Linux系统加入AD域
1、需要的软件包
[root@filesrv CentOS]# rpm -qa|grep krb5
krb5-auth-dialog-0.7-1
krb5-libs-1.6.1-25.el5
krb5-devel-1.6.1-25.el5
pam_krb5-2.2.14-1
krb5-workstation-1.6.1-25.el5
[root@filesrv CentOS]# rpm -qa|grepsamba （samba系统）
samba-swat-3.0.28-0.el5.8
samba-common-3.0.28-0.el5.8
samba-client-3.0.28-0.el5.8
samba-3.0.28-0.el5.8
2、装samba服务器
设置开机启动chkconfig--level 35 smb on
3、修改/etc/hosts文件.
把本机的IP和计算机名写入进去
127.0.0.1 db localhost localhost.localdomainlocalhost4 localhost4.localdomain4
::1 localhost localhost.localdomainlocalhost6 localhost6.localdomain6
172.16.15.247 db
4、修改/etc/resolv.conf文件
# Generated by NetworkManager
search yx.com （你的域控制器名）
nameserver 172.16.14.88 （DNS域控制器IP）
5、修改/etc/krb5.conf文件
[logging]
default =FILE:/var/log/krb5libs.log
kdc =FILE:/var/log/krb5kdc.log
admin_server =FILE:/var/log/kadmind.log
[libdefaults]
default_realm =YX.COM
dns_lookup_realm = false
dns_lookup_kdc= false
ticket_lifetime= 24h
renew_lifetime= 7d
forwardable =true
[realms]
EXAMPLE.COM = {
kdc =kerberos.example.com
admin_server =kerberos.example.com
}
YX.COM = {
kdc = 172.16.14.88
admin_server = 172.16.14.88
}
[domain_realm]
.example.com =EXAMPLE.COM
example.com =EXAMPLE.COM
yx.com = YX.COM
.yx.com = YX.COM
6、修改smb.conf文件
#=======================GlobalSettings===================================
[global]
#--authconfig--start-line--
# Generated byauthconfig on 2015/09/23 16:56:56
# DO NOT EDIT THISSECTION (delimited by --start-line--/--end-line--)
# Any modificationmay be deleted or altered by authconfig in future
workgroup = YX
password server= 172.16.14.88
realm = YX.COM
security = ads
idmap config * :range = 16777216-33554431
template shell =/sbin/nologin
winbind usedefault domain = true
winbind offlinelogon = true
template homedir= /home/%U
winbindseparator = /
winbind enumusers = Yes
winbind enumgroups = Yes
#--authconfig--end-line--
server string = server-xg
log file = /var/log/samba/%m.log
server role = standalone server
nt acl support = no
dns proxy = no
7、修改/etc/nsswitch.conf文件
passwd: files winbind
shadow: files winbind
group: files winbind
8、检查Linux系统时间和AD域的时间，时间差不能超过5分钟
[root@db ~]# date
2015年 09月 24日星期四 16:19:01 CST
9、Kerberos 测试
[root@db ~]# kinit administrator@YX.COM
Password for administrator@YX.COM:
[root@db ~]#
如果没有任何提示，那就是好消息。
（然后最好重新启动机器，把所以服务重新启动一遍）
10、手动把Linux加入到AD域里面去
[root@db ~]# net ads join -U administrator@YX.COM
administrator@RAINBIRD.NET'spassword:
The workgroup in/etc/samba/smb.conf does not match the short
domain name obtainedfrom the server.
Using short domainname -- YX
Joined 'db' to realm 'YX.COM'
一般只要出现了这句joined to就是加入进域里面去了。
11、验证加入的AD是否成功
可以使用
Wbinfo -t
wbinfo -u 查看AD域的用户
wbinfo -g 查看AD域的组
自动创建个人用户目录
1、修改smb.conf文件
[homes]
comment = Home Directories
path=/home/%U
browseable = no
writable = no
root preexec = /root/mkhome.sh %U %G
valid users=yx/%U
write list =yx/%U
Mkhome.sh的脚本内容如下：
#!/bin/bash
user=$1
group=$2
home=/home/$user
if [ ! -d"$home" ]; then
mkdir -p $home
chown $user $home-R
chmod 700 $home
edquota -p xemb -u$user
fi
2、验证个人目录。
使用账号登陆终端，进入文件服务器，如果能够看到个人目录，并能在home目录下生成个人目录，说明个人目录创建成功了。
root@ftp01 samba]#wbinfo -t
checking the trust secret via RPC callsfailed
error code was NT_STATUS_INVALID_HANDLE(0xc000000
Could not check secre
解决了，原来是linux的主机名和加入的域名是相同造成的，netbios是唯一性的
