Linux加入到Windows域

一、实验环境：
AD server：windows server 2003
samba：redhat as5
AD server的hostname和IP地址：
turbomai-c89f91.test.com  192.168.0.122/24
AD samba的hostname和IP地址：
zhouhw       192.168.0.121/24
Domain name：turbomai-c89f91.test.com
DNS：192.168.151.122
安装NTP时间验证套件：
# mount /dev/cdrom /media
# rpm -ivh /cdrom/CentOS/RPMS/ntp-4.2.2p1-7.el5.i386.rpm
当然也可以用yum来安装
#yum -y install ntp （注意ntp要小写）
再来与AD server校准时间
# ntpdate 192.168.0.122
# hwclock -w
安装Samba服务器软件需求：
krb5-workstation-1.2.7-19
pam_krb5-1.70-1
krb5-devel-1.2.7-19
krb5-libs-1.2.7-19
samba-3.0.5-2
安装完后，如果你要确认samba安装成功没有可以用下述命令来检查samba包的基础库支持
# smbd -b | grep LDAP
HAVE_LDAP_H
HAVE_LDAP
HAVE_LDAP_DOMAIN2HOSTLIST
...
# smbd -b | grep KRB
HAVE_KRB5_H
HAVE_ADDRTYPE_IN_KRB5_ADDRESS
HAVE_KRB5
...
# smbd -b | grep ADS
WITH_ADS
WITH_ADS
# smbd -b | grep WINBIND
WITH_WINBIND
WITH_WINBIND
二、编辑设定档
1、krb5配置
#vi /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = TEST.COM # 大写域名
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
forwardable = yes
[realms]
TEST.COM = { # 大写域名
kdc = 192.168.0.122:88 # 域伺服器IP
admin_server = 192.168.0.122:749 # 域伺服器IP
default_domain = test.com # 这里就不用大写了
}
[domain_realm]
.ttest.com = TEST.COM # 域验证范围
test.com =TEST.COM
[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf
[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
连接AD server
kinit administrator@TT.COM
Kerberos 的 kinit 命令将测试服务器间的通信，后面的域名TT.COM 是你的活动目录的域名，必须大写，否则会收到错误信息：
kinit(v5): Cannot find KDC for requested realm while getting initial credentials.
如果通信正常，你会提示输入口令，口令正确的话，就返回 bash 提示符，如果错误则报告：
kinit(v5): Preauthentication failed while getting initial credentials.
這一步代表了已经可以和AD server做沟通了，但并不代表Samba Server已经加入域了。
2、smb.conf配置
#vi /etc/samba/smb.conf
[global]
        workgroup = TEST # 一定要填自己的domain名稱
        netbios name = zhouhw #你的linux主机名
        idmap uid    = 15000-20000
        idmap gid    = 15000-20000
        winbind enum groups = yes
        winbind enum users  = yes
        winbind separator   = /
;       winbind use default domain = yes
        template homedir = /home/%D/%U
        template shell   = /bin/bash

        security = domain

        encrypt passwords = yes
        password server = 192.168.0.122
[homes]
   path = /home/%D/%U
   browseable = no
   writable = yes
   valid users = TESTcom/%U
   create mode = 0777
   directory mode = 0777
3、配置nsswitch.conf
#vi /etc/nsswitch.conf
修改以下位置
passwd:     files winbind
shadow:     files winbind
group:      files winbind
4、启用samba和winbind服务
service smb start
service winbind start
5、加入AD域
[root@zhouhw ~]# net rpc join -S turbomai-c89f91.test.com -U administrator
Password:
Joined domain TEST.
6、验证加入是否成功
[root@zhouhw ~]# net rpc testjoin
Join to 'TEST' is OK
7、做完这些，就可以到AD server上的活动目录中看到该机器了