Linux加入域的那些事儿

说明：本文为Linux加入Windows域的具体情况作一些说明，关于如何加入到域，本文不再详述，仅提供一个配置样板，如果有不了解的，可以再查看相关文章。
*-====================-*
* Linux To Windows AD
*-====================-*

- 基本概念
* PDC - 主域控制器
* BDC - 备份域控制器
* KDC - 密钥颁发中心，Kerberos服务器
* PAM - 可插拨认证模块
* SRV - DNS服务资源记录
- 域模式
* PRC - Linux以Windows 2000/NT4样式加入到域中
* ADS - 活动目录，Windows2003,WindowsXP
* 混合 - 有最好的兼容性

- 软件包Sw
* Samba: yum install samba.* samba-common.* samba-winbind-client.*
* Winbind: yum install samba-winbind.*
* Samba4: yum install samba4.* ;A newer version of samba
* Kerberos5: yum install pam_krb5.* krb5-workstation.* krb5-libs.*
* ldconfig
* ldconfig -v | grep winbind
* ls /usr/lib/libnss_winbind.so

- 配置文件
- NSS: /etc/nsswitch.conf ;指示系统如何查找系统配置文件
; 修改以下内容

password: files winbind
group: files winbind
- Samba: /etc/smb.conf
; 与共享文件夹相关的配置
 [global]
  client use spnego = no
  server signing = auto
  workgroup = CAMPUS
# The SHORT-DOMAIN name of your domain, you need to modify
  wins support = yes
  wins server = 10.0.0.4
# Controller of the domain, You need to modify it to your own
  wins proxy = yes
  security = ADS
# or AD,ADS,domain, DOMAIN is the RPC mode
  acl compatibility = win2k
  idmap uid = 16777216-33554431
# Set based on your user count
  idmap gid = 16777216-33554431
  password server = 10.0.0.4
# Domain Controller
  map to guest = bad user
  guest ok = no
  realm = CAMPUS.COM
# You need to keep the same with file krb5.conf defined
# encrypt psswords = yes
# Encrypt PASS, not supported by some version of samba
  winbind use default domain = yes
# winbind separator = %
  template homedir = /home/%D/%U
  # A mode 777 should be set on /home/%D
  template shell = /bin/bash
[homes]
  comment = %S
  path =/home/%D/%S
  writeable = yes
  browsable = yes
; valid users = %S
  valid users = CAMPUS\%S
* Kerberos配置文件: /etc/krb5.conf
 [logging]
  default = FILE:/var/log/krb5libs.log
  kdc = FILE:/var/log/krb5kdc.log
  admin_server = FILE:/var/log/kadmind.log
[libdefaults]
  default_realm = CAMPUS.COM
  dns_lookup_realm = false
  dns_lookup_kdc = false
[realms]
  CAMPUS.COM = {
  kdc = ADS.CAMPUS.COM:88
  admin_server = ADS.CAMPUS.COM:749
  default_domain = campus.com
}
# This is a REALMS to DOMAIN MAPPING, REALMS Format is uppercase
[domain_realm]
  .campus.com = CAMPUS.COM
  campus.com = CAMPUS.COM
# Build the mapping
[kdc]
  profile = /var/kerberos/krb5kdc/kdc.conf
[appdefaults]
  pam = {
  debug = false
  ticket_lifetime = 36000
  renew_lifetime = 36000
  forwardable = true
  krb4_cOnvert= false
}
* 重启samba: service smb restart
; 汪: 如果只作认证，SMB服务可以不启动，但smb.conf必须配置好
* 重启Winbind: service winbind restart
* 初始化KDC: net ads kerberos kinit
* 加域: net rpc join -S ADS.CAMPUS.COM -U Administrator%
* 查看信息: net rpc info; net ads testjoin; net ads
* 退域: net ads leave -S ADS.CAMPUS.COM -U Administrator%
* 查看用户信息: wbinfo -u, wbinfo -t
* 查看本机用户: getent passwd K-id, getent group K-id
* 获取SID: net rpc getsid -U Administrator% -I x.x.x.x
* NTLM-AUTH: ntlm_auth --username=$USER