windows AD域用户访问centos7 下samba共享文件夹

在这里插入代码片一、samba服务器加入AD域。
1，修改主机名和修改selinux：
vi /etc/hostname
centos #主机名
vi /etc/sysconfig/selinux
修改为SELINUX=disabled
保存退出然后执行 setenforce 0
2，添加以下文件到hosts文件
vi /etc/hosts
192.168.150.2 centos.com #域账号和域ip
3，修改dns
vi /etc/resolv.conf
search centos.com #域名
nameserver 192.168.150.2 #域ip
4.安装所需软件
yum -y install samba samba-client samba-common samba-winbind samba-winbind-clients
5.编辑krb5.conf
vi /etc/krb5.conf
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
default_realm = CENTSO.COM
[realms]
CENTOS.COM = {
kdc = 192.168.150.2 #域地址
admin_server = 192.168.150.2
}
[domain_realm]
.centos.com = CENTOS.COM #域名
centos.com =CENTOS.COM
6.编辑nsswitch.conf
vi /etc/nsswitch.conf
passwd: files winbind
shadow: files winbind
group: files winbind
7.编辑smb.conf
vi /etc/samba/smb.conf
[global]
workgroup = CENTOS
security = ads
password server = 192.168.150.2
realm = CENTOS.COM
server string = Samba Server Version %v
hosts allow = 192.168.
log file = /var/log/samba/log.%m
max log size = 50
passdb backend = tdbsam
idmap config * : range = 16777216-33554431
idmap config * : backend = tdb
template shell = /sbin/nologin
template homedir = /home/%U
winbind use default domain = Yes
winbind offline logon = Yes
winbind separator = /
winbind enum users = Yes
winbind enum groups = Yes
printing = cups
printcap name = cups
load printers = yes
cups options = raw
ntlm auth = yes //使xp和win2003的客户机可以访问
[homes]
comment = Home Directories
valid users = CENTOS.COM/%U
browseable = No
read only = No
path = /home/%U
root preexec = /root/mkhome.sh %U %G
[share]
comment = share
path = /share_dir
browseable = yes
writable = yes
valid users = @“orc” #域orc组
[nas]

[printers]
comment = All Printers
path = /var/tmp
printable = Yes
create mask = 0600
browseable = No

8.编辑创建与用户脚本
yum -y install quota
vi /root/mkhome.sh
#!/bin/bash
DATE=‘date+%s’
touch /tmp/$DATE
user=$1
group=$2
home=/home/$1

if [ ! -d $home ];then
mkdir -p $home
chown $user $home
chgrp $group $home
chmod 700 $home
edquota -p administrator -u $user
fi

chmod 700 /root/mkhome.sh #给mkhome.sh加权限
9、 加入域
rpm -q krb5-workstation #查看是否安装了krb-workstation 没安装就安装下

加入域:net ads join -U [email protected]
显示如下：Using short domain name – NCCSI
Joined ‘MFILE’ to dns domain ‘centos.com’
No DNS domain configured for mfile. Unable to perform DNS Update.
DNS update failed: NT_STATUS_INVALID_PARAMETER
dns报错先不用管加入了域就行
10.启动服务，验证是否加入成功
systemctl start smb.service
systemctl start nmb.service
systemctl start winbind.service
wbinfo -t
checking the trust secret for domain NIMEI via RPC calls succeeded
查看AD用户信息
wbinfo -u
查看AD用户信息
wbinfo -g
显示本地和域可登录用户
getent passwd
二，建立共享文件夹NAS(samba不适合建立多级共享目录)
mkdir /nas
chmod -R 775 /nas
chown -R root:“domain users” /nas #添加domain users使域用户可以访问
vi /etc/samba/smb.conf
[nas]
path = /home/nas
browseable = yes
valid users = 设置读权限的用户
write list = 设置写权限的用户
public = no
create mask = 0777 //设置创建文件权限
directory mask = 0777 //设置创建的文件夹权限
systemctl restart smb.service
systemctl restart nmb.service
systemctl restart winbind.service

然后用添加了域的用户电脑就可以访问啦 ：\加ip
记得关闭防火墙

mkdir /media/cdrom
mount /dev/sr0 /media/cdrom
rpm -ivh /media/cdrom/Packages/wget*
cd /etc/yum.r*
mkdir a
mv C* a
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
yum makecache
systemctl stop firewalld.service    
systemctl status firewalld.service
systemctl disable firewalld.service

sed -i '1 s/localhost.localdomain/fuwuqi/' /etc/hostname 
hostname fuwuqi
sed -i '7 s/enforcing/disabled/' /etc/sysconfig/selinux
setenforce 0
sed -i '1 s/localhost localhost.localdomain localhost4 localhost4.localdomain4/fuwuqi/' /etc/hosts
sed -i '2 s/::1         localhost localhost.localdomain localhost6 localhost6.localdomain6/192.168.150.2  nc.csi.corp/' /etc/hosts
yum -y install samba samba-client samba-common  samba-winbind samba-winbind-clients

sed -i '15 s/#//'  /etc/krb5.conf
sed -i '15 s/EXAMPLE.COM/NC.CSI.CORP/'  /etc/krb5.conf
sed -i '19 s/# EXAMPLE.COM/ NC.CSI.CORP/'  /etc/krb5.conf

sed -i '20 s/#  kdc = kerberos.example.com/kdc = 192.168.150.2/'  /etc/krb5.conf
sed -i '21 s/#  admin_server = kerberos.example.com/admin_server = 192.168.150.2/'  /etc/krb5.conf
sed -i '22 s/#//' /etc/krb5.conf
sed -i '25 s/# .example.com = EXAMPLE.COM/.nc.csi.corp = NC.CSI.CORP/'  /etc/krb5.conf
sed -i '26 s/# example.com = EXAMPLE.COM/nc.csi.corp = NC.CSI.CORP/'  /etc/krb5.conf


sed -i '33 s/sss/winbind/' /etc/nsswitch.conf
sed -i '34 s/sss/winbind/' /etc/nsswitch.conf
sed -i '35 s/sss/winbind/' /etc/nsswitch.conf



sed -i '1,$d' /etc/samba/smb.conf

cat>/etc/samba/smb.conf<# See smb.conf.example for a more detailed config file or
# read the smb.conf manpage.
# Run 'testparm' to verify the config is correct after
# you modified it.

[global]
        workgroup = NCCSI
        security = ads
        password server = 192.168.150.2
        realm = NC.CSI.CORP
        server string = Samba Server Version %v
        hosts allow = 192.168.
        log file = /var/log/samba/log.%m
        max log size = 50
        passdb backend = tdbsam
        idmap config * : range = 16777216-33554431           
        idmap config * : backend = tdb           
        template shell = /sbin/nologin           
        template homedir = /home/%U           
        winbind use default domain = Yes           
        winbind offline logon = Yes            
        winbind separator = /         
        winbind enum users = Yes         
        winbind enum groups = Yes
        printing = cups
        printcap name = cups
        load printers = yes
        cups options = raw
        ntlm auth = yes  
[homes]
        comment = Home Directories
        valid users = NC.CSI.CORP
        browseable = No
        read only = No
        path = /home/%U
        root preexec = /root/mkhome.sh %U %G
[share]
        comment = share
        path = /share_dir
        browseable = yes
        writable = yes
        valid users = @"orc"   #域orc组
[printers]
        comment = All Printers
        path = /var/tmp
        printable = Yes
        create mask = 0600
        browseable = No
EOF


touch /root/mkhome.sh
cat>/root/mkhome.sh<#!/bin/bash               
DATE='date+%s'
touch /tmp/$DATE
user=$1               
group=$2               
home=/home/$1               
 
if [ ! -d $home ];then               
mkdir -p $home               
chown $user $home               
chgrp $group $home               
chmod 700 $home               
edquota -p administrator -u $user               
fi
EFO
chmod 700 /root/mkhome.sh
/root/mkhome.sh
yum -y install krb5-workstation

net ads join -U administrator@nc.csi.corp<!veCisc0
EOF
systemctl restart smb nmb winbind

mkdir /home/nas
chmod -R 777 /home/nas
chown -R root:"domain users" /home/nas
sed -i '$a [nas] \n    path = /home/nas \n    browseable = yes \n    valid users = n31026 \n    write list = n31026 \n    avaliable = no \n    public = no		create mask = 0777	\n	directory mask = 0777' /etc/samba/smb.conf
systemctl restart smb nmb winbind
systemctl enable smb nmb winbind
\n