LinuxにおけるSamba+ADドメイン制御認証の導入

1
--prefix=/usr/local/samba \
2
--with-system-mitkrb5 \
3
--with-ldap \
4
--with-syslog \
5
--with-pam \
6
--with-systemd \
7
--with-ads \
8
--without-ad-dc \
9
--with-winbind \
10
--enable-debug

1
echo "export PATH=/usr/local/samba/bin:/usr/local/samba/sbin:$PATH" > /etc/profile.d/samba.sh
2
source /etc/profile

1
cat /etc/systemd/system/smbd.service
2
[Unit]
3
Description=Samba SMB Daemon
4
After=network.target
5

6
[Service]
7
Type=forking
8
ExecStart=/usr/local/samba/sbin/smbd -s /usr/local/samba/etc/smb.conf -D
9
ExecReload=/bin/kill -HUP $MAINPID
10
ExecStop=/bin/kill -TERM $MAINPID
11
PIDFile=/usr/local/samba/var/run/smbd.pid
12
#User=samba
13
#Group=samba
14
Restart=always
15

16
[Install]
17
WantedBy=multi-user.target
18

19
cat /etc/systemd/system/nmbd.service
20
[Unit]
21
Description=Samba NetBIOS Name Server
22
After=network.target
23

24
[Service]
25
Type=forking
26
ExecStart=/usr/local/samba/sbin/nmbd -s /usr/local/samba/etc/smb.conf -D
27
PIDFile=/usr/local/samba/var/run/nmbd.pid
28
#User=samba
29
#Group=samba
30
Restart=always
31

32
[Install]
33
WantedBy=multi-user.target
34

35
cat /etc/systemd/system/winbindd.service
36
[Unit]
37
Description=Samba Winbind Daemon
38
After=network.target
39

40
[Service]
41
Type=forking
42
ExecStart=/usr/local/samba/sbin/winbindd -s /usr/local/samba/etc/smb.conf -D
43
PIDFile=/usr/local/samba/var/run/winbindd.pid
44
#User=samba
45
#Group=samba
46
Restart=always
47

48
[Install]
49
WantedBy=multi-user.target

1
[libdefaults]
2
    default_realm = KOEVN.COM
3
    dns_lookup_realm = true
4
    dns_lookup_kdc = true
5
    rdns = false
6
    ticket_lifetime = 24h
7
    forwardable = true
8

9
[domain_realm]
10
  .koevn.com = KOEVN.COM
11
  koevn.com = KOEVN.COM

1
[global]
2
  workgroup = KOEVN
3
  realm = KOEVN.com
4
  security = ADS
5

6
  winbind use default domain = yes
7
  winbind enum users  = yes
8
  winbind enum groups = yes
9
  winbind nss info = template
10

11
  idmap config * : backend = tdb
12
  idmap config * : range = 1000000-1999999
13
  idmap config KOEVN : backend = rid
14
  idmap config KOEVN : range = 10000-999999
15

16
  template shell = /bin/false
17
  template homedir = /nonexistent
18
  winbind refresh tickets = yes
19

20
  log file = /data/samba/logs/samba.log
21
  log level = 2
22

23
[test]
24
  path = /data/samba/test
25
  comment = テストディレクトリ
26
  browseable = yes
27
  browseable = no
28
  read only = no
29
  guest ok = no
30
  hide unreadable = yes
31
  force group = samba
32
  create mask = 0660
33
  directory mask = 0770
34
  valid users = K95221
35
  delete readonly = no

1
systemctl start smbd.service && systemctl start nmbd.service && systemctl start winbindd.service

1
net ads join -U ldap@KOEVN.COM

1
wbinfo -n K95221   # このコマンドを実行するとSIDの文字列が返されます
2
wbinfo -S SID      # このコマンドを実行するとUIDが返されます。解決できない場合は、共有ディレクトリの認証が直接失敗することを意味します。

1
cp /usr/local/samba/lib/libnss_winbind.so.2 /lib/x86_64-linux-gnu/
2
cd /lib/x86_64-linux-gnu/
3
ln -sf libnss_winbind.so.2 libnss_winbind.so