FreeSource - AltLinux/Dokumentacija/samba/idmapldap

2005-12-01 22:36:52

�� /Alt Linux / Dokumentacija / samba / idmapldap �� 2005-12-01 22:36:52 � 2005-12-07 21:39:56

��:

�� altlinux.org. �� freesource.info ��.

�� , �� smbldap-populate, �� (?). � «��» �� 0.9.1 � �� .

2005-12-01 22:35:09

�� /Alt Linux / Dokumentacija / samba / idmapldap �� 2005-12-01 22:35:09 � 2005-12-01 22:36:52

��:

�� uid=kolya,ou=People, o=example. � �� uidNumber: 510, � objectclass: posixAccount, sambaSAMAccount. �� :
� �� : winbind �� uid �� (�� ). �� uid �� gidNumber, �� uid=kolya,ou=People; �� . �� idmap_rid. �� , �� .

��:

�� uid=kolya,ou=People, o=example. � �� uidNumber: 510, � objectclass: sambaSAMAccount. �� :
� �� : winbind �� uid �� (�� ). �� uid �� uid=kolya,ou=People; �� . �� idmap_rid. �� , �� .

2005-11-30 19:11:40

�� /Alt Linux / Dokumentacija / samba / idmapldap �� 2005-11-30 19:11:40 � 2005-12-01 22:35:09

��:

��: ab@ �� nss_winbind �� pdc � �� ldap backend � ��. ��, �� winbind �� pdc � 3.0.14 � �� 3.0.21rc1.

2005-11-29 21:36:24

�� /Alt Linux / Dokumentacija / samba / idmapldap �� 2005-11-29 21:36:24 � 2005-11-30 19:11:40

��:

... �� , � �� – � �� , �� /��? ;) �� «��» uid/gid, �� (�� 3.0.11pre2 samba �� ). � �� root �� ;)
�� ldapsam:trusted:
Yes you still need it [nss_ldap] as Samba is going to use it. I'll look
into modifying smbd so that all getpwXXX calls go via passdb
and thus take advantage of LDAP if that's configured directly.
That'll have to be for 3.0.21+ though.

Jeremy Allison
You still need ldap in /etc/nsswitch.conf, be it only for the
other unix programs running. The major optimizations come from the assumption
that all accounts relevant to Samba are in LDAP and both the posix and samba
object classes are on the same LDAP entry.

Volker Lendecke

��:

... �� , � �� – � �� , �� /��? ;) �� «��» uid/gid, �� (�� 3.0.11pre2 samba �� ). � �� root �� ;)
http://us2.samba.org/samba/ftp/HOWTO/Samba-Rights-HOWTO

2005-11-29 21:30:17

�� /Alt Linux / Dokumentacija / samba / idmapldap �� 2005-11-29 21:30:17 � 2005-11-29 21:36:24

��:

��, �� PDC �� unix extensions = yes, � �� cifs (� �� smbfs). � �� , �� owner uid (510), �� member �� nss_ldap.
�� idmap backend = ldap, �� uid'�� – �� pdc. �� pdc �� .

�� nss_winbind �� uid �� nss_ldap. � �� , �� nss_winbind wbinfo ��-�� , �� nss_ldap �� domain member � �� nss_winbind (�� pam_winbind �� – �� , � �� ).

��:

��, �� PDC �� unix extensions = yes, � �� cifs (� �� smbfs). � �� , �� owner uid (510), �� member �� nss_ldap.
�� idmap backend = ldap, �� uid'�� – �� pdc. �� pdc �� .
� �� , �� nss_winbind wbinfo ��-�� , �� nss_winbind �� nss_ldap.
�� pam_winbind �� – �� , � �� . �� uid ��, �� pam_ldap �� nss_winbind.

2005-11-29 21:26:08

�� /Alt Linux / Dokumentacija / samba / idmapldap �� 2005-11-29 21:26:08 � 2005-11-29 21:30:17

��:

�� , smbldap-{user,group}add �� smbldap-tools �� : objectClass=sambaIdmapEntry.
[root@vault root]# diff -Naur /usr/sbin/smbldap-useradd.orig /usr/sbin/smbldap-useradd

/usr/sbin/smbldap-useradd.orig 2005–11–29 17:15:42 +0200
+++ /usr/sbin/smbldap-useradd 2005–11–29 20:34:41 +0200
@@ -382,7 +382,7 @@

my $modify = $ldap_master->modify ( «uid=$userName,$config{usersdn}",

changes => [

– add => [objectClass => 'sambaSAMAccount'],
+ add => [objectClass => ['sambaSAMAccount', 'sambaIdmapEntry']],

add => [sambaPwdLastSet => "$valpwdlastset"],
add => [sambaLogonTime => '0'],
add => [sambaLogoffTime => '2147483647'],

� �� , �� nss_winbind wbinfo ��-�� , �� nss_winbind �� nss_ldap.

��:

�� , smbldap-{user,group}add �� smbldap-tools �� : objectClass=sambaIdmapEntry. �� :)
�� , �� nss_winbind wbinfo ��-�� , �� nss_winbind �� nss_ldap, �� .

2005-11-29 21:25:23

�� /Alt Linux / Dokumentacija / samba / idmapldap �� 2005-11-29 21:25:23 � 2005-11-29 21:26:08

��:

��:

... �� , � �� – � �� , �� /��? ;) �� «��» uid/gid, �� (�� 3.0.11pre2 samba �� , http://us2.samba.org/samba/ftp/HOWTO/Samba-Rights-HOWTO). � �� ;)

2005-11-29 21:16:39

�� /Alt Linux / Dokumentacija / samba / idmapldap �� 2005-11-29 21:16:39 � 2005-11-29 21:25:23

��:

group:      files ldap db nisplus nis

Could not convert gid 513 to sid

param/loadparm.c:2875

if (idmap_uid_low == 0 || idmap_uid_high == 0)
     return False;

param/loadparm.c:2889

if (idmap_gid_low == 0 || idmap_gid_high == 0)

... �� , � �� – � �� , �� /��? ;) �� «��» uid/gid, �� (�� 3.0.11pre2 samba �� , http://us2.samba.org/samba/ftp/HOWTO/Samba-Rights-HOWTO). � �� ;)

��:

group: files ldap db nisplus nis

Could not convert gid 513 to sid

param/loadparm.c:2875

if (idmap_uid_low == 0 || idmap_uid_high == 0) param/loadparm.c:2889 if (idmap_gid_low == 0 || idmap_gid_high == 0)

... �� , � �� – � �� , �� /��? ;)

2005-11-29 20:17:24

�� /Alt Linux / Dokumentacija / samba / idmapldap �� 2005-11-29 20:17:24 � 2005-11-29 21:16:39

��:

��3: �� , �� idmap gid / idmap uid �� : � �� �� �� uid/gid, � �� ldap �� , winbind �� «��». � ��, Administrator (uid=0) � �� uid 20001. �� range � �� : � �� “idmap range missing or invalid”. �� :
param/loadparm.c:2875

if (idmap_uid_low == 0 || idmap_uid_high == 0) return False; param/loadparm.c:2889 if (idmap_gid_low == 0 || idmap_gid_high == 0)

return False;

... �� , � �� – � �� , �� /��? ;)