Samba is certified by Openldap.
1. Environmental preparation
1.1. Experimental environment
[root@moban ~] # cat / etc/redhat-release
CentOS release 6.8 (Final)
[root@moban ~] # uname-r
2.6.32-642.el6.x86_64
1.2. Calibrate server time
[root@moban ~] # ntpdate pool.ntp.org
12 Nov 01:11:59 ntpdate [2354]: adjust time server 202.118.1.81 offset 0.004307 sec
[root@moban ~] # crontab-l
# time sync
* / 5 * / usr/sbin/ntpdate pool.ntp.org > / dev/null 2 > & 1
1.3.Down selinux and iptables
[root@moban ~] # getenforce
Enforcing
[root@moban ~] # setenforce 0
[root@moban ~] # getenforce
Permissive
[root@moban ~] # service iptables stop
Installation and configuration of 2.Openldap and Samba
2.1. install Openldap and Samba
[root@moban ~] # yum-y install openldap openldap-clients openldap-servers nss-pam-ldapd
[root@moban ~] # yum-y install samba-common samba samba-client
2.2.Configuring openldap
A.Openldap references samba.schema
[root@moban ~] # cp / usr/share/doc/samba-3.6.23/LDAP/samba.schema / etc/openldap / schema/
b. Copy the sample configuration file for openldap
[root@moban ~] # cp / usr/share/openldap-servers/slapd.conf.obsolete / etc/openldap/slapd.conf
c. Generate ldap administrator password
[root@moban ~] # slappasswd-s 123456
{SSHA} Ae1JJTvbeP60y91e9MdAqOmpleSWG19o
d. Modify the configuration file
[root@moban ~] # vi / etc/openldap/slapd.conf
Insert the following at line 18:
18 include / etc/openldap/schema/samba.schema
Comment out 99 lines to 102 lines:
99 # database config
100 # access to *
101 # by dn.exact= "gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
102 # by * none
Insert the following access content on line 111:
111 access to attrs=userPassword
112 by self write
113 by anonymous auth
114 by * none
115 access to attrs=sambaNTPassword
116 by self write
117 by anonymous auth
118 by * none
119 access to *
120 by self write
121 by * read
Modify lines 126 to 134 as follows:
Before modification:
126 database bdb
127 suffix "dc=my-domain,dc=com"
128 checkpoint 1024 15
129 rootdn "cn=Manager,dc=my-domain,dc=com"
130 # Cleartext passwords, especially for the rootdn, should
131 # be avoided. See slappasswd (8) and slapd.conf (5) for d
Etails.
132 # Use of strong authentication encouraged.
133 # rootpw secret
134 # rootpw {crypt} ijFYNcSNctBYg
After modification:
126 database bdb
127 suffix "dc=etiantian,dc=org"
128 checkpoint 1024 15
129 rootdn "cn=admin,dc=etiantian,dc=org"
130 # Cleartext passwords, especially for the rootdn, should
131 # be avoided. See slappasswd (8) and slapd.conf (5) for d
Etails.
132 # Use of strong authentication encouraged.
133 # rootpw secret
134 rootpw {SSHA} Ae1JJTvbeP60y91e9MdAqOmpleSWG19o
Modify line 143 to read:
Before modification:
Index ou,cn,mail,surname,givenname eq,pres,sub
After modification:
Index ou,cn,mail,surname,givenname eq,pres,sub,approx
Modify lines 105 to 109 as follows:
Before modification:
105 database monitor
106 access to *
107 by dn.exact= "gidNumber=0+uidNumber=0,cn=peercred,cn
= external,cn=auth "read
108 by dn.exact= "cn=Manager,dc=my-domain,dc=com" read
109 by * none
After modification:
105 database monitor
106 access to *
107 by dn.exact= "cn=admin,dc=etiantian,dc=org" read
108 by * none
2.3.initialize openldap
a. Delete openldap's original configuration files and data
[root@moban ~] # rm-rf / etc/openldap/slapd.d/*
[root@moban ~] # rm-rf / var/lib/ldap/*
b. Copy the configuration file of the database
[root@moban ~] # cp / usr/share/openldap-servers/DB_CONFIG.example / var/lib/ldap/DB_CONFIG
[root@moban] # chown ldap.ldap-R / var/lib/ldap
[root@moban ~] # ll / var/lib/ldap
Total 4
-rw-r--r--. 1 ldap ldap 845 Nov 12 01:54 DB_CONFIG
c. Generate a configuration file for version 2.4
[root@moban ldap] # slaptest-u
Config file testing succeeded
[root@moban ldap] # slaptest-f / etc/openldap/slapd.conf-F / etc/openldap/slapd.d/ # generate the old version of the configuration file
Config file testing succeeded
d. Initialize the basic data of openldap
[root@moban openldap] # vi base.ldif
Dn: dc=etiantian,dc=org
ObjectClass: organization
ObjectClass: dcObject
Dc: etiantian
O: etiantian
Dn: ou=People,dc=etiantian,dc=org
ObjectClass: organizationalUnit
Ou: People
Dn: ou=group,dc=etiantian,dc=org
ObjectClass: organizationalUnit
Ou: group
[root@moban openldap] # vi group.ldif
Dn: cn=DBA,ou=group,dc=etiantian,dc=org
ObjectClass: posixGroup
ObjectClass: top
Cn: DBA
MemberUid: test1
GidNumber: 10673
[root@moban openldap] # vi user.ldif
Dn: uid=test1,ou=People,dc=etiantian,dc=org
ObjectClass: posixAccount
ObjectClass: top
ObjectClass: inetOrgPerson
ObjectClass: shadowAccount
GidNumber: 0
GivenName: test1
Sn: test1
Uid: test1
HomeDirectory: / home/test1
LoginShell: / bin/bash
ShadowFlag: 0
ShadowMin: 0
ShadowMax: 99999
ShadowWarning: 0
ShadowInactive: 99999
ShadowLastChange: 12011
ShadowExpire: 99999
Cn: test1
UidNumber: 24422
e. Import basic data into ldap
[root@moban openldap] # slapadd-l base.ldif
58260c66 The first database does not allow slapadd; using the first available one (2)
_ # 100.0000% eta none elapsed none fast!
Closing DB...
[root@moban openldap] # slapadd-l group.ldif
58260c6d The first database does not allow slapadd; using the first available one (2)
_ # 100.0000% eta none elapsed none fast!
Closing DB...
[root@moban openldap] # slapadd-l user.ldif
58260c72 The first database does not allow slapadd; using the first available one (2)
_ # 100.0000% eta none elapsed none fast!
Closing DB...
[root@moban openldap] # chown-R ldap.ldap / var/lib/ldap
[root@moban openldap] # chown-R ldap.ldap / etc/openldap/slapd.d
[root@moban openldap] # chmod-R 700 / var/lib/ldap
[root@moban openldap] # chmod-R 700 / etc/openldap/slapd.d
2.4.Configuring samba
a. Modify the configuration of samba
[root@moban openldap] # cd / etc/samba/
[root@moban samba] # cp smb.conf smb.conf.ori
[root@moban samba] # vi smb.conf
[global]
Workgroup = WORKGROUP
Server string = Samba-ldap Server Version% v
Netbios name = samba-ldapsam
Log file = / var/log/samba/log.%m
Max log size = 50
Security = user
Passdb backend = ldapsam:ldap://192.168.0.111/
Ldap suffix = "dc=etiantian,dc=org"
Ldap admin dn = "cn=admin,dc=etiantian,dc=org"
Ldap user suffix = "ou=People,dc=etiantian,dc=org"
Ldap group suffix = "ou=group,dc=etiantian,dc=org"
Ldap delete dn = no
Ldap passwd sync = yes
Ldap ssl = no
[sambashare]
Comment = share all
Path = / app/log
Browseable = yes
Public = yes
Writable = yes
[myshare]
Comment = share for users
Path = / application
Browseable = yes
Public = no
Writable = yes
b. Create a shared data directory
[root@moban samba] # mkdir / app/log-p
[root@moban samba] # mkdir / application
Tip: to facilitate testing, give permission to directory 777 first
[root@moban samba] # chmod-R 777 / application
[root@moban samba] # chmod-R 777 / app/log
c. Save the admin password of openldap to samba
Tip: to enable samba to access ldap, save the ldap administrator's password to samba's secrets.tdb (/ var/lib/samba/private/secrets.tdb)
[root@moban samba] # smbpasswd-w 123456
Setting stored password for "cn=admin,dc=etiantian,dc=org" in secrets.tdb
d. In openldap, add the samba test user
[root@moban openldap] # cat / etc/passwd | grep admin (system user)
Admin:x:500:500::/home/admin:/bin/bash
[root@moban samba] # cd / etc/openldap/
[root@moban openldap] # vi / etc/samba/smbusers
Add samba users at the bottom
Admin sambatest # means that the system user name admin has a virtual SMB user name: sambatest
[root@moban openldap] # vi sambauser.ldif
Dn: uid=sambatest,ou=People,dc=etiantian,dc=org
ObjectClass: posixAccount
ObjectClass: top
ObjectClass: inetOrgPerson
ObjectClass: shadowAccount
GidNumber: 1009
GivenName: sambatest
Sn: sambatest
Uid: sambatest
HomeDirectory: / home/sambatest
LoginShell: / bin/bash
ShadowFlag: 0
ShadowMin: 0
ShadowMax: 99999
ShadowWarning: 0
ShadowInactive: 99999
ShadowLastChange: 12011
ShadowExpire: 99999
Cn: sambatest
UidNumber: 24425
[root@moban openldap] # slapadd-l sambauser.ldif
58261bcf The first database does not allow slapadd; using the first available one (2)
_ # 100.0000% eta none elapsed none fast!
Closing DB...
e. Set the operating system to authenticate users from ldap
Tip: set up the system to authenticate in openldap if the user is not found in / etc/passwd.
[root@moban openldap] # authconfig-tui
User Information
[*] Use LDAP
Authentication
[*] Use Fingerprint reader
┌─┤ LDAP Settings ├─
│
│ [] Use TLS
│ Server: ldap://192.168.0.111/
│ Base DN: dc=etiantian,dc=org
[root@moban openldap] # grep "ldap" / etc/nsswitch.conf
Passwd: files ldap
Shadow: files ldap
Group: files ldap
Netgroup: files ldap
Automount: files ldap
[root@moban openldap] # tail-3 ldap.conf
URI ldap://192.168.0.111/
BASE dc=etiantian,dc=org
TLS_CACERTDIR / etc/openldap/cacerts
[root@moban openldap] # / etc/init.d/slapd start
[root@moban openldap] # / etc/init.d/smb start
f. Test to get user information from ldap
[root@moban openldap] # id sambatest
Uid=24425 (sambatest) gid=1009 groups=1009
[root@moban openldap] # grep "sambatest" / etc/passwd
Note: the sambatest was not found in the passwd file, indicating that the sambatest was obtained from ldap.
g. Set the test user's sambatest password
[root@moban openldap] # smbpasswd-a sambatest
New SMB password:123456789
Retype new SMB password:123456789
Added user sambatest.
h. Test whether sambatest users can log in in samba
[root@moban openldap] # smbclient-U sambatest / / 192.168.0.111/sambashare
Enter sambatest's password:
Domain= [WORKGROUP] OS= [Unix] Server= [Samba 3.6.23-36.el6_8]
Smb:\ > ls
. D 0 Sat Nov 5 20:38:28 2016
.. D 0 Thu Oct 27 13:01:13 2016
UM4SW7~D.LOG A 74 Thu Oct 27 19:29:01 2016
U41Y9B~1.LOG A 85 Thu Oct 27 19:37:24 2016
U0XZAY~G.LOG A 117 Thu Oct 27 19:18:40 2016
UAKC5V~4.LOG A 99 Thu Oct 27 19:27:02 2016
UO0D3H~P.LOG A 0 Sat Nov 5 20:38:28 2016
U3DW4T~X.LOG A 48 Thu Oct 27 19:30:14 2016
51760 blocks of size 524288. 45745 blocks available
Smb:\ >
[root@moban openldap] # smbclient-U sambatest / / 192.168.0.111/myshare
Enter sambatest's password:
Domain= [WORKGROUP] OS= [Unix] Server= [Samba 3.6.23-36.el6_8]
Smb:\ > ls
. D 0 Sat Nov 5 23:26:28 2016
.. DR 0 Fri Nov 11 22:26:21 2016
Svndata D 0 Thu Oct 27 01:48:57 2016
Create a new Microsoft Access database. Accdb A 512000 Sat Nov 5 23:26:28 2016
Svnpasswd D 0 Sat Nov 5 21:02:06 2016
51760 blocks of size 524288. 45745 blocks available
Smb:\ >
From the above results, you can see that the access of samba verified by openldap is normal, and then take a look at the access of windows, as shown below:
