Linux加入到Windows域 收藏

一、实验环境:
AD server windows server 2003
samba redhat as5
AD server hostname IP 地址:
turbomai-c 89f 91.test.com  192.168.0.122/24
AD samba hostname IP 地址:
zhouhw       192.168.0.121/24
Domain name turbomai-c 89f 91.test.com
DNS 192.168.151.122
安装 NTP 时间验证套件:
# mount /dev/cdrom /media
# rpm -ivh /cdrom/CentOS/RPMS/ntp-4.2.2p1-7.el5.i386.rpm
当然也可以用 yum 来安装
#yum -y install ntp (注意 ntp 要小写)
再来与 AD server 校准时间
# ntpdate 192.168.0.122
# hwclock -w
安装 Samba 服务器软件需求:
krb5-workstation- 1.2.7 -19
pam_krb5-1.70-1
krb5-devel- 1.2.7 -19
krb5-libs- 1.2.7 -19
samba- 3.0.5 -2
安装完后,如果你要确认 samba 安装成功没有可以用下述命令来检查 samba 包的基础库支持
# smbd -b | grep LDAP
HAVE_LDAP_H
HAVE_LDAP
HAVE_LDAP_DOMAIN2HOSTLIST
...
# smbd -b | grep KRB
HAVE_KRB5_H
HAVE_ADDRTYPE_IN_KRB5_ADDRESS
HAVE_KRB5
...
# smbd -b | grep ADS
WITH_ADS
WITH_ADS
# smbd -b | grep WINBIND
WITH_WINBIND
WITH_WINBIND
二、编辑设定档
1 krb5 配置
#vi /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
 
[libdefaults]
default_realm = TEST.COM # 大写域名
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
forwardable = yes
[realms]
TEST.COM = { # 大写域名
kdc = 192.168.0.122:88 # 域伺服器 IP
admin_server = 192.168.0.122:749 # 域伺服器 IP
default_domain = test.com # 这里就不用大写了
}
[domain_realm]
.ttest.com = TEST.COM # 域验证范围
test.com =TEST.COM
[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf
[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
连接 AD server
Kerberos kinit 命令将测试服务器间的通信,后面的域名 TT.COM 是你的活动目录的域名,必须大写,否则会收到错误信息:
kinit(v5): Cannot find KDC for requested realm while getting initial credentials.
如果通信正常,你会提示输入口令,口令正确的话,就返回 bash 提示符,如果错误则报告:
kinit(v5): Preauthentication failed while getting initial credentials.
�@一步代表了已经可以和 AD server 做沟通了,但并不代表 Samba Server 已经加入域了。
2 smb.conf 配置
#vi /etc/samba/smb.conf
[global]
        workgroup = TEST # 一定要填自己的 domain 名�Q
        netbios name = zhouhw # 你的 linux 主机名
        idmap uid    = 15000-20000
        idmap gid    = 15000-20000
        winbind enum groups = yes
        winbind enum users  = yes
        winbind separator   = /
;       winbind use default domain = yes
        template homedir = /home/%D/%U
        template shell   = /bin/bash
 
        security = domain
 
        encrypt passwords = yes
        password server = 192.168.0.122
[homes]
   path = /home/%D/%U
   browseable = no
   writable = yes
   valid users = TESTcom/%U
   create mode = 0777
   directory mode = 0777
3 、配置 nsswitch.conf
#vi /etc/nsswitch.conf
修改以下位置
passwd:     files winbind
shadow:     files winbind
group:      files winbind
4 、启用 samba winbind 服务
service smb start
service winbind start
5 、加入 AD
[root@zhouhw ~]# net rpc join -S turbomai-c 89f 91.test.com -U administrator
Password:
Joined domain TEST.
6 、验证加入是否成功
[root@zhouhw ~]# net rpc testjoin
Join to 'TEST' is OK
7 、做完这些,就可以到 AD server 上的活动目录中看到该机器了
本文出自 51CTO.COM技术博客

你可能感兴趣的:(linux,职场,休闲)