ldap_active_directory
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision | |||
|
ldap_active_directory [2014/11/24 02:13] ben removed |
— (current) | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== LDAP/ | ||
| - | = Configuring LDAP/Active Directory on Gentoo Linux = | ||
| - | |||
| - | Follow this HOWTO: http:// | ||
| - | |||
| - | ===== Global use flags ===== | ||
| - | <source lang=" | ||
| - | USE=" | ||
| - | </ | ||
| - | |||
| - | ===== / | ||
| - | <source lang=" | ||
| - | net-misc/ | ||
| - | net-fs/ | ||
| - | net-nds/ | ||
| - | sys-auth/ | ||
| - | sys-auth/ | ||
| - | </ | ||
| - | |||
| - | Such that packages install with the following options | ||
| - | |||
| - | <source lang=" | ||
| - | [[ebuild| | ||
| - | [[ebuild| | ||
| - | [[ebuild| | ||
| - | [[ebuild| | ||
| - | [[ebuild| | ||
| - | </ | ||
| - | |||
| - | ===== Configuration ===== | ||
| - | ==== NTP ==== | ||
| - | / | ||
| - | <source lang=" | ||
| - | server river.sihnon.net | ||
| - | driftfile | ||
| - | restrict default nomodify nopeer | ||
| - | restrict 127.0.0.1 | ||
| - | </ | ||
| - | |||
| - | Start ntp-client to update the clock immediately, | ||
| - | <source lang=" | ||
| - | - / | ||
| - | - / | ||
| - | - rc-update add ntp-client default | ||
| - | - rc-update add ntpd default | ||
| - | </ | ||
| - | |||
| - | ==== Samba ==== | ||
| - | / | ||
| - | <source lang=" | ||
| - | [[global]] | ||
| - | - Server Naming Options: | ||
| - | | ||
| - | | ||
| - | | ||
| - | | ||
| - | |||
| - | - Logging Options: | ||
| - | log file = / | ||
| - | max log size = 50 | ||
| - | log level = 2 | ||
| - | |||
| - | - Security and Domain Membership Options: | ||
| - | map to guest = bad user | ||
| - | | ||
| - | | ||
| - | | ||
| - | |||
| - | - Browser Control and Networking Options: | ||
| - | | ||
| - | | ||
| - | local master = no | ||
| - | | ||
| - | |||
| - | - Name Resolution Options: | ||
| - | name resolve order = wins host lmhosts bcast | ||
| - | wins server = 87.194.163.94 | ||
| - | dns proxy = yes | ||
| - | |||
| - | - Misc | ||
| - | nt acl support = true | ||
| - | | ||
| - | | ||
| - | use spnego | ||
| - | |||
| - | # | ||
| - | [[homes]] | ||
| - | | ||
| - | | ||
| - | | ||
| - | - You can enable VFS recycle bin on a per share basis: | ||
| - | - Uncomment the next 2 lines (make sure you create a | ||
| - | - .recycle folder in the base of the share and ensure | ||
| - | - all users will have write access to it. See | ||
| - | - examples/ | ||
| - | ; vfs object = / | ||
| - | </ | ||
| - | |||
| - | Start Samba, then join the machine to the Domain. | ||
| - | <source lang=" | ||
| - | - / | ||
| - | - rc-config add samba default | ||
| - | - net ads join -U Administrator | ||
| - | Administrator' | ||
| - | Using short domain name -- SIHNON | ||
| - | Joined ' | ||
| - | </ | ||
| - | |||
| - | |||
| - | ==== LDAP ==== | ||
| - | / | ||
| - | <source lang=" | ||
| - | - See ldap.conf(5) for details | ||
| - | - This file should be world readable but not world writable. | ||
| - | |||
| - | BASE dc=ad, | ||
| - | URI | ||
| - | HOST 87.194.163.94 | ||
| - | REFERRALS no | ||
| - | |||
| - | # | ||
| - | # | ||
| - | DEREF never | ||
| - | |||
| - | TLS_CACERT / | ||
| - | TLS_REQCERT never | ||
| - | </ | ||
| - | |||
| - | / | ||
| - | <source lang=" | ||
| - | host 87.194.163.94 | ||
| - | uri ldaps:// | ||
| - | base dc=ad, | ||
| - | ldap_version 3 | ||
| - | binddn cn=scout, | ||
| - | bindpw ****** | ||
| - | rootbinddn cn=root, | ||
| - | scope sub | ||
| - | timelimit 30 | ||
| - | |||
| - | - Attribute mapping between ldap and AD | ||
| - | nss_base_passwd dc=ad, | ||
| - | nss_base_shadow dc=ad, | ||
| - | nss_base_group dc=ad, | ||
| - | nss_map_objectclass posixAccount user | ||
| - | nss_map_objectclass shadowAccount user | ||
| - | nss_map_objectclass posixGroup group | ||
| - | nss_map_attribute homeDirectory unixHomeDirectory | ||
| - | nss_map_attribute gecos cn | ||
| - | nss_map_attribute uniqueMember member | ||
| - | |||
| - | logdir / | ||
| - | |||
| - | - Allow us to boot even if the LDAP server is inaccessible | ||
| - | bind_policy soft | ||
| - | bind_timelimit 5 | ||
| - | |||
| - | - force users to be a member of the linuxusers group to log in | ||
| - | pam_groupdn " | ||
| - | pam_member_attribute member | ||
| - | pam_passwd ad | ||
| - | pam_password ad | ||
| - | |||
| - | - Encryption is required to be able to change user passwords | ||
| - | ssl on | ||
| - | tls_cacertfile / | ||
| - | tls_checkpeer no | ||
| - | tls_ciphers TLSv1 | ||
| - | </ | ||
| - | |||
| - | / | ||
| - | <source lang=" | ||
| - | - / | ||
| - | - $Header: / | ||
| - | |||
| - | passwd: | ||
| - | shadow: | ||
| - | group: | ||
| - | |||
| - | - passwd: | ||
| - | - shadow: | ||
| - | - group: | ||
| - | |||
| - | hosts: | ||
| - | networks: | ||
| - | |||
| - | services: | ||
| - | protocols: | ||
| - | rpc: db files | ||
| - | ethers: | ||
| - | netmasks: | ||
| - | netgroup: | ||
| - | bootparams: | ||
| - | |||
| - | automount: | ||
| - | aliases: | ||
| - | </ | ||
| - | |||
| - | ==== Pam ==== | ||
| - | / | ||
| - | <source lang=" | ||
| - | #%PAM-1.0 | ||
| - | |||
| - | auth | ||
| - | auth | ||
| - | auth | ||
| - | auth | ||
| - | |||
| - | account | ||
| - | account | ||
| - | |||
| - | password | ||
| - | password | ||
| - | password | ||
| - | password | ||
| - | |||
| - | session | ||
| - | session | ||
| - | session | ||
| - | session | ||
| - | </ | ||
| - | |||
| - | / | ||
| - | <source lang=" | ||
| - | #%PAM-1.0 | ||
| - | |||
| - | auth | ||
| - | |||
| - | - If you want to restrict users begin allowed to su even more, | ||
| - | - create / | ||
| - | - writable by root, and add users that are allowed to su to that | ||
| - | - file, one per line. | ||
| - | #auth | ||
| - | |||
| - | - Uncomment this to allow users in the wheel group to su without | ||
| - | - entering a passwd. | ||
| - | #auth | ||
| - | |||
| - | - Alternatively to above, you can implement a list of users that do | ||
| - | - not need to supply a passwd with a list. | ||
| - | #auth | ||
| - | |||
| - | - Comment this to allow any user, even those not in the ' | ||
| - | - group to su | ||
| - | auth | ||
| - | auth | ||
| - | |||
| - | auth | ||
| - | |||
| - | account | ||
| - | |||
| - | password | ||
| - | |||
| - | session | ||
| - | session | ||
| - | session | ||
| - | </ | ||
| - | |||
| - | ===== Certificates ===== | ||
| - | / | ||
| - | <source lang=" | ||
| - | -----BEGIN CERTIFICATE----- | ||
| - | MIIEljCCA36gAwIBAgIQIkEhY3aR7olM0OSGrKd6ETANBgkqhkiG9w0BAQUFADBS | ||
| - | MRMwEQYKCZImiZPyLGQBGRYDbmV0MRYwFAYKCZImiZPyLGQBGRYGc2lobm9uMRIw | ||
| - | EAYKCZImiZPyLGQBGRYCYWQxDzANBgNVBAMTBlN0aXRjaDAeFw0wODAxMTMwMjU2 | ||
| - | MjVaFw0xMzAxMTMwMzA1MTRaMFIxEzARBgoJkiaJk/ | ||
| - | kiaJk/ | ||
| - | U3RpdGNoMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoDEsstUEWWme | ||
| - | gXbQPhqlRC6KCL3/ | ||
| - | 63qTT7LaCjDbDDiSF44j2Fu32dJEQyyqRItbaCS9BsbYOPZZ5JjQgYVwiy3wtR/ | ||
| - | 6B3nQuvUjJKjFtkDLczHgnkuuDzJbUFZf6BASBFkeN3FBn2YsdVqaFN4Qu57oZjN | ||
| - | GjWOMoBoy6+VkG3fFE9QucszEqNWsKwJ3DMo5fkwRvNuGiOp7Fs4ixlPHqgRUrrF | ||
| - | qxHrh8x/ | ||
| - | 1juJZPLAzQIDAQABo4IBZjCCAWIwEwYJKwYBBAGCNxQCBAYeBABDAEEwCwYDVR0P | ||
| - | BAQDAgGGMA8GA1UdEwEB/ | ||
| - | jeOD/ | ||
| - | aCxDTj1zdGl0Y2gsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENO | ||
| - | PVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9YWQsREM9c2lobm9uLERDPW5l | ||
| - | dD9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/ | ||
| - | RGlzdHJpYnV0aW9uUG9pbnSGMWh0dHA6Ly9zdGl0Y2guYWQuc2lobm9uLm5ldC9D | ||
| - | ZXJ0RW5yb2xsL1N0aXRjaC5jcmwwEAYJKwYBBAGCNxUBBAMCAQAwDQYJKoZIhvcN | ||
| - | AQEFBQADggEBAFHlAgQEpD5VA0CO5klWcX3JbzL4mW7jUstKt0cNNzC1tFz8yVGx | ||
| - | CzuZs+L8QtnQ/ | ||
| - | WFvArXWnQP55DtOo6vfoEJMef8JKVLmQ58ymoxwow2KYBowSiQK+XolGRq21aJuV | ||
| - | IXoh/ | ||
| - | Q82X3vq/ | ||
| - | bFxOeG6JTRqz1MFbh9o+b3mChRnn9QXDHsw= | ||
| - | -----END CERTIFICATE----- | ||
| - | </ | ||
ldap_active_directory.1416795190.txt.gz · Last modified: 2014/11/24 02:13 by ben
Page Tools
