Tutorial completo de implementação de LDAP + Samba + Squid
Este tutorial destina-se a todos os administradores de redes e sistemas que queiram economizar tempo e gerenciar de uma maneira simples e segura seus usuários utilizando o LDAP (Lightweight Directory Access Protocol).
Parte 8: Samba
Vamos agora à parte que devemos ter mais atenção, que é a do Samba.
Como já tínhamos descompactado anteriormente, vamos entrar no diretório dele:
# cd samba-3.0.20
# env CPPFLAGS="-I/usr/local/include/"
# ./configure --bindir=/usr/local/bin --sbindir=/usr/local/sbin --libexecdir=/usr/local/libexec --with-configdir=/etc/samba --with-mandir=/usr/local/man --with-logfilebase=/var/log/samba --enable-cups --with-smbmount --with-ldapsam --with-syslog --with-quotas --with-acl-support --with-ads --enable-debug --with-winbind --with-krb5=/usr --enable-krb5developer
OBS: As duas últimas opções, --with-krb5=/usr e --enable-krb5developer, use somente se você tiver o kerberos instalado, caso contrário não precisa.
# make
# make install
Vamos agora ao smb.conf, depois de uns três dias ralando em cima do Samba, pude realmente chegar a configuração ideal para ele implementado ao LDAP. Segue o smb.conf:
Como já tínhamos descompactado anteriormente, vamos entrar no diretório dele:
# cd samba-3.0.20
# env CPPFLAGS="-I/usr/local/include/"
# ./configure --bindir=/usr/local/bin --sbindir=/usr/local/sbin --libexecdir=/usr/local/libexec --with-configdir=/etc/samba --with-mandir=/usr/local/man --with-logfilebase=/var/log/samba --enable-cups --with-smbmount --with-ldapsam --with-syslog --with-quotas --with-acl-support --with-ads --enable-debug --with-winbind --with-krb5=/usr --enable-krb5developer
OBS: As duas últimas opções, --with-krb5=/usr e --enable-krb5developer, use somente se você tiver o kerberos instalado, caso contrário não precisa.
# make
# make install
Vamos agora ao smb.conf, depois de uns três dias ralando em cima do Samba, pude realmente chegar a configuração ideal para ele implementado ao LDAP. Segue o smb.conf:
[global]
workgroup = LINUXAJUDA
netbios name = PDC-SRV
server string = Slackware
security = user
encrypt passwords = yes
guest account = nobody
log file = /var/log/samba/%m.log
max log size = 50
os level = 100
local master = yes
domain master = yes
preferred master = yes
domain logons = yes
admin users = administrador root
logon script = %U.bat
logon path = %Lprofiles%U
hosts allow = 10.0.0. 127.
wins support = no
dns proxy = no
ldap passwd sync = yes
ldap delete dn = Yes
passdb backend = ldapsam:ldap://127.0.0.1/
ldap admin dn = cn=administrador,dc=linuxajuda,dc=org
ldap suffix = dc=linuxajuda,dc=org
ldap group suffix = ou=Grupos
ldap user suffix = ou=Usuarios
ldap machine suffix = ou=Computadores
ldap idmap suffix = ou=Idmap
idmap backend = ldap:ldap://127.0.0.1
idmap uid = 10000-15000
idmap gid = 10000-15000
template shell = /bin/false
winbind use default domain = no
;smb passwd file=/etc/samba/smbpasswd
passwd program=/usr/bin/passwd %u
passwd chat = *New*password* %n *Retype*new*password* %n
;#*passwd:*all*authentication*tokens*updated*successfully*
socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=8192 SO_SNDBUF=8192
add machine script = /usr/local/sbin/smbldap-useradd -w "%u"
add user script = /usr/local/sbin/smbldap-useradd -m "%u"
delete user script = /usr/local/sbin/smbldap-userdel "%u"
add machine script = /usr/local/sbin/smbldap-useradd -w "%u"
add group script = /usr/local/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/local/sbin/smbldap-groupdel "%g"
add user to group script = /usr/local/sbin/smbldap-groupmod -m "%u" "%g"
delete user from group script = /usr/local/sbin/smbldap-groupmod -x "%u" "%g"
set primary group script = /usr/local/sbin/smbldap-usermod -g "%g" "%u"
dos charset = UTF-8
unix charset = UTF-8
[homes]
comment = Diretório Home
browseable = no
writable = yes
create mask = 0700
directory mask = 0700
force user = %U
[profiles]
path = /home/profiles
browseable = no
writeable = yes
force user = %U
valid users = %U @"Domain Admins"
[netlogon]
path = /home/netlogon
browseable = no
guest ok = no
writeable = no
share modes = no
read only = yes
[printers]
comment = Impressoras
path = /var/spool/samba
browseable = no
guest ok = no
writable = no
printable = yes
[publico]
comment = Área Publica
path = /publico
browseable = yes
create mask = 0777
directory mask = 0777
guest ok = yes
writable = yes
force user = %U
[sistema]
comment = Área do Sistema da Empresa
path = /sistema
browseable = yes
create mode = 0777
directory mask = 0777
guest ok = yes
writable = yes
force user = %U
workgroup = LINUXAJUDA
netbios name = PDC-SRV
server string = Slackware
security = user
encrypt passwords = yes
guest account = nobody
log file = /var/log/samba/%m.log
max log size = 50
os level = 100
local master = yes
domain master = yes
preferred master = yes
domain logons = yes
admin users = administrador root
logon script = %U.bat
logon path = %Lprofiles%U
hosts allow = 10.0.0. 127.
wins support = no
dns proxy = no
ldap passwd sync = yes
ldap delete dn = Yes
passdb backend = ldapsam:ldap://127.0.0.1/
ldap admin dn = cn=administrador,dc=linuxajuda,dc=org
ldap suffix = dc=linuxajuda,dc=org
ldap group suffix = ou=Grupos
ldap user suffix = ou=Usuarios
ldap machine suffix = ou=Computadores
ldap idmap suffix = ou=Idmap
idmap backend = ldap:ldap://127.0.0.1
idmap uid = 10000-15000
idmap gid = 10000-15000
template shell = /bin/false
winbind use default domain = no
;smb passwd file=/etc/samba/smbpasswd
passwd program=/usr/bin/passwd %u
passwd chat = *New*password* %n *Retype*new*password* %n
;#*passwd:*all*authentication*tokens*updated*successfully*
socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=8192 SO_SNDBUF=8192
add machine script = /usr/local/sbin/smbldap-useradd -w "%u"
add user script = /usr/local/sbin/smbldap-useradd -m "%u"
delete user script = /usr/local/sbin/smbldap-userdel "%u"
add machine script = /usr/local/sbin/smbldap-useradd -w "%u"
add group script = /usr/local/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/local/sbin/smbldap-groupdel "%g"
add user to group script = /usr/local/sbin/smbldap-groupmod -m "%u" "%g"
delete user from group script = /usr/local/sbin/smbldap-groupmod -x "%u" "%g"
set primary group script = /usr/local/sbin/smbldap-usermod -g "%g" "%u"
dos charset = UTF-8
unix charset = UTF-8
[homes]
comment = Diretório Home
browseable = no
writable = yes
create mask = 0700
directory mask = 0700
force user = %U
[profiles]
path = /home/profiles
browseable = no
writeable = yes
force user = %U
valid users = %U @"Domain Admins"
[netlogon]
path = /home/netlogon
browseable = no
guest ok = no
writeable = no
share modes = no
read only = yes
[printers]
comment = Impressoras
path = /var/spool/samba
browseable = no
guest ok = no
writable = no
printable = yes
[publico]
comment = Área Publica
path = /publico
browseable = yes
create mask = 0777
directory mask = 0777
guest ok = yes
writable = yes
force user = %U
[sistema]
comment = Área do Sistema da Empresa
path = /sistema
browseable = yes
create mode = 0777
directory mask = 0777
guest ok = yes
writable = yes
force user = %U
Edite-o de acordo com suas necessidades.
Agora vamos criar um script para iniciar o Samba:
# vim /etc/rc.d/rc.samba
#!/bin/sh
#
# /etc/rc.d/rc.samba
#
# Start/stop/restart the Samba SMB file/print server.
#
# To make Samba start automatically at boot, make this
# file executable: chmod 755 /etc/rc.d/rc.samba
#
samba_start() {
if [ -x /usr/local/sbin/smbd -a -x /usr/local/sbin/nmbd -a -r /etc/samba/smb.conf ]; then
echo "Starting Samba: /usr/local/sbin/smbd -D"
/usr/local/sbin/smbd -D
echo "/usr/local/sbin/nmbd -D"
/usr/local/sbin/nmbd -D
fi
}
samba_stop() {
killall smbd nmbd
}
samba_restart() {
samba_stop
sleep 2
samba_start
}
case "$1" in
'start')
samba_start
;;
'stop')
samba_stop
;;
'restart')
samba_restart
;;
*)
# Default is "start", for backwards compatibility with previous
# Slackware versions. This may change to a 'usage' error someday.
samba_start
esac
#
# /etc/rc.d/rc.samba
#
# Start/stop/restart the Samba SMB file/print server.
#
# To make Samba start automatically at boot, make this
# file executable: chmod 755 /etc/rc.d/rc.samba
#
samba_start() {
if [ -x /usr/local/sbin/smbd -a -x /usr/local/sbin/nmbd -a -r /etc/samba/smb.conf ]; then
echo "Starting Samba: /usr/local/sbin/smbd -D"
/usr/local/sbin/smbd -D
echo "/usr/local/sbin/nmbd -D"
/usr/local/sbin/nmbd -D
fi
}
samba_stop() {
killall smbd nmbd
}
samba_restart() {
samba_stop
sleep 2
samba_start
}
case "$1" in
'start')
samba_start
;;
'stop')
samba_stop
;;
'restart')
samba_restart
;;
*)
# Default is "start", for backwards compatibility with previous
# Slackware versions. This may change to a 'usage' error someday.
samba_start
esac
Crie o diretório /var/log/samba e rode o script /etc/rc.d/rc.samba:
# /etc/rc.d/rc.samba start
Realmente você faz a diferença aqui no VOL ao postar um tuto como estes e se tratando de um assunto como LDAP.
Sinceramente thelinux.