FreeSource: AndrewShan/sambagosa

Samba

Самба мной ставилась позже, чем все выше описанное, поэтому были внесены некоторые изменения. Для опытного и толкового администратора они не проблема.

Для начала скажу что вместо админа LDAP cn=administrator,dc=office,dc=etersoft,dc=ru у меня теперь фигурирует cn=admin,dc=office,dc=etersoft,dc=ru .

Советую поставить в добавок ко всему phpldapadmin. Для работы достаточно прописать в Apache путь и права. :) Вход в консоль управления осуществляется при помощи LDAP админа (имя надо вводить полностью cn=admin,dc=office,...)

Сейчас расскажу что пришлось изменить для корректной работы Самбы.

Файл Open LDAP стал таким

#slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/corba.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/trust.schema include /etc/openldap/schema/gosa/samba3.schema include /etc/openldap/schema/gosa/gosystem.schema include /etc/openldap/schema/gosa/gofon.schema include /etc/openldap/schema/gosa/goto.schema include /etc/openldap/schema/gosa/goto-mime.schema include /etc/openldap/schema/gosa/gosa+samba3.schema include /etc/openldap/schema/gosa/gofax.schema include /etc/openldap/schema/gosa/goserver.schema include /etc/openldap/schema/gosa/openssh-lpk_openldap.schema #include /etc/openldap/schema/gosa/gosa.schema include /etc/openldap/schema/gosa/fai.schema include /etc/openldap/schema/gosa/dnszone.schema include /etc/openldap/schema/gosa/rfc2739.schema include /etc/openldap/schema/gosa/kolab2.schema include /etc/openldap/schema/gosa/phpgwaccount.schema include /etc/openldap/schema/gosa/pureftpd.schema include /etc/openldap/schema/gosa/phpscheduleit.schema include /etc/openldap/schema/gosa/pptp.schema include /etc/openldap/schema/gosa/dhcp.schema schemacheck on #include /etc/openldap/slapd-access.conf access to dn.exact="" by dn="cn=admin,dc=office,dc=etersoft,dc=ru" write by * read access to dn.base="cn=Subschema" by dn="cn=admin,dc=office,dc=etersoft,dc=ru" write by * read access to dn.subtree="dc=office,dc=etersoft,dc=ru" by dn="cn=admin,dc=office,dc=etersoft,dc=ru" write by * read allow bind_v2 concurrency 20 #gentlehup on sizelimit -1 loglevel 1024 password-hash {CRYPT} pidfile /var/run/slapd.pid argsfile /var/run/slapd.args #replica-pidfile /var/run/slurpd.pid #replica-argsfile /var/run/slurpd.args rootDSE /etc/openldap/rootdse.ldif access to attrs=userPassword,sambaLMPassword,sambaNTPassword,shadowMax,shadowExpire by dn="cn=admin,dc=office,dc=etersoft,dc=ru" write by self write by anonymous auth by * none access to attrs=sambaHomeDrive,sambaHomePath,sambaKickoffTime,sambaLogoffTime,sambaLogonTime,sambaPasswordHistory,sambaPrimaryGroupSID,sambaProfilePath,sambaPwdCanChange,sambaPwdLastSet,sambaSID,uid,uidNumber by dn="cn=admin,dc=office,dc=etersoft,dc=ru" write by anonymous auth by self write by * none access to attrs=cn,givenName,sn,gecos by dn="cn=admin,dc=office,dc=etersoft,dc=ru" write by self write by users read by * read access to attrs=loginShell by dn="cn=admin,dc=office,dc=etersoft,dc=ru" write by self write by * read access to * by self write by dn="cn=admin,dc=office,dc=etersoft,dc=ru" write by * read access to attrs=goImapPassword by dn="cn=admin,dc=office,dc=etersoft,dc=ru" write by * none access to attrs=goKrbPassword by dn="cn=admin,dc=office,dc=etersoft,dc=ru" write by * none access to dn="ou=(people|groups|computers),dc=mydc,dc=mycountry" by dn="cn=admin,dc=office,dc=etersoft,dc=ru" write # by dn="uid=samba,ou=DSA,dc=mydc,dc=mycountry" write by * read access to attrs=gotoLastUser by * write modulepath /usr/lib/openldap moduleload back_hdb.la moduleload back_monitor.la moduleload back_null.la #sasl-host localhost #TLSRandFile /dev/random #TLSCipherSuite HIGH:+SSLv2 #TLSCertificateFile /etc/openldap/ldap.pem #TLSCertificateKeyFile /etc/openldap/ldap.pem #TLSCACertificatePath /etc/openldap/ #TLSCACertificateFile /etc/openldap/ldap.pem #TLSVerifyClient 0 include /etc/openldap/slapd-hdb-db01.conf

Как можно заметить, были внесены изменения в схемы (если самба используется без ГОсы, то достаточно переключить на схему, связанную с самбой) и в ACL. Я пошел по пути простому, пусть один пользователь (админ) заведует всем. Кто хочет, может сделать все это сложнее, разделить пользователей, но я пока не вижу смысла, при этом знаю в чем выгода этого решения.

Дальше

# cat slapd-hdb-db01.conf # slapd-hdb-db01.conf database hdb suffix "dc=office,dc=etersoft,dc=ru" rootdn cn=admin,dc=office,dc=etersoft,dc=ru rootpw {CRYPT}jncgr52bkvktw #readonly off directory /var/lib/ldap/bases/office.etersoft.ru #index objectClass eq #index uid,uidNumber,gidNumber eq #index cn,ou,mail,surname,givenname eq,sub,subany #index gosaSubtreeACL,gosaObject,gosaUser eq index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index gosaSubtreeACL,gosaUser eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq #access to attrs=userPassword # by self write # by dn="cn=admin,dc=office,dc=etersoft,dc=ru" write # by dn="cn=proxy,dc=office,dc=etersoft,dc=ru" read # by anonymous auth # by * none #access to attrs=cn,uid # by self write # by dn="cn=admin,dc=office,dc=etersoft,dc=ru" write # by anonymous auth # by * read #access to * # by self write # by dn="cn=admin,dc=office,dc=etersoft,dc=ru" write # by * read

Он вроде не изменялся, но все равно выложил

Поехали дальше – было принято решение работать без pam_ldap, только nss_ldap. Файл nsswitch.conf остался без изменений.

А вот nss_ldap.conf стал таким (здесь много что закамменчено, настроек минимум)

# cat nss_ldap.conf # @(#)$Id: ldap.conf,v 1.37 2006/04/13 03:26:17 lukeh Exp $ # # This is the configuration file for the LDAP nameservice # switch library and the LDAP PAM module. # # PADL Software # http://www.padl.com # # Your LDAP server. Must be resolvable without using LDAP. # Multiple hosts may be specified, each separated by a # space. How long nss_ldap takes to failover depends on # whether your LDAP client library supports configurable # network or connect timeouts (see bind_timelimit). host 127.0.0.1 # The distinguished name of the search base. base dc=office,dc=etersoft,dc=ru # Another way to specify your LDAP server is to provide an # uri with the server name. This allows to use # Unix Domain Sockets to connect to a local LDAP Server. uri ldap://127.0.0.1/ #uri ldaps://127.0.0.1/ #uri ldapi://%2fvar%2frun%2fldapi_sock/ # Note: %2f encodes the '/' used as directory separator # The LDAP version to use (defaults to 3 # if supported by client library) ldap_version 3 # The distinguished name to bind to the server with. # Optional: default is to bind anonymously. #binddn cn=admin,dc=office,dc=etersoft,dc=ru # The credentials to bind with. # Optional: default is no credential. #bindpw secret # The distinguished name to bind to the server with # if the effective user ID is root. Password is # stored in /etc/ldap.secret (mode 600) rootbinddn cn=admin,dc=office,dc=etersoft,dc=ru # The port. # Optional: default is 389. #port 389 # The search scope. #scope sub #scope one #scope base # Search timelimit timelimit 5 # Bind/connect timelimit bind_timelimit 5 # Reconnect policy: hard (default) will retry connecting to # the software with exponential backoff, soft will fail # immediately. #bind_policy hard # Idle timelimit; client will close connections # (nss_ldap only) if the server has not been contacted # for the number of seconds specified below. #idle_timelimit 3600 # Filter to AND with uid=%s #pam_filter objectclass=posixAccount # The user ID attribute (defaults to uid) #pam_login_attribute uid # Search the root DSE for the password policy (works # with Netscape Directory Server) #pam_lookup_policy yes # Check the 'host' attribute for access control # Default is no; if set to yes, and user has no # value for the host attribute, and pam_ldap is # configured for account management (authorization) # then the user will not be allowed to login. #pam_check_host_attr yes # Check the 'authorizedService' attribute for access # control # Default is no; if set to yes, and the user has no # value for the authorizedService attribute, and # pam_ldap is configured for account management # (authorization) then the user will not be allowed # to login. #pam_check_service_attr yes # Group to enforce membership of #pam_groupdn cn=PAM,ou=Groups,dc=example,dc=com # Group member attribute #pam_member_attribute uniquemember # Specify a minium or maximum UID number allowed #pam_min_uid 0 #pam_max_uid 0 # Template login attribute, default template user # (can be overriden by value of former attribute # in user's entry) #pam_login_attribute userPrincipalName #pam_template_login_attribute uid #pam_template_login nobody # HEADS UP: the pam_crypt, pam_nds_passwd, # and pam_ad_passwd options are no # longer supported. # # If you are using XAD, you can set pam_password # to racf, ad, or exop. Make sure that you have # SSL enabled. # Do not hash the password at all; presume # the directory server will do it, if # necessary. This is the default. #pam_password clear # Hash password locally; required for University of # Michigan LDAP server, and works with Netscape # Directory Server if you're using the UNIX-Crypt # hash mechanism and not using the NT Synchronization # service. #pam_password crypt # Remove old password first, then update in # cleartext. Necessary for use with Novell # Directory Services (NDS) #pam_password clear_remove_old #pam_password nds # RACF is an alias for the above. For use with # IBM RACF #pam_password racf # Update Active Directory password, by # creating Unicode password and updating # unicodePwd attribute. #pam_password ad # Use the OpenLDAP password change # extended operation to update the password. #pam_password exop # Redirect users to a URL or somesuch on password # changes. #pam_password_prohibit_message Please visit http://internal to change your password. # RFC2307bis naming contexts # Syntax: # nss_base_XXX base?scope?filter # where scope is {base,one,sub} # and filter is a filter to be &'d with the # default filter. # You can omit the suffix eg: # nss_base_passwd ou=People, # to append the default base DN but this # may incur a small performance impact. nss_base_passwd ou=people,dc=office,dc=etersoft,dc=ru?one nss_base_shadow ou=people,dc=office,dc=etersoft,dc=ru?one nss_base_passwd ou=computers,dc=office,dc=etersoft,dc=ru?one nss_base_group ou=groups,dc=office,dc=etersoft,dc=ru?one #nss_base_hosts ou=Hosts,dc=example,dc=com?one #nss_base_services ou=Services,dc=example,dc=com?one #nss_base_networks ou=Networks,dc=example,dc=com?one #nss_base_protocols ou=Protocols,dc=example,dc=com?one #nss_base_rpc ou=Rpc,dc=example,dc=com?one #nss_base_ethers ou=Ethers,dc=example,dc=com?one #nss_base_netmasks ou=Networks,dc=example,dc=com?ne #nss_base_bootparams ou=Ethers,dc=example,dc=com?one #nss_base_aliases ou=Aliases,dc=example,dc=com?one #nss_base_netgroup ou=Netgroup,dc=example,dc=com?one # attribute/objectclass mapping # Syntax: #nss_map_attribute rfc2307attribute mapped_attribute #nss_map_objectclass rfc2307objectclass mapped_objectclass # configure --enable-nds is no longer supported. # NDS mappings #nss_map_attribute uniqueMember member # Services for UNIX 3.5 mappings #nss_map_objectclass posixAccount User #nss_map_objectclass shadowAccount User #nss_map_attribute uid msSFU30Name #nss_map_attribute uniqueMember msSFU30PosixMember #nss_map_attribute userPassword msSFU30Password #nss_map_attribute homeDirectory msSFU30HomeDirectory #nss_map_attribute homeDirectory msSFUHomeDirectory #nss_map_objectclass posixGroup Group #pam_login_attribute msSFU30Name #pam_filter objectclass=User #pam_password ad # configure --enable-mssfu-schema is no longer supported. # Services for UNIX 2.0 mappings #nss_map_objectclass posixAccount User #nss_map_objectclass shadowAccount user #nss_map_attribute uid msSFUName #nss_map_attribute uniqueMember posixMember #nss_map_attribute userPassword msSFUPassword #nss_map_attribute homeDirectory msSFUHomeDirectory #nss_map_attribute shadowLastChange pwdLastSet #nss_map_objectclass posixGroup Group #nss_map_attribute cn msSFUName #pam_login_attribute msSFUName #pam_filter objectclass=User #pam_password ad # RFC 2307 (AD) mappings #nss_map_objectclass posixAccount user #nss_map_objectclass shadowAccount user #nss_map_attribute uid sAMAccountName #nss_map_attribute homeDirectory unixHomeDirectory #nss_map_attribute shadowLastChange pwdLastSet #nss_map_objectclass posixGroup group #nss_map_attribute uniqueMember member #pam_login_attribute sAMAccountName #pam_filter objectclass=User #pam_password ad # configure --enable-authpassword is no longer supported # AuthPassword mappings #nss_map_attribute userPassword authPassword # AIX SecureWay mappings #nss_map_objectclass posixAccount aixAccount #nss_base_passwd ou=aixaccount,?one #nss_map_attribute uid userName #nss_map_attribute gidNumber gid #nss_map_attribute uidNumber uid #nss_map_attribute userPassword passwordChar #nss_map_objectclass posixGroup aixAccessGroup #nss_base_group ou=aixgroup,?one #nss_map_attribute cn groupName #nss_map_attribute uniqueMember member #pam_login_attribute userName #pam_filter objectclass=aixAccount #pam_password clear # Netscape SDK LDAPS #ssl on # Netscape SDK SSL options #sslpath /etc/ssl/certs # OpenLDAP SSL mechanism # start_tls mechanism uses the normal LDAP port, LDAPS typically 636 #ssl start_tls #ssl on # OpenLDAP SSL options # Require and verify server certificate (yes/no) # Default is to use libldap's default behavior, which can be configured in # /etc/openldap/ldap.conf using the TLS_REQCERT setting. The default for # OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes". #tls_checkpeer yes # CA certificates for server certificate verification # At least one of these are required if tls_checkpeer is "yes" #tls_cacertfile /etc/ssl/ca.cert #tls_cacertdir /etc/ssl/certs # Seed the PRNG if /dev/urandom is not provided #tls_randfile /var/run/egd-pool # SSL cipher suite # See man ciphers for syntax #tls_ciphers TLSv1 # Client certificate and key # Use these, if your server requires client authentication. #tls_cert #tls_key # Disable SASL security layers. This is needed for AD. #sasl_secprops maxssf=0 # Override the default Kerberos ticket cache location. #krb5_ccname FILE:/etc/.ldapcache # SASL mechanism for PAM authentication - use is experimental # at present and does not support password policy control #pam_sasl_mech DIGEST-MD5

Для верности можно в pam_ldap изменить

host 127.0.0.1 base dc=office,dc=etersoft,dc=ru uri ldap://127.0.0.1/

Не забываем что 127.0.0.1 это годится только для локальной машины (нашего сервера), для остальных *nix-машин надо вводить testing.office.etersoft.ru (забыл упомянуть что тестовая машина тоже изменилась :) )

Примечание (не обязательное к прочтению): В настройке pam_ldap все же были внесены измениния (но не значительные, которые почти не влияют на работу (они не позволяют пользователю LDAP войти локально)). ПАМ настраивался с учетом уже существующего конфига (#PAM).

Теперь попытаюсь объяснить суть этого примечания. Физически в паме есть изменения, но они ни каким образом не влияют на работу, т.к. для их корректнной работы надо изменять nss_ldap и pam_ldap (весь это процесс я уже описывал)

Двигаемся дальше:

Ставим Samba и Smbldap tools через apt-get:

$ rpm -qa | grep samba samba-3.0.28-alt1.1 samba-common-3.0.28-alt1.1 samba-doc-3.0.28-alt1.1 samba-client-control-1.2-alt1 samba-swat-3.0.28-alt1.1 samba-client-3.0.28-alt1.1 samba-client-cups-3.0.28-alt1.1 $ rpm -qa | grep smb smbldap-tools-0.9.4-alt1 libsmbclient-3.0.28-alt1.1

Меняем конфиг самбы (smb.conf) на такой:

# cat smb.conf [global] coding system = KOI8-R client code page = 866 workgroup = DOMAIN netbios name = DOMAIN-PDC server string = Samba Server %v interfaces = 192.168.0.57/24, eth0 encrypt passwords = Yes update encrypted = Yes map to guest = Bad User nt acl support = Yes passwd program = /usr/bin/passwd %u passwd chat = *New*password* %n\n *Please*retype*new*password* %n\n *password*successfully*updated* log file = /var/log/samba/log.%m max log size = 500 time server = Yes load printers = No character set = KOI8-R # domain admin = root@"Domain Admins" # domain guest group = pcguest domain logons = Yes os level = 255 preferred master = Yes domain master = Yes wins proxy = Yes wins support = Yes # guest account = pcguest # admin users = @wheel hosts allow = 192.168.0., 127.0.0.1 socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 ldap admin dn = cn=admin,dc=office,dc=etersoft,dc=ru ldap delete dn = Yes ldap group suffix = ou=groups ldap idmap suffix = ou=idmap ldap machine suffix = ou=computers ldap passwd sync = Yes ldap suffix = dc=office,dc=etersoft,dc=ru ldap ssl = no ldap user suffix = ou=people idmap uid = 15000-20000 idmap gid = 15000-20000 # logon home = logon script = %G.bat # logom path = # logon drive = logon path = \\%L\%U\Profiles logon drive = Z: [IPC$] path = /tmp hosts allow = 192.168.0.0/24, 127.0.0.1 hosts deny = 0.0.0.0/0 [Homes] comment = Home Directories path = /var/lib/samba/profiles writable = Yes create mask = 0600 browseable = No [netlogon] comment = Network Logon Service path = /var/lib/samba/netlogon # guest ok = Yes # public = Yes # share modes = Yes # locking = No browseable = No read only = yes [%U] comment = Users' Profiles path = /var/lib/samba/profiles/%U read only = No #browseable = Yes security mask = 0755 create mask = 0755 directory mask = 0755 guest ok = Yes profile acls = yes # csc policy = disable # next line is a great way to secure the profiles force user = %U # next line allows administrator to access all profiles valid users = %U @"Domain Admins" # force group = "Domain Users" fstype = NTFS [Public] comment = Public path = /var/lib/samba/public read only = No directory mask = 0777 valid users = @"Domain Admins", @"Domain Users" fstype = NTFS

С помощью такой настройки (в сочетание с smbldap tools) я пытался добиться того, чтобы при залогинивании у каждого пользователя был сетевой профиль, хранящийся на сервере, + чтобы профиль подключался как сетевой диск. Также есть файловая помойка (share).

В отличие от обычных описаний, я не стал разбивать пользователей на отдельные группы, решил чтобы абсолютно все пользователи находились в одной группе.

Для того чтобы получить SID надо ввести команду net getlocalsid, этот номер записываем в след.файл + изменения.

cat smbldap.conf # General Configuration SID="S-1-5-21-2786314553-1476379512-3697525084" sambaDomain="DOMAIN" slaveLDAP="127.0.0.1" slavePort="389" masterLDAP="127.0.0.1" masterPort="389" ldapTLS="0" verify="require" suffix="dc=office,dc=etersoft,dc=ru" usersdn="ou=people,${suffix}" computersdn="ou=computers,${suffix}" groupsdn="ou=groups,${suffix}" idmapdn="ou=idmap,${suffix}" sambaUnixIdPooldn="sambaDomainName=${sambaDomain},${suffix}" scope="sub" hash_encrypt="CRYPT" crypt_salt_format="%s" userLoginShell="/bin/bash" userHome="/var/lib/samba/profiles/%U" userHomeDirectoryMode="755" #userGecos="System User" defaultUserGid="513" defaultComputerGid="515" skeletonDir="/etc/skel" defaultMaxPasswordAge="45" # SAMBA Configuration userSmbHome="\\Domain-pdc\%U" #userSmbHome= # The UNC path to profiles locations (%U username substitution) # Just set it to a null string if you want to use the smb.conf 'logon path' # directive and/or disable roaming profiles # Ex: userProfile="\\PDC-SMB3\profiles\%U" userProfile="\\Domain-pdc\%U\Profiles" # The default Home Drive Letter mapping # (will be automatically mapped at logon time if home directory exist) # Ex: userHomeDrive="H:" userHomeDrive=Z: # The default user netlogon script name (%U username substitution) # if not used, will be automatically username.cmd # make sure script file is edited under dos # Ex: userScript="startup.cmd" # make sure script file is edited under dos userScript="/var/lib/samba/netlogon/*.bat" # Domain appended to the users "mail"-attribute # when smbldap-useradd -M is used # Ex: mailDomain="idealx.com" mailDomain="office.etersoft.ru" # SMBLDAP-TOOLS Configuration (default are ok for a RedHat) with_smbpasswd="0" smbpasswd="/usr/bin/smbpasswd" with_slappasswd="1" slappasswd="/usr/sbin/slappasswd"

Файл smbldap_bind.conf

############################ # Credential Configuration # ############################ # Notes: you can specify two differents configuration if you use a # master ldap for writing access and a slave ldap server for reading access # By default, we will use the same DN (so it will work for standard Samba # release) slaveDN="cn=admin,dc=office,dc=etersoft,dc=ru" slavePw="secret" masterDN="cn=admin,dc=office,dc=etersoft,dc=ru" masterPw="secret"

Теперь можно заполнить базу

smbldap-populate -u 30000 -g 30000

После этого:

chmod 0644 /etc/smbldap-tools/smbldap.conf chmod 0600 /etc/smbldap-tools/smbldap_bind.conf

и определяем пароль root'a LDAP для samba:

smbpasswd -w secret_word Setting stored password for "cn=admin,dc=office,dc=etersoft,dc=ru" in secrets.tdb

smbpasswd -a root

Задаем пароль root (с помощью него будем вводить в домен Win-машину)

На всякий случай вот еще есть изменения в /etc/hosts

$ cat hosts 127.0.0.1 testing.office.etersoft.ru testing localhost.localdomain localhost 192.168.0.57 domain domain-pdc testing.office.etersoft.ru 192.168.0.124 winxp

В моем случаи имя машины winxp

Работа полученной конфигурации проверяется следующим образом:

getent passwd | grep 0:0

Вывод должен быть такой:

root:x:0:0:root:/root:/bin/bash root:x:0:0:Netbios Domain Administrator:/home/root:/bin/false

добавление пользователей в домен:

smbldap-useradd -a -m -P username

смотреть, как пользователь «устроился» в домене:

pdbedit -Lv username

Windows XP SP2 компьютер вводится в полученный домен от учетной записи root; прописывается в базе автоматически.

Для управления этой конфигурацией можно использовать phpLDAPAdmin (http://phpldapadmin.sourceforge.net) или GOsa (https://www.gosa-project.org).

В некоторых описаниях читал, что для корректной работы надо править реестр Винды, но у меня в XP SP2 ничего не пришлось изменять.

И наконец, вот скрипты для автоматической инициализации сетевых дисков, его следует положить в папку netlogon

$ cat Users.bat #net use Z: \\Domain-pdc\Profiles /yes # диск Z: может и сам создаваться средствами Самба :) net use Y: \\Domain-pdc\Public /yes #net use X: \\Domain-pdc\%U /yes[root@testing netlogon]

[shan@testing openldap]$ cd /var/lib/samba/ [shan@testing samba]$ ls -l итого 268 -rw------- 1 root root 4096 Фев 20 18:00 account_policy.tdb -rw-r--r-- 1 root root 40200 Мар 11 17:48 brlock.tdb -rw-r--r-- 1 root root 523 Мар 12 12:20 browse.dat -rw-r--r-- 1 root root 0 Мар 5 16:21 conf -rw-r--r-- 1 root root 12288 Мар 11 17:48 connections.tdb -rw-r--r-- 1 root root 4096 Фев 22 17:29 gencache.tdb -rw------- 1 root root 4096 Фев 20 18:00 group_mapping.tdb -rw------- 1 root root 4096 Фев 22 17:29 idmap_cache.tdb -rw-r--r-- 1 root root 40200 Мар 11 17:48 locking.tdb -rw-r--r-- 1 root root 696 Фев 21 13:39 login_cache.tdb -rw------- 1 root root 696 Мар 11 17:48 messages.tdb -rw-r--r-- 1 root root 7686 Мар 5 17:20 namelist.debug drwxrwxr-x 2 root pav 4096 Мар 12 12:23 netlogon -rw------- 1 root root 696 Фев 22 17:29 netsamlogon_cache.tdb -rw-r--r-- 1 root root 696 Мар 8 18:54 notify.tdb -rw------- 1 root root 4096 Фев 20 18:00 ntdrivers.tdb -rw------- 1 root root 696 Фев 20 18:00 ntforms.tdb -rw------- 1 root root 4096 Фев 20 18:00 ntprinters.tdb drwxr-xr-x 2 root root 4096 Фев 20 18:00 perfmon drwxr-xr-x 2 root root 4096 Фев 20 18:24 printing drwxrwxr-x 5 testuser pav 4096 Мар 8 18:52 profiles drwxrwxrwx 5 nobody pav 4096 Мар 8 18:47 public -rw------- 1 root root 16384 Мар 11 17:48 registry.tdb -rw-r--r-- 1 root root 696 Мар 11 17:48 sessionid.tdb -rw------- 1 root root 4096 Фев 21 15:40 share_info.tdb -rw-r--r-- 1 root root 4096 Мар 11 17:49 unexpected.tdb -rw------- 1 root root 53248 Фев 22 17:29 winbindd_cache.tdb -rw-r--r-- 1 root root 4096 Фев 22 17:29 winbindd_idmap.tdb drwxr-x--- 2 root winbind 4096 Фев 22 17:29 winbindd_privileged -rw-r--r-- 1 root root 445 Мар 12 12:25 wins.dat -rw------- 1 root root 4096 Мар 11 17:48 wins.tdb

pav это группа Domain Users. По каким-то причинам имена совмещаются и принадлежат одной группе.

А теперь самое интересное – Как создавать пользователя?

1) Создать пользователя в ГОсе.

2) Настроить его, добавить в соответствующую группу (!)

3) smbpasswd -a имя_пользователя

4) возможно придется создать его домашний каталог в profiles и настроить его (chmod, chown)

Только после этого он входит у меня в домен на XP. При первом заходе может ругаться что нет сетевого диска и т.п., зато при последующих исправно работает.