CentOS下基于PPTPD与AD验证的×××服务器构建

一.×××服务器加入AD域名

1.安装kerberos、samba、ntpdate

yum -y install krb5-workstation pam_krb5 krb5-devel krb5-libs samba ntpdate

2.修改DNS文件

vim /etc/resolv.conf
#在第一行加入
nameserver 192.168.100.238

3.与AD同步时间

ntpdate 192.168.100.238
echo "* */2 * * * /sbin/ntpdate 192.168.100.238" >> /etc/crontab

4.修改vim /etc/krb5.conf

vim /etc/krb5.conf
[logging]default &＃61; FILE:/var/log/krb5libs.logkdc &＃61; FILE:/var/log/krb5kdc.logadmin_server &＃61; FILE:/var/log/kadmind.log
[libdefaults]default_realm &＃61; LUSHARE.COMdns_lookup_realm &＃61; falsedns_lookup_kdc &＃61; falseticket_lifetime &＃61; 24hrenew_lifetime &＃61; 7dforwardable &＃61; true
[realms]LUSHARE.COM &＃61; {kdc &＃61; adserver.lushare.comadmin_server &＃61; adserver.lushare.com}
[domain_realm].lushare.com &＃61; LUSHARE.COMlushare.com &＃61; LUSHARE.COM

5.测试kerberos(需要注意域名的大小写)

kinit administrator&＃64;LUSHARE.COM
Password for administrator&＃64;LUSHARE.COM:

PS:需要注意LUSHARE.COM一定是大写&＃xff0c;否则会出现

kinit: Cannot find KDC for requested realm while getting initial credentials

6.修改/etc/samba/smb.conf

vim /etc/samba/smb.conf
#修改如下内容
workgroup &＃61; LUSHARE
server string &＃61; pptpd Server
security &＃61; ads
realm &＃61; LUSHARE.COM
encrypt passwords &＃61; yes
password server &＃61; adserver.lushare.com
#添加如下内容
idmap uid &＃61; 50001-550000
idmap gid &＃61; 50001-550000
winbind separator &＃61; &＃43;
winbind refresh tickets &＃61;yes
winbind use default domain&＃61; no
winbind enum users &＃61; yes
winbind enum groups &＃61; yes
template shell &＃61; /bin/bash
template homedir &＃61;/home/%D/%U

7.加入AD

#使用klist查看刚刚使用的kinit命令是否执行成功
[root&＃64;graceboy ~]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: administrator&＃64;LUSHARE.COM
Valid starting Expires Service principal
03/29/14 14:34:47 03/30/14 00:34:47 krbtgt/LUSHARE.COM&＃64;LUSHARE.COMrenew until 04/05/14 14:34:47
#使用如下命令加入AD
net ads join -U administrator&＃64;LUSHARE.COM
Enter administrator&＃64;LUSHARE.COM&＃39;s password:
Using short domain name -- LUSHARE
Joined &＃39;GRACEBOY&＃39; to dns domain &＃39;lushare.com&＃39;

8.启动相应的服务并测试加入AD是否正常

service smb restart ;chkconfig smb on
service nmb restart ;chkconfig nmb on
service winbind restart ;chkconfig winbind on
#测试是否可以获取AD中的信息
checking the trust secret for domain LUSHARE via RPC calls succeeded
#查看AD中的账户
wbinfo -u
LUSHARE&＃43;administrator
LUSHARE&＃43;guest
LUSHARE&＃43;support_388945a0
LUSHARE&＃43;krbtgt
LUSHARE&＃43;luke
LUSHARE&＃43;test

二.安装PPTPD(可参考http://fengwan.blog.51cto.com/508652/1385345)

1.安裝ppp

2.下载及安装pptpd

3.配置×××的DNS

4.配置ppp的客户端IP

vim /etc/pptpd.conf
#加入以下2行&＃xff0c;主要是本地IP,及远程×××客户端使用的IP&＃xff0c;不建议使用内部网段
localip 172.16.0.1
remoteip 172.16.0.2-245

本文是参考&＃xff1a;http://chengcai.blog.51cto.com/728195/1367677

另外本人测试&＃xff0c;只要是启用的账户都可以进行连接&＃xff0c;暂时还无法设置某些用户无法使用×××