なければ空Enter) . ldap slave port [389] > # 空Enter . ldap slave bind dn [cn=admin,dc=server,dc=world] > # 空Enter . ldap slave bind password [] > # スレーブがあれば入力(なければテキトーに) . ldap tls support (1/0) [0] > # 空Enter . SID for domain ServerWorld: SID of the domain (can be obtained with 'net getlocalsid PDC-SRV') SID for domain ServerWorld [S-1-5-21-3961433887-2246042430-2486930623] > S-1-5-21-647443440-3639858122-3827560290 # PDCと同じもの . unix password encryption: encryption used for unix passwords unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA) [SSHA] > # 空Enter . default user gidNumber [513] > # 空Enter . default computer gidNumber [515] > # 空Enter . default login shell [/bin/bash] > # 空Enter . default skeleton directory [/etc/skel] > # 空Enter . default domain name to append to mail adress [] > # 空Enter -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= backup old configuration files: /etc/smbldap-tools/smbldap.conf->/etc/smbldap-tools/smbldap.conf.old /etc/smbldap-tools/smbldap_bind.conf->/etc/smbldap-tools/smbldap_bind.conf.old writing new configuration file: /etc/smbldap-tools/smbldap.conf done. /etc/smbldap-tools/smbldap_bind.conf done.
[root@bdc ~]#
/etc/rc.d/init.d/smb restart Shutting down SMB services: [ OK ] Starting SMB services: [ OK ][root@bdc ~]# /etc/rc.d/init.d/nmb restart Shutting down NMB services: [ OK ] Starting NMB services: [ OK ] # ユーザー情報確認 # プライマリ側と同じ結果が得られているか確認 [root@bdc ~]# pdbedit -L root:0:root nobody:99:nobody domainadmin:4294967295:domainadmin hiroyuki-5ff0c2$:4294967295:HIROYUKI-5FF0C2$ rx-00$:4294967295:RX-00$ # ドメインユーザーに遷移可能か確認 [root@bdc ~]# su - domainadmin Creating directory '/home/domainadmin'. [domainadmin@bdc ~]$ |
Sponsored Link |
|