Dotaz: Linux a AD. Pokracovani.

[OgeeN]

Ahoj,
tak postupne pokracuji s integraci linuxovych stanic do domeny w2k3.
Dostal sem se az k bodu kdy jsem na server nainstaloval MS Services for Unix a jsem schopny se z linuxove stanice(fc5) prihlasit pomoci kerberosu(pokud mam dopredu vytvoreny zaznam pro uzivatele v passwd).
Moje uspechy, ale konci, kdyz se pokusim ziskat prihlasovaci udaje o uzivateli pomoci LDAPu:

Jun 27 10:03:48 d8-02 login: pam_unix(login:auth): check pass; user unknown
Jun 27 10:03:48 d8-02 login: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty4 ruser= rhost=
Jun 27 10:03:48 d8-02 login: pam_succeed_if(login:auth): error retrieving information about user homer
Jun 27 10:03:50 d8-02 login: FAILED LOGIN 1 FROM (null) FOR homer, User not known to the underlying authentication module

Prikladam konfiguraci /etc/ldap.conf:

host 172.16.31.50
base dc=testovaci,dc=cz
ldap_version 3
binddn cn=AD Reader,cn=Users,dc=testovaci,dc=cz
bindpw heslo
scope sub
nss_base_passwd dc=testovaci,dc=cz
nss_base_group dc=testovaci,dc=cz
nss_map_objectclass posixAccount user
nss_map_attribute uid sAMAccountName
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_objectclass posixGroup group
nss_map_attribute uniqueMember member
pam_login_attribute sAMAccountName
pam_filter objectclass=user
pam_password ad
ssl no
tls_cacertdir /etc/openldap/cacerts

Mezi serverem a klientem probehne cila komunikace, ale ziskat inforamci se nepodari. Pritom pomoci ldapsearch se mi dari informace ze serveru vydolovat.
Dalsi problem je, ze se mi nedari rozjest sifrovanou LDAP komunikaci mezi serverem a klientem. Podarilo se to nekomu? Ja vzdycky skoncim chybou:

[root@d8-02 log]# ldapsearch -W -h 172.16.31.50 -b "ou=Uzivatele,dc=testovaci,dc=cz" -D "cn=Homer Simpson,ou=Uzivatele,dc=testovaci,dc=cz" "sAMAccountName=*" sAMAcountName
Enter LDAP Password:
SASL/EXTERNAL authentication started
ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
additional info: SASL(-4): no mechanism available:

Jeste bych se chtel zeptat, jestli nemate nekdo podrobnejsi inormace o tom, jak exportovat domovske adresare na w2k3 serveru pomoci nfs na linuxovou stanici.

Dik moc za rady.

Odpovědi

[OgeeN]

Tak sem pokrocil o kousek dal.
Diky tomuhle dokumentu:
http://www.microsoft.com/technet/itsolutions/cits/interopmigration/unix/usecdirw/08wsdsu.mspx
Stacilo do ldap.conf vlozit toto:

nss_map_objectclass posixAccount User
nss_map_objectclass shadowAccount User
nss_map_objectclass posixGroup Group
nss_map_attribute uid sAMAccountName
nss_map_attribute uidNumber msSFU30UidNumber
nss_map_attribute gidNumber msSFU30GidNumber
nss_map_attribute loginShell msSFU30LoginShell
nss_map_attribute uniqueMember msSFU30posixMember
nss_map_attribute homeDirectory msSFU30HomeDirectory
nss_map_attribute memberUid msSFU30MemberUid

A prihlasovani zacalo fungovat.
Nicmene problem s exportem domovskeho adresare a sifrovanou LDAP komunikaci zustava.
Kdyby nekdo mel s touto problematikou zkusenosti, byl bych mu moc vdecny kdby se o ne podelil.
Diky.