下面这样折腾可以自动共享当前用户的home,
vi /etc/krb5.conf
[logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = HWA.NET dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 24h forwardable = yes [realms] HWA.NET = { kdc = cdad.hwa.net:88 kdc = ad.hwa.net:88 admin_server = ad.hwa.net:389 default_domain = hwa.net } [domain_realm] .hwa.net = HWA.NET hwa.net = HWA.NET [appdefaults] pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false }
vi /etc/samba/smb.conf
[global] workgroup = HWA server string = %h dns proxy = no log file = /var/log/samba/log.%m max log size = 1000 syslog = 0 panic action = /usr/share/samba/panic-action %d encrypt passwords = true security = ads realm = HWA.NET password server = AD.HWA.NET passdb backend = tdbsam obey pam restrictions = yes unix password sync = yes # sending the correct chat script for the passwd program in Debian Sarge). passwd program = /usr/bin/passwd %u passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* . pam password change = yes # to anonymous connections map to guest = bad user usershare allow guests = yes #idmap uid = 16777216-33554431 #这里的两行之所以注释掉, 是因为我这已经有 LDAP来认证SSH了, 如果不注释, 可能 UID会变化... #idmap gid = 16777216-33554431 template shell = /sbin/nologin template homedir = /home/%U winbind use default domain = true winbind offline logon = true winbind enum groups = yes winbind enum users = yes winbind separator = / #ln support follow symlinks = yes wide links = yes unix extensions = no [homes] comment = Home Directories path = /local_home/%U valid users = hwa.net/%U read only = no writable = yes browseable = No
把/etc/resolve.conf 添加AD的DNS
设置/etc/hosts
启动 smb、 winbind
然后加域
net ads join -U test@HWA.NET -S AD.HWA.NET
WIN7访问Samba一直密码不正确
Samba出现如下日志:
read_data: read failure for 4 bytes to client ...
在WIN7 本地安全策略-->本地策略-->安全选项-->
#网络安全:LAN 管理器身份验证级别 #选择 发送 LM 和 NTLM - 如果已协商, 则使用 NTLMv2 会话安全
#实际测试可以不用启动 winbind ####
转载于:https://blog.51cto.com/abian/1401304