	[x] Posted via EE Mobile
	Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

04/22/2009 at 04:28PM PDT, ID: 24347311

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

8.2

SAMBA to join as a member of an Active Directory domain

Asked by cyberfool in Samba File Sharing, Linux Networking

Tags: SAMBA ver 3.2, Active Directory, Windows Domain

I am trying to get my Fedora Linux, running SAMBA 3.2.5-0.22.fc9, to be able to join as a member (ie not a DC) of an Active Directory Windows Domain.

We have 2 DCs, one called upsilonc, the other gamma and a Linux machine called Omega. We are trying to get the Linux machine to be a member of the domain, so that the shares are accessible using Windows user authentication. To put it another way, I want authorized Windows domain users to not encounter prompts for passwords when reading or writing to the SAMBA shares.

We do NOT attempt to mount windows file shares from Linux. We do NOT use any of the printer sharing that SAMBA allows. We use SAMBA only to make Linux directories readable/writable from Windows workstations.

Our domain name is baltimore.com
We are running Win2000 in native mode.
We have a set of private/non-routable IP addresses. We use only fixed IP addresses.

I have attempted to properly configure Kerberos client on the Linux machine.

~~
I have sanitized the names, but i think I did it consistently enough that there should be no ill effect on the answer. The boss wouldn't like me publicizing our actual domain name, etc.

View the Solution FREE for 30 Days

         
           
             1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:

           
           
             There are two files that I've configured to do this:
 
smb.conf:
# NOTE: Whenever you modify this file you should run the command "testparm"
# to check that you have not made any basic syntactic errors. 
#
#======================= Global Settings =====================================
[global]
	realm = BALTIMORE.COM
 
;	netbios name = omega
 
# NOTE:  Docs say that you really have to have a guest acct for browsing --B
# Uncomment this if you want a guest account, you must add this to /etc/passwd
# otherwise the user "nobody" is used
;  guest account = pcguest
 
	log level = 1
 
# workgroup = NT-Domain-Name or Workgroup-Name
	workgroup = bwf2
 
# server string is the equivalent of the NT Description field
	server string = Omega
 
# 127.0.0.1 included by default
	hosts allow = 192.168.128. 192.168.130. 66.105.72.64/255.255.255.248
 
# this tells Samba to use a separate log file for each machine
# that connects
	log file = /var/log/samba/%m.log
 
# Put a capping on the size of the log files (in Kb).
	max log size = 102400
	security = ads
 
# to auto-locate the domain controller/s
;   password = server
	password server = upsilonc
	encrypt passwords = yes
 
# Most people will find that this option gives better performance.
# See speed.txt and the manual pages for details
	socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
 
# Configure Samba to use multiple interfaces
# If you have multiple network interfaces then you must list them
# here. See the man page for details.
	interfaces = 192.168.128.15
 
	null passwords = yes
	guest ok = yes
# Browser Control Options:
# set local master to no if you don't want Samba to become a master
# browser on your network. Otherwise the normal election rules apply
	local master = no
	domain master = no
 
# s Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable it's WINS Server
   #wins support = yes
 
# WINS Server - Tells the NMBD components of Samba to be a WINS Client
#	Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
	wins server = 192.168.128.130, 192.168.128.140,
 
# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
# via DNS nslookups. The built-in default for versions 1.9.17 is yes,
# this has been changed in version 1.9.18 to no.
	dns proxy = no
 
#	smb passwd file = /etc/samba/smbpasswd
;	guest account = nobody
#============================ Share Definitions ==============================
 
[share]
	comment = BWF Samba Share
	path = /share
   # users or @groups.  These are UNIX-side accts, not s-side accts
	writeable = yes
   # Does MASK & in-perms -> out-perms.  I notice that it masks 01 also :(
	create mask = 0765
	short preserve case = no
	preserve case = no
;	browseable = yes
	guest ok = yes
 
[tiger]
	comment = BWF Samba Share
	path = /tiger
   # users or @groups.  These are UNIX-side accts, not s-side accts
	writeable = yes
	create mask = 0765
	short preserve case = no
	preserve case = no
;	browseable = yes
	guest ok = yes
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
kbr5.conf:
 
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log
 
[libdefaults]
 default_realm = BALTIMORE.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 forwardable = yes
 
[realms]
 BALTIMORE.COM = {
  kdc = upsilonc.baltimore.com:88
  admin_server = upsilonc.baltimore.com:749
  default_domain = baltimore.com
 }
 
[domain_realm]
 .baltimore.com = BALTIMORE.COM
 baltimore.com  = BALTIMORE.COM
 
[appdefaults]
 pam = {
   debug = false
   ticket_lifetime = 36000
   renew_lifetime = 36000
   forwardable = true
   krb4_convert = false
 }

           
         

20090824-EE-VQP-74 - Hierarchy / EE_QW_3_20080625

1. it4soho7,332
2. fosiul015,000
2. henjoh095,000
4. noci4,000
4. oocyte4,000
6. Let_Me_Be3,750
7. oklit3,250
8. DrUltima3,000
8. savone3,000
8. omarfarid3,000
11. Uberpappa2,500
12. arnold2,000
12. maxim_leon2,000
12. Netman662,000
12. gheist2,000
12. ibu12,000
12. demazter2,000
12. eoinosullivan2,000
12. nabeelmoidu2,000
12. Michaelj422,000
12. MightySW2,000
12. LunarNRG2,000
12. ai_ja_nai2,000
12. AdamsCo...2,000
12. medvedd2,000
12. technious2,000
12. nuke3dd2,000
12. malayali_...2,000
12. CuriousR...2,000

1. it4soho7,332
2. henjoh095,300
3. omarfarid5,000
3. fosiul015,000
5. ibu14,600
6. noci4,000
6. oocyte4,000
8. Let_Me_Be3,750
9. oklit3,250
10. DrUltima3,000
10. Mysidia3,000
10. savone3,000
13. sanjooz2,872
14. Redimido2,582
15. Uberpappa2,500
15. woolmilkp...2,500
15. mzalfres2,500
18. TeRReF2,000
18. arnold2,000
18. maxim_leon2,000
18. Netman662,000
18. Jonvee2,000
18. gheist2,000
18. demazter2,000
18. eoinosullivan2,000
18. nabeelmoidu2,000
18. Michaelj422,000
18. MightySW2,000
18. LunarNRG2,000
18. ai_ja_nai2,000
18. AdamsCo...2,000
18. medvedd2,000
18. technious2,000
18. nuke3dd2,000
18. malayali_...2,000
18. CuriousR...2,000

SAMBA to join as a member of an Active Directory domain

Asked by cyberfool in Samba File Sharing, Linux Networking

Tags: SAMBA ver 3.2, Active Directory, Windows Domain

About this solution