tag:blogger.com,1999:blog-15154059615969355112024-11-01T03:35:11.972-07:00mofanhttp://www.blogger.com/profile/11633837173886886730noreply@blogger.comBlogger15125tag:blogger.com,1999:blog-1515405961596935511.post-88509739850698042472010-12-20T16:27:00.000-08:002010-12-20T16:31:11.446-08:00<p><strong>RedHat Linux</strong> command to reload or restart network (login as root user):</p> <p><code># service network restart</code><br />OR<br /><code># /etc/init.d/network restart</code></p> <p>To start Linux network service:<br /><code><b># service network start</b></code></p> <p>To stop Linux network service:<br /><code><b># service network stop</b></code></p> <p><strong>Debian Linux</strong> command to reload or restart network:<br /><code><b> # /etc/init.d/networking restart</b></code></p> <p>To start Linux network service:<br /><code><b> # /etc/init.d/networking start</b></code></p> <p>To stop Linux network service:<br /><code><b> # /etc/init.d/networking stop</b></code></p> <p><strong>Ubuntu Linux </strong>user use sudo command with above Debian Linux command:<br /><code><b> # sudo /etc/init.d/networking restart</b></code></p> <p>To start Linux network service:<br /><code><b> # sudo /etc/init.d/networking start</b></code></p> <p>To stop Linux network service:<br /><code><b> # sudo /etc/init.d/networking stop</b></code></p>mofanhttp://www.blogger.com/profile/11633837173886886730noreply@blogger.com0tag:blogger.com,1999:blog-1515405961596935511.post-4182451734969327502010-12-20T16:23:00.000-08:002010-12-20T16:26:17.994-08:00How to change or convert DHCP network configuration to static configuration. After initial installation, he wanted to change network settings. Further, his system is w/o GUI system aka X Windows. Here is quick way to accomplish the same:<br /><br />Your main network configuration file is /etc/network/interfaces<br /><br />Desired new sample settings:<br />=> Host IP address 192.168.1.100<br />=> Netmask: 255.255.255.0<br />=> Network ID: 192.168.1.0<br />=> Broadcast IP: 192.168.1.255<br />=> Gateway/Router IP: 192.168.1.254<br />=> DNS Server: 192.168.1.254<br /><br />Open network configuration file<br />$ sudo vi /etc/network/interfacesOR$ sudo nano /etc/network/interfaces<br /><br />Find and remove dhcp entry:<br />iface eth0 inet dhcp<br /><br />Append new network settings:<br /><br />iface eth0 inet static<br />address 192.168.1.100<br />netmask 255.255.255.0<br />network 192.168.1.0<br />broadcast 192.168.1.255<br />gateway 192.168.1.254<br /><br />Save and close the file. Restart the network:<br />$ sudo /etc/init.d/networking restart<br />Task: Define new DNS servers<br /><br />Open /etc/resolv.conf file<br />$ sudo vi /etc/resolv.conf<br /><br />You need to remove old DNS server assigned by DHCP server:<br />search myisp.com<br />nameserver 192.168.1.254<br />nameserver 202.54.1.20<br />nameserver 202.54.1.30<br /><br />Save and close the file.<br />Task: Test DNS server<br /><br />$ host cyberciti.biz<br />Network command line cheat sheet<br /><br />You can also use commands to change settings. Please note that these settings are temporary and not the permanent. Use above method to make network changes permanent or GUI tool as described below.<br />Task: Display network interface information<br /><br />$ ifconfig<br />Task: Take down network interface eth0 / take a network interface down<br /><br />$ sudo ifconfig eth0 downOR $ sudo ifdown eth0<br />Task: Bring a network interface eth0 up<br /><br />$ sudo ifconfig eth0 upOR$ sudo ifup eth0<br />Task: Change IP address and netmask from command line<br /><br />Activate network interface eth0 with a new IP (192.168.1.50) / netmask:<br />$ sudo ifconfig eth0 192.168.1.50 netmask 255.255.255.0 up<br />Task: Display the routing table<br /><br />$ /sbin/route OR$ /sbin/route -n<br />Output:<br /><br />Kernel IP routing table<br />Destination Gateway Genmask Flags Metric Ref Use Iface<br />localnet * 255.255.255.0 U 0 0 0 ra0<br />172.16.114.0 * 255.255.255.0 U 0 0 0 eth0<br />172.16.236.0 * 255.255.255.0 U 0 0 0 eth1<br />default 192.168.1.254 0.0.0.0 UG 0 0 0 ra0<br /><br />Task: Add a new gateway<br /><br />$ sudo route add default gw 172.16.236.0<br />Task: Display current active Internet connections (servers and established connection)<br /><br />$ netstat -nat<br />Task: Display open ports<br /><br />$ sudo netstat -tulpOR$ sudo netstat -tulpn<br />Task: Display network interfaces stats (RX/TX etc)<br /><br />$ netstat -i<br />Task: Display output for active/established connections only<br /><br />$ netstat -e<br />$ netstat -te<br />$ netstat -tue<br /><br />Where,<br /><br /> * -t : TCP connections<br /> * -u : UDP connections<br /> * -e : Established<br /><br />Task: Test network connectivity<br /><br />Send ICMP ECHO_REQUEST to network hosts, routers, servers etc with ping command. This verifies connectivity exists between local host and remote network system:<br />$ ping router<br />$ ping 192.168.1.254<br />$ ping cyberciti.biz<br /><br />See simple Linux system monitoring with ping command and scripts for more information.<br />Task: Use GUI (Graphical Configuration) network Tool<br /><br />If you are new, use GUI configuration tool, type the following command at terminal:<br />$ network-admin &amp;<br /><br />Above command is Ubuntu's GUI for configuring network connections tool.<br />Final tip - Learn how find out more information about commands<br /><br />A man page is your best friend when you wanted to learn more about particular command or syntax. For example, read detailed information about ifconfig and netstat command:<br />$ man ifconfig<br />$ man netstat<br /><br />Just get a short help with all command options by appending --help option to each command:<br />$ netstat --help<br /><br />Find out what command is used for particular task by searching the short descriptions and manual page names for the keyword:<br />$ man -k 'delete directory'<br />$ apropos -s 1 remove<br /><br />Display short descriptions of a command:<br />$ whatis rm<br />$ whatis netstat<br /><br />Linux offers an excellent collection of utilities, which can be use to finding the files and executables, remember you cannot memorize all the commands and files ;)mofanhttp://www.blogger.com/profile/11633837173886886730noreply@blogger.com0tag:blogger.com,1999:blog-1515405961596935511.post-41460084746318343222010-06-06T17:13:00.000-07:002010-06-06T17:16:26.655-07:00Super-fast and great-looking, Ubuntu is a secure, intuitive operating system that powers desktops, servers, netbooks and laptops. Ubuntu is, and always will be, absolutely free.<br /><br /> "Get Ubuntu Desktop Edition Download"<br />You can download Ubuntu Desktop Edition online, completely free.<br /><br />Download link : <br /><br />http://www.ubuntu.com/desktop/get-ubuntu/downloadmofanhttp://www.blogger.com/profile/11633837173886886730noreply@blogger.com0tag:blogger.com,1999:blog-1515405961596935511.post-28551338145220908662010-04-01T00:41:00.000-07:002010-04-01T00:44:40.713-07:00Network Setting -- Join Centos Domain 5.2<br /><br />EDIT the DNS Network Configuration<br />-goto -sytem -administration - network<br /><br />point the DNS Manually<br /><br />Hostname : localhost.localdomain<br /><br />Primary DNS : 192.168.1.... - IP of your Domain Controller<br /><br />DNS Search hpo.hd ----- Domain DNS<br /><br /><br />continue-----------------------------------<br /><br />-goto -sytem -administration - Authentication Configuration<br /><br />check - enable winbind support<br /><br /> Windbind domain : HPO<br /> security model : ads<br /> winbind ADS Realm : HPO.HD<br /> Winbind Domain Controllers : mars.hpo.hd<br /> Template : /bin/bash<br /><br />--Options :<br />Check shadow passwords<br />check local authorization is sufficient for local users<br />check home directories on the first login<br /><br /><br />Then -- go to File system - etc - samba<br /><br />Edit the smb.conf<br /><br />[global]<br />#--authconfig--start-line--<br /><br /># Generated by authconfig on 2010/04/01 13:14:56<br /># DO NOT EDIT THIS SECTION (delimited by --start-line--/--end-line--)<br /># Any modification may be deleted or altered by authconfig in future<br /><br /> workgroup = HPD<br /> password server = earth.HPO.HD<br /> realm = HPO.HD<br /> security = ads<br /> idmap uid = 16777216-33554431<br /> idmap gid = 16777216-33554431<br /> template shell = /bin/bash<br /> winbind use default domain = true ----- this should be add<br /> winbind offline logon = falsemofanhttp://www.blogger.com/profile/11633837173886886730noreply@blogger.com1tag:blogger.com,1999:blog-1515405961596935511.post-67403266769875132862010-02-09T18:28:00.000-08:002010-02-09T19:31:53.652-08:00One of the things that I wanted to do since the installation of CentOS is to upgrade the currrently default version of OpenOffice.org, which is 2.3, to the latest available version being <a href="http://www.openoffice.org/dev_docs/features/3.1/index.html">OpenOffice.org 3.1</a>. I have done these upgrades before on Dreamlinux and (X)Ubuntu but this would be the first time on an “rpm based” distribution.<br /><br /><br />-- (remove old file openoffice)<br />-- yum remove openoffice.org-*<br />--cd (riht click the extracted file copy with root directory)<br />-- sudo rpm -i *.rpm<br />--cd desktop-integration<br />--ls<br />--yum install (right click not yet extracted file .tar)<br />--sudo rpm -i (redhat-centos)<br />cd ../ root<br />--sudo rpm -i *.rpm<br />--restart<br />--finish<br /><br /><br />Link to Resa's Blogs..<br /><br />http://resa.linux-hardcore.com/?p=154mofanhttp://www.blogger.com/profile/11633837173886886730noreply@blogger.com0tag:blogger.com,1999:blog-1515405961596935511.post-26358411549433705772010-02-03T18:58:00.000-08:002010-02-03T19:03:43.322-08:00<p>This is a second version of <a href="http://anothersysadmin.wordpress.com/2007/08/03/active-directoy-authentication-with-ubuntu/">this other guide</a> that applied to previous Ubuntu versions.<br />Since Ubuntu 8.04 (Hardy Heron), and now Ubuntu 8.10 (Intrepid Ibex) it come the <a href="http://www.likewisesoftware.com/products/likewise_open/">Likewise Open</a> package that makes basic Active Directory authentication in Ubuntu a breeze.</p> <p>Just follow these steps:</p> <ol><li><code>sudo apt-get update</code></li><li><code>sudo apt-get install likewise-open</code></li><li><code>sudo domainjoin-cli join fqdn.of.your.domain Administrator</code></li><li><code>sudo update-rc.d likewise-open defaults</code></li><li><code>sudo /etc/init.d/likewise-open start</code></li></ol> <p>and you can now log into your machine using your DOMAIN\user credentials. Remember that the DOMAIN\ part is mandatory and that it represents the short name of your Active Directory domain. You can join the domain using any user with sufficient privileges (there’s no need to use Administrator), and you can even directly join the PC in a particular OU passing the –ou argument to domainjoin-cli. The fourth point maybe won’t be necessary when Ubuntu 8.04 LTS wil be released because it seems to be a bug in the package (it won’t start likewise on reboot, so if you don’t issue this command it would seem that nothing is working after a reboot).</p> <p>I’ve just started to use this method on a test machine so I’ll leave more opinions on this product in the future.</p> <p><em>EDIT:<strong> First impressions</strong></em></p> <p>After some days of not so extensive usage, I’ve seen a couple of things that it’s worth notice:</p> <ul><li>the likewise-open process seems to “die” from time to time, blocking all your login accesses with a “ERROR” message. Restarting it through init script solves the issue… but it’s something that definitely should not happen</li><li>It informs you on login if your password is going to expire in X days (as set in your GPO). Very nice indeed.</li></ul> <p>Notes to the readers: if you’re experiencing installation problem, the best way is to report them to the <a title="Likewise open discuss mailing list" href="http://lists.likewisesoftware.com/cgi-bin/mailman/listinfo/likewise-open-discuss" target="_blank">likewise-open-discuss mailing list</a>. There you can contact directly likewise developers (of Samba fame) and solve your problems or doubts.</p> <p><em>EDIT2</em>: it seems that with the final Ubuntu 8.04 update, likewise-open package is now 100% stable, I didn’t have a single failure since last update (one week up, while before it died at least once per day)</p> <p><em>EDIT3</em>: as mentioned in the comment, with likewise-open 4.x you can add<br /><code><br />winbind use default domain = yes<br /></code><br />in <code>/etc/samba/lwiauthd.conf</code> so you d’nt have to specify the DOMAIN\ part every time you log in your box.</p>mofanhttp://www.blogger.com/profile/11633837173886886730noreply@blogger.com0tag:blogger.com,1999:blog-1515405961596935511.post-71091521418970906592010-02-03T17:06:00.000-08:002010-02-03T17:13:53.479-08:00<h3 class="title">Accessing a Samba Share</h3> <p> Another, use for Samba is to integrate into an existing Windows network. Once part of an Active Directory domain, Samba can provide file and print services to AD users. </p> <p> The simplest way to join an AD domain is to use <span class="application"><strong>Likewise-open</strong></span>. For detailed instructions see <a class="xref" href="https://help.ubuntu.com/9.10/serverguide/C/likewise-open.html" title="Likewise Open">the section called “Likewise Open”</a>. </p> <p> Once part of the domain, install the following packages: </p> <pre class="screen"><span class="command"><strong>sudo apt-get install samba smbfs smbclient</strong></span><br /></pre> <p> Since the <span style="color: rgb(0, 0, 0);" class="application"><strong>likewise-open</strong></span><span style="color: rgb(0, 0, 0);"> and </span><span style="color: rgb(0, 0, 0);" class="application"><strong>samba</strong></span><span style="color: rgb(0, 0, 0);"> packages use separate </span><code style="color: rgb(0, 0, 0);" class="filename">secrets.tdb</code><span style="color: rgb(0, 0, 0);"> files, a symlink will need to be created in </span><code style="color: rgb(0, 0, 0);" class="filename">/var/lib/samba</code><span style="color: rgb(0, 0, 0);">: </span></p> <pre class="screen"><span class="command"><strong>sudo mv /var/lib/samba/secrets.tdb /var/lib/samba/secrets.tdb.orig</strong></span><br /><span class="command"><strong>sudo ln -s /etc/samba/secrets.tdb /var/lib/samba</strong></span><br /></pre> <p style="color: rgb(0, 0, 0);"> Next, edit <code class="filename">/etc/samba/smb.conf</code> changing: </p> <pre class="programlisting"><span style="color: rgb(0, 0, 0);"> workgroup = EXAMPLE</span><br /><span style="color: rgb(0, 0, 0);"> ...</span><br /><span style="color: rgb(0, 0, 0);"> security = ads</span><br /><span style="color: rgb(0, 0, 0);"> realm = EXAMPLE.COM</span><br /><span style="color: rgb(0, 0, 0);"> ...</span><br /><span style="color: rgb(0, 0, 0);"> idmap backend = lwopen</span><br /><span style="color: rgb(0, 0, 0);"> idmap uid = 50-9999999999</span><br /><span style="color: rgb(0, 0, 0);"> idmap gid = 50-9999999999</span><br /></pre> <p> Restart <span class="application"><strong>samba</strong></span> for the new settings to take effect: </p> <pre class="screen"><span class="command"><strong>sudo /etc/init.d/samba restart</strong></span><br /></pre> <p> You should now be able to access any <span class="application"><strong>Samba</strong></span> shares from a Windows client. However, be sure to give the appropriate AD users or groups access to the share directory. See <a class="xref" href="https://help.ubuntu.com/9.10/serverguide/C/samba-fileprint-security.html" title="Securing a Samba File and Print Server">the section called “Securing a Samba File and Print Server”</a> for more details. </p> <div class="sect2" title="Accessing a Windows Share"> <div class="titlepage"> <div> <div> <h3 class="title">Accessing a Windows Share</h3> </div> </div> </div> <p> Now that the Samba server is part of the Active Directory domain you can access any Windows server shares: </p> <div class="itemizedlist"> <ul class="itemizedlist" type="disc"><li class="listitem"> <p> To mount a Windows file share enter the following in a terminal prompt: </p> <pre class="screen"><span class="command"><strong>mount.cifs //fs01.example.com/share mount_point</strong></span><br /></pre> <p> It is also possible to access shares on computers not part of an AD domain, but a username and password will need to be provided. </p> </li><li style="color: rgb(0, 0, 0);" class="listitem"> <p> To mount the share during boot place an entry in <code class="filename">/etc/fstab</code>, for example: </p> <pre class="programlisting">//192.168.0.5/share /mnt/windows cifs auto,username=steve,password=secret,rw 0 0<br /></pre> </li><li style="color: rgb(0, 0, 0);" class="listitem"> <p> Another way to copy files from a Windows server is to use the <span class="application"><strong>smbclient</strong></span> utility. To list the files in a Windows share: </p> <pre class="screen"><span class="command"><strong>smbclient //fs01.example.com/share -k -c "ls"</strong></span><br /></pre> </li><li class="listitem"> <p> To copy a file from the share, enter: </p> <pre class="screen"><span class="command"><strong>smbclient //fs01.example.com/share -k -c "get file.txt"</strong></span><br /></pre> <p> This will copy the <code class="filename">file.txt</code> into the current directory. </p> </li><li class="listitem"> <p> And to copy a file to the share: </p> <pre style="color: rgb(0, 0, 0);" class="screen"><span class="command"><strong>smbclient //fs01.example.com/share -k -c "put /etc/hosts hosts"</strong></span><br /></pre> <p style="color: rgb(0, 0, 0);"> This will copy the <code class="filename">/etc/hosts</code> to <code class="filename">//fs01.example.com/share/hosts</code>. </p> </li><li class="listitem"> <p> The <span class="emphasis"><em>-c</em></span> option used above allows you to execute the <span class="application"><strong>smbclient</strong></span> command all at once. This is useful for scripting and minor file operations. To enter the <span class="emphasis"><em>smb: \></em></span> prompt, a FTP like prompt where you can execute normal file and directory commands, simply execute: </p> <pre class="screen"><span class="command"><strong>smbclient //fs01.example.com/share -k</strong></span><br /></pre> </li></ul> </div> <div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"> <table style="width: 628px; height: 4360px;" summary="Note" border="0"> <tbody><tr> <td rowspan="2" valign="top" width="25" align="center"> <img style="width: 26px; height: 26px;" alt="[Note]" src="https://help.ubuntu.com/9.10/libs/admon/note.png" /> </td> <th align="left"><br /></th> </tr> <tr> <td valign="top" align="left"> <p> Replace all instances of <span class="emphasis"><em>fs01.example.com/share</em></span>, <span class="emphasis"><em>//192.168.0.5/share</em></span>, <span class="emphasis"><em>username=steve,password=secret</em></span>, and <span class="emphasis"><em>file.txt</em></span> with your server's IP, hostname, share name, file name, and an actual username and password with rights to the share.<br /></p><p><span style="font-weight: bold;"><br /></span></p><p><span style="font-weight: bold;"><br /></span></p><p><span style="font-size:180%;"><span style="font-weight: bold; color: rgb(255, 0, 0);">Likewise Open - winbind based </span></span><br /></p><br /><p> <span class="application"><strong>Likewise Open</strong></span> simplifies the necessary configuration needed to authenticate a Linux machine to an Active Directory domain. Based on <span class="application"><strong>winbind</strong></span>, the <span class="application"><strong>likewise-open</strong></span> package takes the pain out of integrating Ubuntu authentication into an existing Windows network. </p> <div class="sect2" title="Installation"> <div class="titlepage"> <div> <div> <h3 class="title">Installation</h3> </div> </div> </div> <p> There are two ways to use Likewise Open, <span class="application"><strong>likewise-open</strong></span> the command line utility and <span class="application"><strong>likewise-open-gui</strong></span>. This section focuses on the command line utility. </p> <p> To install the <span class="application"><strong>likewise-open</strong></span> package, open a terminal prompt and enter: </p> <pre class="screen"><span class="command"><strong>sudo apt-get install likewise-open</strong></span><br /></pre> <p> With Ubuntu 9.04 <span class="application"><strong>Likewise Open 5.0</strong></span> is available in the <span class="emphasis"><em>Universe</em></span> repository. However, since upgrading from <span class="application"><strong>Likewise Open 4.1</strong></span> currently requires the system to leave the domain and re-join, a separate package for version five was created. </p> <p> To install <span class="application"><strong>Likewise Open 5.0</strong></span> enter: </p> <pre class="screen"><span class="command"><strong>sudo apt-get install likewise-open5</strong></span><br /></pre> <div class="warning" title="Warning" style="margin-left: 0.5in; margin-right: 0.5in;"> <table summary="Warning" border="0"> <tbody><tr> <td rowspan="2" valign="top" width="25" align="center"> <img style="width: 25px; height: 25px;" alt="[Warning]" src="https://help.ubuntu.com/9.10/libs/admon/warning.png" /> </td> <th align="left"><br /></th> </tr> <tr> <td valign="top" align="left"> <p> Installing likewise-open5 over an existing likewise-open (4.1) installation will replace it. You will have to rejoin the domain after install. </p> </td> </tr> </tbody></table> </div> </div> <div class="sect2" title="Joining a Domain"> <div class="titlepage"> <div> <div> <h3 class="title">Joining a Domain</h3> </div> </div> </div> <p> The main executable file of the <span class="application"><strong>likewise-open</strong></span> package is <code class="filename">/usr/bin/domainjoin-cli</code>, which is used to join your computer to the domain. Before you join a domain you will need to make sure you have: </p> <div class="itemizedlist"> <ul class="itemizedlist" type="disc"><li class="listitem"> <p> Access to an Active Directory user with appropriate rights to join the domain. </p> </li><li class="listitem"> <p> The <span class="emphasis"><em>Fully Qualified Domain Name</em></span> (FQDN) of the domain you want to join. If your AD domain does not match a valid domain such as <span class="italic">example.com</span>, it is likely that it has the form of <span class="emphasis"><em>domainname.local</em></span>. </p> </li><li class="listitem"> <p> DNS for the domain setup properly. In a production AD environment this should be the case. Proper Microsoft DNS is needed so that client workstations can determine the Active Directory domain is available. </p> <p> If you don't have a Windows DNS server on your network, see <a class="xref" href="https://help.ubuntu.com/9.10/serverguide/C/likewise-open.html#likewise-open-ms-dns" title="Microsoft DNS">the section called “Microsoft DNS”</a> for details. </p> </li></ul> </div> <p> To join a domain, from a terminal prompt enter: </p> <pre class="screen"><span class="command"><strong>sudo domainjoin-cli join example.com Administrator</strong></span><br /></pre> <div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"> <table summary="Note" border="0"> <tbody><tr> <td rowspan="2" valign="top" width="25" align="center"> <img style="width: 32px; height: 32px;" alt="[Note]" src="https://help.ubuntu.com/9.10/libs/admon/note.png" /> </td> <th align="left"><br /></th> </tr> <tr> <td valign="top" align="left"> <p> Replace <span class="emphasis"><em>example.com</em></span> with your domain name, and <span class="emphasis"><em>Administrator</em></span> with the appropriate user name. </p> </td> </tr> </tbody></table> </div> <p> You will then be prompted for the user's password. If all goes well a <span class="emphasis"><em>SUCCESS</em></span> message should be printed to the console. </p> <div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"> <table style="width: 467px; height: 81px;" summary="Note" border="0"> <tbody><tr> <td rowspan="2" valign="top" width="25" align="center"> <img style="width: 24px; height: 24px;" alt="[Note]" src="https://help.ubuntu.com/9.10/libs/admon/note.png" /> </td> <th align="left"><br /></th> </tr> <tr> <td valign="top" align="left"> <p> After joining the domain, it is necessary to reboot before attempting to authenticate against the domain. </p> </td> </tr> </tbody></table> </div> <p> After successfully joining an Ubuntu machine to an Active Directory domain you can authenticate using any valid AD user. To login you will need to enter the user name as 'domain\username'. For example to ssh to a server joined to the domain enter: </p> <pre class="screen"><span class="command"><strong>ssh 'example\steve'@hostname</strong></span><br /></pre> <div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"> <table summary="Note" border="0"> <tbody><tr> <td rowspan="2" valign="top" width="25" align="center"> <img style="width: 26px; height: 26px;" alt="[Note]" src="https://help.ubuntu.com/9.10/libs/admon/note.png" /> </td> <th align="left"><br /></th> </tr> <tr> <td valign="top" align="left"> <p> If configuring a Desktop the user name will need to be prefixed with <span class="italic">domain\</span> in the graphical logon as well. </p> </td> </tr> </tbody></table> </div> <p> To make likewise-open use a default domain, you can add the following statement to <code class="filename">/etc/samba/lwiauthd.conf</code>: </p> <pre class="programlisting">winbind use default domain = yes<br /></pre> <p> Then restart the <span class="application"><strong>likewise-open</strong></span> daemons: </p> <pre class="screen"><span class="command"><strong>sudo /etc/init.d/likewise-open restart</strong></span><br /></pre> <div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"> <table summary="Note" border="0"> <tbody><tr> <td rowspan="2" valign="top" width="25" align="center"> <img style="width: 26px; height: 26px;" alt="[Note]" src="https://help.ubuntu.com/9.10/libs/admon/note.png" /> </td> <th align="left"><br /></th> </tr> <tr> <td valign="top" align="left"> <p> Once configured for a <span class="emphasis"><em>default domain</em></span> the <span class="italic">'domain\'</span> is no longer required, users can login using only their username. </p> </td> </tr> </tbody></table> </div> <p> The <span class="application"><strong>domainjoin-cli</strong></span> utility can also be used to leave the domain. From a terminal: </p> <pre class="screen"><span class="command"><strong>sudo domainjoin-cli leave</strong></span><br /></pre> </div> <div class="sect2" title="Other Utilities"> <div class="titlepage"> <div> <div> <h3 class="title">Other Utilities</h3> </div> </div> </div> <p> The <span class="application"><strong>likewise-open</strong></span> package comes with a few other utilities that may be useful for gathering information about the Active Directory environment. These utilities are used to join the machine to the domain, and are the same as those available in the <span class="application"><strong>samba-common</strong></span> and <span class="application"><strong>winbind</strong></span> packages: </p> <div class="itemizedlist"> <ul class="itemizedlist" type="disc"><li class="listitem"> <p> <span class="application"><strong>lwinet</strong></span>: Returns information about the network and the domain. </p> </li><li class="listitem"> <p> <span class="application"><strong>lwimsg</strong></span>: Allows interaction with the <span class="application"><strong>likewise-winbindd</strong></span> daemon. </p> </li><li class="listitem"> <p> <span class="application"><strong>lwiinfo</strong></span>: Displays information about various parts of the Domain. </p> </li></ul> </div> <p> Please refer to each utility's man page specific for details. </p> </div> <div class="sect2" title="Troubleshooting"> <div class="titlepage"> <div> <div> <h3 class="title">Troubleshooting</h3> </div> </div> </div> <div class="itemizedlist"> <ul class="itemizedlist" type="disc"><li class="listitem"> <p> If the client has trouble joining the domain, double check that the Microsoft DNS is listed first in <code class="filename">/etc/resolv.conf</code>. For example: </p> <pre class="programlisting">nameserver 192.168.0.1<br /></pre> </li><li class="listitem"> <p> For more information when joining a domain, use the <span class="emphasis"><em>--loglevel verbose</em></span> or <span class="emphasis"><em>--advanced</em></span> option of the <span class="application"><strong>domainjoin-cli</strong></span> utility: </p> <pre class="screen"><span class="command"><strong>sudo domainjoin-cli --loglevel verbose join example.com Administrator</strong></span><br /></pre> </li><li class="listitem"> <p> If an Active Directory user has trouble logging in, check the <code class="filename">/var/log/auth.log</code> for details. </p> </li><li class="listitem"> <p> When joining an Ubuntu Desktop workstation to a domain, you may need to edit <code class="filename">/etc/nsswitch.conf</code> if your AD domain uses the <span class="italic">.local</span> syntax. In order to join the domain the <span class="emphasis"><em>"mdns4"</em></span> entry from the <span class="emphasis"><em>hosts</em></span> option. For example: </p> <pre class="programlisting">hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4<br /></pre> <p> Change the above to: </p> <pre class="programlisting">hosts: files dns [NOTFOUND=return]<br /></pre> <p> Then restart networking by entering: </p> <pre class="screen"><span class="command"><strong>sudo /etc/init.d/networking restart</strong></span><br /></pre> <p> You should now be able to join the Active Directory domain. </p> </li></ul> </div> </div> <div class="titlepage"> <div> <div> <h3 class="title">Microsoft DNS</h3> </div> </div> </div> <p> The following are instructions for installing DNS on an Active Directory domain controller running Windows Server 2003, but the instructions should be similar for other versions: </p> <ul class="itemizedlist" type="disc"><li class="listitem"> <p> Click <span class="guimenuitem">Start</span> → <span class="guimenuitem">Administrative Tools</span> → <span class="guimenuitem">Manager Your Server</span>. This will open the <span class="application"><strong>Server Role Mangement</strong></span> utility. </p> <div class="orderedlist"> <ol class="orderedlist" type="1"><li class="listitem"> <p>Click Add or remove a role</p> </li><li class="listitem"> <p>Click Next</p> </li><li class="listitem"> <p>Select "DNS Server"</p> </li><li class="listitem"> <p>Click Next</p> </li><li class="listitem"> <p>Next</p> </li><li class="listitem"> <p>Select "Create a forward lookup zone" if it is not selected.</p> </li><li class="listitem"> <p>Click Next</p> </li><li class="listitem"> <p>Make sure "This server maintains the zone" is selected and click Next.</p> </li><li class="listitem"> <p>Enter your domain name and click Next</p> </li><li class="listitem"> <p>Click Next to "Allow only secure dynamic updates"</p> </li><li class="listitem"> <p>Click Next to "Allow only secure dynamic updates"</p> </li><li class="listitem"> <p> Enter the IP for DNS servers to forward queries to, or Select "No, it should not forward queries" and click Next. </p> </li><li class="listitem"> <p>Click Finish</p> </li><li class="listitem"> <p>Click Finish</p> </li></ol> </div> <p> DNS is now installed and can be further configured using the <span class="application"><strong>Microsoft Management Console</strong></span> DNS snap-in. </p> </li><li class="listitem"> <p> Next, configure the Server to use itself for DNS queries: </p> <div class="orderedlist"> <ol class="orderedlist" type="1"><li class="listitem"> <p>Click Start</p> </li><li class="listitem"> <p>Control Panel</p> </li><li class="listitem"> <p>Network Connections</p> </li><li class="listitem"> <p>Right Click "Local Area Connection"</p> </li><li class="listitem"> <p>Click Properties</p> </li><li class="listitem"> <p>Double click "Internet Protocol (TCP/IP)"</p> </li><li class="listitem"> <p>Enter the Server's IP Address as the "Preferred DNS server"</p> </li><li class="listitem"> <p>Click Ok</p> </li><li class="listitem"> <p>Click Ok again to save the settings</p> </li></ol> </div></li></ul><br /><br /></td></tr></tbody></table></div></div>mofanhttp://www.blogger.com/profile/11633837173886886730noreply@blogger.com0tag:blogger.com,1999:blog-1515405961596935511.post-17766895241848732272010-01-31T11:29:00.000-08:002010-01-31T11:38:02.502-08:00<strong>BIND</strong> is an open-source software that implements the Domain Name System (DNS) protocols for the Internet. The name BIND stands for “Berkeley Internet Name Domain”. This article describes how to install and configure BIND in Red Hat Enterprise Linux 5 or CentOS 5.<br /><br /><h2>Installing BIND</h2> <p>The steps below will install the chrooted BIND and the GUI configuration tool.</p> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/bind-install.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/bind-install.png" /></a><br />1. Type in the command below to install BIND. <pre class="steps">yum install bind-chroot system-config-bind<br /></pre> </div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/service-config.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/service-config.png" /></a><br />2. Start the <em>named</em> service. <a href="http://www.linuxmail.info/how-to-start-stop-services-centos-5/">Learn how to start and stop services.</a></div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/security-level-config.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/security-level-config.png" /></a><br />3. Open the TCP port 53 and UDP port 53. <a href="http://www.linuxmail.info/firewall-configuration-centos-5/">Learn how to configure the firewall.</a></div> <h2>Configuring BIND</h2> <p>The steps shows how to configure BIND using the GUI configuration tool.</p> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/bind-shortcut.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/bind-shortcut.png" /></a><br />1. Click <em>System</em>, select <em>Administration</em> and click <em>Domain Name System</em>. This will launch the <strong>BIND Configuration GUI</strong> window.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/bind-configure.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/bind-configure.png" /></a><br />2. Click <em>Ok</em> to initialize BIND with default values.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/bind-configuration.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/bind-configuration.png" /></a><br />3. BIND has now been initialized. We can now create a DNS zone and add DNS records.</div> <h2>Creating a DNS Zone</h2> <p>The steps below will show you how to create a DNS zone named “acme.local”.</p> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/bind-configuration-add-zone.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/bind-configuration-add-zone.png" /></a><br />1. To create a DNS zone, right click <em>DNS Server</em>, select <em>Add</em> and click <em>Zone</em>.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/bind-configuration-new-zone-1.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/bind-configuration-new-zone-1.png" /></a><br />2. In the <strong>New Zone</strong> window, click the <em>Ok</em> button under <em>Class</em>.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/bind-configuration-new-zone-2.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/bind-configuration-new-zone-2.png" /></a><br />3. Next, click the <em>Ok</em> button under <em>Origin Type</em>.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/bind-configuration-new-zone-3.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/bind-configuration-new-zone-3.png" /></a><br />4. Provide the name of the zone and click <em>Ok</em>.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/bind-configuration-new-zone-4.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/bind-configuration-new-zone-4.png" /></a><br />5. Review the various settings and click <em>Ok</em>.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/bind-save.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/bind-save.png" /></a><br />6. Click <em>Save</em> and click <em>Yes</em>.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/bind-configuration-2.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/bind-configuration-2.png" /></a><br />7. You now have a new DNS zone.</div> <h2>Creating DNS Records</h2> <p>The steps below describes how to create some of the most common DNS records.</p><br /><h3>Creating an A record</h3> <p>An A record maps a hostname to its IPv4 address.</p> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/bind-configuration-add-ipv4.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/bind-configuration-add-ipv4.png" /></a><br />1. Right click the zone you where you want to add an A record, select <em>Add</em> and click <em>A IPv4 Address</em>.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/bind-configuration-aipv4.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/bind-configuration-aipv4.png" /></a><br />2. Specify the <em>Domain Name</em> and <em>IPv4 Address</em> and click <em>Ok</em>.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/bind-save.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/bind-save.png" /></a><br />3. Click <em>Save</em> and click <em>Yes</em>.</div> <h3>Creating a CNAME record</h3> <p>A CNAME record specifies that a domain name is an alias of another domain name.</p> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/bind-configuration-add-cname.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/bind-configuration-add-cname.png" /></a><br />1. Right click the zone you where you want to add a CNAME record, select <em>Add</em> and click <em>CNAME Alias</em>.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/bind-cname-alias.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/bind-cname-alias.png" /></a><br />2. Specify the <em>Domain Name</em> and <em>Canonical Name</em> (target domain name) and click <em>Ok</em>.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/bind-save.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/bind-save.png" /></a><br />3. Click <em>Save</em> and click <em>Yes</em>.</div> <h3>Creating an MX record</h3> <p>An MX record specifies how Internet e-mail should be routed using SMTP.</p> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/bind-configuration-add-mx.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/bind-configuration-add-mx.png" /></a><br />1. Right click the zone you where you want to add an MX record, select <em>Add</em> and click <em>MX Mail Exchange</em>.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/bind-mxmail-exchange.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/bind-mxmail-exchange.png" /></a><br />2. Specify the <em>Mail Server Name</em> and click <em>Ok</em>.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/bind-save.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/bind-save.png" /></a><br />3. Click <em>Save</em> and click <em>Yes</em>.</div> <h2>Testing BIND</h2> <p>To test your BIND setup, you can use the <em>nslookup</em> and <em>dig</em> utility.</p> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/nslookup-localhost.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/nslookup-localhost.png" /></a><br />1. Type the command below in a terminal window to use nslookup <pre class="steps">nslookup mail.acme.local localhost<br /></pre> Replace <em>mail.acme.local</em> with the domain you want to check. If your DNS server is not on <em>localhost</em> then change it. </div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/dig-localhost.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/dig-localhost.png" /></a><br />2. Type in the command below to query any records using dig. <pre class="steps">dig @localhost acme.local ANY<br /></pre> Replace <em>acme.local</em> with your own domain. If your DNS server is not on <em>localhost</em> then change it. </div>mofanhttp://www.blogger.com/profile/11633837173886886730noreply@blogger.com0tag:blogger.com,1999:blog-1515405961596935511.post-54807348174774712712010-01-31T08:19:00.000-08:002010-01-31T08:22:41.570-08:00<p> Samba configuration is straightforward. All modifications to Samba are done in the <tt class="filename">/etc/samba/smb.conf</tt> configuration file. Although the default <tt class="filename">smb.conf</tt> file is well documented, it does not address complex topics such as LDAP, Active Directory, and the numerous domain controller implementations. </p> <p> The following sections describe the different ways a Samba server can be configured. Keep in mind your needs and the changes required to the <tt class="filename">smb.conf</tt> file for a successful configuration. </p> <div class="section" lang="en-US" lang="en-US"> <div class="titlepage"> <div> <div> <h3 class="title">Stand-alone Server</h3> </div> </div> </div> <p> A stand-alone server can be a workgroup server or a member of a workgroup environment. A stand-alone server is not a domain controller and does not participate in a domain in any way. The following examples include several anonymous share-level security configurations and one user-level security configuration.</p> <div class="section" lang="en-US" lang="en-US"> <div class="titlepage"> <div> <div> <h4 class="title">Anonymous Read-Only</h4> </div> </div> </div> <p> The following <tt class="command">smb.conf</tt> file shows a sample configuration needed to implement anonymous read-only file sharing. The <tt class="command">security = share</tt> parameter makes a share anonymous. Note, security levels for a single Samba server cannot be mixed. The <tt class="command">security</tt> directive is a global Samba parameter located in the <tt class="command">[global]</tt> configuration section of the <tt class="command">smb.conf</tt> file. </p> <pre class="screen">[global]<br />workgroup = DOCS<br />netbios name = DOCS_SRV<br />security = share <br />[data]<br />comment = Documentation Samba Server<br />path = /export<br />read only = Yes<br />guest only = Yes<br /></pre> </div> <div class="section" lang="en-US" lang="en-US"> <div class="titlepage"> <div> <div> <h4 class="title">Anonymous Read/Write</h4> </div> </div> </div> <p> The following <tt class="command">smb.conf</tt> file shows a sample configuration needed to implement anonymous read/write file sharing. To enable anonymous read/write file sharing, set the <tt class="command">read only</tt> directive to <tt class="command">no</tt>. The <tt class="command">force user</tt> and <tt class="command">force group</tt> directives are also added to enforce the ownership of any newly placed files specified in the share. </p> <div class="note"> <h2>Note</h2> <p> Although having an anonymous read/write server is possible, it is not recommended. Any files placed in the share space, regardless of user, are assigned the user/group combination as specified by a generic user (<tt class="command">force user</tt>) and group (<tt class="command">force group</tt>) in the <tt class="filename">smb.conf</tt> file. </p> </div> <pre class="screen">[global]<br />workgroup = DOCS<br />netbios name = DOCS_SRV<br />security = share <br />[data]<br />comment = Data<br />path = /export<br />force user = docsbot<br />force group = users<br />read only = No<br />guest ok = Yes<br /></pre> </div> <div class="section" lang="en-US" lang="en-US"> <div class="titlepage"> <div> <div> <h4 class="title">Anonymous Print Server</h4> </div> </div> </div> <p> The following <tt class="command">smb.conf</tt> file shows a sample configuration needed to implement an anonymous print server. Setting <tt class="command">browseable</tt> to <tt class="command">no</tt> as shown does not list the printer in Windows <span><b class="guilabel">Network Neighborhood</b></span>. Although hidden from browsing, configuring the printer explicitly is possible. By connecting to <tt class="command">DOCS_SRV</tt> using NetBIOS, the client can have access to the printer if the client is also part of the <tt class="command">DOCS</tt> workgroup. It is also assumed that the client has the correct local printer driver installed, as the <tt class="command">use client driver</tt> directive is set to <tt class="command">Yes</tt>. In this case, the Samba server has no responsibility for sharing printer drivers to the client. </p> <pre class="screen">[global]<br />workgroup = DOCS<br />netbios name = DOCS_SRV<br />security = share<br />printcap name = cups<br />disable spools= Yes<br />show add printer wizard = No<br />printing = cups <br />[printers]<br />comment = All Printers<br />path = /var/spool/samba<br />guest ok = Yes<br />printable = Yes<br />use client driver = Yes<br />browseable = Yes<br /></pre> </div> <div class="section" lang="en-US" lang="en-US"> <div class="titlepage"> <div> <div> <h4 class="title">Secure Read/Write File and Print Server</h4> </div> </div> </div> <p> The following <tt class="command">smb.conf</tt> file shows a sample configuration needed to implement a secure read/write print server. Setting the <tt class="command">security</tt> directive to <tt class="command">user</tt> forces Samba to authenticate client connections. Notice the <tt class="command">[homes]</tt> share does not have a <tt class="command">force user</tt> or <tt class="command">force group</tt> directive as the <tt class="command">[public]</tt> share does. The <tt class="command">[homes]</tt> share uses the authenticated user details for any files created as opposed to the <tt class="command">force user</tt> and <tt class="command">force group</tt> in <tt class="command">[public]</tt>. </p> <pre class="screen">[global]<br />workgroup = DOCS<br />netbios name = DOCS_SRV<br />security = user<br />printcap name = cups<br />disable spools = Yes<br />show add printer wizard = No<br />printing = cups <br />[homes]<br />comment = Home Directories<br />valid users = %S<br />read only = No<br />browseable = No <br />[public]<br />comment = Data<br />path = /export<br />force user = docsbot<br />force group = users<br />guest ok = Yes <br />[printers]<br />comment = All Printers<br />path = /var/spool/samba<br />printer admin = john, ed, @admins<br />create mask = 0600<br />guest ok = Yes<br />printable = Yes<br />use client driver = Yes<br />browseable = Yes<br /></pre> </div> </div> <div class="section" lang="en-US" lang="en-US"> <div class="titlepage"> <div> <div> <h3 class="title">Domain Member Server</h3> </div> </div> </div> <p> A domain member, while similar to a stand-alone server, is logged into a domain controller (either Windows or Samba) and is subject to the domain's security rules. An example of a domain member server would be a departmental server running Samba that has a machine account on the Primary Domain Controller (PDC). All of the department's clients still authenticate with the PDC, and desktop profiles and all network policy files are included. The difference is that the departmental server has the ability to control printer and network shares. </p> <div class="section" lang="en-US" lang="en-US"> <div class="titlepage"> <div> <div> <h4 class="title">Active Directory Domain Member Server</h4> </div> </div> </div> <p> The following <tt class="command">smb.conf</tt> file shows a sample configuration needed to implement an Active Directory domain member server. In this example, Samba authenticates users for services being run locally but is also a client of the Active Directory. Ensure that your kerberos <tt class="command">realm</tt> parameter is shown in all caps (for example <tt class="command">realm = EXAMPLE.COM</tt>). Since Windows 2000/2003 requires Kerberos for Active Directory authentication, the <tt class="command">realm</tt> directive is required. If Active Directory and Kerberos are running on different servers, the <tt class="command">password server</tt> directive may be required to help the distinction. </p> <pre class="screen">[global]<br />realm = EXAMPLE.COM<br />security = ADS<br />encrypt passwords = yes<br /># Optional. Use only if Samba cannot determine the Kerberos server automatically.<br />password server = kerberos.example.com<br /></pre> <p> In order to join a member server to an Active Directory domain, the following steps must be completed: </p> <div class="itemizedlist"> <ul><li> <p> Configuration of the <tt class="filename">smb.conf</tt> file on the member server </p> </li><li> <p> Configuration of Kerberos, including the <tt class="filename">/etc/krb5.conf</tt> file, on the member server </p> </li><li> <p> Creation of the machine account on the Active Directory domain server </p> </li><li> <p> Association of the member server to the Active Directory domain </p> </li></ul> </div> <p> To create the machine account and join the Windows 2000/2003 Active Directory, Kerberos must first be initialized for the member server wishing to join the Active Directory domain. To create an administrative Kerberos ticket, type the following command as root on the member server: </p> <pre class="screen"><b class="userinput"><tt>kinit administrator@EXAMPLE.COM</tt></b><br /></pre> <p> The <tt class="command">kinit</tt> command is a Kerberos initialization script that references the Active Directory administrator account and Kerberos realm. Since Active Directory requires Kerberos tickets, <tt class="command">kinit</tt> obtains and caches a Kerberos ticket-granting ticket for client/server authentication. For more information on Kerberos, the <tt class="command">/etc/krb5.conf</tt> file, and the <tt class="command">kinit</tt> command, refer to <a href="http://www.centos.org/docs/5/html/Deployment_Guide-en-US/ch-kerberos.html" title="42.6. Kerberos">Section 42.6, “Kerberos”</a>. </p> <p> To join an Active Directory server (windows1.example.com), type the following command as root on the member server: </p> <pre class="screen"><b class="userinput"><tt>net ads join -S windows1.example.com -U administrator%password</tt></b><br /></pre> <p> Since the machine <tt class="command">windows1</tt> was automatically found in the corresponding Kerberos realm (the <tt class="command">kinit</tt> command succeeded), the <tt class="command">net</tt> command connects to the Active Directory server using its required administrator account and password. This creates the appropriate machine account on the Active Directory and grants permissions to the Samba domain member server to join the domain. </p> <div class="note"> <h2>Note</h2> <p> Since <tt class="command">security = ads</tt> and not <tt class="command">security = user</tt> is used, a local password backend such as <tt class="filename">smbpasswd</tt> is not needed. Older clients that do not support <tt class="command">security = ads</tt> are authenticated as if <tt class="command">security = domain</tt> had been set. This change does not affect functionality and allows local users not previously in the domain. </p> </div> </div> <div class="section" lang="en-US" lang="en-US"> <div class="titlepage"> <div> <div> <h4 class="title">Windows NT4-based Domain Member Server</h4> </div> </div> </div> <p> The following <tt class="command">smb.conf</tt> file shows a sample configuration needed to implement a Windows NT4-based domain member server. Becoming a member server of an NT4-based domain is similar to connecting to an Active Directory. The main difference is NT4-based domains do not use Kerberos in their authentication method, making the <tt class="command">smb.conf</tt> file simpler. In this instance, the Samba member server functions as a pass through to the NT4-based domain server. </p> <pre class="screen">[global]<br />workgroup = DOCS<br />netbios name = DOCS_SRV<br />security = domain <br />[homes]<br />comment = Home Directories<br />valid users = %S<br />read only = No<br />browseable = No <br />[public]<br />comment = Data<br />path = /export<br />force user = docsbot<br />force group = users<br />guest ok = Yes<br /></pre> <p> Having Samba as a domain member server can be useful in many situations. There are times where the Samba server can have other uses besides file and printer sharing. It may be beneficial to make Samba a domain member server in instances where Linux-only applications are required for use in the domain environment. Administrators appreciate keeping track of all machines in the domain, even if not Windows-based. In the event the Windows-based server hardware is deprecated, it is quite easy to modify the <tt class="command">smb.conf</tt> file to convert the server to a Samba-based PDC. If Windows NT-based servers are upgraded to Windows 2000/2003, the <tt class="command">smb.conf</tt> file is easily modifiable to incorporate the infrastructure change to Active Directory if needed. </p> <div class="important"> <h2>Important</h2> <p> After configuring the <tt class="command">smb.conf</tt> file, join the domain <span class="emphasis"><em>before</em></span> starting Samba by typing the following command as root: </p> <pre class="screen"><b class="userinput"><tt>net rpc join -U administrator%password</tt></b><br /></pre> </div> <p> Note that the <tt class="option">-S</tt> option, which specifies the domain server hostname, does not need to be stated in the <tt class="command">net rpc join</tt> command. Samba uses the hostname specified by the <tt class="command">workgroup</tt> directive in the <tt class="filename">smb.conf</tt> file instead of it being stated explicitly. </p> </div> </div> <div class="titlepage"> <div> <div> <h3 class="title">Domain Controller</h3> </div> </div> </div> <p> A domain controller in Windows NT is functionally similar to a Network Information Service (NIS) server in a Linux environment. Domain controllers and NIS servers both host user/group information databases as well as related services. Domain controllers are mainly used for security, including the authentication of users accessing domain resources. The service that maintains the user/group database integrity is called the <i class="firstterm">Security Account Manager</i> (SAM). The SAM database is stored differently between Windows and Linux Samba-based systems, therefore SAM replication cannot be achieved and platforms cannot be mixed in a PDC/BDC environment. </p> <p> In a Samba environment, there can be only one PDC and zero or more BDCs. </p> <div class="important"> <h2>Important</h2> <p> Samba cannot exist in a mixed Samba/Windows domain controller environment (Samba cannot be a BDC of a Windows PDC or vice versa). Alternatively, Samba PDCs and BDCs <span class="emphasis"><em>can</em></span> coexist. </p> </div> <div class="titlepage"> <div> <div> <h4 class="title">Primary Domain Controller (PDC) using <tt class="command">tdbsam</tt></h4> </div> </div> </div> <p> The simplest and most common implementation of a Samba PDC uses the <tt class="command">tdbsam</tt> password database backend. The <tt class="command">passdb backend</tt> directive controls which backend is to be used for the PDC. </p> <pre class="screen">[global]<br />workgroup = DOCS<br />netbios name = DOCS_SRV <br />passdb backend = tdbsam<br />security = user<br />add user script = /usr/sbin/useradd -m %u<br />delete user script = /usr/sbin/userdel -r %u<br />add group script = /usr/sbin/groupadd %g <br />delete group script = /usr/sbin/groupdel %g <br />add user to group script = /usr/sbin/usermod -G %g %u<br />add machine script = /usr/sbin/useradd -s /bin/false -d /dev/null -g machines %u<br /># The following specifies the default logon script <br /># Per user logon scripts can be specified in the user<br /># account using pdbedit logon script = logon.bat<br /># This sets the default profile path.<br /># Set per user paths with pdbedit<br />logon drive = H:<br />domain logons = Yes<br />os level = 35<br />preferred master = Yes<br />domain master = Yes <br />[homes]<br /> comment = Home Directories<br /> valid users = %S<br /> read only = No <br />[netlogon]<br /> comment = Network Logon Service<br /> path = /var/lib/samba/netlogon/scripts<br /> browseable = No <br /> read only = No<br /># For profiles to work, create a user directory under the<br /># path shown.<br /><tt class="command">mkdir -p /var/lib/samba/profiles/john</tt><br />[Profiles]<br /> comment = Roaming Profile Share<br /> path = /var/lib/samba/profiles<br /> read only = No<br /> browseable = No<br /> guest ok = Yes<br /> profile acls = Yes <br /># Other resource shares ... ...<br /></pre>mofanhttp://www.blogger.com/profile/11633837173886886730noreply@blogger.com0tag:blogger.com,1999:blog-1515405961596935511.post-13278447696673549152010-01-31T08:05:00.000-08:002010-01-31T08:07:03.743-08:00<p>To update CentOS 5.0 to CentOS 5.1, all you have to do is type in <tt>yum update</tt> from the Terminal window. This command will automatically get the updated packages over the internet. But if you have the CentOS 5.1 DVD, the steps below will show you how to update from that.</p> <span id="more-58"></span> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/desktop.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/desktop.png" /></a><br />1. Insert the CentOS 5.1 DVD into the DVD drive and double click the <em>Computer</em> icon in the CentOS Desktop.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/file-browser-computer.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/file-browser-computer.png" /></a><br />2. On the <strong>Computer – File Browser</strong> window, double click on the <em>CD-ROM Drive</em>.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/file-browser-computer.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/file-browser-dvd.png" /></a><br />3. The CentOS 5.1 DVD should now be available on <em>/media/CentOS_5.1_Final</em>.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/terminal-ln.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/terminal-ln.png" /></a><br />4. From a terminal window, type in <tt>ln -sf /media/CentOS_5.1_Final /media/CentOS</tt> and press <em>Enter</em>. This enables the CentOS 5.1 DVD to be located on the yum search path.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/edit-centos-media.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/edit-centos-media.png" /></a><br />5. Edit the file <em>/etc/yum.repos.d/CentOS-Media.repo</em> and change <em>beta</em> into <em>CentOS-5</em> in the line <tt>gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-beta</tt>.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/terminal-yum.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/terminal-yum.png" /></a><br />6. Finally, type in <tt>yum --disablerepo=* --enablerepo=c5-media</tt> and press <em>Enter</em> to begin the update process.</div> <div class="clearfix steps"><img class="icon32x32 left" alt="Note" src="http://www.linuxmail.info/images/emblem-note.png" />For 64-bit users: You need to add the line <tt>login_process_size = 64</tt> in the file <em>/etc/dovecot.conf</em> and restart dovecot after upgrading.</div>mofanhttp://www.blogger.com/profile/11633837173886886730noreply@blogger.com0tag:blogger.com,1999:blog-1515405961596935511.post-76697542115238370752010-01-31T07:08:00.000-08:002010-01-31T07:10:49.102-08:00<h2>System Management</h2> <p>This section describes how to perform system management tasks.</p> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/user-manager.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/user-manager.png" /></a><br /><a href="http://www.linuxmail.info/how-to-add-remove-user-accounts-centos-5/">How to add, edit or remove a user account</a></div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/package-manager-apps.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/package-manager-apps.png" /></a><br /><a href="http://www.linuxmail.info/how-to-add-remove-applications-centos-5/">How to add or remove packages or applications</a></div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/service-config-2.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/service-config-2.png" /></a><br /><a href="http://www.linuxmail.info/how-to-start-stop-services-centos-5/">How to start, stop or restart a background service</a><br /><a href="http://www.linuxmail.info/how-to-start-stop-services-centos-5/">How to enable or disable an on demand service</a></div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/security-level-config.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/security-level-config.png" /></a><br /><a href="http://www.linuxmail.info/firewall-configuration-centos-5/">How to configure the firewall</a></div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/date-time-properties-2.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/date-time-properties-2.png" /></a><br /><a href="http://www.linuxmail.info/synchronize-system-clock-centos-5/">How to synchronize the system clock using NTP</a></div> <h2>System Utilities</h2> <p>This section describes utilities you can use to manage your system.</p> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/windows-xp/putty-terminal.png"><img class="full" alt="" src="http://www.linuxmail.info/images/windows-xp/putty-terminal.png" /></a><br /><a href="http://www.linuxmail.info/ssh-howto/">How to setup SSH to remotely administer a Linux server using a command line</a></div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/windows-xp/tightvnc-session.png"><img class="full" alt="" src="http://www.linuxmail.info/images/windows-xp/tightvnc-session.png" /></a><br /><a href="http://www.linuxmail.info/vnc-remote-desktop-howto/">How to use VNC to remotely administer a Linux server using a GUI</a></div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/webmin-main.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/webmin-main.png" /></a><br /><a href="http://www.linuxmail.info/webmin-setup-howto/">How to setup Webmin, a web based system administration tool</a></div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/service-rsync.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/service-rsync.png" /></a><br /><a href="http://www.linuxmail.info/rsync-howto/">How to use rsync to synchronize files between two computers</a></div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/vi/vi-3.gif"><img class="full" alt="" src="http://www.linuxmail.info/images/vi/vi-3.gif" /></a><br /><a href="http://www.linuxmail.info/vi-editor-tutorial/">How to use vi, a command line editor</a></div>mofanhttp://www.blogger.com/profile/11633837173886886730noreply@blogger.com0tag:blogger.com,1999:blog-1515405961596935511.post-35848110713719659552010-01-31T06:57:00.000-08:002010-02-01T20:41:14.812-08:00<a href="http://www.linuxmail.info/images/centos-5/firefox-webmin.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/firefox-webmin.png" /></a><br /><br />1.Go to <a href="http://www.webmin.com/">www.webmin.com</a> and download the Webmin RPM package. <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/webmin-install.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/webmin-install.png" /></a><br />2. Double click the downloaded file to install Webmin.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/security-level-config-2.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/security-level-config-2.png" /></a><br />3. After installing Webmin, configure the firewall to allow traffic on the TCP port 10000. <a href="http://www.linuxmail.info/firewall-configuration-centos-5/">Learn how to configure the firewall</a>.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/service-config.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/service-config.png" /></a><br />4. Start the <em>httpd</em> service. <a href="http://www.linuxmail.info/how-to-start-stop-services-centos-5/">Learn how to start and stop services here.</a></div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/webmin-login.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/webmin-login.png" /></a><br />5. From a web browser, connect to <strong>https://localhost:10000</strong> and login using root.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/webmin-main.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/webmin-main.png" /></a><br />6. That’s it. It’s working.<br /><br /><div class="post-content no-border"> <p><strong>Webmin</strong> is a web-based interface for system administration for Unix. Using any modern web browser, you can setup user accounts, Apache, DNS, file sharing and much more. This article will show you how to install Webmin.</p></div><br /></div>mofanhttp://www.blogger.com/profile/11633837173886886730noreply@blogger.com0tag:blogger.com,1999:blog-1515405961596935511.post-59473617815259742572010-01-31T06:53:00.000-08:002010-01-31T06:55:10.408-08:00<p>It is recommended to an Active Directory enabled DNS server, this will ensure that the LDAP lookups and Kerberos authentication will work properly. Also, provide a user account dedicated for the LDAP authentication.</p> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/authentication.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/authentication.png" /></a>1. Click <em>System</em>, select <em>Administration</em> and click <em>Authentication</em>. This will launch the <strong>Authentication Configuration</strong> window.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/auth-config-user-information.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/auth-config-user-information.png" /></a>2. Check <em>Enable LDAP Support</em> and click the <em>Configure LDAP</em> button.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/auth-config-ldap-settings.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/auth-config-ldap-settings.png" /></a>3. Fill in the <em>LDAP Search Base DN</em> and <em>LDAP Server</em> fields. Click <em>Ok</em> when you are done.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/auth-config-options.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/auth-config-options.png" /></a>4. Click the <em>Options</em> tab and check <em>Local authorization is sufficient for local users</em> and <em>Create home directories on the first login</em>. Click <em>Ok</em> when you are done.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/edit-ldap-conf.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/edit-ldap-conf.png" /></a>4. Edit the file <em>/etc/ldap.conf</em> and add the following lines below. <pre class="steps">binddn <em>user account</em><br />bindpw <em>password for binddn</em><br />nss_map_objectclass posixAccount User<br />nss_map_objectclass posixGroup Group<br />nss_map_attribute homeDirectory unixHomeDirectory<br /></pre> </div> <div class="clearfix steps">If you are using Services for Unix 3.5, remove the homeDirectory mapping above and add the lines below. <pre class="steps">nss_map_attribute uid msSFU30Name<br />nss_map_attribute uidNumber msSFU30UidNumber<br />nss_map_attribute gidNumber msSFU30GidNumber<br />nss_map_attribute homeDirectory msSFU30HomeDirectory<br />nss_map_attribute loginShell msSFU30LoginShell<br /></pre> </div> <div class="clearfix steps"><img class="icon32x32 left" alt="Note" src="http://www.linuxmail.info/images/emblem-note.png" />If you are not using an Active Directory enabled DNS server, you need to add the line <tt>referrals no</tt> to make this work.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/terminal-getent-passwd.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/terminal-getent-passwd.png" /></a>5. Type in <tt>getent passwd</tt> in a terminal window. You should see your Active Directory user accounts.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/terminal-getent-group.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/terminal-getent-group.png" /></a>6. Type in <tt>getent group</tt> in a terminal window. You should see your Active Directory groups.</div>mofanhttp://www.blogger.com/profile/11633837173886886730noreply@blogger.com0tag:blogger.com,1999:blog-1515405961596935511.post-70456371033601622682010-01-31T06:44:00.000-08:002010-01-31T06:50:16.444-08:00This article will show you how to join your Linux server into the Active Directory domain, how to integrate the Active Directory user accounts into the Linux user accounts and how to authenticate users in Active Directory using Winbind, a component of Samba.<br /><br />A better way to integrate Active Directory into your Linux mail server is by using <a href="http://www.linuxmail.info/postfix-dovecot-ldap-centos-5/">Postfix’s Virtual User Accounts</a>. <div class="clearfix steps"><img class="icon32x32 left" alt="Note" src="http://www.linuxmail.info/images/emblem-note.png" />Samba is installed by default when you select the Server installation type during the installation process. In case you need to install or reinstall it, just add the <em>Windows File Server</em> package located in the <em>Servers</em> category using the <a href="http://www.linuxmail.info/how-to-add-remove-applications-centos-5/">Package Manager</a> tool.</div> <h2>Setup and Configure Winbind</h2> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/authentication.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/authentication.png" /></a>1. Click <em>System</em>, select <em>Administration</em> and click <em>Authentication</em>. This will launch the <strong>Authentication Configuration</strong> window.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/auth-config.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/auth-config.png" /></a>2. Check the <em>Enable Winbind Support</em> and click <em>Configure Winbind</em>. This will launch the <strong>Winbind Settings</strong> window.</div> <div id="winbind-settings" class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/winbind-settings.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/winbind-settings.png" /></a><div class="m">3. In the <strong>Winbind Settings</strong> window, set the <em>Security Model</em> to <em>ads</em> and fill in the <em>Winbind Domain</em>, <em>Winbind ADS Realm</em> and <em>Winbind Domain Controllers</em>. See sample settings below.</div> <div> </div> <div class="m"> <div class="fw">Winbind Domain</div><div>acme</div> <div class="fw">Winbind ADS Realm</div><div>acme.local</div> <div class="fw">Domain Controllers</div><div>server1.acme.local,server2.acme.local</div> </div> </div> <div class="clearfix steps"><img class="icon32x32 left" alt="Note" src="http://www.linuxmail.info/images/emblem-note.png" />If you would like to allow your Active Directory users to login to your Linux system, change <strong>Template Shell</strong> to <em>/bin/bash</em>.</div> <div class="clearfix steps"><img class="icon32x32 left" alt="Important" src="http://www.linuxmail.info/images/emblem-important.png" />To ensure the success of the Active Directory integration, make sure that your Active Directory DNS is working, you are using the Active Directory DNS, you can ping the domain controllers and that the difference between the domain controllers’ clock and the mail server’s clock is not more than five minutes.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/join-winbind.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/join-winbind.png" /></a>4. Click <em>Join Winbind Domain</em>. You will be asked to save your changes, click <em>Save</em>. In the <strong>Joining Winbind Domain</strong> window, fill in the <em>Domain Administrator</em> and <em>Password</em>. Click <em>Ok</em> when you are done. Click <em>Ok</em> again to close the <strong>Winbind Settings</strong> window.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/auth-config-2.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/auth-config-2.png" /></a>5. Click the <em>Authentication</em> tab and check the <em>Enable Winbind Support</em>.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/auth-config-3.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/auth-config-3.png" /></a>6. Click the <em>Options</em> tab and check the <em>Local authorization is sufficient for local users</em>. Click <em>Ok</em> when you are done.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/edit-smb-conf.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/edit-smb-conf.png" /></a>7. Open the file <em>/etc/samba/smb.conf</em> for editing and change the key values below.<div class="m"><pre class="steps">winbind use default domain = yes<br />winbind enum users = yes<br />winbind enum groups = yes<br />obey pam restrictions = yes<br />allow trusted domains = no<br />idmap backend = idmap_rid:acme=16777216-33554431<br /></pre> </div> For the last line, replace <em>acme</em> with the value of <em>workgroup</em> and ensure that the range matches your <em>idmap uid</em> range. </div> <div class="clearfix steps"><img class="icon32x32 left" alt="Note" src="http://www.linuxmail.info/images/emblem-note.png" />The last line activates algorithmic mapping of the Windows IDs to Unix IDs. This enables you to use Samba across several Linux machines or recreate a corrupted mapping database since the mapping is consistent.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/smb-home-dir.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/smb-home-dir.png" /></a>8. Create the folder that will contain the home directory of the Active Directory users. From the terminal window, type in the commands below.<div class="m"><pre class="steps">mkdir /home/DOMAIN</pre></div><div class="m">Replace <em>DOMAIN</em> with your domain. Make sure to capitalize your domain like <em>ACME</em> in our example.</div></div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/edit-system-auth.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/edit-system-auth.png" /></a>9. Edit the file <em>/etc/pam.d/system-auth</em> and add the line below.</div> <pre class="steps">session required pam_oddjob_mkhomedir.so skel=/etc/skel/ umask=0022</pre> <div class="steps">This will automatically create the user’s home directory whenever a PAM session is opened. Winbind and Dovecot will be opening the PAM session thus automatically creating the user’s home directory.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/service-config.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/service-config.png" /></a>10. Restart the <em>winbind</em> service and start the <em>oddjobd</em> service. <a href="http://www.linuxmail.info/how-to-start-stop-services-centos-5/">Learn how to start and restart services here.</a></div> <h2 id="test-active-directory">Test the Active Directory Integration</h2> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/wbinfo-u.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/wbinfo-u.png" /></a>1. From a terminal window, type in <tt>wbinfo -u</tt>. You should see the Active Directory user accounts.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/wbinfo-a.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/wbinfo-a.png" /></a>2. Try the Active Directory authentication, type in <tt>wbinfo -a "username"%"password"</tt>.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/getent-passwd.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/getent-passwd.png" /></a>3. Finally, type in <tt>getent passwd</tt>. You should see the Linux system accounts along with the Active Directory user accounts.</div> <img class="icon32x32 left" alt="Note" src="http://www.linuxmail.info/images/emblem-note.png" />mofanhttp://www.blogger.com/profile/11633837173886886730noreply@blogger.com0tag:blogger.com,1999:blog-1515405961596935511.post-88579672884674168902010-01-31T06:40:00.000-08:002010-01-31T06:43:57.085-08:00The Postfix Cyrus SASL support is used to authenticate remote SMTP clients to the Postfix SMTP server. Thanks to the Pluggable Authentication Modules (PAM) in Linux, we can configure Cyrus SASL to delegate the authentication process to an Active Directory server.<br /><h2>Setup and Configure Kerberos</h2><br /><p>The steps below describes how to configure Kerberos using the GUI tool. You can apply the changes manually by editing the file <em>/etc/krb5.conf</em>.</p> <p><img class="icon32x32 left" alt="Important" src="http://www.linuxmail.info/images/emblem-important.png" />The Kerberos network authentication protocol requires the clocks of the involved machines to be synchronized or at least the difference is less than 5 minutes.</p> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/authentication.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/authentication.png" /></a>1. Click <em>System</em>, select <em>Administration</em> and click <em>Authentication</em>. This will launch the <strong>Authentication Configuration</strong> window.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/auth-config-a.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/auth-config-a.png" /></a>2. Click the <em>Authentication</em> tab and check the <em>Enable Kerberos Support</em>. Next, click the <em>Configure Kerberos</em> button.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/kerberos-settings.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/kerberos-settings.png" /></a>3. In the <strong>Kerberos Settings</strong> window, fill in the <em>Realm</em>, clear out <em>KDC</em> and <em>Admin Servers</em> and check the <em>Use DNS to locate KDCs for realms</em>. Realm is usually your domain name capitalized, <em>capitalization is important.</em> KDC is your Active Directory server. Click <em>Ok</em> when you’re done.</div> <p><img class="icon32x32 left" alt="Note" src="http://www.linuxmail.info/images/emblem-note.png" />To make sure that your KDC can be automatically located, type in the command <tt>host -t any _kerberos._tcp.acme.local</tt> in a terminal window. Replace <em>acme.local</em> with your own realm. If it replies “_kerberos._tcp.acme.local has SRV record …” then it works, otherwise you’ll have to fill in the KDC field above. This is how the Windows workstation is able to find the domain controller during domain logon.</p> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/auth-config-b.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/auth-config-b.png" /></a>4. Uncheck the <em>Enable Kerberos Support</em> and click <em>Ok</em>. We don’t actually want to use Kerberos authentication in Linux, we just want the tool to setup Kerberos for us.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/terminal-kinit.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/terminal-kinit.png" /></a>5. Test Kerberos by typing in <tt>kinit username</tt> in a terminal window. If you need help in making sense of the kinit error messages, check out <a href="http://www.linuxmail.info/troubleshooting-active-directory-centos-5/#test-kerberos">Test the Kerberos Authentication</a>.</div> <h2>Configuring Cyrus SASL</h2> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/edit-pam-smtp-postfix.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/edit-pam-smtp-postfix.png" /></a>1. Edit the file <em>/etc/pam.d/smtp.postfix</em> and replace the content with the lines below. </div> <pre class="steps">auth sufficient pam_krb5.so no_user_check validate<br />account sufficient pam_permit.so<br /></pre> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/service-config-saslauthd.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/service-config-saslauthd.png" /></a>2. Restart the saslauthd service.</div> <div class="clearfix steps"><a href="http://www.linuxmail.info/images/centos-5/terminal-testsaslauthd.png"><img class="full" alt="" src="http://www.linuxmail.info/images/centos-5/terminal-testsaslauthd.png" /></a>3. Test saslauthd by typing in <tt>testsaslauthd -u <em>username</em> -p <em>password</em> -r <em>domain</em> -s smtp</tt> in a terminal window.</div> <p>Cyrus SASL is now configured to authenticate against an Active Directory server. Proceed to <a href="http://www.linuxmail.info/smtp-authentication-postfix-centos-5/">Postfix SMTP Authentication</a> for instructions on configuring Postfix. Or restart Postfix or MailScanner and jump directly to the <a href="http://www.linuxmail.info/smtp-authentication-postfix-centos-5/#test-postfix">Test Postfix using Telnet</a> part if you have already done so.</p>mofanhttp://www.blogger.com/profile/11633837173886886730noreply@blogger.com0