Administrace komentářů

Ahoj,
prave se snazim rozchodit prihlasovani uzivatelu pomoci jejich uctu v AD.
Chtel bych pouzit winbind
Pouzivam FC6 a Sambu 3.0.23c-2.
Bohuzel mam nekolik problemu:

1. Kdyz nabootoju do linuxu a ihned po prihlaseni jako root se pokusim zkontolovat zabezpeceni pomoci wbinfo -t dostanu akorat tuhle chybu:

checking the trust secret via RPC calls failed
error code was NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND (0xc0000233)
could not check secret

Kdyz zkusim spustit wbinfo -t za chvili tak dostanu uspesnou odpoved:
checking the trust secret via RPC calls succeeded.

Je tohle normalni chovani?

2.Winbind neudrzuje databazi jednoznacnych uzivatelskych identifikatoru mezi linuxem a AD na w2k3 serveru. Winbindd a smbd se mi podari uspesne spustit, ale kdyz spustim getent passwd Dostanu akorat seznam lokalnich linuxovych uzivatelu a neni mozne se ke stanici prihlasit, dokud nepridam informace o uzivateli do \etc\paswd manualne. V AD mam ale pres 600 uzivatelu a je neunosne je pridavat do \etc\passwd rucne. Jak zjistit proc winbindd neudrzuje databazi uzivatelu?

3. Kdyz pridam informace o uzivateli do passwd rucne, tak se prihlasit muzu, ale pri prihalseni jsem nuceny zadat helso dvakrat. V cem by mohl byt problem?

Konfiguracni soubory:

smb.conf:
[global]
workgroup = MYDOMAIN.COM
server string = Samba Server
security = domain
winbind separator = \
idmap uid = 16777216-33554431
idmap gid = 16777216-33554431
winbind enum users = yes
winbind enum groups = yes
template homedir = /home/winnt/%U
template shell = /bin/bash
winbind use default domain = true
winbind cache time = 10
encrypt passwords = yes
winbind trusted domains only = yes
obey pam restrictions = yes
password server = server.mydomain.com
[homes]
comment = Home Directories
browseable = no
writable = yes

nsswitch.conf:

passwd: files winbind
shadow: files winbind
group: files winbind
hosts: files dns
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files winbind
rpc: files
services: files winbind
netgroup: files winbind
publickey: nisplus
automount: files winbind
aliases: files nisplus

pam.d configuration:
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_winbind.so
auth required pam_deny.so

account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account sufficient pam_winbind.so
account required pam_permit.so

password requisite pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password sufficient pam_winbind.so use_authtok
password required pam_deny.so

session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so

session required pam_mkhomedir.so skel=/etc/skel/ umask=0022

Diky za pomoc