Administrace komentářů

Ahoj, snazim se na CentOSu 5.1 rozchodit autentizaci squidu vuci Active Directory.

Konfigurace krb5.conf:

[libdefaults]
        default_realm = DOMENA.CZ
        ticket_lifetime = 36000
        clockskew = 300
        dns_lookup_realm = false
        dns_lookup_kdc = false

[realms]
        DOMENA.CZ = {
        kdc = 192.168.2.41:88
        admin_server = 192.168.2.41:749
        default_domain = DOMENA.CZ
        }

[domain_realm]
        .domena.cz = 192.168.2.41
        domena.cz = 192.168.2.41

[kdc]
        profile = /etc/krb5kdc/kdc.conf

[logging]
        kdc = FILE:/var/log/krb5kdc.log
        admin_server = FILE:/var/log/kadmin.log
        default = FILE:/var/log/krb5lib.log

Konfigurace samby:

[global]
netbios name = fw
realm = DOMENA.CZ
workgroup = DOMENA
security = ADS
password server = 192.168.2.41
socket options = TCP_NODELAY SO_RCVBUF=16384 SO_SNDBUF=16384
idmap uid = 10000-20000
winbind enum users = yes
winbind uid = 10000-20000
winbind enum groups = yes
winbind gid = 10000-20000
winbind cache time = 15
winbind separator = +
winbind use default domain = yes
encrypt passwords = yes
log level = 3 passdb:5 auth:10 winbind:5
template shell = /bin/false
idmap gid = 16777216-33554431

Konfigurace nsswitch:

passwd:     files winbind
shadow:     files winbind
group:      files winbind
hosts:      files dns
bootparams: nisplus [NOTFOUND=return] files
ethers:     files
netmasks:   files
networks:   files
protocols:  files winbind
rpc:        files
services:   files winbind
netgroup:   nisplus winbind
publickey:  nisplus
automount:  files nisplus winbind
aliases:    files nisplus

Vytah z konfigurace squidu:

auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
  auth_param ntlm children 10
  auth_param ntlm keep_alive on
  auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-basic
  auth_param basic children 5
  auth_param basic realm baumatic_ma
  auth_param basic credentialsttl 2 hours
  .
  acl purge method PURGE
  acl CONNECT method CONNECT
  acl authenticated_users proxy_auth REQUIRED
  .
  http_access allow authenticated_users
  .

Funkci kerbera jsem overil pomoci kinit.

Server sem pripojil do domeny pomoci prikazu:

net join -w DOMENA.CZ -S 192.168.2.41 -U Administrator

Kdyz se ale v prohlizeci nastavim proxy server, tak pri pokusu o pristup na webove stranky mi vyskoci okno s zadosti o prihlasovaci udaje a logu squidu vidim toto:

[2008/03/19 19:32:09, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(63)
  Got NTLMSSP neg_flags=0xa200b207
[2008/03/19 19:32:09, 3] libsmb/ntlmssp.c:ntlmssp_server_auth(739)
  Got user=[Administrator] domain=[DOMENA] workstation=[SRVDA01] len1=24 len2=24
[2008/03/19 19:32:09, 3] utils/ntlm_auth.c:winbind_pw_check(515)
  Login for user [DOMENA]\[Administrator]@[SERVER] failed due to [NT_STATUS_CANT_ACCESS_DOMAIN_INFO]

V cem by mohl byt problem?

Diky za vase reakce.