Autenticação no Samba como Domain Controller

gugarthur
(usa Fedora)

Enviado em 08/12/2015 - 16:12h

Olá, pessoal

Estou dando uma pesquisada sobre como autenticar num Samba Domain Controller através do Fedora. Achei muita informação, mas ainda não ficou muito claro pra mim. Achei um programa, authconfig, que configura a autenticação no Fedora, mas não entendi como configurá-lo. Achei também um tal de sssd, mas também não ficou claro pra mim. Enfim, creio que não deve ser algo tão difícil, portanto se vcs puderem me indicar algum material, fico agradecido. Segue o smb.conf do meu servidor:

#======================= Global Settings =====================================



[global]



# ----------------------- Network-Related Options -------------------------

#

# workgroup = the Windows NT domain name or workgroup name, for example, MYGROUP.

#

# server string = the equivalent of the Windows NT Description field.

#

# netbios name = used to specify a server name that is not tied to the hostname.

#

# interfaces = used to configure Samba to listen on multiple network interfaces.

# If you have multiple interfaces, you can use the "interfaces =" option to

# configure which of those interfaces Samba listens on. Never omit the localhost

# interface (lo).

#

# hosts allow = the hosts allowed to connect. This option can also be used on a

# per-share basis.

#

# hosts deny = the hosts not allowed to connect. This option can also be used on

# a per-share basis.

#

# max protocol = used to define the supported protocol. The default is NT1. You

# can set it to SMB2 if you want experimental SMB2 support.

#

	workgroup = LENEP

	server string = Samba Server Version %v



;	netbios name = MYSERVER



;	interfaces = lo eth0 192.168.12.2/24 192.168.13.2/24

;	hosts allow = 127. 192.168.12. 192.168.13.



;	max protocol = SMB2



# --------------------------- Logging Options -----------------------------

#

# log file = specify where log files are written to and how they are split.

#

# max log size = specify the maximum size log files are allowed to reach. Log

# files are rotated when they reach the size specified with "max log size".

#



	# log files split per-machine:

	log file = /var/log/samba/log.%m

	# maximum size of 50KB per log file, then rotate:

	max log size = 50



# ----------------------- Domain Controller Options ------------------------

#

# security = must be set to user for domain controllers.

#

# passdb backend = the backend used to store user information in. New

# installations should use either tdbsam or ldapsam. No additional configuration

# is required for tdbsam. The "smbpasswd" utility is available for backwards

# compatibility.

#

# domain master = specifies Samba to be the Domain Master Browser, allowing

# Samba to collate browse lists between subnets. Do not use the "domain master"

# option if you already have a Windows NT domain controller performing this task.

#

# domain logons = allows Samba to provide a network logon service for Windows

# workstations.

#

# logon script = specifies a script to run at login time on the client. These

# scripts must be provided in a share named NETLOGON.

#

# logon path = specifies (with a UNC path) where user profiles are stored.

#

#

	security = user

	passdb backend = tdbsam



	domain master = yes

	domain logons = yes



	# the following login script name is determined by the machine name

	# (%m):

;	logon script = %m.bat

	# the following login script name is determined by the UNIX user used:

	logon script = %u.bat

	logon path = \\%L\Profiles\%u

	# use an empty path to disable profile support:

;	logon path =



	# various scripts can be used on a domain controller or a stand-alone

	# machine to add or delete corresponding UNIX accounts:



	add user script = /usr/sbin/useradd "%u" -n -g users

	add group script = /usr/sbin/groupadd "%g"

	add machine script = /usr/sbin/useradd -n -c "Workstation (%u)" -M -d /nohome -s /bin/false "%u"

	delete user script = /usr/sbin/userdel "%u"

	delete user from group script = /usr/sbin/userdel "%u" "%g"

	delete group script = /usr/sbin/groupdel "%g"





# --------------------------- Printing Options -----------------------------

#

# The options in this section allow you to configure a non-default printing

# system.

#

# load printers = when set you yes, the list of printers is automatically

# loaded, rather than setting them up individually.

#

# cups options = allows you to pass options to the CUPS library. Setting this

# option to raw, for example, allows you to use drivers on your Windows clients.

#

# printcap name = used to specify an alternative printcap file.

#



	load printers = yes

	cups options = raw



;	printcap name = /etc/printcap

	# obtain a list of printers automatically on UNIX System V systems:

;	printcap name = lpstat

;	printing = cups



#============================ Share Definitions ==============================



[homes]

	comment = Home Directories

	browseable = no

	writable = yes

;	valid users = %S

;	valid users = MYDOMAIN\%S



[printers]

	comment = All Printers

	path = /var/spool/samba

	browseable = no

	guest ok = no

	writable = no

	printable = yes



# Un-comment the following and create the netlogon directory for Domain Logons:

[netlogon]

	comment = Network Logon Service

	path = /var/lib/samba/netlogon

	guest ok = yes

	writable = no

	share modes = no



# Un-comment the following to provide a specific roving profile share.

# The default is to use the user's home directory:

[Profiles]

	path = /var/lib/samba/profiles

	browseable = no

	guest ok = yes



# A publicly accessible directory that is read only, except for users in the

# "staff" group (which have write permissions):

[public]

	comment = Public Stuff

	path = /home/samba

	public = yes

	writable = yes

	printable = no

	write list = +staff