Linux加入windows域
Linux加入windows域
1.安装必要条件
------------------------------
1.安装必要软件
yum -y install pam_krb5* krb5-libs* krb5-workstation* krb5-devel* krb5-auth* samba samba-winbind* samba-client* samba-swat*
2.修改/etc/samba/smb.conf
-------------------------------
cat > /etc/samba/smb.conf <<EOF
[global]
workgroup = LOCAL
password server = DC.LOCAL.COM
realm = LOCAL.COM
security = ads
idmap uid = 10000-20000
idmap gid = 10000-20000
template shell = /bin/bash
winbind use default domain = true
winbind offline logon = true
template homedir = /home/%U
winbind separator = /
winbind enum users = Yes
winbind enum groups = Yes
EOF
3.修改/etc/krb5.conf
------------------------------
cat > /etc/krb5.conf <<EOF
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = LOCAL.COM
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
[realms]
LOCAL.COM = {
kdc = DC.LOCAL.COM
admin_server = DC.LOCAL.COM
default_domain = LOCAL.COM
}
[domain_realm]
.local.com = LOCAL.COM
local.com = LOCAL.COM
EOF
4.修改/etc/nsswitch.conf
------------------------------------
vim /etc/nsswitch.conf
passwd: files winbind
shadow: files winbind
group: files winbind
......
5.设置开机自动启动
---------------------------------------
chkconfig smb on
chkconfig winbind on
chkconfig --list | grep 3:on
/etc/init.d/smb restart
/etc/init.d/winbind restart
6.通过SETUP配置认证方式，通过修改文本需要配置的地方太多，不建议
---------------------------------------------------------------------------
1.使用setup配置工具，并选择“验证配置”，选择下面三项：按F12直接下一步
“use winbind” ##对应中文“使用winbind”
“use kerberos” ##对应中文“使用kerberos”
“use winbind authertication” ##对应中文“使用winbind验证”
2.然后点击【下一步】，按如下填写：
域：test.com
KDC：dc-01.test.com
管理服务器：dc-01.test.com
##并勾选下面两个选项。
3.再次点击【下一步】，按如下选择或填写：
安全模型：ADS
域：TEST ##注意大写
域控制器：dc-01.test.com
ADS域：test.com
模板Shell: /bin/bash
6.加入域，需要重启才能生效
------------------------------
net ads join -U [email protected]
reboot
7.检查加域信息
---------------------------------
[root@filesrv samba]# wbinfo -t
checking the trust secret via RPC calls succeeded
#说明主机信任已成功建立
[root@filesrv samba]# wbinfo -u
#使用wbinfo �Cu 可以列出AD中注册的帐号信息
[root@filesrv samba]# wbinfo -g
#wbinfo �Cg可以返回AD中的组信息
wbinfo -m
#查看内置组，默认组
8.修改visudo将域用户加入sudo
-------------------------------------
echo " %yyy ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
visudo -c
##注意yyy是windows的安全组，不是OU
9.解决域用户登录后没有家目录的问题
---------------------------------------------------
echo "session required pam_mkhomedir.so skel=/etc/skel umask=0077" >> /etc/pam.d/system-auth
echo "session required pam_mkhomedir.so skel=/etc/skel umask=0077" >> /etc/pam.d/sshd
10.关于Linux虚拟机的复制
--------------------------------
1.rm -rf /etc/udev/rules.d/70-persistent-net.rules
2.修改主机名和IP地址
3.修改web服务器的主机头别名alias
4.重新运行net ads join -U [email protected]