下面这样折腾可以自动共享当前用户的home，
vi /etc/krb5.conf
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
|
[logging]
default = FILE:
/var/log/krb5libs
.log
kdc = FILE:
/var/log/krb5kdc
.log
admin_server = FILE:
/var/log/kadmind
.log
[libdefaults]
default_realm = HWA.NET
dns_lookup_realm =
false
dns_lookup_kdc =
false
ticket_lifetime = 24h
forwardable =
yes
[realms]
HWA.NET = {
kdc = cdad.hwa.net:88
kdc = ad.hwa.net:88
admin_server = ad.hwa.net:389
default_domain = hwa.net
}
[domain_realm]
.hwa.net = HWA.NET
hwa.net = HWA.NET
[appdefaults]
pam = {
debug =
false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable =
true
krb4_convert =
false
}
|
vi /etc/samba/smb.conf
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
|
[global]
workgroup = HWA
server string = %h
dns proxy = no
log
file
=
/var/log/samba/log
.%m
max log size = 1000
syslog = 0
panic action =
/usr/share/samba/panic-action
%d
encrypt passwords =
true
security = ads
realm = HWA.NET
password server = AD.HWA.NET
passdb backend = tdbsam
obey pam restrictions =
yes
unix password
sync
=
yes
# sending the correct chat script for the passwd program in Debian Sarge).
passwd
program =
/usr/bin/passwd
%u
passwd
chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
pam password change =
yes
# to anonymous connections
map to guest = bad user
usershare allow guests =
yes
#idmap uid = 16777216-33554431 #这里的两行之所以注释掉, 是因为我这已经有 LDAP来认证SSH了, 如果不注释, 可能 UID会变化...
#idmap gid = 16777216-33554431
template shell =
/sbin/nologin
template homedir =
/home/
%U
winbind use default domain =
true
winbind offline logon =
true
winbind enum
groups
=
yes
winbind enum
users
=
yes
winbind separator = /
#ln support
follow symlinks =
yes
wide links =
yes
unix extensions = no
[homes]
comment = Home Directories
path =
/local_home/
%U
valid
users
= hwa.net/%U
read
only = no
writable =
yes
browseable = No
|
把/etc/resolve.conf 添加AD的DNS
设置/etc/hosts
启动 smb、 winbind
然后加域
|
1
|
net ads
join
-U
test
@HWA.NET -S AD.HWA.NET
|
WIN7访问Samba一直密码不正确
Samba出现如下日志:
|
1
|
read_data:
read
failure
for
4 bytes to client ...
|
在WIN7 本地安全策略-->本地策略-->安全选项-->
|
1
2
|
#网络安全:LAN 管理器身份验证级别
#选择 发送 LM 和 NTLM - 如果已协商, 则使用 NTLMv2 会话安全
|
|
1
|
#实际测试可以不用启动 winbind ####
|
本文转自 nonono11 51CTO博客，原文链接：http://blog.51cto.com/abian/1401304，如需转载请自行联系原作者
